Reduce risk and simplify maintenance via minimal installs

Computerworld - Bob, IT director: Joe, did you see the latest warnings from CERT today? There's a BIG security hole in one of the X Windows programs. I think it was "xterm." Yikes! We've got 50 servers sitting on the Net! And, I saw something about a service called "comsat," whatever that is.

Joe, system administrator: No, I didn't get to it yet. No big deal though.

Bob: What? The advisory said that anyone can use some exploits that are all over the Net to get root access on any box! Isn't that bad?

Joe: Yeah, it's very bad. But don't worry, we're covered.

Bob: How so?

Joe: I took care of this over a year ago. None of our 50 servers ever needed the X Windows software. So, I never installed it. It's a little hard to exploit something that doesn't exist. As for the comsat service, I disabled that the minute I set up the boxes. It's not necessary to run a "new e-mail" notification service on a server that no one uses directly.

Bob: So, no xterm program on the server, no exploit? No comsat service running, no hole?

Joe: Neat, eh?

As Joe could tell you, by eliminating unnecessary software and services, you can increase the security of your systems and potentially reduce the pain you have to endure when security exploits abound. To do this effectively, you must know your operating system and software products intimately, what each and every program does, and what you can eliminate or configure to avoid security exploits.

Minimize, Disable and Tighten

By knowing all that you can about the software you're using, from operating systems to applications, you can customize and tailor installations to include only the pieces you actually need. If you understand the intricacies of your operating system and software packages, you can go further and disable those pieces that you are forced to install but don't actually need. Lastly, you can go even further and tightly configure the software that you need to install in such a way that it is less likely to be compromised.

Here are some examples:

• Minimize your operating system: Many Internet servers need only 20 or so of the over 100 modules available in Solaris. This is true of Linux as well.






• Minimize your applications: Most Internet servers just don't need X Windows (perhaps one in 100 servers do).






• Disable services: Disable RPC daemons when possible; many servers don't require them.






• Tighten configurations: Restrict MySQL access to the local machine only (using its Unix domain socket support), if you can.