CCP14
Methods, Problems and Solutions
Linux Information for Crystallography
Installing a secure Redhat 6.2 Linux and Win95 Dual Boot System via Network/FTP/HTTP Install on a Toshiba Laptop
The CCP14 Homepage is at http://www.ccp14.ac.uk
As of 2000/2001 - Redhat 7.0, then 7.1 and then 7.2 have been released. The installation given below
is still pretty much valid - and when differences happen they are pretty obvious. Tutorials for
installing 7.2 will be done once a spare computer and (more difficult in London) some office
space for the computer becomes available.
Note: As of early March 2000, Redhat 6.2 was released. Workarounds have now
been determined in doing an equivalent secure 6.0 type install. Overall, Redhat 6.2 install is
quite good, but there are still some post install fixups to do after the install.
Please note that a significant change for a laptop install Redhat Linux 6.2 (compared to Redhat 6.0)
is that the pcmcia.img is now the boot floppy disk to use.
Disclaimer
The following install and configuration should leave no open services for potential
hackers to scan. This is consistent with setting up a client system or getting ready to
create a server. In the following, the text based install is used as this gives the
option to install scientific crystallography important options such as the Fortran Compiler.
(If you are running X, use of port 6000 by X can be disabled by adding the
flag '-nolisten tcp' to the X server command line.)
Note: Because of variations in install, multiple toolsets, (never knowing whether
a previous install might have affected the next one); some/all(?) of the following information
might be wrong; and there are probably better methods for doing the following. Keep this in
mind and feel free to think a bit before blindly following the instructions.
Note 2: Redhat does have a reputation of loading more than you really need and running
deamons that you may not really need. After installing, doing a security audit and removing
deamons you do not require is pretty much mandatory. Some of this is explained at the end
of install file. As stated above, this installation tutorial has been modified to try and have
this as hacker safe an installation as possible with by default, no scannable ports open.
Warning: (was advised by local department network support group to insert
the following) In some organisations and departments, installing unauthorized software
or operating systems such as Linux could be a sackable offence. If in doubt, check with
your network support group. Also, take note that some distributions and setup options may
also install software deemed to be "hacker tools". Presence of "hacker tools" on a
computer system could prompt management or criminal action against "offenders".
Also refer:
Backup your old stuff
The following method does the dual boot installation of Linux and Win95 from scratch using
an unpartitioned disk. It is possible to install Linux on an existing Windows system
without destroying the Windows area using FIPS or other similar non-destructive reformatting
software (e.g., Partition Magic). However implementing that is possibly part of a "future" X
hour hacking session; so we are doing "clean the disk - then install" method here.
"FIPS is a program for non-destructive splitting of harddisk partitions" -
FIPs Webpage at: http://bmrc.berkeley.edu/people/chaffee/fips/fips.html.
Note that an up to date FIPS is included in the Redhat Linux tools area.
Partition-Magic is a commercial program with a good reputation for repartitioning without destroying
your data:
http://www.partitionmagic.com/
If new to Linux, Expect to Initially Waste a Lot of Time
Like Austen Powers(?), "It's UNIX Baby Yeahhhh!"
Also refer Unix-haters handbook -
http://catalog.com/hopkins/unix-haters/handbook.html
Noting down the PC System Information
Note down all the information on your system including chip-sets, monitor refresh rates, etc.
If Linux makes a wrong choice, or prompts for a decision, you have to give it the
correct information. If you have Win95/Win98 or WinNT installed, you can
gain this information quite easily from the control panel (assuming the PC is
setup with the correct drivers). This also includes all the network information;
IP address, name, domain, gateway/router, NetMask, etc. Too much information
does not hurt, only too little. For network cards and the like, you may have to
go into Win95 or Win98 and get the memory addresses and the IRQs used. You tend to
find out what extra information you need the hard way.
