“If you install most Linux distributions, including Red Hat 6.x
in the “Server” configuration, you’ll find a number of optional
system “daemons” running. Given the normal path of discovery of
security vulnerabilities , one or more of these (totally optional)
programs might have a bug that attackers can exploit to get root
access. The problem is this: most system administrators don’t
know what all those programs on their systems do ! This article
attempts to clear up the confusion, by describing the purpose of
each of the running daemons on a Red Hat 6.1/6.x “Server” box and
often giving suggestions for deactivation. While this article
is a “must-read” for every Red Hat/Mandrake system administrator,
executives should find this article useful as well, to get a
general understanding and to help set a security policy.”
“Most Linux distributions/Unices, by default, run a number of
optional background system programs, regardless of whether you need
them. These “daemons” might include an FTP server, printer daemon,
or NFS system. The vendor does this as a matter of convenience and
ease for users. The end user doesn’t have to remember how to
activate the FTP server, easing phone support costs on the vendor.
Unfortunately, this provides convenience to another class of
people: system crackers! It radically increases their chances of
cracking your system! Why?”
“Well, each system daemon has a probability of possessing a
security vulnerability, a bug that a cracker can exploit to get
access. The more activated system daemons, the higher a chance that
the box has a vulnerable one. Since almost all either run as
superuser (root), these are all dangerous places to have a security
bug. So, we very carefully try to reduce the total number and then
take steps to configure the ones that we must leave running. We’re
applying computer security’s Principle of Applied Minimalism:
reduce the number of possible paths to system compromise by
reducing the number of privileged programs. Let’s get to the
example that forms the basis for this article, Red Hat 6.1.”