From shawn at redhat.com Thu Aug 20 11:31:10 2015 Content-Type: multipart/mixed; boundary="===============7821182622988327610==" MIME-Version: 1.0 From: Shawn Wells To: scap-security-guide at lists.fedorahosted.org Subject: Re: [PATCH 1/2] added rationale to base services guidance * moved some service discussion elsewhere Date: Mon, 04 Jun 2012 11:15:37 -0400 Message-ID: <4FCCD119.4080302@redhat.com> In-Reply-To: 1338821984-28920-2-git-send-email-blank@eclipse.ncsc.mil --===============7821182622988327610== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable On 6/4/12 10:59 AM, Jeffrey Blank wrote: > Signed-off-by: Jeffrey Blank > --- > rhel6/src/input/services/base.xml | 516 ++++++++++++++++--------------= ------- > 1 files changed, 226 insertions(+), 290 deletions(-) > > diff --git a/rhel6/src/input/services/base.xml b/rhel6/src/input/services= /base.xml > index 259037e..ab6ddf1 100644 > --- a/rhel6/src/input/services/base.xml > +++ b/rhel6/src/input/services/base.xml > @@ -1,20 +1,25 @@ > > Base Services > -This section addresses the base services that are installed= on a RHEL 6 default installation. > -Some of these services listen on the network and should be treated with = particular discretion. The other > -services are local system utilities that may or may not be extraneous. E= ach of these services should be > -disabled if not required. > - > +This section addresses the base services that are installed= on a > +RHEL 6 default installation which are not covered in other > +sections. Some of these services listen on the network and > +should be treated with particular discretion. Other services are local > +system utilities that may or may not be extraneous. In general, system s= ervices > +should be disabled if not required. > > > Disable Automatic Bug Reporting Tool (abrtd) > -The Automatic Bug Reporting Tool (abrtd) is a daemon that c= ollects and reports crash data > -when an application crash is detected. Using a variety of plugins abrtd = can email crash reports to system > -administrators, log crash reports to files, or forward crash reports to = a centralized issue tracking > -system such as RHTSupport. Mishandling crash data exposes sensitive info= rmation about vulnerablities in > -software executing on the local machine. For most deployments this daemo= n should be disabled. > +The Automatic Bug Reporting Tool (abrtd) daemon co= llects > +and reports crash data when an application crash is detected. Using a va= riety > +of plugins, abrtd can email crash reports to system administrators, log = crash > +reports to files, or forward crash reports to a centralized issue tracki= ng > +system such as RHTSupport. Theabrtd service can be disabled w= ith the > +following command: >
# chkconfig abrtd off
>
> + Mishandling crash data could expose sensitive information a= bout > +vulnerablities in software executing on the local machine, as well as se= nsitive > +information from within a process's address space or registers. > > > > @@ -23,11 +28,16 @@ software executing on the local machine. For most dep= loyments this daemon should > > > Disable Advanced Configuration and Power Interface (acpid)</titl= e> > -<description>The Advanced Configuration and Power Interface Daemon (acpi= d) dispatches ACPI events (such > -as power/reset button depressed) to userspace programs. Unless trapping = ACPI events is a requirement > -on the local system this daemon should be disabled. > +<description>The Advanced Configuration and Power Interface Daemon (<tt>= acpid</tt>) > +dispatches ACPI events (such as power/reset button depressed) to userspa= ce > +programs. The<tt>acpid</tt> service can be disabled with the following > +command: > <pre># chkconfig acpid off</pre> > </description> > +<rationale>ACPI support is highly desirable for systems in some network = roles, > +such as laptops or desktops. For other systems, such as servers, it may= permit > +accidental or trivially achievable denial of service situations and disa= bling > +it may be prudent.</rationale> > <ident cce=3D"4298-6" /> > <oval id=3D"service_acpid_disabled" /> > <ref nist=3D"CM-6, CM-7" /> > @@ -36,84 +46,55 @@ on the local system this daemon should be disabled. > > <Rule id=3D"service_atd_disabled"> > <title>Disable At Service (atd) > -Theat andbatch commands can be used to = schedule tasks that are meant > -to be executed only once (similar to cron but not recurring). The daemon= atd keeps track of > -tasks scheduled viaat andbatch and executes them at = the specified time. Unless > -scheduling tasks withat orbatch is a requirement for= the local machine this > -daemon should be disabled. > +Theat andbatch commands can be used to > +schedule tasks that are meant to be executed only once. This allows del= ayed > +execution in a manner similar to cron, except that it is not > +recurring. The daemonatd keeps track of tasks scheduled via > +at andbatch, and executes them at the specified time.= The > +atd service can be disabled with the following command: >