In this case:
- Toshiba Tecra 520CDT Laptop Pentium 166 with 32 Meg RAM
- 3Com (3C562D-3C563D) EL III Lan + 336 Modem PC Card (From Win95 - Input/Output Range 0110-011F)
- Network card: IRQ = 3
- Modem card: IRQ = 9
- Yamaha OPL3-SAx Sound System - IRQ = 5
- 800x600 256 Colour (32h) Thin Film Transistor (TFT) LCD display - 60 Hz (can do high colour)
- Monitor Scanning Frequency:
- 800x600 16Mil Colours Vert: 60 Hz, Horiz: 37.9Hz
- 800x600 32k/64k Virtual Colours Vert: 60 Hz, Horiz: 48.5Hz
- 800x600 32k/64k Colours Vert: 60/75/85 Hz, Horiz: 31.5/37.6/43.2Hz
- 640x480 16Mil Colours Vert: 60 Hz, Horiz: 31.5Hz
- 640x480 32k/64k Colours Vert: 60/75/85 Hz, Horiz: 31.5/37.6/43.2Hz
- PCIC or compatiable PCMCIA Card / Multifunction Parent Card: IRQ = 3
- Toshiba IDE CD-ROM XM-1502BN
- Generic IDE/ESDI Hard Disk Type01 (4 Gig)
- Generic NEC Floppy Disk
- Chips and Technologies 65555 PCI Video Card - DirectDraw Version 4 - 2 Meg RAM
- Toshiba CPI to PCI bridge
- Hard-disk controller IRQ = 14 / IRQ = 15
- Keyboard IRQ = 1
- PCI IRQ = 11
- Serial Ports = IRQ = 10 (COM2) IRQ = 4 (COM1)
- Printer Port = IRQ = 7
- Internal 2-button laptop mouse and external PS/2 MS 3 button Intellimouse.
(NOTE: If using an external mouse as we are here (having the 3 buttons is far more
convenient than emulating an X-mouse via 2 mouse buttons), it would be safest to
configure your Laptop BIOS to not use both internal and external mice simultaneious as erratic things
can occur). If you have an external serial port mouse (not PS/2), Redhat may not be able to recognise
and use this mouse, so you may be stuck with using the internet Laptop mouse. A quick solution to this is
to get a "serial to PS/2" adapter for the mouse.
Deciding now on the partitions
Summary: the old Redhat 5.2 manual recommends you partition the hard-disk into segments.
An easy option is to just partition the disk into one large "/" partition that
everything fits into. This can be much simpler but "might" hurt you
in the future (though unlikely for a client crystallographic number crunching
computer). I prefer to put everything on one partition with this laptop as
expanding harddisk space is not a practical option - thus everything has to fit.
(Please note that decisions made now can cause much pain and gnashing of teeth later - though
using a single partition has not resulted in any problems so far).
The following decisions were made due to limitations of a 2 Gig Hard-disk (of which ~1 Gig is
for Linux). An easy option is just to have a single Linux "/" partition. This will get
you going without too many complications that other Linux partitioning strategies can cause.
- 950 meg for Win95 and Windows programs (FAT 32)
- 120 Meg of Linux SWAP - mandatory - don't forget to make the LINUX SWAP area
- rest goes to /
- The Previous Partitioning was as follows - but the above is far simpler
- 950 meg for Win95 and Windows programs (FAT 32)
- 5 Meg for /boot (very important partition for dual booting)
- 48 Meg of Linux SWAP - mandatory - don't forget to make the LINUX SWAP area
- 80 Meg of / (root partition - /var and /tmp will also go here)
- 65 Meg of /opt (KDE desktop rpm binary installs should be happy with this http://www.kde.org)
- 550 Meg of /usr (large number of Linux Packages get installed here)
- 110 Meg of /home (juggle this with /usr/local)
- rest goes to /usr/local
Obtain the Ranish Partition Manager for DOS and create a Win95 Boot disk
After mucking around with a few utilities, the freeware Ranish Partition Manager for DOS
is a work of genius for managing partitions and boot managing.
