10 things you should do to a new Linux PC before exposing it to the Internet

1: Your purpose

Linux, like Microsoft Windows, is simply a computer operating system. When I talk to friends or co-workers who are embarking on the Linux experience for their initial time, this is the first point I stress. Linux in itself is not a magic wand that can be waved and make all sorts of computing problems disappear. While Windows has its own set of problems, so too does Linux. There is no such thing as a perfect or completely secure computer operating system. Will the machine be a desktop computer or a server; purpose is a key to understanding how to initially install and configure your Linux PC.

2: Installation

Unlike Windows, Linux does not present itself as a "server" version or as a "desktop" version. During a typical installation of Linux the choice is yours as to exactly what software you wish to install and therefore exactly what type of a system you are constructing. Because of this, you need to be aware of the packages that the installation program is installing for you. For example, some distributions will configure and start a Samba server or a mail server as part of the base install. Depending upon the purpose of your Linux PC and the security level you are prepared to accept, these services may not be needed or desired at all. Taking the time to familiarize yourself with your distributions' installer can prevent many headaches and/or reinstalls down the road.

3: Install and configure a software firewall

A local software firewall can provide a "just in case" layer of security to any type of network. These types of firewalls allow you to filter the network traffic that reaches your PC and are quite similar to the Windows Firewall. The Mandriva (http://wwwnew.mandriva.com/) package called Shorewall (http://www.shorewall.net/) along with a component of the Linux kernel called Netfilterprovides a software firewall. By installing and configuring Shorewall during the installation process, you can restrict or block certain types of network traffic, be it coming to or going out from your PC.

To access and configure your firewall for Mandriva simply run the mcc (or Mandriva Control Center) command from a command prompt or, depending upon your graphical environment, you may be able to access the Mandriva Control Center from your base system menu. In the security options, select the firewall icon and you will be presented with a list of common applications that may need access through your firewall. For example, checking the box for "SSH server" will open port 22 needed by the Secure Shell server for secure remote access. There is also an advanced section which will allow you to enter some less commonly used ports. For example, entering "8000/tcp" will open port 8000 on your PC to TCP-based network traffic.

Blocking or allowing network traffic is one layer of security, but how do you secure a service that you do allow the Internet or your intranet to connect to? Host based security is yet another layer.

4: Configuring the /etc/hosts.deny and /etc/hosts.allow files

In the preceding section we looked at the example of opening the Secure Shell service to network traffic by opening port 22 on our firewall. To further secure this server from unwanted traffic or potentially hackers, we may wish to limit the hosts or computers that can connect to this server application. The /etc/hosts.deny and /etc/hosts.allow files allow us to do just that.

When a computer attempts to access a service such as a secure shell server on your new Linux PC the /etc/hosts.deny and /etc/hosts.allow files will be processed and access will be granted or refused based on some easily configurable rules. Quite often for desktop Linux PC's it is very useful to place the following line in the /etc/hosts.deny file:

ALL: ALL

This will deny access to all services from all hosts. It seems pretty restrictive at first glance, but we then add hosts to the /etc/hosts.allow file that will allow us to access services. The following are examples that allow some hosts remote secure shell access:

sshd: 192.168.0.1 #allow 192.168.0.1 to access ssh
sshd: somebox.somedomain.com #allow somebox.somedomain.com to access ssh

These two files provide powerful host based filtering methods for your Linux PC.

5: Shutoff or remove non-essential services

Just like Windows there can be services running in the background that you either don't want or don't have a purpose for. By using the Linux command chkconfig you can see what services are running and turn them on and off as needed. Services that are not running don't provide security holes for potential hackers and don't take up those precious CPU cycles.

6: Secure your required services

If your new Linux PC has some services that will receive connections from the Internet make sure you understand their configurations and tune them as necessary. For example, if your Linux PC will receive secure shell connections make sure you check the sshconfig file (for Mandriva it is /etc/ssh/sshd_config) and disable options like root login. Every Linux PC has a root user so you should disable root login via ssh in order to dissuade brute force password crack attempts against your super-user account.

