Example A
This is an example of the /etc/inetd.conf file. Notice how everything is commented out except for ftp and telnetd.

#
# inetd.conf    This file describes the services that will be available
#               through the INETD TCP/IP super server.  To re-configure
#               the running INETD process, edit this file, then send the
#               INETD process a SIGHUP signal.
#
# Version:      @(#)/etc/inetd.conf     3.10    05/27/93
#
# Authors:      Original taken from BSD UNIX 4.3/TAHOE.
#               Fred N. van Kempen, <waltje@uwalt.nl.mugnet.org>
#
# Modified for Debian Linux by Ian A. Murdock <imurdock@shell.portal.com>
#
# Modified for RHS Linux by Marc Ewing <marc@redhat.com>
#
# <service_name> <sock_type> <proto> <flags> <user> <server_path> <args>
#
# Echo, discard, daytime, and chargen are used primarily for testing.
#
# To re-read this file after changes, just do a 'killall -HUP inetd'
#
#echo   stream  tcp     nowait  root    internal
#echo   dgram   udp     wait    root    internal
#discard        stream  tcp     nowait  root    internal
#discard        dgram   udp     wait    root    internal
#daytime        stream  tcp     nowait  root    internal
#daytime        dgram   udp     wait    root    internal
#chargen        stream  tcp     nowait  root    internal
#chargen        dgram   udp     wait    root    internal
#
# These are standard services.
#
ftp     stream  tcp     nowait  root    /usr/sbin/tcpd  in.ftpd -l -L -i -o
telnet stream  tcp     nowait  root    /usr/sbin/tcpd  in.telnetd
#gopher stream  tcp     nowait  root    /usr/sbin/tcpd  gn

# do not uncomment smtp unless you *really* know what you are doing.
# smtp is handled by the sendmail daemon now, not smtpd.  It does NOT
# run from here, it is started at boot time from /etc/rc.d/rc#.d.
#smtp   stream  tcp     nowait  root    /usr/bin/smtpd  smtpd
#nntp   stream  tcp     nowait  root    /usr/sbin/tcpd  in.nntpd
#
# Shell, login, exec and talk are BSD protocols.
#
#shell  stream  tcp     nowait  root    /usr/sbin/tcpd  in.rshd
#login  stream  tcp     nowait  root    /usr/sbin/tcpd  in.rlogind
#exec   stream  tcp     nowait  root    /usr/sbin/tcpd  in.rexecd
#talk   dgram   udp     wait    root    /usr/sbin/tcpd  in.talkd
#ntalk  dgram   udp     wait    root    /usr/sbin/tcpd  in.ntalkd
#dtalk  stream  tcp     waut    nobody  /usr/sbin/tcpd  in.dtalkd
#
# Pop and imap mail services et al
#
#pop-2   stream  tcp     nowait  root    /usr/sbin/tcpd ipop2d
#pop-3   stream  tcp     nowait  root    /usr/sbin/tcpd ipop3d
#imap    stream  tcp     nowait  root    /usr/sbin/tcpd imapd
#
# The Internet UUCP service.
#
#uucp   stream  tcp     nowait  uucp    /usr/sbin/tcpd  /usr/lib/uucp/uucico    -l
#
# Tftp service is provided primarily for booting.  Most sites
# run this only on machines acting as "boot servers." Do not uncomment
# this unless you *need* it.
#
#tftp   dgram   udp     wait    root    /usr/sbin/tcpd  in.tftpd
#bootps dgram   udp     wait    root    /usr/sbin/tcpd  bootpd
#
# Finger, systat and netstat give out user information which may be
# valuable to potential "system crackers."  Many sites choose to disable
# some or all of these services to improve security.
#
# cfinger is for GNU finger, which is currently not in use in RHS Linux
#
#finger stream  tcp     nowait  root    /usr/sbin/tcpd  in.fingerd
#cfinger stream tcp     nowait  root    /usr/sbin/tcpd  in.cfingerd
#systat stream  tcp     nowait  guest   /usr/sbin/tcpd  /bin/ps -auwwx
#netstat        stream  tcp     nowait  guest   /usr/sbin/tcpd  /bin/netstat    -f inet
#
# Time service is used for clock syncronization.
#
#time   stream  tcp     nowait  nobody  /usr/sbin/tcpd  in.timed
#time   dgram   udp     wait    nobody  /usr/sbin/tcpd  in.timed
#
# Authentication
#
#auth   stream  tcp     nowait    nobody    /usr/sbin/in.identd in.identd -l -e -o
#
# End of inetd.conf
 
 
 

Example B
This is an example of the /etc/issue file.