Menu driven, it is a breeze to create and delete partitions,
multiple primary partitions, configure the MBR area. It easily will fit on a Windows/DOS
boot floppy with the rest of your boot utilities. (latest beta version at time of writing (27th April 2000) :
was dated March 14, 2000)
New facilities in Ranish Partition Manager 2.38 not yet covered in these tutorials:
- Handle disks over 8G
- Copy disks and partitions
- Format and Resize FAT partitions
- Boot MS-, PC-, DR- DOS and Windows NT from partitions above 2G
- Boot Partition Manager from a floppy without any OS
- Now added SIMULATION program which lets you play with Partition Manager without messing the real disk
- "The REAL Multi-boot": Tutorials on using shareware/freeware Ranish Partition boot manager and
partition manager to get around the 4 Primary Partition limit with PC:
http://members.tripod.it/Trombettworks/multi-boot.htm
- It should be noted that new boot and partition managers are being created all the time. The
GPL'd XOSL is one worth checking out for Windows which allows 24 boot items (gets around
the 4 Primary partition limit) -
http://www.xosl.org/
Now before you consider deleting Windows, create a boot disk (format a: /u/s) and copy
over the required utility software.
- Copy over the following to the floppy disk:
- Ranish Partition Manager
- format.com
- fdisk.exe
- edit.com
- sys.com
- xcopy.exe
- xcopy32.exe
- himem.sys
- scandisk.exe
- CD-ROM driver and MSCDEX.EXE
- Anything else you fancy and that will fit.
- Configure the config.sys and autoexec.bat on the floppy so that it
will enable the CD-ROM on bootup; plus himem.sys and any country
specific drivers. Set MSCDEX to use D: drive for the CD-ROM. (We will
be formatting the DOS partition of the hard-disk as C: drive.)
In the case of this Toshiba Laptop:
- Note: Having a loaded CD-ROM pointing to C: drive can possibly
stuff up the partitioning process later on; though Ranish Partition
Manager will probably warn you that something is going wrong.
If in doubt, remove the CD-ROM booting from the config.sys and autoexec.bat.
Creating the LINUX Boot Images on Floppy Disk
Using the files located on the Redhat Linux CD-ROM or a mirror,
create the three Image disks depending on how you are installing (local or
network) and hardware type; boot, netboot and pcmcia.
In theory, you only have to create the pcmcia.img
disk to install Redhat Linux 6.2 on a Laptop.
These are generally in the images directory of the media you intend
to install from.
(choose closest Redhat Linux mirrors via:
http://www.redhat.com/mirrors.html or
ftp://ftp.redhat.com/pub/MIRRORS.html)
For example, via FTP, mirror.ac.uk:
Use rawrite or rawrite2 for DOS from the dosutils directory to write/burn the images
onto the CD. Standard "copy" command will not work. Just type rawrite and answer the questions.
Also refer:
- RawWrite 0.3 for windows (NT & 95)
- "rawwrite (or rawrite) is the essential utility for creating boot and root disks for installing Linux.
Unfortunately, it required DOS to operate, so here is the long awaited WIN32 version. It works
under NT and 95."
- http://uranus.it.swin.edu.au/~jn/linux/rawwrite.htm
Alternatively, if you are already on a LINUX PC, you can use the command:
- dd if=filename.img of=/dev/fd0 bs=1440k
- dd if=bootnet.img of=/dev/fd0 bs=1440k
- dd if=pcmcia.img of=/dev/fd0 bs=1440k
- dd if=rescue.img of=/dev/fd0 bs=1440k
Determine the Install Process/Method you are going to Use
You have a variety of options to install the Redhat 6.2 Linux
distribution. Initially, I decided on FTP as the CD installation seemed a
bit quirky and FTP from Imperial College from Daresbury Laboratory
was very quick at nights and on weekends (10-12 minutes). This is compared
to around 90 minutes to do a much abbreviated install during a weekday
between 9am-5pm. However, for repetative installation, creation of a
CD installation disk can spead things up and avoid nuances of the network
and this is the subject of a separate install page. Downloading a bootable
ISO CD-ROM file and burning this to CD can be an effective option. HENSA
and the CCP14 Redhat Linux mirrors have ISO images that can be downloaded.
Whatever you do, if you use the internet, choose the closest
mirror. If you are isolated from the internet, or have slow
links, CD-ROM or Hard-disk based install are obvious things to
choose from. Linux can install from NFS or Windows SMB based
shared hard-disks (but I have never got installing either
locally from a Windows partition-harddisk or from a Windows SMB to work - at least
with Redhat 5.2).
