ࡱ> uwt "<bjbjaa .z"4JJ....d.6&{5}5}5}5}5}5}5,8h;R55W)5W)W)W) {5W){5W)W)34q5I(94>g5506w48;W);(4W)4T5d55W)6;J :    HARDENING THE LINUX SYSTEM Step-by-Step Guide Release 2 Paul Loftness Baylor University | Undergraduate Researcher UAB Simeon Blatchley University of Maryland UC | Analyst SAIC Created July 2012 Updated January 2016 OVERVIEW This document is a general checklist for hardening a Linux system. The important thing to remember is that there is no 100% right checklist. There are bound to be variables that must be changed, and all this document is intending on doing, is to allow the Linux user to follow the steps and successfully secure any type of system without needing much knowledge. However, they will still have the ability to further their security with the more advanced checklists. Of course with any of these checklists, there is a chance of breaking something, and thus all steps must be researched for your specific distro/system. A single user's security settings will be vastly different from a multi-user system. Notes: All commands listed will need to be run as root. You can switch to root by running either sudo I or su. Where we use vi as the command line editor, you can replace it for gedit or any other text editor. Where use apt-get you can insert your distro version of package management. Or if necessary you can download the binaries and compile them (a somewhat easy process of ./configure, make, make install, etc). Shaded areas are terminal commands, you can cut and paste these, although one should be careful and know what the command actually does. MAINTAINANCE Update the Operating System Debian, Ubuntu, Kali, etc apt-get update apt-get upgrade Redhat, YellowDog, CentOS, Scientific Linux, Fedora, etc. yum list updates yum update Suse/etc zypper ref (Refresh the repos) zypper dup (Normal update and install) HARDEN THE SYSTEM Install Bastille There are a few options around to harden a linux system, but we have tested Bastille in real life scenarios and found it to be the most resilient. It is rather customizable for various types of configurations. apt-get install bastille Choose yes when it asks if you want to continue. Once it is done installing, run: bastille -c This will start the command line interface, to allow you to configure Bastille. From there, you'll accept their terms of agreement, and be on your way. It is safe to say that you can just accept the default values, however you should also read about them. Please see our Bastille Configuration file for a more detailed look at Bastille. It's safe to ignore most errors it throws at the end and beginning of the configuration. Install Apparmor Some packages will install their own enforced profiles. Active profiles for LAM Server: usr.sbin.mysqld usr.sbin.apache2 All activity will be logged by auditd and saved to /var/log/audit/audit.log. apt-get install apparmor-profiles apparmor_status (to see current profiles and associated modes) man apparmor (for more details of what to do with that information) Configure