Node: Hints for implementing security, Next: Checksum Databases, Previous: Security and cfengine, Up: Security and cfengine
Cfengine is not specifically a tool for implementing high security solutions for system administration, but it has many features which can be used to monitor the state of your systems and warn about potential breaches in security. Here are some suggestions as to how you can be more security conscious with cfengine's help.
files
feature, it will make
a note of setuid programs it finds there. These are recorded in the
file cfengine.
host.log
which is stored under /etc/cfengine
or
/var/log/cfengine
.
When new setuid programs are discovered, a warning is printed, but only
if you are root. If you ever want a complete list, delete the log
file and cfengine will think that all of the setuid programs it finds
are new. The log file is not readable by normal users.
ChecksumDatabase
files
you can set the option checksum=md5
which
will result in the md5 value of the named file being cached in
a database for future reference. If the file changes in any way
this will be registered and a security warning will be issued. This
gives cfengine behaviour like Tripwire.
files
, tidy
, copy
), it is on the lookout for
suspicious filenames, i.e. files like .. .
containing only space
and/or dots. Such files are never created by sensible people, but are
often used by hackers to try to hide dangerous programs. Cfengine
prints warnings about such files. The variable list FileExtensions
may be used to detect concealed directories during these searches,
if
users create directories which look like common files.
cfd
program attempts to unmask such
attempts by performing double reverse lookups in the name service. This
verifies by a trusted server that the socket address and the host name
are really who they claim to be. If you have the TCP wrappers package
on your system (libwrap)
then cfd will attempt to use it to detect other spoofs too, See TCP wrappers. If you don't have TCP wrappers, then the only line of
defense is the double reverse lookup.
.cfnew
) and then renaming it into place, only
if the transfer was successful. This ensures that there is
space on the filesystem and that nothing went wrong with
the network connection or the disk during copying.
size=
in copy
useshell=
in shellcommands
/bin/sh -c
command. The trouble with this is that
it leaves one open to a variety of attacks. One example is fooling the
shell into starting foreign programs by manipulating the IFS
variable to treat '/' as a separator. You can ask cfengine to start
programs directly, without involving an intermediary shell, by setting
the useshell
variable to false. The disadvantage is that you will
not be able to use shell directives such as |
and >
in
your commands.
warnnonusermail
and warnnonownermail
in control