Thus in this case:
FTP Load
IP Address = 193.63.255.4
Name = src.doc.ic.ac.uk
/pub/Mirrors/ftp.redhat.com/pub/redhat/redhat-6.2/i386/
or
FTP Load
IP Address = 148.88.2.15 or 148.88.2.11
Name = ftp.mirror.ac.uk
/sites/ftp.redhat.com/pub/redhat/redhat-6.2/i386
(restricted to academic users during normal working hours)
or
FTP Load
IP Address = 193.62.124.196
Name = redhat.ccp14.ac.uk
/pub/redhat/redhat-6.2/i386
HTTP Load
IP Address = 193.62.124.196
Name = redhat.ccp14.ac.uk
/pub/redhat/redhat-6.2/i386
Or use the CD-ROM method and boot using the standard non-network boot image.
Booting from Your DOS/Windows Floppy Boot Disk, Deleting Existing Partitions and Editing Master Boot Manager (MBR) Options
Boot from your DOS/Windows Floppy Boot Disk and run the menu driven Ranish Partition Manager.
- Delete the existing partitions.
- Highlight the MBR (Master Boot Record) and:
- Set the MBR Executable to "Boot Manager"
- Boot Interface type to "Compact"
- Check for Viruses "No" (otherwise you may not be allowed to save to the MBR)
- Boot prompt timeout = "6" is nice?
- Default Boot Choice of "Prompt User"
- Save (F2), then out of habit from using DOS, reboot to the floppy again. This may or
may not be optional.
Booting from Your DOS/Windows Floppy Boot Disk and Creating Partitions
Note: There are many possible permutations and combinations but the following
seems to work for me. Despite the literature, setting active partitions and
boot managers can be quite quirky due to limitations/nuances in PC hardware and the
various pieces of software.
Boot from your DOS/Windows Floppy Boot Disk and run the menu driven Ranish Partition Manager.
- (If you want a nice graphical boot manager, select Text 25x80
under the MBR config, then add a "small" "Boot Manager" Partition (4 Meg) as the first Primary partition
using the INS key (which gives a menu list of the possible file systems that can be added)) and
set this as the Bootable Partition . Then, taking into account the above, continue on with the following.
- In the first "Primary" Partition, create a 950 Meg Windows FAT-32 Partition (when promped, save
but DO NOT format as results may not be predictable. We use the Windows format.com program later.)
Set this as your default Boot area using the B key. (Don't be too worried at this point if Ranish is
unhappy about not letting it format the partition and says the DOS/Windows Boot Sector does not have valid information.
Once it is formatted using the format.com program, it should have valid information).
- In the second "Primary" Partition, create a 130 Meg Linux SWAP area
Partition (when promped, save)
- In the third "Primary" Partition, leave the rest as a Linux Partition (this will be "/") (when promped, save)
Formatting the C: Drive - Windows FAT-32
Boot from your DOS/Windows Floppy Boot Disk and run the menu driven Ranish Partition Manager.
- From the floppy disk, type format c: /s and when prompted:
Y - you want to proceed. (/s puts the boot files on the hard-disk)
- Give it a volume name of DOS
- If you want to, you can now install Win95; but I would wait until after getting Linux
happily installed in case some partition nuances (didn't allocate enough space to an
important partition) come to haunt you.
- Take the floppy disk out of the disk drive (to check the boot manager is happy).
- Reboot the PC and you should be given a prompt of HD/1. If you have a Compact boot manager
menu, entering 1 should take you into a command line based Win95/DOS prompt. You
can install more elaborate boot manager menus described in this text (Text
25x80 menu system on startup) if you want to but I was in a "minimalist" mood on this particular occassion.
But now the Text 25x80 menu system is my favourite.
Also Refer:
- reading linux ext2fs partitions with DOS/Windows
Redhat Linux Install
- When prompted for packages to Install, in the list of options I tend to go for the KDE desktop but
it is up to you to choose the desktop of your liking (Gnome or KDE). KDE presently seems slicker
and more oriented towards users.
- When prompted for packages to Install, I tend to go for the defaults except:
- Deselect Gnome and go for KDE
- DOS/Windows Connectivity
- Graphics Manipulation
- Games
- Disable Dialup Workstation
- Development (need this for compilers(?))
