The next thing to take a look at is the security in your system against attacks from local users. Did we just say local users? Yes!
Getting access to a local user account is one of the first things that system intruders attempt while on their way to exploiting the root account. With lax local security, they can then "upgrade" their normal user access to root access using a variety of bugs and poorly setup local services. If you make sure your local security is tight, then the intruder will have another hurdle to jump.
Local users can also cause a lot of havoc with your system even (especially) if they really are who they say they are. Providing accounts to people you don't know or for whom you have no contact information is a very bad idea.
You should make sure you provide user accounts with only the minimal requirements for the task they need to do. If you provide your son (age 10) with an account, you might want him to only have access to a word processor or drawing program, but be unable to delete data that is not his.
Several good rules of thumb when allowing other people legitimate access to your Linux machine:
Many local user accounts that are used in security compromises have not been used in months or years. Since no one is using them they, provide the ideal attack vehicle.
The most sought-after account on your machine is the root (superuser) account. This account has authority over the entire machine, which may also include authority over other machines on the network. Remember that you should only use the root account for very short, specific tasks, and should mostly run as a normal user. Even small mistakes made while logged in as the root user can cause problems. The less time you are on with root privileges, the safer you will be.
Several tricks to avoid messing up your own box as root:
rm foo*.bak, first do
ls foo*.bakand make sure you are going to delete the files you think you are. Using
echoin place of destructive commands also sometimes works.
rmcommand to ask for confirmation for deletion of files.
PATHenvironment variable) specifies the directories in which the shell searches for programs. Try to limit the command path for the root user as much as possible, and never include
.(which means "the current directory") in your PATH. Additionally, never have writable directories in your search path, as this can allow attackers to modify or place new binaries in your search path, allowing them to run as root the next time you run that command.
.rhostsfile for root.
/etc/securettyfile contains a list of terminals that root can login from. By default (on Red Hat Linux) this is set to only the local virtual consoles(vtys). Be very wary of adding anything else to this file. You should be able to login remotely as your regular user account and then
suif you need to (hopefully over
sshor other encrypted channel), so there is no need to be able to login directly as root.
If you absolutely positively need to allow someone (hopefully very
trusted) to have root access to your machine, there are a few
tools that can help.
sudo allows users to use their password to access
a limited set of commands as root. This would allow you to, for
instance, let a user be able to eject and mount removable media on
your Linux box, but have no other root privileges.
sudo also keeps a
log of all successful and unsuccessful sudo attempts, allowing you to
track down who used what command to do what. For this reason
works well even in places where a number of people have root access,
because it helps you keep track of changes made.
sudo can be used to give specific users specific privileges
for specific tasks, it does have several shortcomings. It should be
used only for a limited set of tasks, like restarting a server, or
adding new users. Any program that offers a shell escape will give
root access to a user invoking it via
sudo. This includes
most editors, for example. Also, a program as innocuous as
/bin/cat can be used to overwrite files, which could allow
root to be exploited. Consider
sudo as a means for
accountability, and don't expect it to replace the root user and still