# chkconfig atd off
>
> + > +Theatd service could be used by an unsophisticated insider to = carry > +out activities outside of a normal login session, which could complicate > +accountability. Furthermore, the need to schedule tasks withat= or > +batch is not common. > + > > > >
> > > - > -Enable Audit Service (auditd) > -The audit service is provided for system auditing. By defau= lt > -the service audits SELinux AVC denials and certain types of security-rel= evant > -events such as system logins, account modifications, and authentication = events > -performed by programs such as sudo. Unless there is another service that= will > -be used for system auditing it is recommended that auditd be enabled. > -
# chkconfig auditd on
> -
> - > - > - > -
> - > - > -Bluetooth > -Bluetooth provides a way to transfer information between de= vices such as mobile phones, laptops, PCs, printers, digital cameras, and v= ideo game consoles over a short-range wireless link. Any wireless communica= tion presents a serious security risk to sensitive or classified systems. > -Removal of hardware is the only way to ensure that the Bluetooth wireles= s capability remains disabled. If it is completely impractical to remove th= e Bluetooth hardware module, and site policy still allows the device to ent= er sensitive spaces, every effort to disable the capability via software sh= ould be made. In general, acquisition policy should include provisions to p= revent the purchase of equipment that will be used in sensitive spaces and = includes Bluetooth capabilities. > - > - > - > -Bluetooth Host Controller Interface Daemon (bluetooth) > -If the system requires no Bluetooth devices, disable this s= ervice: > -
# chkconfig bluetooth off
> -
> - > - > - > -
> - > - > -Disable Bluetooth Kernel Modules > -The kernel=C3=A2=E2=82=AC=E2=84=A2s module loading system c= an be configured to prevent loading of the Bluetooth module. Add the follo= wing to/etc/modprobe.conf to prevent the loading of the Bluetooth= module: > -
alias net-pf-31 off
> -alias bluetooth off
> -
> - > - > - > -
> - > -
> - > > Disable Certmonger Service (certmonger) > Certmonger is a D-Bus based service that attempts to simpl= ify interaction > with certifying authorities on networks which use public-key infrastruc= ture. It is often > combined with Red Hat's IPA (Identity Policy Audit) security informatio= n management > -solution to aid in the management of certificates. Unless IPA is used to= help administer > -the LAN this service should be disabled. > +solution to aid in the management of certificates. > +Thecertmonger service can be disabled with the following comma= nd: >
# chkconfig certmonger off
>
> +The services provided by certmonger may be essential for syst= ems > +fulfilling some roles a PKI infrastructure, but its functionality is not= necesssary > +for many other use cases. > > > >
> > + > > Disable Control Group Config (cgconfig) > Control groups allow an administrator to allocate system r= esources (such as CPU, > memory, network bandwidth, etc) among a defined group (or groups) of pr= ocesses executing on > -a system. The cgconfig daemon starts at boot and establishes the predefi= ned control groups. > -Unless control groups are used to manage system resources this service s= hould be disabled. > +a system. Thecgconfig daemon starts at boot and establishes th= e predefined control groups. > +Thecgconfig service can be disabled with the following command: >
# chkconfig cgconfig off
>
> +Unless control groups are used to manage system resources, ru= nning the cgconfig > +service is not necessary. > + > > > > @@ -122,10 +103,13 @@ Unless control groups are used to manage system res= ources this service should be > > Disable Control Group Rules Engine (cgred) > Thecgred service moves tasks into control groups= according to > -parameters set in the/etc/cgrules.conf configuration file. Lik= e the cgconfig service, > -if control groups are not needed to manage system resources then this se= rvice should be disabled. > +parameters set in the/etc/cgrules.conf configuration file. > +Thecgred service can be disabled with the following command: >
# chkconfig cgred off
>
