Archive for September, 2010

Hardening guide for Squid 3.1.8 on CentOS 5.5

  1. Login to the server using Root account.
  2. Create a new account:
    groupadd squid
    useradd -g squid -d /var/spool/squid -s /sbin/nologin squid
  3. Install the following RPM files from the CentOS DVD:
    rpm -ivh kernel-headers-2.6.18-194.el5.i386.rpm
    rpm -ivh glibc-headers-2.5-49.i386.rpm
    rpm -ivh glibc-devel-2.5-49.i386.rpm
    rpm -ivh gmp-4.1.4-10.el5.i386.rpm
    rpm -ivh libgomp-4.4.0-6.el5.i386.rpm
    rpm -ivh cpp-4.1.2-48.el5.i386.rpm
    rpm -ivh gcc-4.1.2-48.el5.i386.rpm
    rpm -ivh libstdc++-devel-4.1.2-48.el5.i386.rpm
    rpm -ivh gcc-c++-4.1.2-48.el5.i386.rpm
  4. Download the latest Squid source files from: http://www.squid-cache.org/Versions/
  5. Copy using SCP (or PSCP), Squid source files into /tmp
  6. Move to /tmp
    cd /tmp
  7. Extract Squid source file:
    tar zxvf squid-3.1.8.tar.gz
  8. Move to the Squid source folder:
    cd /tmp/squid-3.1.8
  9. Run the commands bellow to compile Squid from source files:
    ./configure --bindir=/usr/sbin --sbindir=/usr/sbin --libexecdir=/usr/lib/squid --with-logdir=/var/log/squid --with-pidfile=/var/run/squid.pid --with-default-user=squid --sysconfdir=/etc/squid --datarootdir=/usr/share/squid --enable-http-violations

    make all

    make install  

  10. Move one folder up and remove Squid source files and default content:
    cd ..
    rm -rf /tmp/squid-3.1.8
    rm -f /tmp/squid-3.1.8.tar.gz
    rm -rf /usr/share/squid/man
    rm -f /etc/squid/cachemgr.conf.default
    rm -f /etc/squid/errorpage.css.default
    rm -f /etc/squid/mime.conf.default
    rm -f /etc/squid/msntauth.conf.default
    rm -f /etc/squid/squid.conf.default
    rm -f /etc/squid/squid.conf.documented
  11. Change ownership and permissions on the log folder:
    chown squid:root /var/log/squid
    chmod 770 /var/log/squid
  12. Edit using VI, the file /etc/squid/squid.conf and add the following lines to the end of the file:
    cache_access_log /var/log/squid/access.log
    cache_store_log none
    shutdown_lifetime 1 second
    icp_port 0
    htcp_port 0
    icp_access deny all
    htcp_access deny all
    forwarded_for off
    request_header_access Allow allow all
    request_header_access Authorization allow all
    request_header_access WWW-Authenticate allow all
    request_header_access Proxy-Authorization allow all
    request_header_access Proxy-Authenticate allow all
    request_header_access Cache-Control allow all
    request_header_access Content-Encoding allow all
    request_header_access Content-Length allow all
    request_header_access Content-Type allow all
    request_header_access Date allow all
    request_header_access Expires allow all
    request_header_access Host allow all
    request_header_access If-Modified-Since allow all
    request_header_access Last-Modified allow all
    request_header_access Location allow all
    request_header_access Pragma allow all
    request_header_access Accept allow all
    request_header_access Accept-Charset allow all
    request_header_access Accept-Encoding allow all
    request_header_access Accept-Language allow all
    request_header_access Content-Language allow all
    request_header_access Mime-Version allow all
    request_header_access Retry-After allow all
    request_header_access Title allow all
    request_header_access Connection allow all
    request_header_access Proxy-Connection allow all
    request_header_access User-Agent allow all
    request_header_access Cookie allow all
    request_header_access All deny all
    visible_hostname server1
    maximum_object_size 4096 KB
    minimum_object_size 1 KB
    dns_nameservers DNS_value
    client_lifetime 360 minutes
    pconn_timeout 360 minutes
    Note 1: Replace “server1” with the Squid server DNS name.
    Note 2: Replace “DNS_value” with IP addresses of DNS servers
  13. Run the command bellow to initialize the Squid:
    /usr/sbin/squid -z
  14. In-order to manually start the Squid service, run the command bellow:
    /usr/sbin/squid
  15. In-order to start the Squid service at server startup, add the command bellow to the /etc/rc.local file:
    /usr/sbin/squid
  16. Uninstall the following RPM:
    rpm -e gcc-c++-4.1.2-48.el5
    rpm -e libstdc++-devel-4.1.2-48.el5
    rpm -e gcc-4.1.2-48.el5
    rpm -e cpp-4.1.2-48.el5
    rpm -e libgomp-4.4.0-6.el5
    rpm -e gmp-4.1.4-10.el5
    rpm -e glibc-devel-2.5-49
    rpm -e glibc-headers-2.5-49
    rpm -e kernel-headers-2.6.18-194.el5

Hardening guide for Windows 2008 R2 Domain Controller and DNS Server

This guide explains how to install and configure Domain Controller and DNS server based on Windows 2008 R2 platform, for a new forest in a new domain.

