After rebuilding Bud due to successful attacks, a number of suggestions were made, they were implemented as folows:

• Require complex passwords
• Change all valid shells for daemon accounts to /bin/false

daemon, bin, sys, games, man, mail, news, uucp, proxy, www-date, backup, list, irc, gnats, nobody,

• Require PKA for all admin users
• Create a wheel group to restrict su access

groupadd –system wheel

• Remove sudo entirely
• Provide a script to automate certification generation, providing defaults for standard data

Postfix and Apache both use the SSL certificates in /etc/ssl/ for secure communications and TLS authenication. The guide for creating the keys is at openssl.htm (http://www.nomoa.com/bsd/openssl.htm)

• Backup /etc/ssl/openssl.cnf to /etc/ssl/openssl.cnf.original and change/add defaults to be specific to SLUUG:
  • countryName_default = US
  • stateOrProvinceName_default = Missouri
  • localityName_default = St. Louis
  • 0.organizationName_default = St. Louis Unix User's Group
  • emailAddress = postmaster@sluug.org

• Generate the private server key with passphrase.

openssl genrsa -des3 -out /etc/ssl/private/server.key 1024

• Remove the passphrase (cannot use a passphrase with a server)

openssl rsa -in pass.key -out server.key

• Generate the certificate request with defaults from the modified openssl.cnf. For the "Common Name" enter the servers fqdn e.g. bud.sluug.org

openssl req -new -key /etc/ssl/private/<name>.key -out /etc/ssl/private/<name>.csr

Self sign the certificate request to produce the certificate.

openssl x509 -req -days 3650   -in /etc/ssl/private/<name>.csr   -signkey /etc/ssl/private/<name>.key   -out /etc/ssl/<name>.crt

• Next change group so postfix can read it.

chown :postfix /etc/ssl/private/postfix.key
chown :postfix /etc/ssl/postfix.crt

The above commands are in openssl-gencrt to simplify cert creation:

• Launch openssl-keygen with the desired Certificate Name as an argument

openssl-gencrt <Certificate Name>e 

• The defaults for SLUUG are provided - a <cr> will accept them; only the common name is required to be entered.
• Defaults may be overridden if required
• NOTE: A passphrase is requifor the key - it is removed in the second step

• Country: [US]
• Locale: [St. Louis]
• Organization Name: [St. Louis Unix User Group

• OU Name: Server fqdn
• Common name: Function (e.g. Postfix)

• Any of the defaults may be overridden at creation time