> +Unless control groups are used to manage system resources, ru= nning the cgred service > +service is not necessary. > + > > > > @@ -134,92 +118,51 @@ if control groups are not needed to manage system r= esources then this service sh > > Disable CPU Speed (cpuspeed) > Thecpuspeed service can adjust the clock speed o= f supported CPUs based upon > -the current processing load thereby conserving power and reducing heat. = This service is most often > -used on laptops where battery life is a concern. Unless laptop battery p= erformance is a requirement > -this service should be disabled. > +the current processing load thereby conserving power and reducing heat. > +Thecpuspeed service can be disabled with the following command: >
# chkconfig cpuspeed off
>
> +Thecpuspeed service is only necessary if adjusting = the CPU clock speed > +provides benefit. Traditionally this has included laptops (to enhance b= attery life), > +but may also apply to server or desktop environments where conserving po= wer is > +highly desirable or necessary. > + > > > >
> > > - > -Enable Cron (crond) > -The crond service is used to execute commands at preconfigu= red times. > -The cron daemon is required by almost all systems to perform necessary m= aintenance > -tasks. The daemon should be configured defensively. > -
# chkconfig crond on
> -
> - > - > - > -
> - > - > - > -Disable Common Unix Printing System (cups) > -The Common Unix Printing System (CUPS) allows a machine to = interact with > -attached printers. If the machine does not require print services and is= not serving > -as a print server then this service should be disabled. > -
# chkconfig cups off
> -
> - > - > - > -
> - > > Disable Hardware Abstraction Layer Service (haldaemon) > -As its name implies, the Hardware Abstraction Layer Daemon = (haldaemon) collects > -and maintains information about the system's hardware configuration. A l= ist of live devices > -is provided via D-Bus messaging. Please note that this service is requir= ed on a workstation > -running a desktop environment. If a desktop environment is not needed th= en this service can > -be disabled. > +The Hardware Abstraction Layer Daemon (haldaemon) = collects > +and maintains information about the system's hardware configuration. > +This service is required on a workstation > +running a desktop environment, and may be necessary on any system which > +deals with removable media or devices. > +Thehaldaemon service can be disabled with the following > +command: >
# chkconfig haldaemon off
>
> +The haldaemon provides essential functionality on systems > +that use removable media or devices, but can be disabled for systems > +that do not require these. > + > > > >
> > - > -Enable Ip6tables (ip6tables) > -The kernel distributed with RHEL 6 comes with Netfilter's p= acket filtering framework. The > -framework has the ability to filter IPv6 packets. Firewall configuration= can be administered with the > -ip6tables command line tool. The ip6tables service applies IPv= 6 firewall rules during system boot > -and can be used to save the current ip6tables ruleset via/sbin/servi= ce ip6tables save. If IPv6 > -networking is enabled on the local machine then this service should be e= nabled. > -
# chkconfig ip6tables on
> -
> - > - > - > -
> - > - > -Enable Iptables (iptables) > -The kernel distributed with RHEL 6 comes with Netfilter's p= acket filtering framework. The > -framework has the ability to filter IPv4 packets. Firewall configuration= can be administered with the > -iptables command line tool. The iptables service applies IPv4 = firewall rules during system boot > -and can be used to save the current iptables ruleset via/sbin/servic= e iptables save. If IPv4 > -networking is enabled on the local machine then this service should be e= nabled. > -
# chkconfig iptables on
> -
> - > - > - > -
> > > Enable IRQ Balance (irqbalance) > -The goal of the irqbalance service is to optimize the balan= ce between > +Theirqbalance service optimizes the balance betwe= en > power savings and performance through distribution of hardware interrup= ts across > -multiple processors. In a server environment with multiple processors, t= his provides > -a useful service and should be left enabled. > +multiple processors. Theirqbalance service can be enabled wit= h the following command: >
# chkconfig irqbalance on
>
> +In an environment with multiple processors (now common), the = irqbalance service > +provides potential speedups for handling interrupt requests. > > > > @@ -227,40 +170,49 @@ a useful service and should be left enabled. > > > Disable KDump Kernel Crash Analyzer (kdump) > -Kdump is a new kernel crash dump analyzer. It uses kexec to= boot a > -secondary kernel (=C3=A2=E2=82=AC=C5=93capture=C3=A2=E2=82=AC=C2=9D kern= el) following a system crash. The kernel dump > -from the system crash is loaded into the capture kernel for analysis. Un= less the > -system is used for kernel development or testing, disable the service: > +Thekdump service provides a kernel crash dump ana= lyzer. It uses thekexec > +system call to boot a secondary kernel ("capture" kernel) following a sy= stem > +crash, which can load information from the crashed kernel for analysis. = To > +disable thekdump service, run the following command: >
