-
Language:
English
-
Language:
English
Security Guide
For Red Hat Enterprise Linux 4
Edition 2
Copyright © 2008 Red Hat, Inc
Abstract
Introduction
- Firewalls
- Encryption
- Securing Critical Services
- Virtual Private Networks
- Intrusion Detection
- General Introduction to Security
- Configuring Red Hat Enterprise Linux for Security
- Assessing Your Security
- Intrusions and Incident Response
- Appendix
- The Installation Guide provides information regarding installation.
- The Red Hat Enterprise Linux Introduction to System Adminitration contains introductory information for new Red Hat Enterprise Linux system administrators.
- The System Administrators Guide offers detailed information about configuring Red Hat Enterprise Linux to suit your particular needs as a user. This guide includes some services that are discussed (from a security standpoint) in the Security Guide.
- Reference Guide provides detailed information suited for more experienced users to refer to when needed, as opposed to step-by-step instructions.
1. More to Come
1.1. Send in Your Feedback
http://bugzilla.redhat.com/bugzilla/
) against the component rhel-sg
.
rhel-sg
Part I. A General Introduction to Security
Chapter 1. Security Overview
1.1. What is Computer Security?
1.1.1. How did Computer Security Come about?
1.1.2. Computer Security Timeline
1.1.2.1. The 1960s
- Students at the Massachusetts Institute of Technology (MIT) form the Tech Model Railroad Club (TMRC) begin exploring and programming the school's PDP-1 mainframe computer system. The group eventually coined the term "hacker" in the context it is known today.
- The DoD creates the Advanced Research Projects Agency Network (ARPANet), which gains popularity in research and academic circles as a conduit for the electronic exchange of data and information. This paves the way for the creation of the carrier network known today as the Internet.
- Ken Thompson develops the UNIX operating system, widely hailed as the most "hacker-friendly" OS because of its accessible developer tools and compilers, and its supportive user community. Around the same time, Dennis Ritchie develops the C programming language, arguably the most popular hacking language in computer history.
1.1.2.2. The 1970s
- Bolt, Beranek, and Newman, a computing research and development contractor for government and industry, develops the Telnet protocol, a public extension of the ARPANet. This opens doors for the public use of data networks which were once restricted to government contractors and academic researchers. Telnet, though, is also arguably the most insecure protocol for public networks, according to several security researchers.
- Steve Jobs and Steve Wozniak found Apple Computer and begin marketing the Personal Computer (PC). The PC is the springboard for several malicious users to learn the craft of cracking systems remotely using common PC communication hardware such as analog modems and war dialers.
- Jim Ellis and Tom Truscott create USENET, a bulletin-board-style system for electronic communication between disparate users. USENET quickly becomes one of the most popular forums for the exchange of ideas in computing, networking, and, of course, cracking.
1.1.2.3. The 1980s
- IBM develops and markets PCs based on the Intel 8086 microprocessor, a relatively inexpensive architecture that brought computing from the office to the home. This serves to commodify the PC as a common and accessible tool that was fairly powerful and easy to use, aiding in the proliferation of such hardware in the homes and offices of malicious users.
- The Transmission Control Protocol, developed by Vint Cerf, is split into two separate parts. The Internet Protocol is born from this split, and the combined TCP/IP protocol becomes the standard for all Internet communication today.
- Based on developments in the area of phreaking, or exploring and hacking the telephone system, the magazine 2600: The Hacker Quarterly is created and begins discussion on topics such as cracking computers and computer networks to a broad audience.
- The 414 gang (named after the area code where they lived and hacked from) are raided by authorities after a nine-day cracking spree where they break into systems from such top-secret locations as the Los Alamos National Laboratory, a nuclear weapons research facility.
- The Legion of Doom and the Chaos Computer Club are two pioneering cracker groups that begin exploiting vulnerabilities in computers and electronic data networks.
- The Computer Fraud and Abuse Act of 1986 is voted into law by congress based on the exploits of Ian Murphy, also known as Captain Zap, who broke into military computers, stole information from company merchandise order databases, and used restricted government telephone switchboards to make phone calls.
- Based on the Computer Fraud and Abuse Act, the courts convict Robert Morris, a graduate student, for unleashing the Morris Worm to over 6,000 vulnerable computers connected to the Internet. The next most prominent case ruled under this act was Herbert Zinn, a high-school dropout who cracked and misused systems belonging to AT&T and the DoD.
- Based on concerns that the Morris Worm ordeal could be replicated, the Computer Emergency Response Team (CERT) is created to alert computer users of network security issues.
- Clifford Stoll writes The Cuckoo's Egg, Stoll's account of investigating crackers who exploit his system.
1.1.2.4. The 1990s
- ARPANet is decommissioned. Traffic from that network is transferred to the Internet.
- Linus Torvalds develops the Linux kernel for use with the GNU operating system; the widespread development and adoption of Linux is largely due to the collaboration of users and developers communicating via the Internet. Because of its roots in UNIX, Linux is most popular among hackers and administrators who found it quite useful for building secure alternatives to legacy servers running proprietary (closed-source) operating systems.
- The graphical Web browser is created and sparks an exponentially higher demand for public Internet access.
- Vladimir Levin and accomplices illegally transfer US$10 Million in funds to several accounts by cracking into the CitiBank central database. Levin is arrested by Interpol and almost all of the money is recovered.
- Possibly the most heralded of all crackers is Kevin Mitnick, who hacked into several corporate systems, stealing everything from personal information of celebrities to over 20,000 credit card numbers and source code for proprietary software. He is arrested and convicted of wire fraud charges and serves 5 years in prison.
- Kevin Poulsen and an unknown accomplice rig radio station phone systems to win cars and cash prizes. He is convicted for computer and wire fraud and is sentenced to 5 years in prison.
- The stories of cracking and phreaking become legend, and several prospective crackers convene at the annual DefCon convention to celebrate cracking and exchange ideas between peers.
- A 19-year-old Israeli student is arrested and convicted for coordinating numerous break-ins to US government systems during the Persian-Gulf conflict. Military officials call it "the most organized and systematic attack" on government systems in US history.
- US Attorney General Janet Reno, in response to escalated security breaches in government systems, establishes the National Infrastructure Protection Center.
- British communications satellites are taken over and ransomed by unknown offenders. The British government eventually seizes control of the satellites.
1.1.3. Security Today
- On any given day, there are approximately 225 major incidences of security breach reported to the CERT Coordination Center at Carnegie Mellon University.[1]
- In 2003, the number of CERT reported incidences jumped to 137,529 from 82,094 in 2002 and from 52,658 in 2001.[2]
- The worldwide economic impact of the three most dangerous Internet Viruses of the last three years was estimated at US$13.2 Billion.[3]
1.1.4. Standardizing Security
- Confidentiality — Sensitive information must be available only to a set of pre-defined individuals. Unauthorized transmission and usage of information should be restricted. For example, confidentiality of information ensures that a customer's personal or financial information is not obtained by an unauthorized individual for malicious purposes such as identity theft or credit fraud.
- Integrity — Information should not be altered in ways that render it incomplete or incorrect. Unauthorized users should be restricted from the ability to modify or destroy sensitive information.
- Availability — Information should be accessible to authorized users any time that it is needed. Availability is a warranty that information can be obtained with an agreed-upon frequency and timeliness. This is often measured in terms of percentages and agreed to formally in Service Level Agreements (SLAs) used by network service providers and their enterprise clients.
1.2. Security Controls
- Physical
- Technical
- Administrative
1.2.1. Physical Controls
- Closed-circuit surveillance cameras
- Motion or thermal alarm systems
- Security guards
- Picture IDs
- Locked and dead-bolted steel doors
- Biometrics (includes fingerprint, voice, face, iris, handwriting, and other automated methods used to recognize individuals)
1.2.2. Technical Controls
- Encryption
- Smart cards
- Network authentication
- Access control lists (ACLs)
- File integrity auditing software
1.2.3. Administrative Controls
- Training and awareness
- Disaster preparedness and recovery plans
- Personnel recruitment and separation strategies
- Personnel registration and accounting
1.3. Conclusion
Chapter 2. Attackers and Vulnerabilities
2.1. A Quick History of Hackers
2.1.1. Shades of Grey
2.2. Threats to Network Security
2.2.1. Insecure Architectures
2.2.1.1. Broadcast Networks
2.2.1.2. Centralized Servers
2.3. Threats to Server Security
2.3.1. Unused Services and Open Ports
2.3.2. Unpatched Services
2.3.3. Inattentive Administration
2.3.4. Inherently Insecure Services
2.4. Threats to Workstation and Home PC Security
2.4.1. Bad Passwords
2.4.2. Vulnerable Client Applications
Part II. Configuring Red Hat Enterprise Linux for Security
Chapter 3. Security Updates
3.1. Updating Packages
- Listed and available for download on Red Hat Network
- Listed and unlinked on the Red Hat Errata website
Note
3.1.1. Using Red Hat Network
Note
Important
3.1.2. Using the Red Hat Errata Website
/tmp/updates
, and save all the downloaded packages to it.