Installation phase

  1. Install Windows 2008 R2 server (either standard of enterprise edition).
  2. Important note: The first domain controller in the forest root domain must be installed on physical hardware and not as a virtual server.

  3. Login for the first time to the new server, using administrator account.
  4. Start -> Run -> dcpromo.exe
  5. Click Next twice -> select “Create a new domain in a new forest” -> click Next -> specify the FQDN of the new forest root domain -> click Next -> on the forest functional level, choose “Windows Server 2008 R2” -> click Next -> leave “DNS server” select and click Next -> click “Yes” on the warning message -> choose a location for the database, logs and sysvol folders -> click Next -> specify complex password for the Directory Services Restore Mode administrator password (and document the password) -> click Next twice -> select “Reboot on completion”.
  6. Allow the server to restart when the installation process completes.
  7. Login to the new domain controller for the first time using domain administrator account.
  8. Start -> Run -> cmd.exe
  9. Write the commands bellow to synchronize the PDC emulator with external reliable time source:
    w32tm /config /computer:<> /manualpeerlist:time.windows.com /syncfromflags:manual /update

    exit

  10. Start -> Administrative Tools, right-click Active Directory Module for Windows PowerShell, and then click Run as administrator.
  11. Write the commands bellow to protect all OUs in the domain from accidental deletion:
    import-module activedirectory

    Get-ADOrganizationalUnit -filter * -Properties ProtectedFromAccidentalDeletion | where {$_.ProtectedFromAccidentalDeletion -eq $false} | Set-ADOrganizationalUnit -ProtectedFromAccidentalDeletion $true

    exit

  12. Server Manager -> right click on Features -> Add Features -> select “Windows Server Backup Features” -> click Next -> click Install -> click Close.
  13. Start -> Administrative Tools -> Windows Server Backup -> from the Actions pane, click on “Backup Schedule” -> click Next -> choose “Full server” -> Specify a backup time -> click Next -> click the check box for your destination disk -> click Next -> click Yes to confirm that the destination disk will be reformatted -> verify the label for the destination disk -> click Next -> verify the information on the Summary page -> click Finish -> On the Confirmation page -> click Close.
  14. Server Manager -> expand Roles -> expand DNS Server -> expand DNS -> expand the server name -> right click on “Reverse Lookup Zones” -> New Zone -> click Next -> choose “Primary zone” -> leave “Store the zone in Active Directory” checked -> click Next -> select “To all DNS Servers running on domain controllers in this forest” -> click Next -> choose “IPv4 Reverse Lookup Zone” -> click Next -> on the “Network ID” field, put the first 3 octats of the network segment the Domain controller resides in -> click Next -> select “Allow only secure dynamic updates” -> click Next -> click Finish.
  15. Perform the above step for all other network segments reside in your organization.
  16. From the left pane, expand the server name -> expand “Forward Lookup Zones” -> right click on each zone name -> Properties -> Name Servers tab -> make sure all Windows 2008 R2 DNS servers appear on this list (assuming you have installed more Windows 2008 R2 domain controllers with DNS service) -> Zone Transfers tab -> select “Allow zone transfers” -> select “Only to servers listed on the Name Servers tab” -> click OK.
  17. Perform the above step for all other “Forward Lookup zones” and “Reverse Lookup zones” in your forest.

IPv6 DNS settings

  1. In-order to configure IPv6 address for the DNS server, start -> Control Panel -> under “Network and Internet”, click on “View network status and tasks” -> click “Change adapter settings” -> right click on the relevant “Local Area Connection” icon -> Properties -> click on “Internet Protocol Version 6 (TCP/IPv6) -> Properties -> select “Use the following IPv6 address” -> if you are not familiar with IP addressing, you can use 2001:0db8:29cd:1a0f:857b:455b:b4ec:7403 -> enter a Subnet prefix length of 64 -> click OK -> click close.
  2. Server Manager -> expand Roles -> expand DNS Server -> expand DNS -> expand the server name -> expand “Reverse Lookup Zones” -> right click on “Reverse Lookup Zones” -> New Zone -> click Next -> choose “Primary Zone” -> click Next -> choose “To all DNS servers running on domain controllers in this forest” -> click Next -> choose “IPv6 Reverse Lookup Zone” -> click Next -> on the “IPv6 Address Prefix” field type the IPv6 subnet prefix (in this example: 2001:0db8:29cd:1a0f::/64) -> click Next -> select “Allow only secure dynamic updates” -> click Next -> click Finish.
  3. Right click on the new “Reverse Lookup Zone” -> properties -> Zone Transfers tab -> select “Allow zone transfers” -> select “Only to servers listed on the Name Servers tab” -> click OK.