# chkconfig kdump off
>
> +Unless the system is used for kernel development or testing, = there > +is little need to run the kdump service. > > > >
> > + > > > Disable Software RAID Monitor (mdmonitor) > The mdmonitor service is used for monitoring a software RA= ID (hardware > -RAID setups do not use this service). This service is extraneous unless = software > -RAID is in use (which is not common). If software RAID monitoring is not= required, > -disable this service: > +RAID setups do not use this service). > +Themdmonitor service can be disabled with the following comman= d: >
# chkconfig mdmonitor off
>
> +If software RAID monitoring is not required (and it is uncomm= on), > +there is no need to run the service. > > > > @@ -269,15 +221,19 @@ disable this service: > > > Disable D-Bus IPC Service (messagebus) > -D-Bus is an IPC mechanism that provides a common channel fo= r inter-process communication. > -A number of default services make use of D-Bus, including X Windows, Blu= etooth, and Avahi. This guide > -recommends that D-Bus and all its dependencies be disabled unless there = is a mission-critical need > -for them. Stricter configuration of D-Bus is possible and documented in = the man page dbus-daemon(1). > -D-Bus maintains two separate configuration files, located in /etc/dbus-1= /, one for system-specific > -configuration and the other forsession-specific configuration. If no ser= vices which require D-Bus > -are in use, disable this service: > +D-Bus provides an IPC mechanism used by > +a growing list of programs, such as those used for Gnome, Bluetooth, and= Avahi. > +Due to these dependencies, disabling D-Bus may not be practical for > +many systems. > +Themessagebus service can be disabled with the following comma= nd: >
# chkconfig messagebus off
>
> +If no services which require D-Bus are needed, then it > +can be disabled. As a broker for IPC between processes of different priv= ilege levels, > +it could be a target for attack. However, disabling D-Bus is likely to = be > +impractical for any system which needs to provide > +a graphical login session. > + > > > > @@ -285,13 +241,16 @@ are in use, disable this service: > > > Disable Network Console (netconsole) > -The netconsole service is responsible for loading the netco= nsole kernel > -module which logs kernel printk messages over UDP to a syslog server. Th= is allows > -debugging of problems where disk logging fails and serial consoles are i= mpractical. > -This service should not be needed unless you need to debug kernel panics= . In general > -this service should be disabled. > +Thenetconsole service is responsible for loading = the > +netconsole kernel module, which logs kernel printk messages over UDP to a > +syslog server. This allows debugging of problems where disk logging fail= s and > +serial consoles are impractical. Thenetconsole service can be > +disabled with the following command: >
# chkconfig netconsole off
>
> +Thenetconsole service is not necessary unless there= is a need to debug > +kernel panics, which is not common. > + > > > > @@ -301,53 +260,52 @@ this service should be disabled. > > Enable Network (network) > The network service is made up of a series of scripts and = configuration > -files that are used to configure network interfaces upon system boot. If= the system > -does not need any sort of networking then this service can be disabled. = Otherwise, > -this service can be left enabled. > +files that are used to configure network interfaces upon system boot. It= is very > +unusual for a system to not need any sort of networking. > +Thenetwork service can be activated with the following command: >
# chkconfig network on
>
> +Ensuring automatic activation of the network service at boot = helps > +speed recovery and reduce confusion following a system crash and subsequ= ent > +reboot. > > > >
> > > - > -Enable Network Time Protocol (ntpd) > -The Network Time Protocol is used to manage the system cloc= k over a network. > -Computer clocks are not very accurate, so time will drift on unmanaged s= ystems. Central > -time protocols can be used both to ensure that time is consistent among = a network of > -machines, and that their time is consistent with the outside world. It i= s recommended > -to leave this service enabled. > -
# chkconfig ntpd on
> -
> - > - > - > -