3.1.3. Verifying Signed Packages
/mnt/cdrom
, use the following command to import it into the keyring (a database of trusted keys on the system):
rpm --import /mnt/cdrom/RPM-GPG-KEY
rpm -qa gpg-pubkey*
gpg-pubkey-db42a60e-37ea5438
rpm -qi
command followed by the output from the previous command, as in this example:
rpm -qi gpg-pubkey-db42a60e-37ea5438
rpm -K /tmp/updates/*.rpm
gpg OK
. If it doesn't, make sure you are using the correct Red Hat public key, as well as verifying the source of the content. Packages that do not pass GPG verfications should not be installed, as they may have been altered by a third party.
3.1.4. Installing Signed Packages
rpm -Uvh /tmp/updates/*.rpm
rpm -ivh /tmp/updates/<kernel-package>
rpm -e <old-kernel-package>
Note
Important
3.1.5. Applying the Changes
Note
- Applications
- User-space applications are any programs which can be initiated by a system user. Typically, such applications are used only when a user, script, or automated task utility launches them and they do not persist for long periods of time.Once such a user-space application is updated, halt any instances of the application on the system and launch the program again to use the updated version.
- Kernel
- The kernel is the core software component for the Red Hat Enterprise Linux operating system. It manages access to memory, the processor, and peripherals as well as schedules all tasks.Because of its central role, the kernel cannot be restarted without also stopping the computer. Therefore, an updated version of the kernel cannot be used until the system is rebooted.
- Shared Libraries
- Shared libraries are units of code, such as
glibc
, which are used by a number of applications and services. Applications utilizing a shared library typically load the shared code when the application is initialized, so any applications using the updated library must be halted and relaunched.To determine which running applications link against a particular library, use thelsof
command as in the following example:lsof /usr/lib/libwrap.so*
This command returns a list of all the running programs which use TCP wrappers for host access control. Therefore, any program listed must be halted and relaunched if thetcp_wrappers
package is updated. - SysV Services
- SysV services are persistent server programs launched during the boot process. Examples of SysV services include
sshd
,vsftpd
, andxinetd
.Because these programs usually persist in memory as long as the machine is booted, each updated SysV service must be halted and relaunched after the package is upgraded. This can be done using the Services Configuration Tool or by logging into a root shell prompt and issuing the/sbin/service
command as in the following example:/sbin/service <service-name> restart
In the previous example, replace <service-name> with the name of the service, such assshd
.Refer to the chapter titled Controlling Access to Services in the System Administrators Guide for more information regarding the Services Configuration Tool. xinetd
Services- Services controlled by the
xinetd
super service only run when a there is an active connection. Examples of services controlled byxinetd
include Telnet, IMAP, and POP3.Because new instances of these services are launched byxinetd
each time a new request is received, connections that occur after an upgrade are handled by the updated software. However, if there are active connections at the time thexinetd
controlled service is upgraded, they are serviced by the older version of the software.To kill off older instances of a particularxinetd
controlled service, upgrade the package for the service then halt all processes currently running. To determine if the process is running, use theps
command and then use thekill
orkillall
command to halt current instances of the service.For example, if security errataimap
packages are released, upgrade the packages, then type the following command as root into a shell prompt:ps -aux | grep imap
This command returns all active IMAP sessions. Individual sessions can then be terminated by issuing the following command:kill -9 <PID>
In the previous example, replace <PID> with the process identification number (found in the second column of theps
command) for an IMAP session.To kill all active IMAP sessions, issue the following command:killall imapd
Refer to the chapter titled TCP Wrappers andxinetd
in the Reference Guide for general information regardingxinetd
.
Chapter 4. Workstation Security
4.1. Evaluating Workstation Security
- BIOS and Boot Loader Security — Can an unauthorized user physically access the machine and boot into single user or rescue mode without a password?
- Password Security — How secure are the user account passwords on the machine?
- Administrative Controls — Who has an account on the system and how much administrative control do they have?
- Available Network Services — What services are listening for requests from the network and should they be running at all?
- Personal Firewalls — What type of firewall, if any, is necessary?
- Security Enhanced Communication Tools — Which tools should be used to communicate between workstations and which should be avoided?
4.2. BIOS and Boot Loader Security
4.2.1. BIOS Passwords
- Preventing Changes to BIOS Settings — If an intruder has access to the BIOS, they can set it to boot from a diskette or CD-ROM. This makes it possible for them to enter rescue mode or single user mode, which in turn allows them to start arbitrary processes on the system or copy sensitive data.
- Preventing System Booting — Some BIOSes allow password protection of the boot process. When activated, an attacker is forced to enter a password before the BIOS launches the boot loader.
4.2.1.1. Securing Non-x86 Platforms
4.2.2. Boot Loader Passwords
- Preventing Access to Single User Mode — If attackers can boot the system into single user mode, they are logged in automatically as root without being prompted for the root password.
- Preventing Access to the GRUB Console — If the machine uses GRUB as its boot loader, an attacker can use the use the GRUB editor interface to change its configuration or to gather information using the
cat
command. - Preventing Access to Non-Secure Operating Systems — If it is a dual-boot system, an attacker can select at boot time an operating system, such as DOS, which ignores access controls and file permissions.
4.2.2.1. Password Protecting GRUB
/sbin/grub-md5-crypt
/boot/grub/grub.conf
. Open the file and below the timeout
line in the main section of the document, add the following line:
password --md5 <password-hash>
/sbin/grub-md5-crypt
[6].
/boot/grub/grub.conf
file must be edited.
title
line of the non-secure operating system and add a line that says lock
directly beneath it.
title DOS lock
Warning
password
line must be present in the main section of the /boot/grub/grub.conf
file for this method to work properly. Otherwise, an attacker can access the GRUB editor interface and remove the lock line.
lock
line to the stanza, followed by a password line.
title DOS lock password --md5 <password-hash>
4.3. Password Security
/etc/passwd
file, which makes the system vulnerable to offline password cracking attacks. If an intruder can gain access to the machine as a regular user, he can copy the /etc/passwd
file to his own machine and run any number of password cracking programs against it. If there is an insecure password in the file, it is only a matter of time before the password cracker discovers it.
/etc/shadow
, which is readable only by the root user.
4.3.1. Creating Strong Passwords
- Do Not Do the Following:
- Do Not Use Only Words or Numbers — Never use only numbers or words in a password.Some insecure examples include the following:
- 8675309
- juan
- hackme
- Do Not Use Recognizable Words — Words such as proper names, dictionary words, or even terms from television shows or novels should be avoided, even if they are bookended with numbers.Some insecure examples include the following:
- john1
- DS-9
- mentat123
- Do Not Use Words in Foreign Languages — Password cracking programs often check against word lists that encompass dictionaries of many languages. Relying on foreign languages for secure passwords is not secure.Some insecure examples include the following:
- cheguevara
- bienvenido1
- 1dumbKopf
- Do Not Use Hacker Terminology — If you think you are elite because you use hacker terminology — also called l337 (LEET) speak — in your password, think again. Many word lists include LEET speak.Some insecure examples include the following:
- H4X0R
- 1337
- Do Not Use Personal Information — Steer clear of personal information. If the attacker knows your identity, the task of deducing your password becomes easier. The following is a list of the types of information to avoid when creating a password:Some insecure examples include the following:
- Your name
- The names of pets
- The names of family members
- Any birth dates
- Your phone number or zip code
- Do Not Invert Recognizable Words — Good password checkers always reverse common words, so inverting a bad password does not make it any more secure.Some insecure examples include the following:
- R0X4H
- nauj
- 9-DS
- Do Not Write Down Your Password — Never store a password on paper. It is much safer to memorize it.
- Do Not Use the Same Password For All Machines — It is important to make separate passwords for each machine. This way if one system is compromised, all of your machines are not immediately at risk.
- Do the Following:
- Make the Password At Least Eight Characters Long — The longer the password, the better. If using MD5 passwords, it should be 15 characters or longer. With DES passwords, use the maximum length (eight characters).
- Mix Upper and Lower Case Letters — Red Hat Enterprise Linux is case sensitive, so mix cases to enhance the strength of the password.
- Mix Letters and Numbers — Adding numbers to passwords, especially when added to the middle (not just at the beginning or the end), can enhance password strength.
- Include Non-Alphanumeric Characters — Special characters such as &, $, and > can greatly improve the strength of a password (this is not possible if using DES passwords).
- Pick a Password You Can Remember — The best password in the world does little good if you cannot remember it; use acronyms or other mnemonic devices to aid in memorizing passwords.
