Setting up a CentOS 6.2 web server: Accounts Hardening

This is a follow on post from my guide to installing CentOS 6.2 and auditing your software installs. We will go through some of the steps required to secure your server and get it ready for production use.

These steps will outline how to harden your user accounts to lessen the risk that they will be compromise (and limit the damage able to be done if they are compromised).
We will assumes you have already created a new user account; if you haven't, just run the following command:

adduser -m -U USERNAME
passwd USERNAME

Now let's lock down our accounts!

1. Let's restrict the root access to the system console only. Edit /etc/securetty and remove everything except for the following:
   

   console
   tty1
   tty2
   ...
   tty10
   tty11

2. Uncomment the following line in /etc/pam.d/su
   
   

   auth required pam_wheel.so use_uid

   
   
3. Uncomment the following line in /etc/sudoers
   
   

   %wheel ALL=(ALL) ALL

4. Add your new administrator user to the wheel group
   

   usermod -G wheel USERNAME

5. Now we will lock non-root system accounts and block shell access. Figure out the list of accounts by running the following (it will print a list of accounts with the associated UID):
   

   awk -F: '{print $1 ":" $3 ":" $7}' /etc/passwd

6. Run the following commands on any non-root account with a UID less than 500:
   

   usermod -L account
   usermod -s /sbin/nologin account

    
7. For reference, this is a list of system accounts generally created on a fresh install:
   bin
   daemon
   adm
   lp
   sync
   shutdown
   halt
   mail
   uucp
   operator
   games
   gopher
   ftp
   nobody
   dbus
   rpc
   abrt
   vcsa
   haldaemon
   saslauth
   postfix
   rpcuser
   nfsnobody
   ntp
   qemu
   radvd
   sshd
   tcpdump
   oprofile
   avahi
   rtkit
   pulse
   avahi-autoipd
   mysql
8. Ensure passwords expire by editing /etc/login.defs
   

   PASS_MAX_DAYS 360
   PASS_MIN_DAYS 14
   PASS_MIN_LENGTH 8PASS_WARN_AGE 32

   For any accounts that have already been created, run the following to enforce the new rules:
   
   

   chage -M 360 -m 14 -W 7 admin

References

• Red Hat Linux 5 Hardening Tips - National Security Agency
• Guide to the secure configuration of Red Hat Linux 5 - National Security Agency
• CentOS wiki on hardening the OS