> - > - > -Disable Network Time Protocol (ntpdate) > -The ntpdate service sets the local hardware clock by pollin= g NTP servers. The > -service is executed once when the system boots. It synchronizes to the N= TP servers listed in > -/etc/ntp/step-tickers (or /etc/ntp.conf if there are no NTP servers defi= ned in > -/etc/ntp/step-tickers) and then sets the local hardware clock to the new= ly synchronized > -system time. This service is best suited for workstations which are rebo= oted more often than > -servers. For these kinds of workstations, a clock synchronization upon s= ystem boot would be > -sufficient. For servers it is generally recommended to enable the ntpd s= ervice. > -
# chkconfig ntpdate on
> + > +Disable ntpdate Service (ntpdate) > +The ntpdate service sets the local hardware clock by pollin= g NTP servers > +when the system boots. It synchronizes to the NTP servers listed in > +/etc/ntp/step-tickers or/etc/ntp.conf > +and then sets the local hardware clock to the newly synchronized > +system time. > +Thentpdate service can be disabled with the following command: > +
# chkconfig ntpdate off
>
> +Thentpdate service may only be suitable for systems= which > +are rebooted frequently enough that clock drift does not cause problems = between > +reboots. In any event, the functionality of the ntpdate service is now > +available in the ntpd program and should be considered deprecated. > > - > + > >
> > > Disable Odd Job Daemon (oddjobd) > -The oddjobd service runs specified privileged tasks for unp= rivileged client > -applications which communicate with it through the system message bus. > +Theoddjobd service exists to provide an interface= and > +access control mechanism through which > +specified privileged tasks can run tasks for unprivileged client > +applications. Communication withoddjobd through the system me= ssage bus. > +Theoddjobd service can be disabled with the following command: >
# chkconfig oddjobd off
>
> +Theoddjobd service may provide necessary functional= ity in > +some environments but it can be disabled if it is not needed. Execution = of > +tasks by privileged programs, on behalf of unprivileged ones, has tradit= ionally > +been a source of privilege escalation security issues. > > > > @@ -356,9 +314,15 @@ applications which communicate with it through the s= ystem message bus. > > > Disable Portreserve (portreserve) > -The portreserve service is a TCP port reservation utility t= hat can be used to prevent portmap from binding to well known TCP ports tha= t are required for other services. This service is one of several services = required for remote procedure calls between systems. Disable this service u= nless it is specifically required. > +Theportreserve service is a TCP port reservation = utility that can > +be used to prevent portmap from binding to well known TCP ports that are > +required for other services. > +Theportreserve service can be disabled with the following comm= and: >
# chkconfig portreserve off
>
> +Theportreserve service provides helpful functionali= ty by > +preventing conflicting usage of ports in the reserved port range, but it= can be > +disabled if not needed. > > > > @@ -366,41 +330,39 @@ applications which communicate with it through the = system message bus. > > > > - > -Enable Postfix (postfix) > -The Postfix mail transfer agent is used for local mail deli= very within > -the system. The default configuration only listens for connections to th= e default SMTP > -port (port 25) on the loopback interface (127.0.0.1). It is recommended = to leave this > -service enabled for local mail delivery. > -
# chkconfig postfix on
> -
> - > - > - > -
> - > - > > Enable Process Accounting (psacct) > -The process accounting service (psacct) is an auditing tool= that allows system > -administrators to log user activity and view every command issued by use= rs of the system. It > -is recommended that this service be configured and enabled. > +The process accounting service (psacct) works with= programs > +includingacct andac to allow system administrators t= o view > +user activity, such as commands issued by users of the system. The > +psacct service can be enabled with the following command: >
# chkconfig psacct on
>
> +Thepsacct service can provide administrators a conv= enient > +view into some user activities. However, it should be noted that the au= diting > +system and its audit records provide more authoritative and comprehensive > +records. > > > >
