There are several ways of customizing the network interfaces of the system to create a more secure system. One way is to unplug it from the wall, turn off the power and use it as a paperweight. As this is generally not most useful modus operandi of your Linux system, one must make some modifications to keep people out while still allowing others to get their work done.

I. The /etc/inetd.conf file and tcp_wrappers
 

A. The /etc/inetd.conf file is the config file for inetd which listens on certain internet sockets and depending on the type of request made starts the correct service. Services include the following:

ftp
telnet
gopher
smtp         disallowed by default
nntp          disallowed by default
shell
login
exec           disallowed by default
talk
pop-2         disallowed by Fermi
pop-3         disallowed by Fermi
imap           disallowed by Fermi
uucp           disallowed by default
finger
netstat        disallowed by default
time
auth

B. The pop and imap services are disallowed at the Lab due to serious problems in the past with security holes in these services. To disallow services, such as the useless gopher services, simply comment out the service line in /etc/inetd.conf by adding a # sign to the front of the line, and restarting the inetd daemon either send a kill -HUP to the process ID associated or by issuing a command directly to the rc script to restart, i.e., '/etc/rc.d/init/inet restart'

C. tcp_wrappers are way to filter and log access from remote systems.
 

1. Filtering is determined by looking in the /etc/hosts.deny and /etc/hosts.allow files, respectively. One of the safest and most paranoid methods of allowing access to machines is to deny all services to everyone by adding a line to /etc/hosts.deny with the following line:
 
ALL: ALL

Access should then be granted on a service, machine or subnet basis in the /etc/hosts.allow file thusly:

ftp: .fnal.gov @dcdsv0.fnal.gov
ALL: .fnal.gov

The first line will allow anyone in the fnal.gov subnet and anyone in the netgroup dcdsv0.fnal.gov to ftp to the machine. The second line will allow all services to anyone in the fnal.gov domain.

2. Logs of access go to /var/log/messages.

A. Install xntp3 which is located on linux.fnal.gov in /linux/current/i386/RedHat/RPMS

B. xntp3 is a time client to sync the system to other systems in the subnet or other servers in the world. For example the cesium clock at the US Naval Observatory or at the National Institute for Standards in Technology.

C. xntp3 is run at boot time so a symbolic links should reside in the /etc/rc.d/rc3.d and rc5.d directories pointing to /etc/rc.d/init.d/xntpd3. Look at the startup script in the init.d dir and make sure that the daemon is started with the -b option. This will set xntpd3 to listen mode. It will then sync the system clock from periodic time broadcasts from the subnet routers.