After rebuilding Bud due to successful attacks, a number of suggestions were made, they were implemented as folows:

• Require complex passwords
• Change all valid shells for daemon accounts to /bin/false

daemon, bin, sys, games, man, mail, news, uucp, proxy, www-date, backup, list, irc, gnats, nobody,

• Require PKA for all admin users
• Create a wheel group to restrict su access

groupadd –system wheel

• Remove sudo entirely
• Provide a script to automate certification generation, providing defaults for standard data

Postfix, Courier IMAP, and Apache all use their own SSL certificates in /etc/ssl/ for secure communications and TLS authenication. The configuration files for each application will have to reflect the name of the certificate file. See the documentation for individual applications or existing systems for the naming convention.

The guide for creating the keys is at openssl.htm. Additional information might be at the OpenSSL web site.

This is done once for the system.

• Backup /etc/ssl/openssl.cnf to /etc/ssl/openssl.cnf.original and change/add defaults in the req_distinguished_name section of openssl.cnf to be specific to SLUUG. The commonName_default and organizationalUnitName_default are different for each system.
  • countryName_default = US
  • stateOrProvinceName_default = Missouri
  • localityName_default = St. Louis
  • 0.organizationName_default = St. Louis Unix User's Group
  • emailAddress = postmaster@sluug.org
  • commonName_default = bud.sluug.org
  • organizationalUnitName_default = bud.sluug.org

This entire section is duplicated below in the SSL Key Generation - Script Method section. Do one or the other, not both.

This is repeated for each application that needs it.

• Generate the private server key with passphrase. Enter anything for the passphrase (4 to 8191 characters), but will have to enter it for the next step that removes it.

openssl genrsa -des3 -out /etc/ssl/private/temp.key 1024

• Remove the passphrase (cannot use a passphrase with a server)

openssl rsa -in /etc/ssl/private/temp.key -out /etc/ssl/private/<name>.key

• No longer need the temporary key.

rm /etc/ssl/private/temp.key

• Generate the certificate request with defaults from the modified openssl.cnf. When running the signing request, you will be asked a number of questions about the identification of the organization and system. Since these were already set in openssl.cnf, you should only need to verify the default value and press Carriage Return to take the default for all of them. For example, for the "Common Name" enter the servers fqdn e.g. bud.sluug.org

openssl req -new -key /etc/ssl/private/<name>.key -out /etc/ssl/private/<name>.csr

• Self sign the certificate request to produce the certificate.

openssl x509 -req -days 3650   -in /etc/ssl/private/<name>.csr   -signkey /etc/ssl/private/<name>.key   -out /etc/ssl/<name>.crt

• Change group and permissions as needed so the application can read it's own certificate. For example, for postfix:

chown :postfix /etc/ssl/private/postfix.key
chown :postfix /etc/ssl/postfix.crt

This entire section is duplicated above in the SSL Key Generation - Script Method section. Do one or the other, not both.

This is repeated for each application that needs it.

The above commands are in a script named openssl-gencrt to simplify certificate creation:

• Copy /usr/local/sbin/openssl-gencrt from another system if not already done.

• Launch openssl-keygen with the desired Certificate Name as an argument

openssl-gencrt <name>

• The defaults for SLUUG are provided - a <cr> will accept them; only the common name is required to be entered.
• Defaults may be overridden if required
• NOTE: A passphrase is required for the key - it is removed in the second step

• Country: [US]
• Locale: [St. Louis]
• Organization Name: [St. Louis Unix User Group

• OU Name: Server fqdn
• Common name: Function (e.g. Postfix)

• Any of the defaults may be overridden at creation time