> > + > > Disable Quota Netlink (quota_nld) > -The quota netlink service listens to the kernel via a netli= nk socket for disk quota > -violations and notifies the appropriate user of the violation using D-Bu= s or by sending a message > -to the terminal that the user has last accessed. If disk quotas are enfo= rced on the local system > -then this service should be enabled. If disk quotas are not used or noti= fication of disk quota > -violations are not desired then disable this service. > +Thequota_nld service provides notifications to > +users of disk space quota violations. It listens to the kernel via a ne= tlink > +socket for disk quota violations and notifies the appropriate user of the > +violation using D-Bus or by sending a message to the terminal that the u= ser has > +last accessed. > +Thequota_nld service can be disabled with the following comman= d: >
# chkconfig quota_nld off
>
> +If disk quotas are enforced on the local system, then the > +quota_nld service likely provides useful functionality and sho= uld > +remain enabled. However, if disk quotas are not used or user notificati= on of > +disk quota violation is not desired then there is no need to run this > +service. > > > > @@ -409,44 +371,35 @@ violations are not desired then disable this servic= e. > > > Disable Network Router Discovery Daemon (rdisc) > -The rdisc daemon implements the client side of the ICMP Int= ernet Router Discovery > -Protocol (IRDP). The daemon can be used to discover routers on the local= subnet. If a router > -is discovered then the local routing table is updated with a correspondi= ng default route. By > -default this daemon is disabled and it should remain disabled. Servers s= hould have their network > -and routing information configured by a system administrator in correspo= ndence with the local > -network management policy. Workstations should use DHCP if they require = dynamic network > -configuration information. > +Therdisc service implements the client side of th= e ICMP > +Internet Router Discovery Protocol (IRDP), which allows discovery of rou= ters on > +the local subnet. If a router is discovered then the local routing table= is > +updated with a corresponding default route. By default this daemon is d= isabled. > +Therdisc service can be disabled with the following command: >
# chkconfig rdisc off
>
> +General-purpose systems typically have their network and rout= ing > +information configured statically by a system administrator. Workstatio= ns or > +some special-purpose systems often use DHCP (instead of IRDP) to retrieve > +dynamic network configuration information. > > > >
> > > - > -Enable Restore SELinux Context Service (restorecond) > -The restorecond service utilizes inotify to look for the cr= eation of new files > -listed in the /etc/selinux/restorecond.conf configuration file. Once the= file is created, > -restorecond ensures that the file receives the proper SELinux security c= ontext. It is > -recommended that this service be enabled. > -
# chkconfig restorecond on
> -
> - > - > - > -
> - > - > > -Disable Red Hat Update Agent (rhnsd) > -The Red Hat Update Agent is a network aware application tha= t automatically > -queries Red Hat Network servers to determine which packages need to be u= pdated on your > -machine. More than likely this would be an undesired behavior on product= ion systems > -where patches must be tested before application. It is recommended to di= sable this > -service and perform patching in accordance with local configuration mana= gement policy. > +Disable Red Hat Network Service (rhnsd) > +The Red Hat Network service automatically queries Red Hat N= etwork > +servers to determine whether there are any actions that should be execut= ed, > +such as package updates. This only occurs if the system was registered = to an > +RHN server or satellite and managed as such. Therhnsd service= can be > +disabled with the following command: >
# chkconfig rhnsd off
>
> +Although systems management and patching is extremely importa= nt to > +system security, management by a system outside the enterprise enclave i= s not > +desirable for some environments. > > > > @@ -455,40 +408,36 @@ service and perform patching in accordance with loc= al configuration management p > > > Disable Red Hat Subscription Manager Daemon (rhsmcertd) > -The Red Hat Subscription Manager (rhsmcertd) runs routinely= to check for > -changes in the entitlements for an organization. Like the Red Hat Update= Agent, it is > -recommended to also disable this service. > +The Red Hat Subscription Manager (rhsmcertd) periodically c= hecks for > +changes in the entitlement certificates for a registered system and upda= tes it > +accordingly. Therhsmcertd service can be disabled with follow= ing command: >
# chkconfig rhsmcertd off
>
> +Therhsmcertd service can provide administrators wit= h some > +additional control over which of their systems are entitled to particular > +subscriptions. However, for systems that are managed locally or which a= re not > +expected to require remote changes to their subscription status, it is > +unnecessary and can be disabled. > > > >
