UNDERCODE COMMUNITY

"i" attribute file cannot be changed: it cannot be deleted or renamed, and this file cannot be created Cannot write data to this file. Only the system administrator can set and clear this attribute. If you want to change the inetd.conf file, you must first clear the flag that does not allow changes:

[root@deep]# chattr -i /etc/inetd.conf

but for things like sendmail, Named, www and other services, because they are not like finger, telnet and other services, when the request comes, the inet daemon starts the corresponding process to provide services, but runs as a daemon when the system starts. For redhat linux, a linuxconfig command is provided, through which you can interactively set whether to run related services at startup under the graphical interface. You can also use commands to set whether to start a service at startup, such as: [root@deep]# chkconfig -level 35 named off.

/etc/hosts.allow file

However, if telnet, ftp and other services are shut down together, it is very inconvenient for the administrator to need remote management. Linux provides another more flexible and effective method to limit the service request users, so that on the basis of ensuring security, trusted users can use various services. Linux provides a program called TCP wrapper. This program is installed by default in most releases. With TCP wrapper you can restrict access to certain services mentioned earlier. And the TCP wrapper log file records all attempts to access your system. By viewing the log of the program through the last command, the administrator can know who has or attempted to connect to your system.

In the /etc directory, there are two files: hosts.deny hosts.allow By configuring these two files, you can specify which machines can use these services and which can not use these services.

/etc/services file

The correspondence between port numbers and standard services is defined in detail in RFC 1700 "Assigned Numbers". The "/etc/services" file enables the server and client programs to convert the name of the service into a port number. This table exists on every host and its file name is "/etc/services". Only the "root" user has the authority to modify this file, and under normal circumstances this file is not necessary to modify, because this file already contains the port number corresponding to the commonly used services. In order to improve security, we can add protection to this file to avoid unauthorized deletion and change. To protect this file, use the following command:

[root@deep]# chattr +i /etc/services

/etc/securetty file The

"/etc/securetty" file allows you to specify that the "root" user can log in from that TTY device. The login program (usually "/bin/login") needs to read the "/etc/securetty" file. Its format is: the listed tty devices are allowed to log in, and comments or those that do not exist in this file do not allow root login.

/etc/inittab file

Comment out a line in the file to disable Control-Alt-Delete from shutting down the computer. If the server is not placed in a safe place, this is very important.

Edit the inittab file (vi /etc/inittab) and change this line:

　ca::ctrlaltdel:/sbin/shutdown -t3 -r now

to:

#ca::ctrlaltdel:/sbin/shutdown -t3 -r now

Use the following command to make the changes take effect:

[root@deep]# /sbin/init q

/etc/rc.d/init.d/

/etc/rc. The script under d/init.d/ mainly contains the script program to start the service. There is no need for the average user to know the contents of the script file. So the permissions of these script files should be changed.

　　[root@deep]# chmod -R 700 /etc/rc.d/init.d/*

This way, only root can read, write, and execute scripts in this directory.

written by Undercode
▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

180 views18:10