How to harden alt-f against hacking

[3p141592654]

Excuse the newb question, but as I understand it the configuration files in /etc and elsewhere are created dynamically when Alt-f reboots, and that means that any unsupported modifications will be lost on reboot. Is that correct?

My box has some ports exposed to internet (SSH for example), and these get relentlessly hammered by hackers. I would like to make their job harder, and there are lots of tips how to do this. For example, using rsa certificates to authenticate instead of a password, using hosts.allow and hosts.deny to fend off unknown hosts, and so on. I can easily configure these things, but if they don't survive a reboot it doesn't seem to be a permanent solution.

What is the recommended approach?

[Joao Cardoso]

On Thursday, August 30, 2012 5:32:56 PM UTC+1, 3p141592654 wrote:

Excuse the newb question, but as I understand it the configuration files in /etc and elsewhere are created dynamically when Alt-f reboots,

Partially. Only certain files are created, others are copied from flash memory.

 

and that means that any unsupported modifications will be lost on reboot. Is that correct?

Partially. Read the HowToFixOrCustomizeFirmware wiki.

In short, if you have any Alt-F package installed, new files will be stored on disk, under the /Alt-F hierarchy.

/Alt-F itself is just a link to the Alt-F package directory on disk:

/ # ls -l /Alt-F

lrwxrwxrwx    1 root     root            15 Aug 31 20:56 /Alt-F -> /mnt/sda4/Alt-F

In this case the Alt-F directory is located in the sda4 filesystem.

Certain rules must be obeyed, however.

/ # ls -l /etc/foo

ls: /etc/foo: No such file or directory

/ # touch /etc/foo

/ # ls -l /etc/foo

-rw-r--r--    1 root     root             0 Aug 30 19:54 /etc/foo

/ # ls -l /Alt-F/etc/foo 

-rw-r--r--    1 root     root             0 Aug 30 19:54 /Alt-F/etc/foo

This occurs because /Alt-F/etc already exists. If it didn't exists, that would not happens:

/ # ls -l /sbin/foo

ls: /sbin/foo: No such file or directory

/ # touch /sbin/foo

/ # ls -l /sbin/foo

-rw-r--r--    1 root     root             0 Aug 30 20:02 /sbin/foo

/ # ls -l /Alt-F/sbin/foo

ls: /Alt-F/sbin/foo: No such file or directory

Additionally, if two files with the same name exists in both the "normal" '/' hierarchy and under the /Alt-F hierarchy, the one from the /Alt-F hierarchy will prevail and will shadow the "normal" one. Deleting files also has some rules. Google for 'union mounting'

Mostly, DON'T directly manipulate files under the /Alt-F hierarchy, as the OS might become crazy and freeze. If you need to do that, and sometimes it need to be done, either mount /Alt-F with 'notify' first (slower access), or unmount the /Alt-F hierarchy using the 'aufs.sh' command, then remount /Alt-F or remount with 'reval'

/ # aufs.sh 

Usage: Alt-F.sh -m (mount the Alt-F union branch) |

                -u (umount the Alt-F union branch) |

                -n (remount with notify) |

                -r (remount with reval) |

                -l (list branches) |

                -i <mountpoint> (install in mountpoint)

                -s (status)

As the wiki says:

Don't send bug reports or fill any issues if you made changes to any system file this way!

[3p141592654]

Thanks for the clarification.  This has been very helpful.