- Extra Documentation
- Utilities
- I normally do not load Emacs (I am a "vi" type of person)
- I normally do not load Emacs with X windows (nuff said though
this can be quite user friendly if you don't like the UNIX "vi" editor)
- Important: At the end, go into Select Individual Packages and
select OK, using the space bar, expand Development/Languages
and manually select the compat-egcs options and egcs-g77; otherwise you will
not have a Fortran 77 compiler for compiling up crystallographic programs.
- Then select DONE to continue.
- If you are prompted about Dependencies, go with "Install packages to satisfy dependencies" and
continue.
- The install then does a "PCI Probe" and says it detects the video card, (in this case a
PCI Entry: 655555, X Server: SVGA)
A happy event indeed given getting X-windows to actually work can be a major pain and this is
encouraging. Thus select OK to continue; after which the relevant XFree-86 program will
be downloaded for installation.
- Redhat Install might(?) tell you it will be keeping a log of everything in /tmp/install.log With this
reassurance, continue by selecting OK
- Redhat Install will then create the partitions/filesystems then download the packages.
- Redhat will then say it is preparing to install, then will start downloading the packages off
the internet. Don't be too concerned if some things seem to stall for a while or you get a long
download time. This can change over time once it starts getting into the install.
In this example, it first stated that
package installation would take 3 hours, but this went down to 20 to 30 minutes after the first
few packages came across the net at this particular time.
- After downloading, Redhat will then do some post install configuration before prompting
whether you wish to create a boot disk.
- When prompted whether you wish to create a Boot Disk, you would normally say yes, but
I tend not to due to installing and reinstalling operating systems all the time.
- You will now be prompted for the Monitor Setup.
Be wary that giving the wrong monitor setup can damage the video monitor so check this
out with the hardware manual.
- (in this case), Custom Monitor setup
- Extended Super VGA, 800x600 @ 60 Hz, 640 x 480 @ 72Hz; then 50-70 for vertical
Sync Range)
Also, if some of the following does go pear-shaped, continue on
and after installation, you can run Xconfigurator to try another Xwindows setup. This
information is given below.
- Input the monitor details. If on probing, Redhat has a problem, just ignore it for now
and this can be fixed up later. Redhat 6.1 and 6.2 seems to have a problem getting the
X setup correct during install - but is fine if re-done after the install.
- Redhat will then run Xwindows. Click OK if you get the screen. Do not be worried
if the screen is a bit strange, we will fix this in the post install fixup. When prompted if you
want to start X on booting, I tend to respond No. I like to boot up in the command line, then
type "startx" to start Xwindows.
- At this point, the Installer should be saying something like Congratulations. (If not,
such is life and it implies things are not happy - most likely in the file partitions)
Before selecting OK to continue, take out the
Boot Floopy you created. If you don't do this, on reboot, it will
prompt to re-install the operating system. If you do end
up booting from the Boot Floppy or CD-ROM. into the installer, exit at first available
opportunity. (or press [CNTRL] [ALT] [DELETE] to restart)
- When the PC restarts, you should now be prompted with HD/1 Press 2 (the second
primary partition) to boot up linux. (A minimalist boot manager I have already admitted but
it should get the job done in a reproduceable manner - But installing a more visually
exiting menu implementation of the boot manager is described above)
If Kudzu runs and says some of the hardware does not exist anymore (most likely the
modem portion of the network card), do what makes you happy here, I tend to remove
the configuration for the card. (make your own decision depending on how important
the modem part of the network card is)
- (If instead, after a LILO boot prompt, the Laptop reboots, something must have gone
strange during the reboot. There may be smarter ways, but I would suggest going through
the install again. Most likely problem is that Linux go a bit mixed up where to put (or point to)
the kernel?)
- It is probable that a few things did not actually get implemented as advertised. Thus reboot redhat and log
in as root and we will get into the fixing up and securing the installation.
- X setup: Redhat 6.2 probably did not probe the hardware correctly during bootup; thus this
will have to be fixed.
- Log in as root.
