Master Checklists

This chapter covers several methods for auditing Unix hosts and their variants. The most important thing to take away is the concepts. Because there are so many variants, it is impossible to list every occurrence you'll run across. Here is a list of the items we reviewed in this chapter:

Auditing Account Management and Password Controls

Checklist for Auditing Account Management and Password Controls

1. qReview and evaluate procedures for creating Unix or Linux user accounts and ensure that accounts are created only when there's a legitimate business need. Also review and evaluate processes for ensuring that accounts are removed or disabled in a timely fashion in the event of termination or job change.

2. qEnsure that all UID's in the password file(s) are unique.

3. qEnsure that passwords are shadowed and use strong hashes where possible.

4. qEvaluate the file permissions for the password and shadow password files.

5. qReview and evaluate the strength of system passwords.

6. qEvaluate the use of password controls such as aging.

7. 7. Review the process used by the system administrator(s) for setting initial passwords for new users and communicating those passwords.

8. qEnsure that each account is associated with and can be traced easily to a specific employee.

9. 9. Ensure that invalid shells have been placed on all disabled accounts.

10. qReview and evaluate super user (root-level) access.

11. 11. Review and evaluate the use of groups, and determine the restrictiveness of their use.

12. qEvaluate the use of passwords at the group level.

13. 13. Review and evaluate the security of directories in the default path used by the system administrator when adding new users. Evaluate the use of the "current directory" in the path.

14. qReview and evaluate the security of directories in root's path. Evaluate the use of the "current directory" in the path.

15. 15. Review and evaluate the security of user home directories and config files. They generally should be writable only by the owner.

Auditing File Security and Controls

Checklist for Auditing File Security and Controls

1. qEvaluate the file permissions for a judgmental sample of critical files and their related directories.

2. qLook for open directories (directories with permission set to drwxrwxrwx) on the system, and determine whether they should have the sticky bit set.

3. qEvaluate the security of all SUID files on the system, especially those that are SUID to "root."

4. qReview and evaluate security over the kernel.

5. qEnsure that all files have a legal owner in the /etc/passwd file.

6. qEnsure the chown command cannot be used by users to compromise user accounts.

7. qObtain and evaluate the default umask value for the server.

8. qExamine the system's crontabs, especially root's, for unusual or suspicious entries.

9. qReview the security of the files referenced within crontab entries, particularly root's. Ensure that the entries refer to files that are owned by and writable only by the owner of the crontab. Also ensure that no crons are being run from open directories (permissions set to drwxrwxrwx).

10. qExamine the system's scheduled atjobs for unusual or suspicious entries.

Auditing Network Security and Controls

Checklist for Auditing Network Security and Controls

1. qDetermine what network services are enabled on the system, and validate their necessity with the system administrator. For necessary services, review and evaluate procedures for assessing vulnerabilities associated with those services and keeping them patched.

2. qExecute a network vulnerability-scanning tool in order to check for current vulnerabilities in the environment.

3. qReview and evaluate the use of trusted access via the /etc/hosts .equiv file and user .rhosts files. Ensure that trusted access is not used or, if deemed to be absolutely necessary, is restricted to the extent possible.

4. qIf anonymous FTP is enabled and genuinely needed, ensure that it is locked down properly.

5. qIf NFS is enabled and genuinely needed, ensure that it is secured properly.

6. qReview for the use of secure protocols.

7. qReview and evaluate the use of .netrc files.

8. qEnsure that a legal warning banner is displayed when connecting to the system.

9. qReview and evaluate the use of modems on the server.

Auditing Audit Logs

Checklist for Auditing Audit Logs

1. qReview controls for preventing direct "root" logins.

2. qReview the su and sudo command logs to ensure that when these commands are used, they are logged with the date, time, and user who typed the command.

3. qEvaluate the syslog in order to ensure that adequate information is being captured.

4. qEvaluate the security and retention of the wtmp log, sulog, syslog, and any other relevant audit logs.

5. qEvaluate security over the utmp file.

Auditing Security Monitoring and Other Controls

Checklist for Auditing Security Monitoring and Other Controls

1. qReview and evaluate system administrator procedures for monitoring the state of security on the system.

2. qIf you are auditing a larger Unix/Linux environment (as opposed to one or two isolated systems), determine whether there is a standard build for new systems and whether that baseline has adequate security settings. Consider auditing a system freshly created from the baseline.

3. qPerform steps from Chapter 4 as they pertain to the system you are auditing.