and Use SELinux As this is the more complicated and advanced alternative to Apparmor, there is a detailed checklist that can be found here:  HYPERLINK "https://docs.oracle.com/cd/E37670_01/E36387/html/ol_selinux_sec.html" https://docs.oracle.com/cd/E37670_01/E36387/html/ol_selinux_sec.html and a troublshooting guide can be found here  HYPERLINK "https://wiki.centos.org/HowTos/SELinux" https://wiki.centos.org/HowTos/SELinux. In this release of our checklist, we have excluded our previous steps and notes on SELinux as we believe making changing to SELinux requires greater detail and knowledge [gained by fully referencing the above documents], in an effort to prevent people from cutting and pasting or falling into script kiddie mode. Configure and use PAM authentication daemon The instructions below are assuming that you do not have SELinux installed. These configurations may change with the installation of SELinux. They will be covered in the SELinux documents listed above. Also for further PAM info, refer to the PAM Configurations here:  HYPERLINK "http://doc.mapr.com/display/MapR/PAM+Configuration" http://doc.mapr.com/display/MapR/PAM+Configuration. vi /etc/pam.d/common-password change: password requisite pam_unix.so nullok obscure sha512 to: password requisite pam_unix.so nullok obscure sha512 min=8 Change min=8 with whatever password length you desire to be enforced. Shadow File Password Policy Change minimum and maximum password ages (most likely set to 0:99999 in the file). We suggest changing those to 1:60 for all entries. . Here is a good example of changing password aging from the the shadow file  HYPERLINK "http://www.cyberciti.biz/faq/understanding-etcshadow-file/"http://www.cyberciti.biz/faq/understanding-etcshadow-file/ Shutdown unnecessary services netstat -anp | grep LISTEN | grep -v STREAM Analyze the services and the process id/process name. Determine which services to terminate. Take caution and ensure you research any unknown services (some can break your host). cd /etc find . -print | grep XXX (where XXX is part of the name of the program) For those entries in the "/etc/rc#.d" directory, delete them (rm). Some suggestions to disable: a. Remove or disable the "r" commands. This includes rlogind, rshd, rcmd, rexecd, rbootd, rquotad, rstatd, rusersd, rwalld and rexd. These services are inadequately authenticated. It is better to remove these and use SSH and scp instead. b. Remove or disable fingerd. Remove or disable fingerd if present. Apart from the possibility of a software vulnerability, fingerd allows an attacker to enumerate usernames on the system and to determine the timing and frequency of system administrator logins. c. Remove or disable tftpd. Tftpd is unauthenticated and not protected against brute-force attacks seeking to enumerate and download files. Do not use tftpd (trivial file transfer protocol) unless unavoidable. d. Remove or disable telnet. Telnet sends commands unencrypted over the wire. This enables the sniffing of passwords