Disable Logwatch on Clients if a Logserver Exists
If your site have a central logserver which has been configured to report on logs received from all systems, then
# rm /etc/cron.daily/0logwatch
If no logserver exists, it will be necessary for each machine to run Logwatch individually.
Using a central logserver provides the security and reliability benefits discussed earlier, and also makes monitoring logs easier and less time-intensive for administrators.
How to disable X Window System Listening
To prevent X.org from listening for remote connections, create the file /etc/X11/xinit/xserverrc and fill it with the following line:
exec X :0 -nolisten tcp $@
One of X.org’s features is the ability to provide remote graphical display. This feature should be disabled unless it is required. If the system uses runlevel 5, which is the default, the GDM display manager starts X safely, with remote listening disabled. However, if X is started from the command line with the startx command, then the server will listen for new connections on X’s default port, 6000.
How to disable Zeroconf Networking
Zeroconf networking allows the system to assign itself an IP address and engage in IP communication without a statically-assigned address or even a DHCP server. Automatic address assignment via Zeroconf (or DHCP) is not recommended.
To disable Zeroconf automatic route assignment in the 169.245.0.0 subnet, add or correct the following line in /etc/sysconfig/network
Zeroconf addresses are in the network 169.254.0.0. The networking scripts add entries to the system’s routing table for these addresses. Zeroconf address assignment commonly occurs when the system is configured to use DHCP but fails to receive an address assignment from the DHCP server.
How to disable Support for TIPC
The Transparent Inter-Process Communication protocol allows applications in a clustered computer environment to communicate quickly and reliably with other applications, regardless of their location within the cluster.
If the TIPC protocol is not needed, its kernel module can be prevented from loading. To do so, add the following line to /etc/modprobe.conf
How to disable Wireless Drivers
Removing the kernel drivers that provide support for wireless Ethernet devices will prevent users from easily activating the devices.
To remove the wireless drivers from the system:
# rm -r /lib/modules/kernelversion(s) /kernel/drivers/net/wireless