4.3.1.1. Secure Password Creation Methodology
- Think of a memorable phrase, such as:"over the river and through the woods, to grandmother's house we go."
- Next, turn it into an acronym (including the punctuation).
otrattw,tghwg.
- Add complexity by substituting numbers and symbols for letters in the acronym. For example, substitute
7
fort
and the at symbol (@
) fora
:o7r@77w,7ghwg.
- Add more complexity by capitalizing at least one letter, such as
H
.o7r@77w,7gHwg.
- Finally, do not use the example password above for any systems, ever.
4.3.2. Creating User Passwords Within an Organization
4.3.2.1. Forcing Strong Passwords
passwd
, which is Pluggable Authentication Manager (PAM) aware and therefore checks to see if the password is easy to crack or too short in length via the pam_cracklib.so
PAM module. Since PAM is customizable, it is possible to add further password integrity checkers, such as pam_passwdqc
(available from http://www.openwall.com/passwdqc/) or to write a new module. For a list of available PAM modules, refer to http://www.kernel.org/pub/linux/libs/pam/modules.html. For more information about PAM, refer to the chapter titled Pluggable Authentication Modules (PAM) in the Reference Guide.
Note
- John The Ripper — A fast and flexible password cracking program. It allows the use of multiple word lists and is capable of brute-force password cracking. It is available online at http://www.openwall.com/john/.
- Crack — Perhaps the most well known password cracking software, Crack is also very fast, though not as easy to use as John The Ripper. It can be found online at http://www.crypticide.com/users/alecm/.
- Slurpie — Slurpie is similar to John The Ripper and Crack, but it is designed to run on multiple computers simultaneously, creating a distributed password cracking attack. It can be found along with a number of other distributed attack security evaluation tools online at http://www.ussrback.com/distributed.htm.
Warning
4.3.2.2. Password Aging
chage
command or the graphical User Manager (system-config-users
) application.
-M
option of the chage
command specifies the maximum number of days the password is valid. So, for instance, to set a user's password to expire in 90 days, type the following command:
chage -M 90 <username>
99999
after the -M
option (this equates to a little over 273 years).
system-config-users
at a shell prompt (for example, in an XTerm or a GNOME terminal). Click on the Users tab, select the user from the user list, and click Properties from the button menu (or choose File => Properties from the pull-down menu).
Figure 4.1. Password Info Pane
4.4. Administrative Controls
sudo
or su
. A setuid program is one that operates with the user ID (UID) of the program's owner rather than the user operating the program. Such programs are denoted by a lower case s
in the owner section of a long format listing, as in the following example:
-rwsr-xr-x 1 root root 47324 May 1 08:09 /bin/su
pam_console.so
, some activities normally reserved only for the root user, such as rebooting and mounting removable media are allowed for the first user that logs in at the physical console (see the chapter titled Pluggable Authentication Modules (PAM) in the Reference Guide for more about the pam_console.so
module.) However, other important system administration tasks such as altering network settings, configuring a new mouse, or mounting network devices are not possible without administrative priveleges. As a result, system administrators must decide how much access the users on their network should receive.
4.4.1. Allowing Root Access
- Machine Misconfiguration — Users with root access can misconfigure their machines and require assistance or worse, open up security holes without knowing it.
- Running Insecure Services — Users with root access may run insecure servers on their machine, such as FTP or Telnet, potentially putting usernames and passwords at risk as they pass over the network in the clear.
- Running Email Attachments As Root — Although rare, email viruses that affect Linux do exist. The only time they are a threat, however, is when they are run by the root user.
4.4.2. Disallowing Root Access
- Changing the root shell
- To prevent users from logging in directly as root, the system administrator can set the root account's shell to
/sbin/nologin
in the/etc/passwd
file.Table 4.1. Disabling the Root Shell
Effects Does Not Affect Prevents access to the root shell and logs any such attempts. The following programs are prevented from accessing the root account:login
gdm
kdm
xdm
su
ssh
scp
sftp
Programs that do not require a shell, such as FTP clients, mail clients, and many setuid programs. The following programs are not prevented from accessing the root account:sudo
- FTP clients
- Email clients
- Disabling root access via any console device (tty)
- To further limit access to the root account, administrators can disable root logins at the console by editing the
/etc/securetty
file. This file lists all devices the root user is allowed to log into. If the file does not exist at all, the root user can log in through any communication device on the system, whether via the console or a raw network interface. This is dangerous, because a user can log in to their machine as root via Telnet, which transmits the password in plain text over the network.By default, Red Hat Enterprise Linux's/etc/securetty
file only allows the root user to log in at the console physically attached to the machine. To prevent the root user from logging in, remove the contents of this file by typing the following command at a shell prompt as root:echo > /etc/securetty
To enablesecuretty
support in the KDM, GDM, and XDM login managers, add the following line:auth [user_unknown=ignore success=ok ignore=ignore default=bad] pam_securetty.so
to the files listed below:/etc/pam.d/gdm
/etc/pam.d/gdm-autologin
/etc/pam.d/gdm-fingerprint
/etc/pam.d/gdm-password
/etc/pam.d/gdm-smartcard
/etc/pam.d/kdm
/etc/pam.d/kdm-np
/etc/pam.d/xdm
Warning
A blank/etc/securetty
file does not prevent the root user from logging in remotely using the OpenSSH suite of tools because the console is not opened until after authentication.Table 4.2. Disabling Root Logins
Effects Does Not Affect Prevents access to the root account via the console or the network. The following programs are prevented from accessing the root account:login
gdm
kdm
xdm
- Other network services that open a tty
Programs that do not log in as root, but perform administrative tasks through setuid or other mechanisms. The following programs are not prevented from accessing the root account:su
sudo
ssh
scp
sftp
- Disabling root SSH logins
- To prevent root logins via the SSH protocol, edit the SSH daemon's configuration file,
/etc/ssh/sshd_config
, and change the line that reads:#PermitRootLogin yes
to read as follows:PermitRootLogin no
Table 4.3. Disabling Root SSH Logins
Effects Does Not Affect Prevents root access via the OpenSSH suite of tools. The following programs are prevented from accessing the root account:ssh
scp
sftp
Programs that are not part of the OpenSSH suite of tools. - Using PAM to limit root access to services
- PAM, through the
/lib/security/pam_listfile.so
module, allows great flexibility in denying specific accounts. The administrator can use this module to reference a list of users who are not allowed to log in. To limit root access to a system service, edit the file for the target service in the/etc/pam.d/
directory and make sure thepam_listfile.so
module is required for authentication.The following is an example of how the module is used for thevsftpd
FTP server in the/etc/pam.d/vsftpd
PAM configuration file (the\
character at the end of the first line is not necessary if the directive is on a single line):auth required /lib/security/pam_listfile.so item=user \ sense=deny file=/etc/vsftpd.ftpusers onerr=succeed
This instructs PAM to consult the/etc/vsftpd.ftpusers
file and deny access to the service for any listed user. The administrator can change the name of this file, and can keep separate lists for each service or use one central list to deny access to multiple services.If the administrator wants to deny access to multiple services, a similar line can be added to the PAM configuration files, such as/etc/pam.d/pop
and/etc/pam.d/imap
for mail clients, or/etc/pam.d/ssh
for SSH clients.For more information about PAM, refer to the chapter titled Pluggable Authentication Modules (PAM) in the Reference Guide.Table 4.4. Disabling Root Using PAM
Effects Does Not Affect Prevents root access to network services that are PAM aware. The following services are prevented from accessing the root account:login
gdm
kdm
xdm
ssh
scp
sftp
- FTP clients
- Email clients
- Any PAM aware services
Programs and services that are not PAM aware.
4.4.3. Limiting Root Access
su
or sudo
.
4.4.3.1. The su
Command
su
command, the user is prompted for the root password and, after authentication, is given a root shell prompt.
su
command, the user is the root user and has absolute administrative access to the system. In addition, once a user has become root, it is possible for them to use the su
command to change to any other user on the system without being prompted for a password.
usermod -G wheel <username>
wheel
group.
system-config-users
at a shell prompt. Select the Users tab, select the user from the user list, and click Properties from the button menu (or choose File => Properties from the pull-down menu).
Figure 4.2. Groups Pane
su
(/etc/pam.d/su
) in a text editor and remove the comment # from the following line:
auth required /lib/security/$ISA/pam_wheel.so use_uid
wheel
to use the program.
Note
wheel
group by default.
4.4.3.2. The sudo
Command
sudo
command offers another approach to giving users administrative access. When trusted users precede an administrative command with sudo
, they are prompted for their own password. Then, once authenticated and assuming that the command is permitted, the administrative command is executed as if by the root user.
sudo
command is as follows:
sudo <command>
mount
.
