os/doc
3
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

Editorial review of System Tuning for Security.

Browse source 
Sponsored by:	iXsystems
This commit is contained in:
Dru Lavigne 2014-05-01 15:27:34 +00:00
parent f8416834f1
commit b8a75b0b58
Notes: svn2git 2020-12-08 03:00:23 +00:00 
svn path=/head/; revision=44730
1 changed files with 56 additions and 51 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

107
en_US.ISO8859-1/books/handbook/security/chapter.xml
View file

@ -568,32 +568,36 @@ cat changed
<sect2 xml:id="security-tuning"> <sect2 xml:id="security-tuning">
<title>System Tuning for Security</title> <title>System Tuning for Security</title>
<para>Many of the systems features may be tuned through the use <para>In &os;, many system features can be tuned using
of &man.sysctl.8;. This is also true for a few security <command>sysctl</command>. A few of the security
features which could be used to prevent denial of service features which can be tuned to prevent Denial of Service
(<acronym>DOS</acronym>) style attacks. Some of the more (<acronym>DoS</acronym>) attacks
important will be covered here. Any time a setting is changed will be covered in this section. More information about using
with &man.sysctl.8;, the chance to cause undesired harm is <command>sysctl</command>, including how to temporarily change
increased affecting the availability of the system. values and how to make the changes permanent after testing,
Considering the <acronym>CIA</acronym> of the system should be can be found in <xref
done during any system-wide configuration change.</para> linkend="configtuning-sysctl"/>.</para>
<para>The following is a list of &man.sysctl.8;'s and a short <note>
description of what effects the changes will have on the <para>Any time a setting is changed
system.</para> with <command>sysctl</command>, the chance to cause undesired harm is
increased, affecting the availability of the system. All changes
should be monitored and, if possible, tried on a testing
system before being used on a production system.</para>
</note>
<para>By default, the &os; kernel boots with a security level of <para>By default, the &os; kernel boots with a security level of
-1. This is called <quote>insecure mode</quote> because <literal>-1</literal>. This is called <quote>insecure mode</quote> because
immutable file flags may be turned off and all devices may be immutable file flags may be turned off and all devices may be
read from or written to. The security level will remain at -1 read from or written to. The security level will remain at <literal>-1</literal>
unless it is altered, either by the administrator or by unless it is altered through <command>sysctl</command> or by
&man.init.8;, because of a setting in the startup scripts. a setting in the startup scripts.
The security level may be raised during system startup by The security level may be increased during system startup by
setting <varname>kern_securelevel_enable</varname> to setting <varname>kern_securelevel_enable</varname> to
<literal>YES</literal> in <filename>/etc/rc.conf</filename>, <literal>YES</literal> in <filename>/etc/rc.conf</filename>,
and the value of <varname>kern_securelevel</varname> to the and the value of <varname>kern_securelevel</varname> to the
desired security level. See &man.security.7; and &man.init.8; desired security level. See &man.security.7; and &man.init.8;
for more information on these settings.</para> for more information on these settings and the available security levels.</para>
<warning> <warning>
<para>Increasing the <varname>securelevel</varname> can break <para>Increasing the <varname>securelevel</varname> can break
@ -601,45 +605,46 @@ cat changed
prepared to do some debugging.</para> prepared to do some debugging.</para>
</warning> </warning>
<para>Next &man.sysctl.8;s to change is the <para>The <varname>net.inet.tcp.blackhole</varname> and
net.inet.tcp.blackhole and net.inet.udp.blackhole. When these <varname>net.inet.udp.blackhole</varname> settings can be used
are set, incoming <acronym>SYN</acronym> packets on closed to drop incoming <acronym>SYN</acronym> packets on closed
ports will be dropped with no return <acronym>RST</acronym> ports without sending a return <acronym>RST</acronym>
response. The normal behavior is to return an response. The default behavior is to return an
<acronym>RST</acronym> to show a port is closed. These will <acronym>RST</acronym> to show a port is closed. Changing the default
provide some level of protection against provides some level of protection against
<quote>stealth</quote> scans against a system. Set the ports scans, which are used to determine
net.inet.tcp.blackhole to <quote>2</quote> and the which applications are running on a system. Set
net.inet.udp.blackhole to <quote>1</quote> and review the <varname>net.inet.tcp.blackhole</varname> to <literal>2</literal> and
information in &man.blackhole.4; for more information.</para> <varname>net.inet.udp.blackhole</varname> to <literal>1</literal>.
Refer to &man.blackhole.4; for more information about these settings.</para>
<para>Additionally the net.inet.icmp.drop_redirect and <para>The <varname>net.inet.icmp.drop_redirect</varname> and
net.inet.ip.redirect should be set as well. These two <varname>net.inet.ip.redirect</varname> settings
&man.sysctl.8;s will help prevent against what are called help prevent against
redirect attacks. Redirect attacks are the purposeful mass <firstterm>redirect attacks</firstterm>. A redirect attack is a type of <acronym>DoS</acronym> which sends mass
issuing of <acronym>ICMP</acronym> type 5 packets which should numbers of <acronym>ICMP</acronym> type 5 packets. Since these packets
not be required in a normal network. As such, set are not required, set
net.inet.icmp.drop_redirect to <quote>1</quote> and set <varname>net.inet.icmp.drop_redirect</varname> to <literal>1</literal> and set
net.inet.ip.redirect to <quote>0</quote>.</para> <varname>net.inet.ip.redirect</varname> to <literal>0</literal>.</para>
<para>Source routing is method of detecting and accessing <para>Source routing is a method for detecting and accessing
non-routable addresses on the internal network. This should non-routable addresses on the internal network. This should
probably be disabled as non-routable addresses are normally be disabled as non-routable addresses are normally
not routable on purpose. To disable this feature, set not routable on purpose. To disable this feature, set
net.inet.ip.sourceroute and net.inet.ip.accept_sourceroute <varname>net.inet.ip.sourceroute</varname> and
to <quote>0</quote>.</para> <varname>net.inet.ip.accept_sourceroute</varname>
to <literal>0</literal>.</para>
<para>Drop all <acronym>ICMP</acronym> echo requests to the <para>When a machine on the network needs to
broadcast address. When machine on the network need to send messages to all hosts on a subnet, an
send messages to all hosts on a subnet, the message is sent <acronym>ICMP</acronym> echo request message is sent
to the broadcast address. There is no reason an external to the broadcast address. However, there is no reason for an external
host should need to perform such an action so set host to perform such an action. To reject
net.inet.icmp.bmcastecho to <quote>0</quote> to reject all external broadcast requests, set
all external broadcast requests.</para> <varname>net.inet.icmp.bmcastecho </varname>to <literal>0</literal>.</para>
<para>Some additional &man.sysctl.8;s are documented in <para>Some additional settings are documented in
&man.security.7; and it is recommended it be consulted for &man.security.7;.</para>
additional information.</para>
</sect2> </sect2>
</sect1> </sect1>