#
#
#  WARNING:  You must have specific authorization to access
#            this machine.  Unauthorized users will be logged,
#            monitored, and then shot on sight!
#
#
 
 

Example C
This is an example of system accounts I leave in the /etc/passwd file.  Notice how the password filed contains "x" and not the encrpyted password.  Encrypted passwords are now securely stored in the /etc/shadow file as a result of the "pwconv" command.

root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:
daemon:x:2:2:daemon:/sbin:
adm:x:3:4:adm:/var/adm:
lp:x:4:7:lp:/var/spool/lpd:
mail:x:8:12:mail:/var/spool/mail:
uucp:x:10:14:uucp:/var/spool/uucp:
nobody:x:99:99:Nobody:/:
 
 
 

Example D
This is an example of /etc/ftpusers

root
bin
daemon
adm
lp
mail
uucp
nobody
 
 
 
 

Example E
 This is an example of of the /etc/securetty file.

tty1
tty2
tty3
tty4
ttyp1 -- > Note, this entry now allows a remote user to login as root.  Normarlly, you do NOT want this entry!
 
 
 
 
 
 

Example F
This is an example of the access control lists for TCP Wrappers.  The syntax is

Service: Source (IP address, network, or name): <optional> : ALLOW or DENY

Example of /etc/hosts.allow

in.telnetd: 192.168.1.0/255.255.255.0 : banners /etc/bannerfile : ALLOW
in.ftpd: 192.168.1.30 :ALLOW
imapd: ALL : spawn (/usr/local/bin/ids.sh %d %h %H %u)

Example of /etc/hosts.deny. I highly recommend you always use this as your /etc/hosts.deny file.

ALL: ALL DENY
 
 
 
 
 
 
 
 
 
 
  Example G
Go to /etc/pam.d directory, where you will find all the configuration files for different binaries that require authentication.  Most of the configuration files will have the following entry.
password   required     /lib/security/pam_pwdb.so nullok use_authtok
or
password   required     /lib/security/pam_pwdb.so shadow nullok use_authtok

All you need to do is find all the configuration files that have this entry, and add "md5" to the end, so it looks like this.
password   required     /lib/security/pam_pwdb.so nullok use_authtok md5
or
password   required     /lib/security/pam_pwdb.so shadow nullok use_authtok md5

For my RedHat 6.0 system, I had to edit this line in the following configuration files in /etc/pam.d
chfn
chsh
login
passwd
rlogin
su
xdm
 
 
 
 
 
 
 
 
 
 
 
 
 
  Example H
Below is the configuration file for IPChains. You can easily implement this on your system using the command 'ipchains-restore' as follows:

mozart #cat ipchains.cfg | ipchains-restore

The contents of the ipchains.cfg file is as follows:

:input DENY
:forward ACCEPT
:output ACCEPT
-A input -s 0.0.0.0/255.255.255.255 -d 0.0.0.0/0.0.0.0 -j DENY
-A input -s 0.0.0.0/0.0.0.0 -d 255.255.255.255/255.255.255.255 -j DENY
-A input -s 0.0.0.0/0.0.0.0 -d 224.0.0.0/255.0.0.0 -j DENY
-A input -s 0.0.0.0/0.0.0.0 -d 0.0.0.0/0.0.0.0 -p 6 -j ACCEPT ! -y
-A input -s 0.0.0.0/0.0.0.0 -d 0.0.0.0/0.0.0.0 -p 17 -j ACCEPT -l
-A input -s 0.0.0.0/0.0.0.0 -d 0.0.0.0/0.0.0.0 -p 1 -j ACCEPT -l
-A input -s 0.0.0.0/0.0.0.0 -d 0.0.0.0/0.0.0.0 -j DENY -l