7: Tune kernel networking security options

The Linux kernel itself can provide some additional networking security. Familiarize yourself with the options in the /etc/sysctl.conf file and tune them as needed. Options in this file control, for example, what type of network information is logged in your system logs.

8: Connect the PC to a router

A hardware router is a pretty common piece of household computer hardware these days. This is the front line security to any home or business network and provides multiple PC's to share one visible or external Internet address. This is generally bad news for any hacker or otherwise malicious program that may take a look at your new Linux PC as it blocks any and all network traffic that you don't specifically allow. Home networking routers are just smaller versions of what the big companies use to separate their corporate infrastructure from the Internet.

9: Update

Always keep the software on your computer up to date with the latest security patches should you be running Linux, Windows, BSD or WhoKnowsWhat. Your distribution will release regular security patches that should be applied and are available off the Internet. As with Windows, this should always be your first Internet destination.

10: Other software

Your second Internet stop may be to install some other hardening or system monitoring software.

Bastille-Linux (http://www.bastille-linux.org/) is a program that can be used to "harden" or secure certain aspects of your new Linux PC. It interactively develops a security policy that is applied to the system and can produce reports on potential security shortcomings. On top of that it is a great tool to use for learning the in and out of securing your Linux PC.

Tripwire (http://sourceforge.net/projects/tripwire) is a software package that monitors your system binaries for unauthorized modifications. Often a hacker may modify system binaries that may be useful in detecting a system intrusion. The modified programs would then report false information to you allowing the hacker to maintain his control over your system.

Krish

Detect intruders on your network with Snort

Snort is a Network Intrusion Detection System (NIDS), which can view and analyse packets on a network to determine whether or not a system is being attacked by remote.

Most Linux distributions come with Snort, so it's simply a matter of installing Snort via urpmi, apt-get, or yum. Snort can write its collected information to a variety of different sources for later analysis, be it flat files or a database such as PostgreSQL or MySQL. As well, Snort can be used as a simple packet logger, sniffer, or a full-blown NIDS.

Once Snort is installed, it can be used right away. Simply executing:

# snort -v

will put Snort into packet sniffing mode; traffic will be scrolled on the screen showing what packets Snort is seeing. To exit, hit CTRL-C and you will see a brief analysis of what Snort detected. To see even more information -- like you might with tcpdump -- use the -vd option instead.

To have Snort log data, simply tell it where to log the information. In the next example, Snort will log information to the /usr/local/log/snort directory, so make sure it exists first.

# snort -l /usr/local/log/snort -d

Snort will log packets in a binary file, such as /usr/local/log/snort/snort.log.1199665001. To view the log, use the -r option with Snort in order to replay the captured data.

# snort -r /usr/local/log/snort/snort.log.1199665001

Using Snort as an NDIS takes a little more work; you must configure Snort appropriately, using the configuration file /etc/snort/snort.conf. Be warned, this configuration file can be quite hefty! Some of the rules available on the Snort Web site may be packaged with Snort, depending on the Linux distribution.

The Snort rules can be downloaded from http://www.snort.org/pub-bin/downloads.cgi. The community rules are available for anyone to use and are most likely to be bundled with any prepackaged vendor-supplied copies of Snort. You can also subscribe to receive updated rules from Sourcefire on a regular basis.

Once you have downloaded a rules package, such as the Community-Rules-CURRENT.tar.gz file, unpack it on the system with Snort installed in the directory where the Snort configuration is:

# cd /etc/snort
# tar xvzf Community-Rules-CURRENT.tar.gz

The new rules will now be in the rules/ directory.

To enable them, edit snort.conf and add:

var RULE_PATH rules
include $RULE_PATH/sql.rules
include $RULE_PATH/icmp.rules
...

Include whichever rules you like. Snort can now be started to load the configuration file /etc/snort/snort.conf , which will, in turn, load the downloaded rules:

# snort -c /etc/snort/snort.conf

Snort will then print information about its initialisation to the screen and then start logging packets that match the defined rules. The rules will determine what Snort will log and what it will ignore, so unlike running Snort as a sniffer, the generated logs will be much smaller as only packets "of consequence" will be logged. These logs will be stored, by default, in /var/log/snort/ and can be analysed by Snort using the -r option as noted previously.

