コード表示 1.1: /etc/apache2/vhosts.d/00_default_vhost.conf

# あなたのIPで、それをlistenするようにしてください
Listen 127.0.0.1

コード表示 1.1: /etc/apache2/modules.d/00_default_settings.conf

ServerSignature Off

コード表示 1.1: BINDをchrootする

# emerge --config bind
(上記コマンドの実行前、chrootするディレクトリを/etc/conf.d/namedで変更すると良いでしょう。
変更しなければ、/chroot/dnsが使用されます。)

コード表示 1.1: ネットワークアクセスを無効にする

skip-networking

コード表示 1.1: [mysqld]セクションにおいて、LOAD DATA LOCAL INFILEを無効にする

set-variable=local-infile=0

コード表示 1.1: サンプルのデータベースと全ての必要でないユーザを削除する

mysql> drop database test;
mysql> use mysql;
mysql> delete from db;
mysql> delete from user where not (host="localhost" and user="root");
mysql> flush privileges;

コード表示 1.1: /etc/proftpd/proftpd.conf

ServerName "My ftp daemon"
#Don't show the ident of the server
ServerIdent on "Go away"

#Makes it easier to create virtual users
RequireValidShell off

#Use alternative password and group file (passwd uses crypt format)
AuthUserFile "/etc/proftpd/passwd"
AuthGroupFile "/etc/proftpd/group"

# Permissions
Umask 077

# Timeouts and limitations
MaxInstances 30
MaxClients 10 "Only 10 connections allowed"
MaxClientsPerHost 1 "You have already logged on once"
MaxClientsPerUser 1 "You have already logged on once"
TimeoutStalled 10
TimeoutNoTransfer 20
TimeoutLogin 20

#Chroot everyone
DefaultRoot ~

#don't run as root
User  nobody
Group nogroup

#Log every transfer
TransferLog /var/log/transferlog

#Problems with globbing
DenyFilter \*.*/

コード表示 1.1: /etc/conf.d/pure-ftpd

AUTH="-lpuredb:/etc/pureftpd.pdb"

## Misc. Others ##
MISC_OTHER="-A -E -X -U 177:077 -d -4 -L100:5 -I 15"

コード表示 1.1: /etc/vsftpd

anonymous_enable=NO
local_enable=YES

#read only
write_enable=NO

#enable logging of transfers
xferlog_std_format=YES

idle_session_timeout=20
data_connection_timeout=20
nopriv_user=nobody

chroot_list_enable=YES
chroot_list_file=/etc/vsftpd/chrootlist

ls_recurse_enable=NO

コード表示 1.1: /etc/samba/smb.conf

[global]
  #Bind to an interface
  interfaces = eth0 10.0.0.1/32

  #Make sure to use encrypted password
  encrypt passwords = yes
  directory security mask = 0700

  #allow traffic from 10.0.0.*
  hosts allow = 10.0.0.

  #Enables user authentication 
  #(don't use the share mode)
  security = user

  #Disallow privileged accounts
  invalid users = root @wheel

  #Maximum size smb shows for a share (not a limit)
  max disk size = 102400

  #Uphold the password policy
  min password length = 8
  null passwords = no

  #Use PAM (if added support)
  obey pam restrictions = yes
  pam password change = yes

コード表示 1.1: /etc/ssh/sshd_config

#Only enable version 2
Protocol 2

#Disable root login. Users have to su to root
PermitRootLogin no

#Turn on Public key authentication
PubkeyAuthentication yes
AuthorizedKeysFile      .ssh/authorized_keys

#Disable .rhost and normal password authentication
HostbasedAuthentication no
PasswordAuthentication no
PermitEmptyPasswords no

#Only allow userin the wheel or admin group to login
AllowGroups wheel admin

#In those groups only allow the following users
#The @<domainname> is optional but replaces the 
#older AllowHosts directive
AllowUsers kn@gentoo.org bs@gentoo.org

#Logging 
SyslogFacility AUTH
LogLevel INFO

（これをあなたのアドレスに変更してください）
ListenAddress 127.0.0.1

コード表示 1.1: 1組のDSA Keyを作成する

# /usr/bin/ssh-keygen -t dsa

コード表示 1.1: ssh-keygenの出力

Generating public/private dsa key pair.
Enter file in which to save the key (/home/kn/.ssh/id_dsa):[Press enter]
Created directory '/home/kn/.ssh'.
Enter passphrase (empty for no passphrase): [Enter passphrase]
Enter same passphrase again: [Enter passphrase again]
Your identification has been saved in /home/kn/.ssh/id_dsa.
Your public key has been saved in /home/kn/.ssh/id_dsa.pub.
The key fingerprint is:
07:24:a9:12:7f:83:7e:af:b8:1f:89:a3:48:29:e2:a4 kn@knielsen

コード表示 1.1: id_dsa.pubファイルを、authorized_keysファイルに追加する

$ scp id_dsa.pub other-host:/var/tmp/currenthostname.pub
$ ssh other-host
password: 
$ cat /var/tmp/currenthostname.pub >> ~/.ssh/authorized_keys

コード表示 1.1: xinetdをインストールする

# emerge xinetd tcp-wrappers

コード表示 1.1: /etc/xinetd.conf

defaults
{
 only_from = localhost
 instances = 10
 log_type = SYSLOG authpriv info
 log_on_success = HOST PID
 log_on_failure = HOST
 cps = 25 30
}

# This will setup pserver (cvs) via xinetd with the following settings:
# max 10 instances (10 connections at a time)
# limit the pserver to tcp only
# use the user cvs to run this service
# bind the interfaces to only 1 ip
# allow access from 10.0.0.*
# limit the time developers can use cvs from 8am to 5pm
# use tpcd wrappers (access control controlled in 
# /etc/hosts.allow and /etc/hosts.deny)
# max_load on the machine set to 1.0
# The disable flag is per default set to no but I like having 
# it in case of it should be disabled
service cvspserver
{
 socket_type = stream
 protocol = tcp
 instances = 10
 protocol = tcp
 wait = no
 user = cvs
 bind = 10.0.0.2
 only_from = 10.0.0.0
 access_times = 8:00-17:00
 server = /usr/sbin/tcpd
 server_args = /usr/bin/cvs --allow-root=/mnt/cvsdisk/cvsroot pserver
 max_load = 1.0
 log_on_failure += RECORD
 disable = no
}

コード表示 1.1: /usr/X11R6/bin/startx

defaultserverargs="-nolisten tcp"

コード表示 1.1: /etc/make.conf

CONFIG_PROTECT_MASK="/usr/X11R6/bin/startx"

コード表示 1.1: /etc/X11/gdm/gdm.conf

[server-Standard]
command=/usr/X11R6/bin/X -nolisten tcp

コード表示 1.1: /etc/X11/xdm/Xservers

:0 local /usr/bin/X11/X -nolisten tcp