Red Hat Bugzilla – Bug 603747
error in section 2.2. Server Security
Last modified: 2015-04-06 23:19:37 EDT
Description of problem: 1. section 2.2.1.1.2. TCP Wrappers and Attack Warnings instead of a command 'ALL : 206.182.68.0 : spawn /bin/ 'date' %c %d >> /var/log/intruder_alert' there should be probably 'ALL : 206.182.68.0 : spawn /bin/echo `date` %c %d >> /var/log/intruder_alert' or 'ALL : 206.182.68.0 : spawn /bin/echo `/bin/date` %c %d >> /var/log/intruder_alert' 2. section 2.2.8. Verifying Which Ports Are Listening The text contains: cat /etc/services | grep 834 (command) This command returns no output... Probably there should be something like This command returns no output related to the port 834. (Since there are lines found which are related to ports 1834, 2834 and 3834) Version-Release number of selected component (if applicable): Red Hat Enterprise Linux 6 Security Guide A Guide to Securing Red Hat Enterprise Linux Edition 1.5
This request was evaluated by Red Hat Product Management for inclusion in a Red Hat Enterprise Linux major release. Product Management has requested further review of this request by Red Hat Engineering, for potential inclusion in a Red Hat Enterprise Linux Major release. This request is not yet committed for inclusion.
fixed in source, will appear on redhat.com when next published - thanks!
I went thru the online Security Guide Edition 1.5 today and found following problems: Old fixes: 1. section 2.2.1.1.2. TCP Wrappers and Attack Warnings There is still '' instead of `` within the example: ALL : 206.182.68.0 : spawn /bin/echo 'date' %c %d >> /var/log/intruder_alert So the output will look like date 206.182.68.0 sshd instead of Fri Aug 13 10:25:29 CEST 2010 206.182.68.0 sshd New problems I found: section 2.2.2.2. Protect portmap With iptables In the example iptables -A INPUT -p tcp -s! 192.168.0.0/24 --dport 111 -j DROP the system will warn about obsoleteness please use iptables -A INPUT -p tcp ! -s 192.168.0.0/24 --dport 111 -j DROP as well as in the next example where will be: iptables -A INPUT -p udp ! -s 192.168.0.0/24 --dport 111 -j DROP 2, section 2.2.6.3.1. Restricting User Accounts To disable specific user accounts in vsftpd, add the username to /etc/vsftpd.ftpusers This file does not exist and default pam configuration points to /etc/vsftpd/ftpusers file. So the correct one to mention is /etc/vsftpd/ftpusers Please take a look at it.