- Run /usr/sbin/setup
- Select X configuration
- It should find the hardware during a PCI Probe
- Select Custom monitor (or if a known monitor type - select this)
- Select (in this case) Extended Super VGA, 800x600 @ 60Hz, 640x480 @ 72 Hz
- 50-70 Hz range for the vertical sync rate
- Now Probe the system
- Once "probing" has finished, select Let Me Choose
- In select video mode, select 16 bit "800x600" (you can select more
than one graphics mode and then use [cntrl] [alt] + to cycle through the available
graphics modes.
- Confirm if you can see the "can you see this screen message"
- And I recommend not starting up X at boot time (thus select no)
(when you boot up Linux and get the command line, just type startx)
- And select OK after reading the information.
- Once back in Text Mode Setup program, you can quit.
- To not advertise port 6000 while running Xwindows, edit the "/usr/X11R6/bin/startx" file
and under "clientargs" and "serverargs" add -nolisten tcp within the quotes.
- Fixing other possible problems:
- To check that the network is working,
try and ping a local or foreign computer, e.g., "ping www.apple.com. If you get no response
or a host unknown, it would look like Redhat did not correctly setup the network. This can be
fixed in a relatively user-friendly way by running linuxconf from the command line. The
main problem is usually the default domain and DNS server information not be retained correctly.
- Redhat Linux 6.2 is quite woeful in letting lots of un-necessary services run that could be
a hacker's dream so, we will be turning these off.
- As root, run /usr/sbin/setup and enter System Services. From the menu, disable:
- indentd
- linuxconf (deamon)
- lpd
- nfslock
- portmap
- sendmail
- The above changes in services will be enabled on reboot.
- Now might be a good time to reboot to enable all the above changes to the network services .
- Warning: Doing the following - and even just downloading nmap - may be a sackable offense
in many organisations. Check with your network support group first before downloading nmap and any other related
tools.
Providing this is consistent with your network usage policies (check with your network support people),
you can now try running a "scanner/probe" on the new Linux machine once it is connected to
the network. A very good scanner program is nmap (http://www.insecure.org/nmap/).
Nmap (using "nmap -sS -O -vv 127.0.0.1") should say there are no open ports.
Then run Xwindows (using the startx command), nmap should still state that there are no open ports. If
there are open ports, you may have forgot to turn a System Service off when using /usr/sbin/setup.
NMAP gives the following result on the above setup Linux computer:
nmap -sS computername
Starting nmap V. 2.30BETA20 by fyodor@insecure.org ( www.insecure.org/nmap/ )
All 1518 scanned ports on computername (ip_address) are: closed
Nmap run completed -- 1 IP address (1 host up) scanned in 3 seconds
Or trying to detect the operating system.
nmap -sS -O computername
Starting nmap V. 2.30BETA20 by fyodor@insecure.org ( www.insecure.org/nmap/ )
All 1518 scanned ports on computername (ip_address) are: closed
Remote OS guesses: Linux 2.0.27 - 2.0.30, Linux 2.0.32-34, Linux 2.0.35-38, Linu
x 2.1.24 PowerPC, Linux 2.1.76, Linux Kernel 2.1.88, Linux 2.1.91 - 2.1.103, Lin
ux 2.1.122 - 2.2.14, Linux 2.2.12, Linux 2.3.12, NetBSD 1.4 / Generic mac68k (Qu
adra 610)
Nmap run completed -- 1 IP address (1 host up) scanned in 2 seconds
- When running KDE desktop, you can change that the active Window is the one the Mouse is over by
going into Settings, Window Behavoir, Properties
and set "Focus Policy" to Focus Follows Mouse.
- A KDE FAQ on the Window manager is at:
http://www.kde.org/documentation/faq/kdefaq-7.html
- For getting back to programs you have minimised or switched from:
- While the mouse is on the desktop, click the middle mouse button will bring up a list of running applications
that you can select from.
- NOTE: When running System S single crystal suite by Ton Spek; in
for Redhat 6.x, bash shell causes a core dump so run "cshell" (type csh)
Some other things
- As root, you may like to edit /etc/passwd and make the default shell for users, csh. Bash can
crash System S/Platon but runs fine with csh
- As root, edit /etc/aliases and set the the alias for root to your E-mail so you receive system
messages from root.