and other information as well as man-in-the-middle attacks. Replace with SSH. e. Disable SNMP daemon. If present by default, disable any SNMP daemon unless this is really required for the role of the computer. Research this service for further info. Examine INIT files for discrepancies cd /etc/init or /etc/xinit (should match /etc/init.d) cd /etc/init.d (examine the two to make sure they match) cd /etc find rc*.d | xargs ls -l All entries should be links to the ../init.d directory. Investigate those that aren't. Examine startup scripts (00755 is the norm, but 00700 is ok here as well) rc.* (as rc.1-6 or rc1-6.d): chmod 0700 /etc/rc* chmod 0700 /etc/init.d* Here's a good article about services and runlevels:  HYPERLINK "https://www.linux.com/news/enterprise/systems-management/8116-an-introduction-to services-runlevels-and-rcd-scripts" https://www.linux.com/news/enterprise/systems-management/8116-an-introduction-to services-runlevels-and-rcd-scripts/ LOCK DOWN THE USER SESSION Secure terminals The relevant configuration file may be called /etc/ttys, /etc/default/login, /etc/security or /etc/securetty depending on the system. See the manual pages for file format and usage information. Check that the secure option is removed from any local entries that don't need root login capabilities. The secure option should be removed from console if you do not want users to be able to reboot in single user mode. [Note: This does not affect usability of the su command.] If it is not already the default, consider using a special group (such as the wheelgroup on BSD systems) to restrict which users can use su to become root. PATH advice Check that the current directory "." is not in the PATH. Note that an empty string is interpreted to mean the same as "." so also make sure the PATH does not contain any empty strings. For example, the following PATH is insecure: /sbin:/bin:/usr/sbin::/usr/bin This PATH advice is especially important for the root account. Including . in the PATH variable can be used by an attacker to fool a root user into running a malicious binary by substituting ./ls instead of /bin/ls for example. Configure user login sessions to time out automatically. After a certain period of inactivity, in particular for the root user. To do this, set the appropriate variable in your shell's startup files. typeset -r TMOUT=900 (15 minutes = 900 seconds) Securing History chattr +a .bash_history (append) chattr +I .bash_history Users history is being locked and they will have to agree before they use your services. LOCK DOWN config-FILES CONTENT Analyze DNS Looking for rogue entries in the resolv.conf file. vi /etc/resolv.conf Here you should just see the DNS server that the router/modem passed on to your computer, and whatever you have added. Other entries can be considered to be rouge (remember to scroll down). However, before you go and delete your whole file, be sure and lookup the listed server and do your research. Here is a good link for some basic DNS finding info:  HYPERLINK "http://www.cyberciti.biz/faq/how-to-find-out-dns-for-router/"http://www.cyberciti.biz/faq/how-to-find-out-dns-for-router/ Analyze host files Ensure there is nothing redirecting incorrectly here. vi /etc/hosts Analyze contents of permission files If you are running , root should have * as the password. If you are running su, it will have a password. Nobody else aside from you and known users should have a password (the big long hash). If they do, make sure they shouldn't be there, and delete that line. Make sure system users have /bin/null set as their shell. Check for rogue users. vi /etc/passwd vi /etc/shadow SET PERMISSIONS ON SENSITVE SYSTEM FILES Sensitive system files need to have the proper permissions set on them to prevent unauthorized changes (see Integrity in the CIA triad). Configuration Files Firewall chmod 0700 /etc/profile chmod 0700 /etc/hosts.allow chmod 0700 /etc/mtab, chmod 0700 /etc/utmp chmod 0700 /var/adm/wtmp (or /var/log/wtmp), chmod 0700 /etc/syslog.pid (or /var/run/syslog.pid) Kernel chmod 0700 /etc/sysctl.conf chmod 0700 /etc/inittab Users Make sure the owner & group are set to root.root and the permissions are set to 0644 (except on the /etc/shadow file which should be 400). Here is a good link for permission changing in Linux:  HYPERLINK "http://articles.slicehost.com/2010/7/17/checking-linux- file-permissions-with-ls "http://articles.slicehost.com/2010/7/17/checking-linux- file-permissions-with-ls  ls -la /etc/fstab Verify: root.root and -rw-r--r-- (644) ls -la /etc/passwd Verify: root.root and -rw-r--r-- (644) ls -la /etc/shadow Verify: root.root and -rw-r----- (400) ls -la /etc/group Verify: root.root and -rw-rr-- (644) ls -la /etc/sudoers Verify: root.root and -rw-rr-- (644) Log Files Ensure that these files (usually located in /var/log/, /var/adm, or var/tmp) are only writable by root. Any World-Writable Files Ensure that there are no unexpected world writable files or directories on your system. Use the find command to locate these: find / -type d -perm +2 ls chmod 750 rm SET PERMISSIONS ON SENSITIVE BINARIES Another good security practice is to set the permissions on certain commands. However, it is very important to remember that what you change here depends on what system youre using. Also, the location of binaries will differ based upon the system (for instance /bin and /usr/bin and /usr/sbin). For instance a server used for development would need the make command to be able to be run by any user. Whereas, on a production server it would not be needed. Some examples (you'll need to run these as root): Set uid: i / su find / \( -perm -2000 \) chown root:admin /bin/example chmod 02750 /bin/example find / \( -perm -4000 \) chown root:admin /bin/example chmod 04750 /bin/su FURTHER SUGGESTIONS Privilege Escalation chmod 02750 /bin/su chmod 02750 /bin/sudo Network settings: chmod 02750 /bin/ping chmod 02750 /sbin/ifconfig Users On: chmod 02750 /usr/bin/w chmod 02750 /usr/bin/who System Configuration chmod 02750 /usr/bin/locate chmod 