10 tips for securing Linux desktops

Out of the box, a Linux desktop is far more secure than most others.

However, this level of security is not necessarily attained through typical security-focused software or techniques. Sometimes, the easiest means to security are those that are the easiest to forget.

You might find these suggestions to be pure common sense, but maybe you'll see a means of security you never thought of before. If you're a new Linux user, these tips are a great place to start to ensure that your Linux experience is a good one.

Here are 10 steps you can take to secure a Linux desktop.

1. Locking the screen and logging out is important

Most people forget that the Linux desktop is a multi-user environment. Because of this, you can log out of your desktop and others can log in. Not only does that mean that others could be using your desktop, it also means you can, and should, log out when you're finished working.

Of course, logging out is not your only option. If you are the only user on your system, you can lock your screen instead. Locking your screen simply means that a password will be required to get back into the desktop. The difference here is that you can leave applications running and lock the desktop. When you unlock the desktop, those same programs will still be running.

2. Hiding files and folders is a quick fix

In "Linux land", files and folders are hidden by adding a "." before the name; so, for example, the file "test" will appear in a file browser, whereas ".test" will not. Most people don't know that running the command "ls-a" will show hidden files and folders.

So, if you have folders or files you don't want your co-workers to see, simply add the dot to the beginning of the file or folder name. You can do this from the command line like so: mv test .test.

3. A good password is a must

Your password on a Linux PC is your golden key. If you give that password out or if you use a weak password, your golden key could become everyone's golden key.

And if you're using a distribution like Ubuntu, that password will give users much more access than, say, Fedora. To that end, make sure your password is strong. There are many password generators you can use, such as Automated Password Generator.

4. Installing file-sharing applications is a slippery slope

I know many Linux users are prone to file-sharing. If you want to run that risk at home, that's your call. But, when at work, you not only open yourself, or your company, up to lawsuits, you open your desktop machine up to other users who might have access to sensitive data on your work PC. So, as a rule, do not install file-sharing tools.

5. Updating your machine regularly is wise

Linux isn't Windows. With Windows, you get security updates when Microsoft releases them, which could be many months away. With Linux, a security update can come minutes or hours after a security flaw is detected. With both KDE and Gnome, there are update applets for the panel. I always recommend having them up and running so you know when updates are made available. Don't put off security updates. There is a reason they come out.

6. Installing virus protection is actually useful in Linux

Believe it or not, virus protection in Linux has its place. Of course, the chances of a virus causing problems on your Linux machine are slim to none. But those emails you forward to others' Windows machines could cause problems. With a good virus-protection tool, such as ClamAV, you can ensure that email going out of your machine doesn't contain anything nasty that could come back to haunt you or your company.

7. SELinux is there for a reason

SELinux (Security-Enhanced Linux) was created by the US National Security Agency. It helps lock down access control to applications, and does so very well.

Certainly, SELinux can sometimes be a pain. In some cases, it might take a hit out of your system performance, or you might find some applications a struggle to install. However, the security comfort you gain by using SELinux (or AppArmor) far outweighs the negatives. During the Fedora installation, you get the chance to enable SELinux.

8. Creating /home in a separate partition is safer

The default Linux installation places your /home directory right in the root of your system. This is fine but, firstly, it is standard, so anyone gaining access to your machine knows right where your data is; and, secondly, if your machine goes down for good, your data might be gone.

To solve this problem, you can place /home on a different hard drive or partition altogether (making it a partition in and of itself). This is not a task for the weak of heart, but it is one worth undertaking if you're very concerned about your data.

9. Using a non-standard desktop is worth its weight in gold

Not only do the alternative desktops (Enlightenment, Blackbox, Fluxbox, etc) give you a whole new look and feel for your PC, they offer simple security from prying eyes you may never have considered.