Important
sudo
command should take extra care to log out before walking away from their machines since sudoers can use the command again without being asked for a password within a five minute period. This setting can be altered via the configuration file, /etc/sudoers
.
sudo
command allows for a high degree of flexibility. For instance, only users listed in the /etc/sudoers
configuration file are allowed to use the sudo
command and the command is executed in the user's shell, not a root shell. This means the root shell can be completely disabled, as shown in Section 4.4.1, “Allowing Root Access”.
sudo
command also provides a comprehensive audit trail. Each successful authentication is logged to the file /var/log/messages
and the command issued along with the issuer's user name is logged to the file /var/log/secure
.
sudo
command is that an administrator can allow different users access to specific commands based on their needs.
sudo
configuration file, /etc/sudoers
, should use the visudo
command.
visudo
and add a line similar to the following in the user privilege specification section:
juan ALL=(ALL) ALL
juan
, can use sudo
from any host and execute any command.
sudo
:
%users localhost=/sbin/shutdown -h now
/sbin/shutdown -h now
as long as it is issued from the console.
sudoers
has a detailed listing of options for this file.
4.5. Available Network Services
4.5.1. Risks To Services
- Denial of Service Attacks (DoS) — By flooding a service with requests, a denial of service attack can bring a system to a screeching halt as it tries to log and answer each request.
- Script Vulnerability Attacks — If a server is using scripts to execute server-side actions, as Web servers commonly do, a cracker can mount an attack on improperly written scripts. These script vulnerability attacks can lead to a buffer overflow condition or allow the attacker to alter files on the system.
- Buffer Overflow Attacks — Services which connect to ports numbered 0 through 1023 must run as an administrative user. If the application has an exploitable buffer overflow, an attacker could gain access to the system as the user running the daemon. Because exploitable buffer overflows exist, crackers use automated tools to identify systems with vulnerabilities, and once they have gained access, they use automated rootkits to maintain their access to the system.
Note
4.5.2. Identifying and Configuring Services
cupsd
— The default print server for Red Hat Enterprise Linux.lpd
— An alternate print server.xinetd
— A super server that controls connections to a host of subordinate servers, such asvsftpd
andtelnet
.sendmail
— The Sendmail mail transport agent is enabled by default, but only listens for connections from the localhost.sshd
— The OpenSSH server, which is a secure replacement for Telnet.
cupsd
running. The same is true for portmap
. If you do not mount NFSv3 volumes or use NIS (the ypbind
service), then portmap
should be disabled.
system-config-services
), ntsysv, and chkconfig
. For information on using these tools, refer to the chapter titled Controlling Access to Services in the System Administrators Guide.
Figure 4.3. Services Configuration Tool
4.5.3. Insecure Services
- Pass Usernames and Passwords Over a Network Unencrypted — Many older protocols, such as Telnet and FTP, do not encrypt the authentication session and should be avoided whenever possible.
- Pass Sensitive Data Over a Network Unencrypted — Many protocols pass data over the network unencrypted. These protocols include Telnet, FTP, HTTP, and SMTP. Many network file systems, such as NFS and SMB, also pass information over the network unencrypted. It is the user's responsibility when using these protocols to limit what type of data is transmitted.Also, remote memory dump services, like
netdump
, pass the contents of memory over the network unencrypted. Memory dumps can contain passwords or, even worse, database entries and other sensitive information.Other services likefinger
andrwhod
reveal information about users of the system.
rlogin
rsh
telnet
vsftpd
rlogin
, rsh
, and telnet
) should be avoided in favor of SSH. (refer to Section 4.7, “Security Enhanced Communication Tools” for more information about sshd
.)
finger
authd
(this was calledidentd
in previous RHEL releases)netdump
netdump-server
nfs
rwhod
sendmail
smb
(Samba)yppasswdd
ypserv
ypxfrd
4.6. Personal Firewalls
system-config-securitylevel
). This tool creates broad iptables
rules for a general-purpose firewall using a control panel interface.
iptables
is likely the best option. Refer to Chapter 7, Firewalls for more information. For a comprehensive guide to the iptables
command, consult the chapter titled iptables
in the Reference Guide.
4.7. Security Enhanced Communication Tools
- OpenSSH — A free implementation of the SSH protocol for encrypting network communication.
- Gnu Privacy Guard (GPG) — A free implementation of the PGP (Pretty Good Privacy) encryption application for encrypting data.
telnet
and rsh
. OpenSSH includes a network service called sshd
and three command line client applications:
ssh
— A secure remote console access client.scp
— A secure remote copy command.sftp
— A secure pseudo-ftp client that allows interactive file transfer sessions.
Important
sshd
service is inherently secure, the service must be kept up-to-date to prevent security threats. Refer to Chapter 3, Security Updates for more information about this issue.
Chapter 5. Server Security
- Keep all services current, to protect against the latest threats.
- Use secure protocols whenever possible.
- Serve only one type of network service per machine whenever possible.
- Monitor all servers carefully for suspicious activity.
5.1. Securing Services With TCP Wrappers and xinetd
xinetd
, a super service that provides additional access, logging, binding, redirection, and resource utilization control.
Note
xinetd
to create redundancy within service access controls. Refer to Chapter 7, Firewalls for more information about implementing firewalls with IPTables commands.
xinetd
can be found in the chapter titled TCP Wrappers and xinetd
in the Reference Guide.
5.1.1. Enhancing Security With TCP Wrappers
hosts_options
man page.
5.1.1.1. TCP Wrappers and Connection Banners
banner
option.
vsftpd
. To begin, create a banner file. It can be anywhere on the system, but it must bear same name as the daemon. For this example, the file is called /etc/banners/vsftpd
.
220-Hello, %c 220-All activity on ftp.example.com is logged. 220-Act up and you will be banned.
%c
token supplies a variety of client information, such as the username and hostname, or the username and IP address to make the connection even more intimidating. The Reference Guide has a list of other tokens available for TCP wrappers.
/etc/hosts.allow
file:
vsftpd : ALL : banners /etc/banners/
5.1.1.2. TCP Wrappers and Attack Warnings
spawn
directive.
/etc/hosts.deny
file, the connection attempt is denied and logged into a special file:
ALL : 206.182.68.0 : spawn /bin/ 'date' %c %d >> /var/log/intruder_alert
%d
token supplies the name of the service that the attacker was trying to access.
spawn
directive in the /etc/hosts.allow
file.
Note
spawn
directive executes any shell command, create a special script to notify the administrator or execute a chain of commands in the event that a particular client attempts to connect to the server.
5.1.1.3. TCP Wrappers and Enhanced Logging
severity
option.
emerg
flag in the log files instead of the default flag, info
, and deny the connection.
/etc/hosts.deny
:
in.telnetd : ALL : severity emerg
authpriv
logging facility, but elevates the priority from the default value of info
to emerg
, which posts log messages directly to the console.
5.1.2. Enhancing Security With xinetd
xinetd
super server is another useful tool for controlling access to its subordinate services. This section focuses on how xinetd
can be used to set a trap service and control the amount of resources any given xinetd
service can use to thwart denial of service attacks. For a more thorough list of the options available, refer to the man pages for xinetd
and xinetd.conf
.
5.1.2.1. Setting a Trap
xinetd
is its ability to add hosts to a global no_access
list. Hosts on this list are denied subsequent connections to services managed by xinetd
for a specified length of time or until xinetd
is restarted. This is accomplished using the SENSOR
attribute. This technique is an easy way to block hosts attempting to port scan the server.
SENSOR
is to choose a service you do not plan on using. For this example, Telnet is used.
/etc/xinetd.d/telnet
and change the flags
line to read:
flags = SENSOR
deny_time = 30
deny_time
attribute are FOREVER, which keeps the ban in effect until xinetd
is restarted, and NEVER, which allows the connection and logs it.
disable = no
SENSOR
is a good way to detect and stop connections from nefarious hosts, it has two drawbacks:
- It does not work against stealth scans.
- An attacker who knows that a
SENSOR
is running can mount a denial of service attack against particular hosts by forging their IP addresses and connecting to the forbidden port.
5.1.2.2. Controlling Server Resources
xinetd
is its ability to control the amount of resources which services under its control can utilize.
cps = <number_of_connections> <wait_period>
— Dictates the connections allowed to the service per second. This directive accepts only integer values.instances = <number_of_connections>
— Dictates the total number of connections allowed to a service. This directive accepts either an integer value orUNLIMITED
.per_source = <number_of_connections>
— Dictates the connections allowed to a service by each host. This directive accepts either an integer value orUNLIMITED
.rlimit_as = <number[K|M]>
— Dictates the amount of memory address space the service can occupy in kilobytes or megabytes. This directive accepts either an integer value orUNLIMITED
.rlimit_cpu = <number_of_seconds>
— Dictates the amount of time in seconds that a service may occupy the CPU. This directive accepts either an integer value orUNLIMITED
.
xinetd
service from overwhelming the system, resulting in a denial of service.
