Services

disable-publishing=yes

$ sudo systemctl mask --now avahi-daemon.service

$ sudo chgrp root /etc/at.allow

$ sudo chgrp root /etc/cron.allow

$ sudo chown root /etc/at.allow 

$ sudo chown root /etc/cron.allow 

$ sudo chmod 0640 /etc/at.allow

$ sudo chmod 0640 /etc/cron.allow

supersede setting value;

request setting;
require setting;

supersede domain-name "example.com";
supersede domain-name-servers 192.168.1.2;
supersede nis-domain "";
supersede nis-servers "";
supersede ntp-servers "ntp.example.com ";
supersede routers 192.168.1.1;
supersede time-offset -18000;
request subnet-mask;
require subnet-mask;

option domain-name
option domain-name-servers
option nis-domain
option nis-servers
option ntp-servers
option routers
option time-offset

$ sudo systemctl mask --now dhcpd.service

$ sudo systemctl mask --now named.service

$ sudo yum install bind-chroot

$ sudo cp /etc/named.conf /var/named/chroot/etc/named.conf
$ sudo chown root:root /var/named/chroot/etc/named.conf
$ sudo chmod 644 /var/named/chroot/etc/named.conf

options {
directory "/path/to/DIRNAME ";
...
}

$ sudo cp -r /path/to/DIRNAME /var/named/chroot/DIRNAME

ROOTDIR=/var/named/chroot

acl internal {
  SUBNET ;
  localhost;
};
view "internal-view" {
  match-clients { internal; };
  zone "." IN {
    type hint;
    file "db.cache";
  };
  zone "internal.example.com " IN {
    ...
  };
};

view "external-view" {
  match-clients { any; };
  recursion no;
  zone "example.com " IN {
    ...
  };
};

options {
  allow-query { any; };
  recursion no;
  ...
};
zone "example.com " IN {
  ...
};

acl internal {
  SUBNET ;
  localhost;
};
options {
  allow-query { internal; };
  ...
};
zone "internal.example.com " IN {
  ...
};

$ sudo systemctl mask --now vsftpd.service

-A INPUT -m state --state NEW -p tcp --dport 21 -j ACCEPT

IPTABLES_MODULES="ip_conntrack_ftp"

$ sudo systemctl mask --now httpd.service

$ httpd -l

# Do not expose PHP error messages to external users
display_errors = Off

# Enable safe mode
safe_mode = On

# Only allow access to executables in isolated directory
safe_mode_exec_dir = php-required-executables-path

# Limit external access to PHP environment
safe_mode_allowed_env_vars = PHP_

# Restrict PHP information leakage
expose_php = Off

# Log all errors
log_errors = On

# Do not register globals for input data
register_globals = Off

# Minimize allowable PHP post size
post_max_size = 1K

# Ensure PHP redirects appropriately
cgi.force_redirect = 0

# Disallow uploading unless necessary
file_uploads = Off

# Disallow treatment of file requests as fopen calls
allow_url_fopen = Off

# Enable SQL safe mode
sql.safe_mode = On

$ sudo service httpd configtest

ChrootDir /chroot/apache

mod_cband mod_bwshare mod_limitipconn mod_evasive

-A INPUT -m state --state NEW -p tcp --dport 143 -j ACCEPT

protocols = PROTOCOL

$ sudo systemctl mask --now dovecot.service

$ sudo mkdir /etc/pki/tls/ldap
$ sudo chown root:root /etc/pki/tls/ldap
$ sudo chmod 755 /etc/pki/tls/ldap

• /etc/pki/tls/ldap/serverkey.pem: the private key ldapserverkey.pem
• /etc/pki/tls/ldap/servercert.pem: the certificate file ldapservercert.pem

$ sudo chown root:ldap /etc/pki/tls/ldap/serverkey.pem
$ sudo chown root:ldap /etc/pki/tls/ldap/servercert.pem
$ sudo chmod 640 /etc/pki/tls/ldap/serverkey.pem
$ sudo chmod 640 /etc/pki/tls/ldap/servercert.pem

$ sudo mkdir /etc/pki/tls/CA
$ sudo chown root:root /etc/pki/tls/CA/cacert.pem
$ sudo chmod 644 /etc/pki/tls/CA/cacert.pem

$ sudo echo "root: " >> /etc/aliases
$ sudo newaliases

$ sudo grep "postmaster:\s*root$" /etc/aliases

postmaster: root

relayhost = 

$ mount -t nfs,nfs4,smbfs,cifs,ncpfs

/DIR	host1(opt1,opt2) host2(opt3)

• Name or alias that is recognized by the resolver
• Fully qualified domain name
• IP address
• IP subnets in the format address/netmask or address/CIDR

$ sudo systemctl mask --now ypserv.service

$ sudo rm /etc/hosts.equiv

$ rm ~/.rhosts

$ sudo systemctl mask --now squid.service

[global]
  load printers = yes
  cups options = raw
[printers]
  comment = All Printers
  path = /usr/spool/samba
  browseable = no
  guest ok = no
  writable = no
  printable = yes

[printers]
  valid users = user @printerusers

[share]
  hosts allow = 192.168.1. 127.0.0.1
  valid users = userone usertwo @usergroup

[share]
  read only = yes
  write list = userone usertwo @usergroup

$ sudo systemctl mask --now smb.service

$ sudo systemctl mask --now snmpd.service

ClientAliveInterval 

HostbasedAuthentication no

Protocol 2

Compression 

PermitEmptyPasswords no

GSSAPIAuthentication no

KerberosAuthentication no

PubkeyAuthentication no

IgnoreRhosts yes

RhostsRSAAuthentication no

PermitRootLogin no

PermitRootLogin prohibit-password

AllowTcpForwarding no

IgnoreUserKnownHosts yes

X11Forwarding no

PermitUserEnvironment no

GSSAPIAuthentication yes

UsePAM yes

PubkeyAuthentication yes

StrictModes yes

Banner /etc/issue

Banner /etc/issue.net

X11Forwarding yes

PrintLastLog yes

RekeyLimit  

LogLevel INFO

LogLevel VERBOSE

MaxAuthTries 

MaxSessions 

MaxStartups 

UsePrivilegeSeparation 

firewall-cmd --permanent --add-rich-rule='rule family="ip_protocol" source address="netwk/mask" service name="ssh" accept'