 |
 |
 |
 |
 |
 |
 |
|||||
Netscape Enterprise Server DetailsCreate an Unprivileged User for the Web Server DaemonOne easy way to reduce your exposure to attack when running a web server is to create a unique unprivileged userid and group for the server application. The userid/group nobody is frequently used for this purpose, but it can be used by other services, thus introducing another vulnerability. Use the following command line entries as patterns for creating the unprivileged group and user account: groupadd httpdTo make sure the user account you created can't be used to log on, check /etc/shadow. The password field for the httpd user should contain the entry *LK*, indicating that the account is locked and cannot be used to log in. httpd:*LK*::::::: Install the Administration ServerNetscape provides an installation script for installing the Enterprise Administration server. To start the installation process, execute the ns-setup script provided with the distribution. You will be prompted to provide the following configuration information for the Administration server.
Install the Web ServerTo make your Web server more secure, use a separate disk partition for your Web content. Create a unique mount point for this directory: htdocs is a good name to use, but make it outside the application directory. You'll need to update /etc/vfstab to mount this partition as part of the server boot process. This directory must exist and be mounted before you create the Web server. From a browser on a remote machine, go to http://servername:port/, using the servername and port defined above. Select the "Create New Netscape Enterprise Server 3.0" hyperlink. Complete the configuration form as outlined.
Set Directory and File PermissionsThe Netscape Enterprise Server installation script sets the file and directory permissions that are required for proper operation of the server. We cannot change some of these Netscape permissions. Because the Enterprise Server uses the Admin interface for defining configuration settings, it uses internal access control mechanisms outside of UNIX file permissions (the Admin user is defined during installation). However, we still need to define additional access privileges for the Web server and related files. We can break users into three groups. These groups are based on functional roles:
The following matrix lists permissions for each relevant directory by group role. This matrix is based in part on recommendations provided in Lincoln Stein's Web Security. Note that you will have to add some individuals to multiple groups to provide the required levels of access.
NOTE: In Web Security Lincoln Stein recommends using mode 2xxx (i.e., setting the SGID bit) for some server directories. His point is that this makes file and directory sharing easier for members of the groups involved in maintaining parts of the server. We followed his recommendations for the server's cgi-bin and Document Root directories, but users will still have to manually change file permissions to allow group write/execute permissions on any new files added to these directories. We do not feel it is appropriate to change the users' UMASK value to automatically allow group write access on files. Configure the Web ServerTo configure the Web server, select the "Configure your server further" hyperlink immediately after installing the Web server, or, from the Admin server main page, select the button identifying your server name. Discussion of all of the possible configuration options is beyond the scope of this document. Listed below are server security–related options, categorized by the Netscape administration headings.
Delete Unneeded HTML DocumentsRemove all non-essential files from the directories under the Document Root directory. It takes only a small error to cause your server to provide a listing of the files in a directory to a browser. If you've developed the habit of leaving files in the directories within your Document Root directory tree, thinking that they can't be accessed if they're not linked to some document, that one small mistake can lead to an unauthorized disclosure. A freshly installed Web server is the best time to start developing good file discipline. Delete Unneeded CGI ScriptsInstall only those CGI scripts you have tested and found safe. At least one of the commonly distributed scripts, pfh, has been used to compromise several Web servers. You should require that all CGI scripts be run only from your strictly controlled cgi-bin directory, and you should not allow not the use of shell scripts. Restrict Remote OperationsPermission to add files to a directory using FTP's PUT is controlled by file and directory permissions. The default configuration we specify will allow anyone in the webauth group to FTP files into your Document Root directory tree. HTTP POST is controlled by turning on Web Publishing and setting up ACLs from within the Enterprise Server Admin interface. Read the vendor documentation for complete details. Configure Server AuditingAuditing is set up by default for both the Admin and Web servers. Configure Access Control and AuthenticationAccess control and authentication are configured via the Admin interface. The details of setting up access control and authentication are available in the vendor documentation. Provide a Security BannerUse the following as an example: ###################################################################### This system is intended for authorized users only. Activity on this system is monitored and recorded. If monitoring reveals activities exceeding privileges, attempts to penetrate system security, or possible criminal activity, system personnel may provide evidence of such activity to law enforcement officials. If you continue past this point, you consent to this monitoring. ###################################################################### |
Our Publications |
