nmap foo.example.com

Interesting ports on foo.example.com:
Not shown: 1710 filtered ports
PORT    STATE  SERVICE
22/tcp  open   ssh
53/tcp  open   domain
80/tcp  open   http
113/tcp closed auth

/sbin/grub-md5-crypt

password --md5 <password-hash>

title DOS lock

title DOS lock password --md5 <password-hash>

chage -M 90 <username>

chage <username>

[root@myServer ~]# chage davido 
Changing the aging information for davido 
Enter the new value, or press ENTER for the default 
Minimum Password Age [0]: 10
Maximum Password Age [99999]: 90 
Last Password Change (YYYY-MM-DD) [2006-08-18]: 
Password Expiration Warning [7]: 
Password Inactive [-1]: 
Account Expiration Date (YYYY-MM-DD) [1969-12-31]: 
[root@myServer ~]#

Figura 2.1. Especificando as opções de expiração de senha

echo > /etc/securetty

PermitRootLogin yes

PermitRootLogin no

kill -HUP `cat /var/run/sshd.pid`

auth required /lib/security/pam_listfile.so item=user \ 
sense=deny file=/etc/vsftpd.ftpusers onerr=succeed

usermod -G wheel <username>

Figura 2.2. Adicionando usuários ao grupo "wheel".

auth  required /lib/security/$ISA/pam_wheel.so use_uid

sudo <command>

juan ALL=(ALL) ALL

%users localhost=/sbin/shutdown -h now

220-Hello, %c 
220-All activity on ftp.example.com is logged.
220-Inappropriate use will result in your access privileges being removed.

 vsftpd : ALL : banners /etc/banners/ 

 ALL : 206.182.68.0 : spawn /bin/echo `date` %c %d >> /var/log/intruder_alert 

 in.telnetd : ALL : severity emerg 

flags           = SENSOR

deny_time       = 30

disable         = no

mkdir /var/ftp/pub/upload

chmod 730 /var/ftp/pub/upload

drwx-wx---    2 root     ftp          4096 Feb 13 20:05 upload

anon_upload_enable=YES

ALL: .example.com EXCEPT cracker.example.com

ALL EXCEPT vsftpd: 192.168.0.

sshd : .example.com : severity emerg

sshd : .example.com : severity local0.alert

sshd : client-1.example.com : allow
sshd : client-2.example.com : deny

sshd : .example.com  \
	: spawn /bin/echo `/bin/date` access denied to %h>>/var/log/sshd.log \
	: deny

vsftpd : .example.com \
: twist /bin/echo "421 %h has been banned from this server!"

service telnet
{
	 disable         = no
	 flags           = REUSE
	 socket_type     = stream
	 wait            = no
	 user            = root
	 server          = /usr/kerberos/sbin/telnetd
	 log_on_failure  += USERID
	 no_access       = 172.16.45.0/24
	 log_on_success  += PID HOST EXIT
	 access_times    = 09:45-16:15
}

Conexão fechada por um host externo.

Sep  7 14:58:33 localhost xinetd[5285]: FAIL: telnet address from=172.16.45.107
Sep  7 14:58:33 localhost xinetd[5283]: START: telnet pid=5285 from=172.16.45.107
Sep  7 14:58:33 localhost xinetd[5283]: EXIT: telnet status=0 pid=5285 duration=0(sec)

service telnet
{
	 socket_type		= stream
	 wait			= no
	 server			= /usr/kerberos/sbin/telnetd
	 log_on_success		+= DURATION USERID
	 log_on_failure		+= USERID
	 bind                    = 123.123.123.123
	 redirect                = 10.0.1.13 23
}