02750 /usr/bin/whereis Kernel Modules Ensure that the files holding the kernel and any kernel modules are owned by root, have group ownership set to group id 0 and permissions that prevent them being written to by any non-root users. To list current module directory: echo "Modules dir: /lib/modules/$(uname -r) for kernel version $(uname -r)" To list contents/permissions of that directory: ls -l /lib/modules/$(uname -r) If you would like further information or assistance please contact us and we are always interested in job opportunities. PAUL LOFTNESS  HYPERLINK "mailto:pabloloft@gmail.com" pabloloft@gmail.com  HYPERLINK "https://www.linkedin.com/in/paulloftness" https://www.linkedin.com/in/paulloftness SIMEON BLATCHLEY  HYPERLINK "mailto:simeondmitry@gmail.com" simeon@linkxrdp.com  HYPERLINK "https://www.linkedin.com/in/sblatchley" https://www.linkedin.com/in/sblatchley  ./9:;<IJK{|޸ui^V^ViM^B7hPhPOJQJhPh)6OJQJh5 5OJQJh5 OJQJh)6h)6OJQJh)6h)65OJQJhPhpOJQJhPhBN CJOJQJaJhBN hBN OJQJhPhPCJOJQJaJhPhpCJOJQJaJ%hPhPB*CJ(OJQJaJ(phY%hPhBN B*CJ(OJQJaJ(phY%hPhDX^B*CJ(OJQJaJ(phYhPhpCJ(OJQJaJ(/9:;<K| dgd*dgd{k- $da$gdBN $da$gd*% * 1 2 $ < @ + , } d e ԹwԅwghPhBN 5CJOJQJ\hPhP5OJQJ\hPhp5OJQJ\%hPh{k-OJQJfHq %hPhDX^OJQJfHq %hPhPOJQJfHq h'OJQJhPhPOJQJhPh{k-OJQJhPhBN OJQJhPhpOJQJ% , e 9L`c $da$gd*d-DM gd* $da$gd{k- & Fdgd*dgd* '-589;`c´rrbJ/hPhP0J 5OJQJ\fHq hPhP0J 5OJQJ\%hPhPOJQJfHq hPhp5OJQJhPh5 5OJQJhPhPOJQJhPhP5OJQJhPh5 5OJQJ\hPhP5CJOJQJ\hPh5 5CJOJQJ\hPhBN 5CJOJQJ\hPhBN 5OJQJ\01B36EGX $da$gd*dgd*d-DM gd*/01ABk356\w|βqffSfffSHfhPh5 OJQJ%hPhPOJQJfHq hPhpOJQJhPhFJOJQJ'hPhP5B*CJOJQJ\phY'hPh5 5B*CJOJQJ\phYhPh{k-5OJQJ\hPhFJ5OJQJ\hPh5 5OJQJ\hPhp5OJQJ\hPhPOJQJ/hPhP0J!6OJQJ]fHq =p5FGX !$&=PhiuߗԀxmxh}yh}yOJQJh}yOJQJjh}yOJQJUhPhFJOJQJhPh}y5OJQJ\%hPhPOJQJfHq hPhP5OJQJ\hPhFJ5OJQJ\hPh}yOJQJhPh5 OJQJhPhpOJQJhPhPOJQJ%"G|$lod-DM gdPd-DM gd*dgd*/0<bdeDFxDFGyz{|տݿw%hPhPOJQJfHq hPh}yOJQJhPhP5OJQJ\hPh}y5OJQJ\hPhFJ5OJQJ\hPhPOJQJh}yh}yOJQJh}yOJQJjh}yOJQJU,hwch}y0JOJQJ_H9mH nH9sH tH9&#-28klD_`3^zλλΰΤΙΙΙxk]JΙ%hPhPOJQJfHq hPhP5OJQJ\hPhP0JOJQJ#jhPhPOJQJUjhPhPOJQJUhPhFJOJQJhPhP5OJQJhPhN*cOJQJ%hPhPOJQJfHq hPhPOJQJhPhPOJQJmH sH -hPhPOJQJfHmH q sH 34<?jm1 2 !A!dgd d^` gdFJ d^gdFJd^`gdFJdgdFJdgd*d-DM gd*z<=u"?e'Cim 1 2 J r !ɽɯꯖhPh5OJQJhPhOJQJhPhBN 5OJQJ\hPhP5OJQJ\hPhPOJQJ\hPhFJ5OJQJ\%hPhPOJQJfHq hPhFJOJQJhPhPOJQJ5! ! !!!!!!!!E"b"c"g"h"|""""""""Q#R#迴Պ{{bMb(hPhOJQJ_HmHnHsHtH1jhPhOJQJU_HmHnHsHtHhPhPOJQJmH sH -hPhPOJQJfHmH q sH hBN hPOJQJhBN OJQJhBN hBN OJQJhPhBN OJQJhPhOJQJ%hPhPOJQJfHq hPhPOJQJhPhP5OJQJA!|!!!!!F"c"|"""####m&n&{&a''g($d^a$gd d^gddgd* d`gdBN d^gdBN d-DM gd*R##########*$F$$$$$%5%h%%%%%&m&o&z&&&&'E'a'm'wlllllllllll` *hPhPOJQJhPhOJQJhPh5OJQJ\'hPhP5B*CJOJQJ\phY'hPh5B*CJOJQJ\phY'hPhBN 5B*CJOJQJ\phYhPhP5OJQJ\hPhPOJQJ1jhPhOJQJU_HmHnHsHtHhPh0JOJQJ!m'''''( (A(E(Q(X(g(((((1)3)e)f)h)y){))))))*0*1*2*=*@*M*r*u**ݼݵݣݐ}jݼ__ݐhPhRVOJQJ$hPhP5B*CJOJQJphY$hPh5B*CJOJQJphY%hPhPOJQJfHq "hPhP5OJPJQJ\^J h)6hPhPhP5OJQJ\%hPhPOJQJfHq hPhPOJQJhPhOJQJ *hPhOJQJ%g(i(1)f)h)y))))**1*?*s***+{,}, d^gdBN d`gdRVdgdBN d-DM gd* d`gd -DM gdP d^gddgd********'+D+m++++++;,<,=,y,z,},,,,,,,,,-3-P-----.