5.2. Securing Portmap
portmap
service is a dynamic port assignment daemon for RPC services such as NIS and NFS. It has weak authentication mechanisms and has the ability to assign a wide range of ports for the services it controls. For these reasons, it is difficult to secure.
Note
portmap
only affects NFSv2 and NFSv3 implementations, since NFSv4 no longer requires it. If you plan to implement a NFSv2 or NFSv3 server, then portmap
is required, and the following section applies.
5.2.1. Protect portmap
With TCP Wrappers
portmap
service since it has no built-in form of authentication.
5.2.2. Protect portmap
With IPTables
portmap
service, it is a good idea to add IPTables rules to the server and restrict access to specific networks.
portmap
service (listening on port 111) from the 192.168.0/24 network and from the localhost (which is necessary for the sgi_fam
service used by Nautilus). All other packets are dropped.
iptables -A INPUT -p tcp -s! 192.168.0.0/24 --dport 111 -j DROP iptables -A INPUT -p tcp -s 127.0.0.1 --dport 111 -j ACCEPT
iptables -A INPUT -p udp -s! 192.168.0.0/24 --dport 111 -j DROP
Note
5.3. Securing NIS
ypserv
, which is used in conjunction with portmap
and other related services to distribute maps of usernames, passwords, and other sensitive information to any computer claiming to be within its domain.
/usr/sbin/rpc.yppasswdd
— Also called theyppasswdd
service, this daemon allows users to change their NIS passwords./usr/sbin/rpc.ypxfrd
— Also called theypxfrd
service, this daemon is responsible for NIS map transfers over the network./usr/sbin/yppush
— This application propagates changed NIS databases to multiple NIS servers./usr/sbin/ypserv
— This is the NIS server daemon.
portmap
service as outlined in Section 5.2, “Securing Portmap”, then address the following issues, such as network planning.
5.3.1. Carefully Plan the Network
5.3.2. Use a Password-like NIS Domain Name and Hostname
/etc/passwd
map:
ypcat -d <NIS_domain> -h <DNS_hostname> passwd
/etc/shadow
file by typing the following command:
ypcat -d <NIS_domain> -h <DNS_hostname> shadow
Note
/etc/shadow
file is not stored within an NIS map.
o7hfawtgmhwg.domain.com
. Similarly, create a different randomized NIS domain name. This makes it much more difficult for an attacker to access the NIS server.
5.3.3. Edit the /var/yp/securenets
File
/var/yp/securenets
file is blank or does not exist (as is the case after a default installation). One of the first things to do is to put netmask/network pairs in the file so that ypserv
only responds to requests from the proper network.
/var/yp/securenets
file:
255.255.255.0 192.168.0.0
Warning
/var/yp/securenets
file.
5.3.4. Assign Static Ports and Use IPTables Rules
rpc.yppasswdd
— the daemon that allows users to change their login passwords. Assigning ports to the other two NIS server daemons, rpc.ypxfrd
and ypserv
, allows for the creation of firewall rules to further protect the NIS server daemons from intruders.
/etc/sysconfig/network
:
YPSERV_ARGS="-p 834" YPXFRD_ARGS="-p 835"
iptables -A INPUT -p ALL -s! 192.168.0.0/24 --dport 834 -j DROP iptables -A INPUT -p ALL -s! 192.168.0.0/24 --dport 835 -j DROP
Note
5.3.5. Use Kerberos Authentication
/etc/shadow
map is sent over the network. If an intruder gains access to an NIS domain and sniffs network traffic, usernames and password hashes can be quietly collected. With enough time, a password cracking program can guess weak passwords, and an attacker can gain access to a valid account on the network.
5.4. Securing NFS
Important
portmap
service as outlined in Section 5.2, “Securing Portmap”. NFS traffic now utilizes TCP in all versions, rather than UDP, and requires it when using NFSv4. NFSv4 now includes Kerberos user and group authentication, as part of the RPCSEC_GSS
kernel module. Information on portmap
is still included, since Red Hat Enterprise Linux supports NFSv2 and NFSv3 which utilize it.
5.4.1. Carefully Plan the Network
5.4.2. Beware of Syntax Errors
/etc/exports
file. Be careful not to add extraneous spaces when editing this file.
/etc/exports
file shares the directory /tmp/nfs/
to the host bob.example.com
with read/write permissions.
/tmp/nfs/ bob.example.com(rw)
/etc/exports
file, on the other hand, shares the same directory to the host bob.example.com
with read-only permissions and shares it to the world with read/write permissions due to a single space character after the hostname.
/tmp/nfs/ bob.example.com (rw)
showmount
command to verify what is being shared:
showmount -e <hostname>
5.4.3. Do Not Use the no_root_squash
Option
nfsnobody
user, an unprivileged user account. In this way, all root-created files are owned by nfsnobody
, which prevents uploading of programs with the setuid bit set.
no_root_squash
is used, remote root users are able to change any file on the shared file system and leave trojaned applications for other users to inadvertently execute.
5.5. Securing the Apache HTTP Server
5.5.1. FollowSymLinks
/
.
5.5.2. The Indexes
Directive
5.5.3. The UserDir
Directive
UserDir
directive is disabled by default because it can confirm the presence of a user account on the system. To enable user directory browsing on the server, use the following directives:
UserDir enabled UserDir disabled root
/root/
. To add users to the list of disabled accounts, add a space delimited list of users on the UserDir disabled
line.
5.5.4. Do Not Remove the IncludesNoExec
Directive
5.5.5. Restrict Permissions for Executable Directories
chown root <directory_name> chmod 755 <directory_name>
5.6. Securing FTP
gssftpd
— A kerberizedxinetd
-based FTP daemon which does not pass authentication information over the network.- Red Hat Content Accelerator (
tux
) — A kernel-space Web server with FTP capabilities. vsftpd
— A standalone, security oriented implementation of the FTP service.
vsftpd
FTP service.
5.6.1. FTP Greeting Banner
vsftpd
, add the following directive to the /etc/vsftpd/vsftpd.conf
file:
ftpd_banner=<insert_greeting_here>
/etc/banners/
. The banner file for FTP connections in this example is /etc/banners/ftp.msg
. Below is an example of what such a file may look like:
#################################################### # Hello, all activity on ftp.example.com is logged.# ####################################################
Note
220
as specified in Section 5.1.1.1, “TCP Wrappers and Connection Banners”.
vsftpd
, add the following directive to the /etc/vsftpd/vsftpd.conf
file:
banner_file=/etc/banners/ftp.msg
5.6.2. Anonymous Access
/var/ftp/
directory activates the anonymous account.
vsftpd
package. This package sets a directory tree up for anonymous users and configures the permissions on directories to read-only for anonymous users.
Warning
5.6.2.1. Anonymous Upload
/var/ftp/pub/
.
mkdir /var/ftp/pub/upload
chmod 730 /var/ftp/pub/upload
drwx-wx--- 2 root ftp 4096 Feb 13 20:05 upload
Warning
vsftpd
, add the following line to the /etc/vsftpd/vsftpd.conf
file:
anon_upload_enable=YES
5.6.3. User Accounts
vsftpd
, add the following directive to /etc/vsftpd/vsftpd.conf
:
local_enable=NO
5.6.3.1. Restricting User Accounts
sudo
privileges, from accessing an FTP server is to use a PAM list file as described in Section 4.4.1, “Allowing Root Access”. The PAM configuration file for vsftpd
is /etc/pam.d/vsftpd
.
vsftpd
, add the username to /etc/vsftpd.ftpusers
.
5.6.4. Use TCP Wrappers To Control Access
5.7. Securing Sendmail
/etc/mail/sendmail.cf
by editing the /etc/mail/sendmail.mc
and running the m4
command as explained in the Reference Guide.
5.7.1. Limiting a Denial of Service Attack
/etc/mail/sendmail.mc
, the effectiveness of such attacks are limited.
confCONNECTION_RATE_THROTTLE
— The number of connections the server can receive per second. By default, Sendmail does not limit the number of connections. If a limit is set and reached, further connections are delayed.confMAX_DAEMON_CHILDREN
— The maximum number of child processes that can be spawned by the server. By default, Sendmail does not assign a limit to the number of child processes. If a limit is set and reached, further connections are delayed.confMIN_FREE_BLOCKS
— The minimum number of free blocks which must be available for the server to accept mail. The default is 100 blocks.confMAX_HEADERS_LENGTH
— The maximum acceptable size (in bytes) for a message header.confMAX_MESSAGE_SIZE
— The maximum acceptable size (in bytes) for any one message.
5.7.2. NFS and Sendmail
/var/spool/mail/
, on an NFS shared volume.
SECRPC_GSS
kernel module does not utilize UID-based authentication.