I have deployed Fluxbox on kiosk machines when I wanted a machine that could do one thing: browse the network. This can be easily achieved. Create a single mouse menu (or desktop icon) for the application you want to use. Unless the user knows how to get back to the command line (by logging out or hitting ctrl-alt-f*, where * is a desktop other than the one you are using), they will not be able to start up any application other than the one offered.

Since most users have no idea how to move around in these desktops anyway, they aren't going to have the slightest idea how to get to your files. It is simple pseudo-security.

10. Stopping services is best

This is a desktop machine. It's not a server. So why are you running services like httpd, ftpd, and sshd? You shouldn't need them and they only pose a security risk, unless you know how to lock them down. So don't run them. Check your /etc/inetd.conf file and make sure that all unnecessary services are commented out. It is a simple but effective method.

Krish

Linux coders join green revolution

Programmers have begun serious work to cut consumption, extend PC Linux battery life and ease server costs

To this end new versions of the operating system are being endowed with a "tickless" kernel that forsakes traditional computer time-keeping in an effort to keep the processor in a somnolent, low-power state.

The tickless kernel isn't the only effort under way. Intel released software called PowerTop in May that makes it easier to find out what software is needlessly keeping a computer's processor on high alert.

"It makes a lot of sense," Illuminata analyst Gordon Haff said of the power-saving work. "Raw, flat-out horsepower is less and less what the game's about -- especially on laptops, which are becoming more common."

Some Linux developments take years to arrive, but the tickless kernel is now making its way into the Linux mainstream.

"The re-engineering has mostly been done," said Linux leader Linus Torvalds of the new kernel. And for higher-level software, PowerTop has been "invaluable, he added. "A lot of people and (Linux) distributions are actually interested in this, so the user applications do seem to be getting fixed."

There's more work to be done, but the progress has been measurable, said Arjan van de Ven, a longtime kernel programmer now working at Intel. "What we see in our lab today is that Linux on a laptop consumes 15 percent to 25 percent less power during idle than a code base of about three months ago," he said.

Cutting chip power
Processors, though not the only power drain in a computer, slurp a lot of electrical power -- more than a 100 watt lightbulb in many cases. Worse, even more electricity is consumed by fans that blow waste heat out of a computer, and more still by air conditioning in datacenters.

But in recent years, chipmakers have given microprocessors the ability to drop down into lower-power states when they don't need to run full throttle. The chip's internal frequency slows, voltage levels drop, and electrical consumption tapers down.

Obviously, processors can go into these power-saving states when a user commands a computer into standby mode. But a lot more can be done. Because gigahertz-frequency processor cycles last less than a billionth of a second, though, chips can actually enter and leave low-power states many times in the interval between two keystrokes of a fast typist.

But an operating system kernel -- the core software that handles basic tasks such as scheduling processes and communicating with hardware -- isn't always good at avoiding busywork. For one thing, software often needlessly prods the kernel into alertness. For another, the kernel itself can waste energy twiddling its thumbs when it could just as well be lowering its blood pressure and dozing off.

Intel's software helps uncover examples of the first problem. The tickless kernel helps with the second.

Going tickless
Version 2.6.21 of the Linux kernel, which Torvalds released in April, includes the tickless option. It was incorporated into Fedora 7, Red Hat's free hobbyist version of Linux.

"In terms of power, it's a huge savings," van de Ven said.

A typical Intel processor for mobile computers consumes a maximum of 1.2 watts in its deepest power-saving state, he said. "The gotcha is that if you wake up every millisecond, you hardly get past the shallow power saving mode," van de Ven said. "The end effect is that tickless gets you into the maximum power save modes, saving significant power and extending battery life."

The tickless kernel still keeps track of time, but in a different way. Instead of checking frequently for work to be done -- literally 1,000 times a second in the case of Linux, with each millisecond-long tick of the kernel's clock -- the kernel schedules the hardware to interrupt it when it knows a future job will require its attention.