<.Z....ۼo#hPhRV5B*OJQJ\phY%hPhPOJQJfHq hPhRVOJQJ\hPhP5OJQJ\hPhRV5OJQJ\hPhP0JOJQJ#jhPhPOJQJUjhPhPOJQJUhPhRVOJQJhPhPOJQJ)},,,,,-Z.m....6/K/T/r/////4050  d^ gdRV & Fdgd*dgdRV d^gdRVd-DM gd*dgd* d`gdRV..5/7/J/K/T/X/4050<0@0K0`0k0y0~000000191A1B1D1E11111112ȽȽֽֽֽֽxfxYxhPhP0JOJQJ#jhPhPOJQJUjhPhPOJQJUhRVhRVOJQJhPhP5OJQJhPhRV5OJQJ%hPhPOJQJfHq hPhPOJQJhPhP5OJQJ\hPhRVOJQJhPhRVOJQJ\#hPhP5B*OJQJ\phY"50<0\0x0y00B11128292O2w2x222222 $da$gdRVd-DM gd*dgd*  d^ gdRVd^`gd*d-DM gdP & Fdgd*292O2x22222 30393:3Q3f3p3q3y3~33333333 4=4n4p4444ƻԉ}kY#hPhP5B*OJQJ\phY#hPhr.T5B*OJQJ\phYhPhP5OJQJhPhBN 5OJQJ%hPhRVOJQJfHq %hPhPOJQJfHq hPhRVOJQJhPhRV5OJQJ\hPhP5OJQJ\%hPhPOJQJfHq hPhPOJQJ2 3/303:3333:4Z4h4n4p446666667&7 d^gdRV d^gdRV d`gdRVdgd* $da$gdRVd-DM gd*4444515@5F5j55555555555 6,6`6666666^7a7t7u7꜇tbP#hPhP5B*OJQJ\phY#hPhr.T5B*OJQJ\phY%hPhPOJQJfHq (hPhP5OJQJfHq hPhP5OJQJhPhP5OJQJ\%hPhPOJQJfHq %hPhr.TOJQJfHq hPhP6OJQJ\hPhPOJQJhPhr.TOJQJ&7G7^7`7u77777788.8J8a88888w999 d^gdr.T d`gdr.Tdgdr.Tgdr.TdgdBN dgd*d-DM gd*u7v7w7777778 88J8a8888909i9w9x99999: :?:@:A:B:v::üvgXhPhOCJOJQJaJhPhr.TCJOJQJaJhPhOOJQJhPhP0J"5OJQJhPhP0J"OJQJ)hPhP0J"OJQJfHq hPhr.TOJQJ hr.ThP%hPhPOJQJfHq hPhP5OJQJhPhr.T5OJQJ h)6hPhPhPOJQJ 99:?:@:A:B::::: ;m;n;o;;;;"< $da$gdad< $da$gdr.Tdgdad< $da$gdr.TdgdOd-DM gd*dgd*:::::::::::; ; ; ;A;B;j;k;o;;;Ĺ}n}]P]7]PP0had<hr.T0JCJOJQJ_H9mH nH9sH tH9had<hr.TCJOJQJ!jhad<hr.TCJOJQJUhPhr.T0JCJOJQJhPhr.TCJOJQJ!jhPhr.TCJOJQJU$hPhr.T5B*CJOJQJphYhPhr.TOJQJhPhOOJQJhPhOCJOJQJaJhad<had<CJOJQJaJhad<hOCJOJQJaJhPhad<CJOJQJaJ;;;;;;;;;;< <"<0had<hr.T0JCJOJQJ_H9mH nH9sH tH90had<hy8r0JCJOJQJ_H9mH nH9sH tH9had<hr.TCJOJQJ!jhad<hr.TCJOJQJU ,1h/ =!n"n#n$n% DyK yK vhttp://www.cyberciti.biz/faq/understanding-etcshadow-file/DyK yK zhttp://www.cyberciti.biz/faq/how-to-find-out-dns-for-router/DyK yK http://articles.slicehost.com/2010/7/17/checking-linux-%20file-permissions-with-ls%20-666666666vvvvvvvvv66666686666666666666666666666666666666666666666666666666hH66666666666666666666666666666666666666666666666666666666666666666p62&6FVfv2(&6FVfv&6FVfv&6FVfv&6FVfv&6FVfv&6FVfv8XV~_HmH nH sH tH R`R Normal*$1$$CJKHPJ^J_H9aJmH sH tH9`@B` +)6 Heading 4dd*$1$@&[$\$5KHPJ\^J_HtH h@Rh ,)6 Heading 5dd*$1$@&[$\$"5CJKHPJ\^J_HaJtH DA D Default Paragraph FontViV 0 Table Normal :V 44 la (k ( 0No List J/J Absatz-StandardschriftartP/P WW-Absatz-StandardschriftartR/R WW-Absatz-Standardschriftart1T/!T WW-Absatz-Standardschriftart11V/1V WW-Absatz-Standardschriftart111X/AX WW-Absatz-Standardschriftart1111Z/QZ !WW-Absatz-Standardschriftart11111\/a\ "WW-Absatz-Standardschriftart111111.oq. WW8Num3z05DA D Default Paragraph Font^/^ #WW-Absatz-Standardschriftart1111111`/` $WW-Absatz-Standardschriftart11111111b/b %WW-Absatz-Standardschriftart111111111d/d &WW-Absatz-Standardschriftart1111111111f/f 'WW-Absatz-Standardschriftart11111111111FU`F Hyperlink>*B* _HmHphsHtH:/: Numbering Symbols*W`* `Strong5\.X`. Emphasis6]>o!