5.7.3. Mail-only Users
/etc/passwd
file should be set to /sbin/nologin
(with the possible exception of the root user).
5.8. Verifying Which Ports Are Listening
netstat -an
or lsof -i
. This method is less reliable since these programs do not connect to the machine from the network, but rather check to see what is running on the system. For this reason, these applications are frequent targets for replacement by attackers. In this way, crackers attempt to cover their tracks if they open unauthorized network ports.
nmap
.
nmap -sT -O localhost
Starting nmap 3.55 ( http://www.insecure.org/nmap/ ) at 2004-09-24 13:49 EDT Interesting ports on localhost.localdomain (127.0.0.1): (The 1653 ports scanned but not shown below are in state: closed) PORT STATE SERVICE 22/tcp open ssh 25/tcp open smtp 111/tcp open rpcbind 113/tcp open auth 631/tcp open ipp 834/tcp open unknown 2601/tcp open zebra 32774/tcp open sometimes-rpc11 Device type: general purpose Running: Linux 2.4.X|2.5.X|2.6.X OS details: Linux 2.5.25 - 2.6.3 or Gentoo 1.2 Linux 2.4.19 rc1-rc7) Uptime 12.857 days (since Sat Sep 11 17:16:20 2004) Nmap run completed -- 1 IP address (1 host up) scanned in 5.190 seconds
portmap
due to the presence of the sunrpc
service. However, there is also a mystery service on port 834. To check if the port is associated with the official list of known services, type:
cat /etc/services | grep 834
netstat
or lsof
. To check for port 834 using netstat
, use the following command:
netstat -anp | grep 834
tcp 0 0 0.0.0.0:834 0.0.0.0:* LISTEN 653/ypbind
netstat
is reassuring because a cracker opening a port surreptitiously on a hacked system would likely not allow it to be revealed through this command. Also, the [p]
option reveals the process id (PID) of the service which opened the port. In this case, the open port belongs to ypbind
(NIS), which is an RPC service handled in conjunction with the portmap
service.
lsof
command reveals similar information since it is also capable of linking open ports to services:
lsof -i | grep 834
ypbind 653 0 7u IPv4 1319 TCP *:834 (LISTEN) ypbind 655 0 7u IPv4 1319 TCP *:834 (LISTEN) ypbind 656 0 7u IPv4 1319 TCP *:834 (LISTEN) ypbind 657 0 7u IPv4 1319 TCP *:834 (LISTEN)
lsof
, netstat
, nmap
, and services
is therefore highly recommended.
Chapter 6. Virtual Private Networks
6.1. VPNs and Red Hat Enterprise Linux
6.2. IPsec
racoon
keying daemon handles the IKE key distribution and exchange.
6.3. IPsec Installation
ipsec-tools
RPM package be installed on all IPsec hosts (if using a host-to-host configuration) or routers (if using a network-to-network configuration). The RPM package contains essential libraries, daemons, and configuration files to aid in setup of the IPsec connection, including:
/sbin/setkey
— manipulates the key management and security attributes of IPsec in the kernel. This executable is controlled by theracoon
key management daemon. For more information onsetkey
, refer to thesetkey
(8) man page./sbin/racoon
— the IKE key management daemon, used to manage and control security associations and key sharing between IPsec-connected systems. This daemon can be configured by editing the/etc/racoon/racoon.conf
file. For more information aboutracoon
, refer to theracoon
(8) man page./etc/racoon/racoon.conf
— theracoon
daemon configuration file used to configure various aspects of the IPsec connection, including authentication methods and encryption algorithms used in the connection. For a complete listing of directives available, refer to theracoon.conf
(5) man page.
6.4. IPsec Host-to-Host Configuration
- The IP address for both hosts
- A unique name to identify the IPsec connection and distinguish it from other devices or connections (for example,
ipsec0
) - A fixed encryption key or one automatically generated by
racoon
- A pre-shared authentication key that is used to initiate the connection and exchange encryption keys during the session
foobarbaz
and the users agree to let racoon
automatically generate and share an authentication key between each host. Both host users decide to name their connections ipsec0
.
ifcfg
file for Workstation A for a host-to-host IPsec connection with Workstation B (the unique name to identify the connection in this example is ipsec0, so the resulting file is named /etc/sysconfig/network-scripts/ifcfg-ipsec0
):
DST=X.X.X.X TYPE=IPSEC ONBOOT=yes IKE_METHOD=PSK
ONBOOT=yes
) and uses the pre-shared key method of authentication (IKE_METHOD=PSK
).
/etc/sysconfig/network-scripts/keys-ipsec0
) that both workstations need to authenticate each other. The contents of this file should be identical on both workstations and only the root user should be able to read or write this file.
IKE_PSK=foobarbaz
Important
keys-ipsec0
file so that only the root user can read or edit the file, perform the following command after creating the file:
chmod 600 /etc/sysconfig/network-scripts/keys-ipsec0
keys-ipsec0
file on both workstations. Both keys must be identical for proper connectivity.
X.X.X.X.conf
(X.X.X.X is replaced with the IP address of the remote IPsec router). Note that this file is automatically generated once the IPsec tunnel is activated and should not be edited directly.
; remote X.X.X.X { exchange_mode aggressive, main; my_identifier address; proposal { encryption_algorithm 3des; hash_algorithm sha1; authentication_method pre_shared_key; dh_group 2 ; } }
remote X.X.X.X
- Specifies that the subsequent stanzas of this configuration file applies only to the remote node identified by the X.X.X.X IP address.
exchange_mode aggressive
- The default configuration for IPsec on Red Hat Enterprise Linux uses an aggressive authentication mode, which lowers the connection overhead while allowing configuration of several IPsec connections with multiple hosts.
my_identifier address
- Defines the identification method to be used when authenticating nodes. Red Hat Enterprise Linux uses IP addresses to identify nodes.
encryption_algorithm 3des
- Defines the encryption cipher used during authentication. By default, Triple Data Encryption Standard (3DES) is used.
hash_algorithm sha1;
- Specifies the hash algorithm used during phase 1 negotiation between nodes. By default, Secure Hash Algorithm version 1 is used.
authentication_method pre_shared_key
- Defines the authentication method used during node negotiation. Red Hat Enterprise Linux by default uses pre-shared keys for authentication.
dh_group 2
- Specifies the Diffie-Hellman group number for establishing dynamically-generated session keys. By default, the 1024-bit group is used.
/etc/racoon/racoon.conf
files should be identical on all IPsec nodes except for the include "/etc/racoon/X.X.X.X.conf"
statement. This statement (and the file it references) is generated when the IPsec tunnel is activated. For Workstation A, the X.X.X.X in the include
statement is Workstation B's IP address. The opposite is true of Workstation B. The following shows a typical racoon.conf
file when IPsec connection is activated.
# Racoon IKE daemon configuration file. # See 'man racoon.conf' for a description of the format and entries. path include "/etc/racoon"; path pre_shared_key "/etc/racoon/psk.txt"; path certificate "/etc/racoon/certs"; sainfo anonymous { pfs_group 2; lifetime time 1 hour ; encryption_algorithm 3des, blowfish 448, rijndael ; authentication_algorithm hmac_sha1, hmac_md5 ; compression_algorithm deflate ; } include "/etc/racoon/X.X.X.X.conf"
racoon.conf
file includes defined paths for IPsec configuration, pre-shared key files, and certificates. The fields in sainfo anonymous
describe the phase 2 SA between the IPsec nodes — the nature of the IPsec connection (including the supported encryption algorithms used) and the method of exchanging keys. The following list defines the fields of phase 2:
sainfo anonymous
- Denotes that SA can anonymously initialize with any peer insofar as the IPsec credentials match.
pfs_group 2
- Defines the Diffie-Hellman key exchange protocol, which determines the method in which the IPsec nodes establish a mutual temporary session key for the second phase of IPsec connectivity. By default, the Red Hat Enterprise Linux implementation of IPsec uses group 2 (or
modp1024
) of the Diffie-Hellman cryptographic key exchange groups. Group 2 uses a 1024-bit modular exponentiation that prevents attackers from decrypting previous IPsec transmissions even if a private key is compromised. lifetime time 1 hour
- This parameter specifies the life cycle of an SA and can be quantified either by time or by bytes of data. The Red Hat Enterprise Linux implementation of IPsec specifies a one hour lifetime.
encryption_algorithm 3des, blowfish 448, rijndael
- Specifies the supported encryption ciphers for phase 2. Red Hat Enterprise Linux supports 3DES, 448-bit Blowfish, and Rijndael (the cipher used in the Advanced Encryption Standard, or AES).
authentication_algorithm hmac_sha1, hmac_md5
- Lists the supported hash algorithms for authentication. Supported modes are sha1 and md5 hashed message authentication codes (HMAC).
compression_algorithm deflate
- Defines the Deflate compression algorithm for IP Payload Compression (IPCOMP) support, which allows for potentially faster transmission of IP datagrams over slow connections.