> > > - > -Enable Syslog Daemon (rsyslog) > -The rsyslog service provides the default logging daemon for= RHEL 6. Unless > -some sort of custom logging daemon is used (like syslog-ng or something = similar) then > -this service must be enabled and configured properly. The rsyslog servic= e provides > -improvements such as connection-oriented (TCP) transmission of logs, the= option to log > -to database formats, and the encryption of log data en route to a centra= l logging server. > -
# chkconfig rsyslog on
> -
> - > - > - > -
> - > - > > Disable Cyrus SASL Authentication Daemon (saslauthd) > -The saslauthd service handles plaintext authentication requ= ests on behalf of the SASL library. > -This service fulfills two roles: 1) it isolates all code requiring super= user privileges into a single > -process, and 2) it can be used to provide proxy authentication services = to clients that do not > -understand SASL based authentication. Unless this service is absolutely = needed it should be disabled. > +The saslauthd service handles plaintext authentication requ= ests on > +behalf of the SASL library. The service isolates all code requiring sup= eruser > +privileges for SASL authentication into a single process, and can also b= e used > +to provide proxy authentication services to clients that do not understa= nd SASL > +based authentication. Thesaslauthd service can be disabled wi= th the > +following command: >
# chkconfig saslauthd off
>
> +Thesaslauthd service provides essential functionali= ty for > +performing authentication in some directory environments, such as those = which > +use Kerberos and LDAP. For others, however, in which only local files m= ay be > +consulted, it is not necessary and should be disabled. > > > > @@ -497,55 +446,55 @@ understand SASL based authentication. Unless this s= ervice is absolutely needed i > > > Disable SMART Disk Monitoring Service (smartd) > -SMART (Self-Monitoring, Analysis, and Reporting Technology)= is a feature of hard drives that > -allows them to detect symptoms of disk failure and relay an appropriate = warning. This technology is > -considered to bring relatively low security risk, and can be useful. Lea= ve this service running if the > -system=C3=A2=E2=82=AC=E2=84=A2s hard drives are SMART-capable. Otherwise= , disable this service. > +SMART (Self-Monitoring, Analysis, and Reporting Technology)= is a > +feature of hard drives that allows them to detect symptoms of disk failu= re and > +relay an appropriate warning. Thesmartd service can be disabl= ed with > +the following command: >
# chkconfig smartd off
>
> +SMART can help protect against denial of > +service due to failing hardware. Nevertheless, if it is not needed or t= he > +system's drives are not SMART-capable (such as solid state drives), it c= an be > +disabled. > > > >
> > - > - > -Disable OpenSSH Daemon (sshd) > -The Secure Shell (SSH) protocol is recommended for remote l= ogin and remote file > -transfer. SSH provides confidentiality and integrity for data exchanged = between two systems, > -as well as server authentication, through the use of public key cryptogr= aphy. If remote > -administration is needed then this service should be enabled. Otherwise,= it should be disabled. > -
# chkconfig sshd off
> -
> - > - > - > -
> - > + > > > Disable System Statistics Reset Service (sysstat) > -The sysstat service resets various I/O and CPU performance = statistics to zero and > -inserts a dummy record in the current daily data file that indicates tha= t these statistics have > -been reset. By default this service is run at boot to reset the statisti= cs. Unless required this > -service should be disabled. > +Thesysstat service resets various I/O and CPU > +performance statistics to zero in order to begin counting from a fresh s= tate > +at boot time. > +Thesysstat service can be disabled with the following command: >
# chkconfig sysstat off
>
> +By default thesysstat service merely runs a program= at > +boot to reset the statistics, which can be retrieved using programs such= as > +sar andsadc. These may provide useful insight into s= ystem > +operation, but unless used this service can be disabled. > > > > @@ -563,17 +512,4 @@ disabled. > >
> --> > - > - > -Disable Yellow Pages Service (ypbind) > -The ypbind service runs on NIS clients and binds them to a = NIS domain. > -It must be running for systems based on glibc to work as NIS clients, bu= t it should > -not be enabled on systems which are not using NIS. > -
# chkconfig ypbind off
> -
> - > - > - > -
> - >
Ack --===============7821182622988327610==--