1. CIS 193A – Lesson4 Bastille Hardening a System

2. CIS 193A – Lesson4 Focus Question What Linux utilities, commands, and files are used by Bastille to harden a system?

3. CIS 193A – Lesson4 The Bastille Package /etc/Bastille - Configuration files (config) /var/log/Bastille - Reports and log files /var/log/Bastillerevert - backup files /usr/lib/Bastille - Perl libraries /usr/share/Bastille - Documentation

4. CIS 193A – Lesson4 Command Syntax bastille –a # --assess Assess the system bastille –x # -c for curses Create config file and implement changes bastille –b Harden system with specified configuration bastille –r Undoes the configuration

5. CIS 193A – Lesson4 Bastille Groupings File Permissions Account Security Boot Security Logging Miscellaneous Daemons Secure Inetd Disable User Tools Services: Sendmail, Printing, Apache, DNS, FTP

6. CIS 193A – Lesson4 File Permissions Setting permissions in /sbin and /usr/sbin to 750 instead of 755 Removing setuid bits from: –mount, umount –ping traceroute –dump restore –at –X windows –others

7. CIS 193A – Lesson4 Account Security Disable clear text r-protocols Add password aging Strengthen umask Disable root loggins on ttys Remove extraneous accounts and groups Restrict use of cron to root account

8. CIS 193A – Lesson4 Boot Security Password protect grub or lilo Disable ctrl-alt-del reboot sequence Password protect single user mode

9. CIS 193A – Lesson4 Logging Adding additional logging Activating system auditing Turning on process accounting

10. CIS 193A – Lesson4 Miscellaneous Daemons Disable the following services: –apmd / acpid –nfs, nis –samba –pcmcia –gpm –kudzu –etc

11. CIS 193A – Lesson4 Secure Inetd Disable telnet service Disable ftp service Include default deny for hosts.deny Banners: authorized use warnings

12. CIS 193A – Lesson4 Disable User Tools Disable compilers

13. CIS 193A – Lesson4 Review

14. CIS 193A – Lesson4 Focus Question What Linux utilities, commands, and files are used by Bastille to harden a system? Bastille uses grub, PAM, chkconfig, chmod, iptables, and edits such files as issue, securetty, nologin, inittab, login.defs, as well as service configuration files.