/sbin/ifup ipsec0
tcpdump
utility to view the network packets being transfered between the hosts (or networks) and verify that they are encrypted via IPsec. The packet should include an AH header and should be shown as ESP packets. ESP means it is encrypted. For example:
17:13:20.617872 pinky.example.com > ijin.example.com: \ AH(spi=0x0aaa749f,seq=0x335): ESP(spi=0x0ec0441e,seq=0x335) (DF)
6.5. IPsec Network-to-Network configuration
Figure 6.1. A Network-to-network IPsec tunneled connection
- The externally-accessible IP addresses of the dedicated IPsec routers
- The network address ranges of the LAN/WAN served by the IPsec routers (such as 192.168.0.0/24 or 10.0.1.0/24)
- The IP addresses of the gateway devices that route the data from the network nodes to the Internet
- A unique name to identify the IPsec connection and distinguish it from other devices or connections (for example,
ipsec0
) - A fixed encryption key or one automatically generated by
racoon
- A pre-shared authentication key that initiates the connection and exchange encryption keys during the session
r3dh4tl1nux
, and the administrators of A and B agree to let racoon
automatically generate and share an authentication key between each IPsec router. The administrator of LAN A decides to name the IPsec connection ipsec0
, while the administrator of LAN B names the IPsec connection ipsec1
..
ifcfg
file for a network-to-network IPsec connection for LAN A. The unique name to identify the connection in this example is ipsec0, so the resulting file is named /etc/sysconfig/network-scripts/ifcfg-ipsec0
.
TYPE=IPSEC ONBOOT=yes IKE_METHOD=PSK SRCGW=192.168.1.254 DSTGW=192.168.2.254 SRCNET=192.168.1.0/24 DSTNET=192.168.2.0/24 DST=X.X.X.X
ONBOOT=yes
) and uses the pre-shared key method of authentication (IKE_METHOD=PSK
). The administrator for LAN A enters the destination gateway, which is the gateway for LAN B (DSTGW=192.168.2.254
) as well as the source gateway, which is the gateway IP address for LAN A (SRCGW=192.168.1.254
). The administrator then enters the destination network, which is the network range for LAN B (DSTNET=192.168.2.0/24
) as well as the source network (SRCNET=192.168.1.0/24
). Finally, the administrator enters the destination IP address, which is the externally-accessible IP address for LAN B (X.X.X.X).
/etc/sysconfig/network-scripts/keys-ipsecX
(where X is 0 for LAN A and 1 for LAN B) that both networks use to authenticate each other. The contents of this file should be identical and only the root user should be able to read or write this file.
IKE_PSK=r3dh4tl1nux
Important
keys-ipsecX
file so that only the root user can read or edit the file, perform the following command after creating the file:
chmod 600 /etc/sysconfig/network-scripts/keys-ipsec1
keys-ipsecX
file on both IPsec routers. Both keys must be identical for proper connectivity.
/etc/racoon/racoon.conf
configuration file for the IPsec connection. Note that the include
line at the bottom of the file is automatically generated and only appears if the IPsec tunnel is running.
# Racoon IKE daemon configuration file. # See 'man racoon.conf' for a description of the format and entries. path include "/etc/racoon"; path pre_shared_key "/etc/racoon/psk.txt"; path certificate "/etc/racoon/certs"; sainfo anonymous { pfs_group 2; lifetime time 1 hour ; encryption_algorithm 3des, blowfish 448, rijndael ; authentication_algorithm hmac_sha1, hmac_md5 ; compression_algorithm deflate ; } include "/etc/racoon/X.X.X.X.conf"
X.X.X.X.conf
(replace X.X.X.X with the IP address of the remote IPsec router). Note that this file is automatically generated once the IPsec tunnel is activated and should not be edited directly.
; remote X.X.X.X { exchange_mode aggressive, main; my_identifier address; proposal { encryption_algorithm 3des; hash_algorithm sha1; authentication_method pre_shared_key; dh_group 2 ; } }
- Edit
/etc/sysctl.conf
and setnet.ipv4.ip_forward
to1
. - Execute the following command to enable the change:
sysctl -p /etc/sysctl.conf
/sbin/ifup ipsec0
ifup
on the IPsec connection. To show a list of routes for the network, run the following command:
/sbin/ip route list
tcpdump
utility on the externally-routable device (eth0 in this example) to view the network packets being transfered between the hosts (or networks) and verify that they are encrypted via IPsec. For example, to check the IPsec connectivity of LAN A, type the following:
tcpdump -n -i eth0 host lana.example.com
12:24:26.155529 lanb.example.com > lana.example.com: AH(spi=0x021c9834,seq=0x358): \ lanb.example.com > lana.example.com: ESP(spi=0x00c887ad,seq=0x358) (DF) \ (ipip-proto-4)
Chapter 7. Firewalls
Table 7.1. Firewall Types
Method | Description | Advantages | Disadvantages | ||||||
---|---|---|---|---|---|---|---|---|---|
NAT | Network Address Translation (NAT) places private IP subnetworks behind one or a small pool of public IP addresses, masquerading all requests to one source rather than several. |
|
| ||||||
Packet Filter | A packet filtering firewall reads each data packet that passes within and outside of a LAN. It can read and process packets by header information and filters the packet based on sets of programmable rules implemented by the firewall administrator. The Linux kernel has built-in packet filtering functionality through the Netfilter kernel subsystem. |
|
| ||||||
Proxy | Proxy firewalls filter all requests of a certain protocol or type from LAN clients to a proxy machine, which then makes those requests to the Internet on behalf of the local client. A proxy machine acts as a buffer between malicious remote users and the internal network client machines. |
|
|
7.1. Netfilter and iptables
iptables
utility.
7.1.1. iptables
Overview
iptables
interface. This command line tool is similar in syntax to its predecessor, ipchains
; however, iptables
uses the Netfilter subsystem to enhance network connection, inspection, and processing; whereas ipchains
used intricate rule sets for filtering source and destination paths, as well as connection ports for both. iptables
features advanced logging, pre- and post-routing actions, network address translation, and port forwarding all in one command line interface.
iptables
. For more detailed information about iptables
, refer to the Reference Guide.
7.2. Using iptables
iptables
is to start the iptables
service. This can be done with the command:
service iptables start
Warning
ip6tables
services should be turned off to use the iptables
service with the following commands:
service ip6tables stop
chkconfig ip6tables off
iptables
start by default whenever the system is booted, you must change runlevel status on the service using chkconfig
.
chkconfig --level 345 iptables on
iptables
is separated into tiers. The main tier is the chain. A chain specifies the state at which a packet is manipulated. The usage is as follows:
iptables -A chain -j target
-A
option appends a rule at the end of an existing ruleset. The chain is the name of the chain for a rule. The three built-in chains of iptables
(that is, the chains that affect every packet which traverses a network) are INPUT, OUTPUT, and FORWARD. These chains are permanent and cannot be deleted. The -j target
option specifies the location in the iptables
ruleset where this particular rule should jump. Some built in targets are ACCEPT, DROP, and REJECT.
-N
option. Creating a new chain is useful for customizing granular or elaborate rules.
7.2.1. Basic Firewall Policies
iptables
uses policies (-P
) to create default rules. Security-minded administrators usually elect to drop all packets as a policy and only allow specific packets on a case-by-case basis. The following rules block all incoming and outgoing packets on a network gateway:
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP
iptables
firewall.
7.2.2. Saving and Restoring iptables
Rules
/sbin/service iptables save
/etc/sysconfig/iptables
and are applied whenever the service is started or restarted, including when the machine is rebooted.
7.3. Common iptables
Filtering
iptables -A INPUT -p tcp -m tcp --sport 80 -j ACCEPT iptables -A OUTPUT -p tcp -m tcp --dport 80 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --sport 443 -j ACCEPT iptables -A OUTPUT -p tcp -m tcp --dport 443 -j ACCEPT
Important
iptables
ruleset, it is critical to remember that order is important. For example, if one chain that specifies that any packets from the local 192.168.100.0/24 subnet be dropped, and then another chain is appended (-A
) to allow packets from 192.168.100.13 (which is within the dropped restricted subnet), then the appended rule is ignored. You must set a rule to allow 192.168.100.13 first, and then set a drop rule on the subnet.
-I
, followed by the chain in which to insert the rule, and a rule number (1,2,3,...,n) for where the rule should reside. For example:
iptables -I INPUT 1 -i lo -p all -j ACCEPT
iptables
to accept connections from remote SSH clients. For example, to allow remote SSH access, the following rules may be used:
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A OUTPUT -p udp --sport 22 -j ACCEPT
iptables
and its various options.
iptables
filtering rules.
