[Network Security] 2.4 Secure system configuration

System configuration is an important part of network security. An insecure system configuration may expose the network to attackers, while a secure system configuration can effectively prevent attackers from intruding. In this article, we will introduce in detail how to configure a secure system, including operating system configuration, network service configuration, application configuration, and how to handle system security events.

1. Operating system configuration

An operating system is the foundation of a computer and controls the operation of hardware and software. An insecure operating system configuration can expose the entire system to attackers. Here are some operating system configuration recommendations:

1. Minimal installation : Install only necessary components and services. For example, if your server only needs to run a web server, then you probably don't need to install a graphical user interface (GUI) or other non-essential services. This can reduce the attack surface of the system, thereby improving the security of the system.

2. Updates and Patches : Regularly update your operating system and installed software with the latest security patches. This improves the security of your system by preventing attackers from exploiting known vulnerabilities.

3. Accounts and permissions : Use the principle of least privilege to manage accounts and permissions. For example, instead of using the root account for daily operations, use a normal account and only escalate privileges when needed. This prevents attackers from gaining too many privileges, thereby improving system security.

4. Security Configuration : Configure the security settings of the operating system, such as enabling the firewall, disabling unnecessary services, and configuring file and directory permissions. This can improve the system's defense capabilities and thus improve its security.

For example, for Linux systems, we can use the following commands to check and shut down unnecessary services:

# 检查运行中的服务
systemctl list-units --type=service

# 关闭不必要的服务
systemctl stop [service]
systemctl disable [service]

2. Network service configuration

Network services are services provided by the system, such as Web services, email services, and database services. An insecure network service configuration may expose the service to attackers. Here are some suggestions for network service configuration:

1. Minimal installation : Only install necessary services and configure the operating system to reduce the attack surface of the system.

2. Updates and Patches : Regularly update the service and related libraries to get the latest security patches.

3. Accounts and permissions : Use the principle of least privilege to manage accounts and permissions for services. For example, instead of using the root account to run services, use a dedicated account.

4. Security configuration : Configure the security settings of the service, such as enabling TLS, configuring a secure password policy, and restricting access to the service.

For example, for the Apache web server, we can /etc/httpd/conf/httpd.confconfigure the following settings to improve security in the configuration file (for example):

# 使用专门的账户和组来运行Apache
User apache
Group apache

# 只监听必要的端口
Listen 80

# 禁用不必要的模块
LoadModule status_module modules/mod_status.so
LoadModule info_module modules/mod_info.so
LoadModule userdir_module modules/mod_userdir.so
LoadModule dir_module modules/mod_dir.so
LoadModule autoindex_module modules/mod_autoindex.so

# 启用TLS
SSLEngine on
SSLCertificateFile "/path/to/your/certificate.crt"
SSLCertificateKeyFile "/path/to/your/private.key"

3. Application configuration

Applications are functions provided by the system, such as web applications, database applications, and email applications. An insecure application configuration can expose the application to attackers. Here are some suggestions for application configuration:

1. Minimal installation : Only install necessary applications and configure the operating system to reduce the attack surface of the system.

2. Updates and Patches : Regularly update apps and related libraries to get the latest security patches.

3. Accounts and Permissions : Use the principle of least privilege to manage your app’s accounts and permissions. For example, instead of using the admin account to run an application, use a normal account and only escalate privileges when needed.

4. Security configuration : Configure application security settings, such as enabling CSRF protection, configuring secure password policies, and restricting application access.

For example, for a WordPress application, we can wp-config.phpconfigure the following settings to improve security in a configuration file (for example):

// 使用安全的数据库连接
define('DB_HOST', 'localhost');
define('DB_NAME', 'secure_wordpress');
define('DB_USER', 'secure_user');
define('DB_PASSWORD', 'secure_password');

// 使用安全的密钥
define('AUTH_KEY',         'put your unique phrase here');
define('SECURE_AUTH_KEY',  'put your unique phrase here');
define('LOGGED_IN_KEY',    'put your unique phrase here');
define('NONCE_KEY',        'put your unique phrase here');
define('AUTH_SALT',        'put your unique phrase here');
define('SECURE_AUTH_SALT', 'put your unique phrase here');
define('LOGGED_IN_SALT',   'put your unique phrase here');
define('NONCE_SALT',       'put your unique phrase here');

// 禁用文件编辑
define('DISALLOW_FILE_EDIT', true);

4. Handle system security incidents

When a security incident occurs in the system, you need to take some steps to handle the incident:

1. Discovery : First, you need to discover the event. This may be done through IDS/IPS, log analysis, or user reporting.

2. Analysis : Then, you need to analyze the nature and impact of the event. This may require viewing system logs, network traffic, or application logs.

3. Respond : Finally, you need to respond to the event. This may be accomplished by blocking attack traffic, repairing affected systems or applications, or updating system configurations.

For example, if you discover that your system has been compromised, you can use the following commands to analyze and respond to the event:

# 查看系统日志
journalctl -xe

# 查看网络流量
tcpdump -i eth0

# 查看应用日志
cat /var/log/apache2/error.log

# 阻止攻击流量
iptables -A INPUT -s [attacker's IP] -j DROP

# 修复受影响的系统或应用
yum update
apt-get update

# 更新系统配置
vi /etc/sysconfig/iptables
vi /etc/httpd/conf/httpd.conf
vi /var/www/html/wp-config.php

in conclusion

System configuration is an important part of network security. A secure system configuration can effectively prevent attackers from intruding. By understanding operating system configuration, network service configuration, application configuration, and how to handle system security events, we can configure a secure system.