A tool that helps me to be sensible on permissions?

Question

Is there a tool or understandable source (manual, webpage, ...) in existence that helps a moderate* user to be more sensible about user permissions?

In my ideal-dream-world I'd have a CLI tool that lets you scan your system or a directory to find security loopholes and gives you a sensible, readable feedback on how one could improve one's security.

I mean "security" in the online generation's way: how to keep my machine (which is running arch btw) from being infiltrated by a virus, a worm, ... I'm not bothered by "my little brother will ruin my system" and tangent problems.

Does this kind of tool exist?

Jeesh: I sound like a windows user here: being paranoid about security and all. I just switched from mac - where I've never had any security problems - to linux. Although I know security is pretty baked in to unix with the concept permissions, I do feel a bit exposed because I'm not quite sure how much the safety my mac offered me was part of Mac in stead of unix. There must be some exploits a malicous party can use on the linux, no?

*a moderate user is a person that knows how to use the CLI (in fact I prefer to use the CLI) etcetera, but isn't the typ of person to compile his own version linux.

Answer 1

Obviously, there are the typical books on Linux systems administration regarding permissions. But, that does not really answer your question. I would recommend the following:

• use a find command to search for "world writable files"
• use a find command to search for "setUID and setGID files"
• use a system security scanning or hardening tool to check your system for vulnerabilities there are tons of these available, the best page I have seen listing them is from YoLinux

YoLinux Security Auditing Tools

I would recommend Bastille-linux and Nessus. As for the find commands a simple net search will turn those up. Beyond that it is straight reading and messing with your system.

EDIT: Obviously, you don't want to necessarily modify the permissions on the world readable or writable files or setUID,GID binaries. Many programs need these like passwd and are already locked down to not be exploitable. You will have to do the research to see if your system needs them.

Also avoid setting permissions too liberally by default. No need to give other permissions if it does not need it. Setup groups and don't drop everyone into users if you don't have to. Don't export NFS shares to * and read up on root_squash if you are messing with NFS.