Amir Malik (amir@virusexperts.com) Webmaster
The security mechanisms offered by the Unix filesystem (not filesystem type such as ext2, reiserfs, or ufs) are inherently weak. The security offered is by way of file ownership and permissions. Firstly, a file (or a directory, since a directory is really just a different "type" of file) contains two types of ownership: user and group. A file may only have one owner. The file also belongs to a group, usually the group of the owner. Access to the file is controlled through user, group, and world permissions. The access for entity (user, group, or world) is determined by the combination of three bits: read, write, and execute. Let's make this more believable by providing a directory listing.
$ ls -l /etc/passwd -rw-r--r-- 1 root root 2946 Aug 11 17:07 /etc/passwdThe first column contains the permission information for the password file. The third and fourth columns indicate the user and group owners, respectively. Let's decipher the first column. It is made up three permissions; let's use "-xxxyyyzzz" as an example. Note that the leading minus sign is used for something else, hence we are not worried about it. Then xxx would represent permissions for the owner of the file, yyy the permissions for the group owner, and zzz the permissions for everyone else. You would belong to the everyone or "world" group if you are not the owner or are not in the owner group. Let's examine the types of permissions more closely.
Remember how I said earlier that a directory is like a file? Well that is not exactly true. Read permission on a directory means you are able to view its contents (note that this is not recursive). Write permission to a directory means you are allowed to create files (or directories) inside it. Finally, execute permission allows you to enter a directory, which you will need in order to be able to read or write files that reside inside the directory.
Securing $HOME/..
Although this is very trivial, removing the read bits for the world
permissions, will not allow the home directory (/home, /usr/home, or
equivalent) to be read. This gives many people an illusion of security,
rather than true comfort because if someone is trying to get the list
of users on your system, their destination would not be /home, rather
it would be the world-readable file, /etc/passwd. But this does give
some security when you are storing more than users' home directories
in /home. This can also be useful in shared hosting environments,
where you have all of your domains under a common directory, and don't
want users snooping in there to find out what you are hosting.
# chmod o-r /homeThis is letting chmod (change permission mode) know that we want to remove (note the minus sign, as opposed to a plus sign) the read bit from the "other," or world group. Let's verify it, look for the entry for the current directory, "." (with respect to /home).
# ls -al /home drwxr-x--x 4 root root 120 Sep 2 16:58 .The first column confirms that only root and members of the root group (root is a member of the root group) are able to read the contents of /home. Note that if you want some special users (such as yourself) to be able to view the contents of /home without being root, you might want to add yourself to the root group (thereby elevating yourself to being right below root himself). Traditionally, such users are added to the "wheel" or "root" group.
Resource Limits
When you are on a multi-user system, it is important to define sane
resource limits so that no one user may hog all of the CPU, memory,
or disk resources. It is difficult to give examples that work all-
around, but let's take a look at the general limits you should start
off with.
To find out how to change these resource limits on your system, do the following:
cap_mkdb /etc/login.confChanges take effect upon users' next login.
Securing $HOME
It is vital to secure one's home directory because any valuable information
can be found there. By default, when a new user is added to the system,
the permissions on the user's home directory are usually read and execute
for everyone. That means everyone will be able to read the contents of
his home directory. Armed with that, they will be able to determine what
other files (and directories) they are able to access. Thus it is
important to secure at least the base of your home directory by setting
its permissions to a more secure setting.
chmod g-r,o-r $HOMEThis tells chmod to remove the read permission from the group permission, and also remove the read permission from everyone else. If your system's chmod does not like the symbolic notation for permissions, you may need to use octal notation, which works as follows. Each permission (user, group, and other), is assigned one number from 0 to 7, made by adding up the following values:
chmod 711 $HOMEYou may be asking yourself, "Why do I even want to give everyone else execute permission into my home directory?" This is a requirement if a web server is running on the same machine because it will need to access your personal files under $HOME/public_html. If you are not hosting your web space under this account, you do not need to give everyone else execute permission to your directory, making it much more secure.
File and directory permissions are a simple way to keep nosy visitors to your website away from content you do not want them to see without the use of Apache's .htaccess files. However, these permissions will apply to all applications and processes.