The tickless kernel provides another indirect benefit when it comes to power efficiency: It enables better use of virtualisation, technology that lets multiple operating systems run simultaneously on the same computer, by replacing numerous idle machines with fewer, more efficiently used ones.

Tickless kernels mean that the virtualisation software that underlies all those operating systems isn't unduly taxed with needless interruptions. So theoretically, administrators can consolidate servers more aggressively.

"If you have a server running 50 virtualised guests, and each guest has a timer tick 1,000 times per second, that is 50 thousand ticks per second, without even doing any work yet," van de Ven said. "With tickless, you go from 1,000 to maybe 10, and suddenly it becomes manageable to do 50 guests."

Michael Larabel, editor of the Phoronix site that tests Linux hardware performance, found the tickless kernel can cut power consumption from 28 watts to 26 watts in IBM's Pentium M-based ThinkPad R52 running Fedora 7.

"A tickless kernel, in conjunction with (processor-based) power-saving technologies, can go a long way in extending the life of the battery and reducing the heat output," Larabel said.

Peeking with PowerTop
A tickless kernel isn't much good if higher-level software requires the kernel to schedule frequent wakeup calls. That's where PowerTop comes in.

"A typical Linux distribution has many components that wake the processor up frequently for no good reason," van de Ven said in an announcement of the software. "PowerTop will provide an indication of which ... software components are the biggest offenders in slurping up your battery time."

Scrutiny with PowerTop has uncovered power-draw culprits. The Gvim text editor's blinking cursor wakes up the kernel. Evolution e-mail software needs to check for new jobs to do 10 times a second. The GAIM (now called Pidgin) instant-messaging software checks every 5 seconds to see if it should set itself as "idle".

As well as fixing these sorts of issue, the Linux kernel itself needs to be spruced up to better support its own "ticklessness".

"Even though the kernel itself now has all the fundamental timer-handling knowledge, most of the kernel subsystems use some timers for their own handling, and tuning that usage will probably go on for some time," Torvalds said.

And other frontiers need work, van de Ven said. Device drivers -- the software modules that let the kernel communicate with hardware such as network cards or keyboards -- need to be revamped to better handle power issues.

Another issue is developing power-related policy management software that governs a computer's behavior based on what its user is doing. And yet another thorny one is supporting laptop suspend-resume abilities better so laptop computers can hibernate gracefully.

"On the suspend/resume side there will be a lot of rearchitecting needed, especially for suspend-to-disk," van de Ven said. "It's an ongoing discussion topic in Linux."

But much of that work can take place on a newly tickless foundation. "The heavy lifting is mostly done," Torvalds said.

Krish.

Site still not launched :(

The website is still not launched. :( Waiting for a nice old computer to host. Let us see how long will it take. :(


Krish.

India My Country

India Means Civil Liberties,
Patriotism Means Protecting Them.






Indians, you may wish to copy this icon to your own page, as a way of showing what patriotism means to you.

Krish.

Is clean India a dream?

Dear Educated Indians,

We daily use different means of public transport to move across the city. We are grateful that our government is providing us these facilities. We are not like the economically and financially backward countries. Thank God!

But are we ensuring proper care for the public places and public transports? Foreigners refer to our cities and our country as dirty. Do not blame them because it we who are to be blamed.

We do not take care of our country. We throw all kinds of waste out in the public places. We have polluted our country to the core. The country has done a lot of things to us. But we have failed to do the same to her.

If the above sentences has made you think then read further, else throw this paper in the dust-bin and not anywhere else. Please that’s a request.

Things to do to stop our city from getting dirty:

• You need not clean the public places as there are workers to do that job.

• All you need to do is stop making it dirtier.

• Stop throwing papers, used tickets, cigarettes buds, and used match sticks.

• Please do not spit on the roads, other public places and transport means.

• Ask your children are other kids to throw the chocolate wrappers into the dustbin

• Do not reproduce this document, instead just spread the message.

I am not from any government agency; I am a citizen of India who wants a cleaner and greener Chennai and hence cleaner and greener India. Let the foreigners see a different India soon.

Thanks for reading this document.

Krish.