> Source TextOJPJQJ^JFV`1F FollowedHyperlink >*B* phNORN Heading $x$OJQJCJPJ^JaJ6BR6 Body Text %x$/Qb$ List&D"@rD Caption 'xx $CJ6aJ]** Index( $DD Quotations)^7]7`^O^ Preformatted Text *OJQJCJPJ^JaJBoB )6Heading 4 Char5CJ\aJ:o: )6Heading 5 Char5\PK!pO[Content_Types].xmlj0Eжr(΢]yl#!MB;.n̨̽\A1&ҫ QWKvUbOX#&1`RT9<l#$>r `С-;c=1g~'}xPiB$IO1Êk9IcLHY<;*v7'aE\h>=^,*8q;^*4?Wq{nԉogAߤ>8f2*<")QHxK |]Zz)ӁMSm@\&>!7;wP3[EBU`1OC5VD Xa?p S4[NS28;Y[꫙,T1|n;+/ʕj\\,E:! t4.T̡ e1 }; [z^pl@ok0e g@GGHPXNT,مde|*YdT\Y䀰+(T7$ow2缂#G֛ʥ?q NK-/M,WgxFV/FQⷶO&ecx\QLW@H!+{[|{!KAi `cm2iU|Y+ ި [[vxrNE3pmR =Y04,!&0+WC܃@oOS2'Sٮ05$ɤ]pm3Ft GɄ-!y"ӉV . `עv,O.%вKasSƭvMz`3{9+e@eՔLy7W_XtlPK! ѐ'theme/theme/_rels/themeManager.xml.relsM 0wooӺ&݈Э5 6?$Q ,.aic21h:qm@RN;d`o7gK(M&$R(.1r'JЊT8V"AȻHu}|$b{P8g/]QAsم(#L[PK-!pO[Content_Types].xmlPK-!֧6 -_rels/.relsPK-!kytheme/theme/themeManager.xmlPK-!!Z!theme/theme/theme1.xmlPK-! ѐ'( theme/theme/_rels/themeManager.xml.relsPK]# "4z z!R#m'*.24u7:;"<!#%&()+,./13579;< A!g(},502&79"< "$'*-02468:h / d Fy_Q#<$y$D)))223 3A3j3333334"4XXXXXXXXXXX8@0( _TE B S  ?AI&(rw^a%58ciktmrO W 5 = J Y ( 0   3:ORZ]^`}  # /4 %589?GJKQtwxzR(+,036GJX[\e)Z\bfmpqux{{!!!!!!!!"""`"k"z"}"~""$$P%R%a&d&e&k&t&w&Y'^'e'h'w'|'''''''''''''''''''''''''''''(( (((( (#(((2(@(E(L(O(P([(`(e(l(o(p(w(((((* * ***!*(***D*G*H*N*W*`*g*i**************+++++ +"+g+j+r+u+v+y+~++++],b,k,m,------............)/.///9/J/O/[/]////////////////000$0'01060>0A0d0i0q0t000000011111152:2$4$:?=@PSc!4$4::::::::lVHll'v~h ^`OJQJo( 8^8`OJQJo(^`OJQJ^Jo(o  p^ `OJQJo(  @ ^ `OJQJo( x^x`OJQJo(H^H`OJQJ^Jo(o ^`OJQJo( ^`OJQJo(^`.^`. ^ `.P^`P@@^@`0^`0``^``^`^`^``^``00^0`^`CJOJQJo(^`CJOJQJo(opp^p`CJOJQJo(@ @ ^@ `CJOJQJo(^`CJOJQJo(^`CJOJQJo(^`CJOJQJo(^`CJOJQJo(PP^P`CJOJQJo(^`5o(. ^`hH. pL^p`LhH. @ ^@ `hH. ^`hH. L^`LhH. ^`hH. ^`hH. PL^P`LhH.'vHWW8Num1WW8Num2WW8Num3vU c        8 ]^ 2'EEuz2'BN {k-)6ad<`bMr.TDX^N*cy8r}yO*5 pFJRVP'"4$4@ z"4p@Unknown G*Ax Times New Roman5Symbol3 *Cx Arial7@ CalibrioDAAAAA+TimesNewRomanPS-BoldMT-3 fgK DejaVu Sans-3 fgI4DejaVu Sans Mono? *Cx Courier New;WingdingsA$BCambria Math" hr;A;A[, ^[, ^! 044BQ P$P)6! xx muffinStephen Turner(        Oh+'0x  ( 4 @ LX`hp'muffin Normal.dotmStephen Turner3Microsoft Macintosh Word@@@5|I@I [, ՜.+,D՜.+,< hp  'United States Army^4  Titled 8@ _PID_HLINKS'AB(}'https://www.linkedin.com/in/sblatchley,imailto:simeondmitry@gmail.com\)https://www.linkedin.com/in/paulloftnessH`mailto:pabloloft@gmail.comwORhttp://articles.slicehost.com/2010/7/17/checking-linux- file-permissions-with-ls EI=http://www.cyberciti.biz/faq/how-to-find-out-dns-for-router/U1 thttps://www.linux.com/news/enterprise/systems-management/8116-an-introduction-to services-runlevels-and-rcd-scriptskx ;http://www.cyberciti.biz/faq/understanding-etcshadow-file/(q3http://doc.mapr.com/display/MapR/PAM+Configuration>a'https://wiki.centos.org/HowTos/SELinuxwEhttps://docs.oracle.com/cd/E37670_01/E36387/html/ol_selinux_sec.html  !"#$%&'()*+,-./0123456789:;<=?@ABCDEGHIJKLMNOPQRSTUVWXYZ[\]^_`abcefghijkmnopqrsvRoot Entry Fr5IxData >1TableF;WordDocument.zSummaryInformation(dDocumentSummaryInformation8lCompObj` F Microsoft Word 97-2004 DocumentNB6WWord.Document.8