Things to do Now that Basic Linux has been Installed
- For some strange reason, Redhat put updates in a separate area and has no transparent way to
check for updates during and after installation. So when installing a version of Redhat fresh
off the internet, you may still be getting the old, buggy programs that may have security flaws. Thus
go to the Redhat website and find out what updates are available and relevant for your installation.
To to the updates directory at the FTP site you are downloading from; grab and install any updates
for programs you are using. These are in the form of RPMs. Thus install via rpm -Uvh filename.rpm.
An automatic/pseudo-transparent way of doing automatic updates or packages and RPMs with Redhat Linux
(and other versions of Linux) is to use autorpm that will do all of this for you once it
has been installed.
Debian Linux does a much better job of this having an automated update system warning that newer programs
are available. (http://www.debian.org using the apt program
- refer: http://www.debian.org/security/).
- The updates may have installed some "open" services you do not know about.
Thus you can now again try running a "scanner/probe" on the new Linux machine once it is connected to
the network such as nmap (http://www.insecure.org/nmap/).
Nmap should say there are no open ports. Then run Xwindows (using the startx command), nmap should
still state that there are no open ports.
- Get and compile the excellent snarf program for being able to quickly get programs via FTP and HTTP via a command line -
http://www.xach.com/snarf/
ftp://ftp.mint.net/pub/snarf/snarf-latest.tar.gz
One of the advantages for UNIX is that it can work on a command line. Useful when you have limited memory or are
remotely logging in. Snarf can be a lifesaver to quickly pull over install files off the internet,
saving you loading up a GUI netscape or bothering with Lynx which can occassionaly be quite finicky for downloading.
- Compile/Install Secure Shell (SSH) for Linux
and disable superfluous inetd.conf based deamons - telnetd, logind, rshd - which should not be running
as inetd was disabled in the installation.
- The above install makes this superfluous but just in case you did not go this way:
Disable unnecessary deamons in the portmapper, inetd.conf
(pretty much everything you don't need; ftpd, telnetd, fingerd, etc)
This means edit the /etc/inetd.conf file and remove everything you don't like the
look of. If you have installed SecureShell, you can pretty much REM out everything.
Then type killall -HUP inetd to restart inetd deamon.
- Refer to the TinityOS documentation which is quite excellent on how to
secure up and administer Linux - http://www.ecst.csuchico.edu/~dranch/LINUX/TrinityOS.wri
- For limiting hacking on your system, by default, Redhat Linux comes with TCPWrappers enabled (tcpd) - which
can protect defined services or a global ALL for programs run from within inetd.
Again, superfluous if you followed the above in disabling inetd but you may have ignored this advice.
Do a man tpcd which sort of describes what this is about and gives some examples.
If you only want people from your domain to be able to access services, following are examples of
/etc/hosts.allow and /etc/hosts.deny that you can modify. You can create a banner depending on whether
the user is authorized or not to use this service from the particular domain they are logging in from.
- /etc/hosts.deny
ALL: ALL : banners /usr/etc/tcpwrap/banner1
- /etc/hosts.deny
ALL: LOCAL, 127.0.0.1 : banners /usr/etc/tcpwrap/banner2
ALL: .dl.ac.uk, .ccp14.ac.uk : banners /usr/etc/tcpwrap/banner2
- Where the /usr/etc/tcpwrap/banner1 directory has files depending on the service you wish to
give a message about - ftpd nul rlogind telnetd
e.g, for telnetd:
*********************************************************
* UNAUTHORIZED ACCESS TO THIS MACHINE IS PROHIBITED *
(and very naughty) *
*********************************************************
- Where the /usr/etc/tcpwrap/banner2 directory has files depending on the service you wish to
give a message about - ftpd nul rlogind telnetd
e.g., for telnetd: Hello, Hello %u@%h.
- Unlike the standard UNIX portmapper, the Redhat linux portmapper is protected by TCP Wrappers as described above.
This is important if you are running NFS and allowing some systems to nfs mount your directory areas; and
limit probes on your system.
- Check around some Securing Linux sites for extra info on keeping your system "unhacked":
- Fill up hard-disk with stuff