7.4. FORWARD
and NAT Rules
iptables
provides routing and forwarding policies that can be implemented to prevent aberrant usage of network resources.
FORWARD
policy allows an administrator to control where packets can be routed within a LAN. For example, to allow forwarding for the entire LAN (assuming the firewall/gateway is assigned an internal IP address on eth1), the following rules can be set:
iptables -A FORWARD -i eth1 -j ACCEPT
iptables -A FORWARD -o eth1 -j ACCEPT
eth1
device.
Note
sysctl -w net.ipv4.ip_forward=1
/etc/sysctl.conf
file. Find and edit the following line, replacing 0
with 1
:
net.ipv4.ip_forward = 0
sysctl.conf
file:
sysctl -p /etc/sysctl.conf
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
-t nat
) and specifies the built-in POSTROUTING chain for NAT (-A POSTROUTING
) on the firewall's external networking device (-o eth0
). POSTROUTING allows packets to be altered as they are leaving the firewall's external device. The -j MASQUERADE
target is specified to mask the private IP address of a node with the external IP address of the firewall/gateway.
-j DNAT
target of the PREROUTING chain in NAT to specify a destination IP address and port where incoming packets requesting a connection to your internal service can be forwarded. For example, if you wanted to forward incoming HTTP requests to your dedicated Apache HTTP Server server system at 172.31.0.23, run the following command:
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j DNAT \ --to 172.31.0.23:80
Note
iptables -A FORWARD -i eth0 -p tcp --dport 80 -d 172.31.0.23 -j ACCEPT
7.4.1. DMZs and iptables
iptables
rules can be set to route traffic to certain machines, such as a dedicated HTTP or FTP server, in a demilitarized zone (DMZ) — a special local subnetwork dedicated to providing services on a public carrier such as the Internet. For example, to set a rule for routing incoming HTTP requests to a dedicated HTTP server at 10.0.4.2 (outside of the 192.168.1.0/24 range of the LAN), NAT calls a PREROUTING
table to forward the packets to their proper destination:
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j DNAT \ --to-destination 10.0.4.2:80
7.5. Viruses and Spoofed IP Addresses
iptables -A OUTPUT -o eth0 -p tcp --dport 31337 --sport 31337 -j DROP
iptables -A FORWARD -o eth0 -p tcp --dport 31337 --sport 31337 -j DROP
iptables -A FORWARD -s 192.168.1.0/24 -i eth0 -j DROP
Note
DROP
and REJECT
targets when dealing with appended rules. The REJECT
target denies access and returns a connection refused
error to users who attempt to connect to the service. The DROP
target, as the name implies, drops the packet without any warning. Administrators can use their own discretion when using these targets. However, to avoid user confusion and attempts to continue connecting, the REJECT
target is recommended.
7.6. iptables
and Connection Tracking
iptables
includes a module that allows administrators to inspect and restrict connections to services available on an internal network using a method called connection tracking. Connection tracking stores connections in a table, which allows administrators to allow or deny access based on the following connection states:
NEW
— A packet requesting a new connection, such as an HTTP request.ESTABLISHED
— A packet that is part of an existing connection.RELATED
— A packet that is requesting a new connection but is part of an existing connection, such as passive FTP connections where the connection port is 20, but the transfer port can be any unused port 1024 or higher.INVALID
— A packet that is not part of any connections in the connection tracking table.
iptables
connection tracking with any network protocol, even if the protocol itself is stateless (such as UDP). The following example shows a rule that uses connection tracking to forward only the packets that are associated with an established connection:
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
7.7. ip6tables
ip6tables
command. The first step in using ip6tables
is to start the ip6tables
service. This can be done with the command:
service ip6tables start
Warning
iptables
services must be turned off to use the ip6tables
service exclusively:
service iptables stop
chkconfig iptables off
ip6tables
start by default whenever the system is booted, change the runlevel status on the service using chkconfig
.
chkconfig --level 345 ip6tables on
iptables
in every aspect except that ip6tables
supports 128-bit addresses. For example, SSH connections on a IPv6-aware network server can be enabled with the following rule:
ip6tables -A INPUT -i eth0 -p tcp -s 3ffe:ffff:100::1/128 --dport 22 -j ACCEPT
7.8. Additional Resources
7.8.1. Installed Documentation
- The Reference Guide has a comprehensive chapter on
iptables
, including definitions for all command options. - The
iptables
man page contains a brief summary of the various options, as well. - A list of common services and their port numbers can be found in Appendix C, Common Ports and in
/etc/services
.
7.8.2. Useful Websites
- http://www.netfilter.org/ — The official homepage of the Netfilter and
iptables
project. - http://www.tldp.org/ — The Linux Documentation Project contains several useful guides relating to firewall creation and administration.
- http://www.iana.org/assignments/port-numbers — The official list of registered and common service ports as assigned by the Internet Assigned Numbers Authority.
7.8.3. Related Documentation
- Red Hat Linux Firewalls, by Bill McCarty; Red Hat Press — a comprehensive reference to building network and server firewalls using open source packet filtering technology such as Netfilter and
iptables
. It includes such topics as analyzing firewall logs, developing firewall rules, and customizing your firewall with graphical tools such aslokkit
. - Linux Firewalls, by Robert Ziegler; New Riders Press — contains a wealth of information on building firewalls using both 2.2 kernel
ipchains
as well as Netfilter andiptables
. Additional security topics such as remote access issues and intrusion detection systems are also covered.
Part III. Assessing Your Security
Chapter 8. Vulnerability Assessment
- The expertise of the staff responsible for configuring, monitoring, and maintaining the technologies.
- The ability to patch and update services and kernels quickly and efficiently.
- The ability of those responsible to keep constant vigilance over the network.
8.1. Thinking Like the Enemy
8.2. Defining Assessment and Testing
Warning
- Creates proactive focus on information security
- Finds potential exploits before crackers find them
- Results in systems being kept up to date and patched
- Promotes growth and aids in developing staff expertise
- Abates Financial loss and negative publicity
8.2.1. Establishing a Methodology
- http://www.isecom.org/projects/osstmm.htm — The Open Source Security Testing Methodology Manual (OSSTMM)
- http://www.owasp.org/ — The Open Web Application Security Project
8.3. Evaluating the Tools
8.3.1. Scanning Hosts with Nmap
8.3.1.1. Using Nmap
nmap
command followed by the hostname or IP address of the machine to scan.
nmap foo.example.com
Starting nmap V. 3.50 ( www.insecure.org/nmap/ ) Interesting ports on localhost.localdomain (127.0.0.1): (The 1591 ports scanned but not shown below are in state: closed) Port State Service 22/tcp open ssh 25/tcp open smtp 111/tcp open sunrpc 443/tcp open https 515/tcp open printer 950/tcp open oftep-rpc 6000/tcp open X11 Nmap run completed -- 1 IP address (1 host up) scanned in 71.825 seconds
8.3.2. Nessus
Note
8.3.3. Nikto
Note
8.3.4. VLAD the Scanner
Note
8.3.5. Anticipating Your Future Needs
Part IV. Intrusions and Incident Response
Chapter 9. Intrusion Detection
9.1. Defining Intrusion Detection Systems
9.1.1. IDS Types
9.2. Host-based IDS
syslog
and its ability to separate logged events by their severity (for example, minor printer messages versus major kernel warnings). The syslog
command is available when installing the sysklogd
package, which is included with Red Hat Enterprise Linux. This package provides system logging and kernel message trapping. The host-based IDS filters logs (which, in the case of some network and kernel event logs, can be quite verbose), analyzes them, re-tags the anomalous messages with its own system of severity rating, and collects them in its own specialized log for administrator analysis.
md5sum
(128-bit algorithm) or sha1sum
(160-bit algorithm). The host-based IDS then stores the sums in a plain text file and periodically compares the file checksums against the values in the text file. If any of the file checksums do not match, the IDS alerts the administrator by email or cellular pager. This is the process used by Tripwire, which is discussed in Section 9.2.1, “Tripwire”.
9.2.1. Tripwire
Note
9.2.2. RPM as an IDS
Important
rpm --import /usr/share/doc/rpm-<version>/RPM-GPG-KEY
rpm -V package_name
- The
-V
option verifies the files in the installed package calledpackage_name
. If it shows no output and exits, this means that none of the files have been modified in any way since the last time the RPM database was updated. If there is an error, such as the followingS.5....T c /bin/ps
then the file has been modified in some way and you must assess whether to keep the file (such as with modified configuration files in the/etc/
directory) or delete the file and reinstall the package that contains it. The following list defines the elements of the 8-character string (S.5....T
in the above example) that notifies of a verification failure..
— The test has passed this phase of verification?
— The test has found a file that could not be read, which is most likely a file permission issueS
— The test has encountered a file that that is smaller or larger than it was when originally installed on the system5
— The test has found a file whose md5 checksum does not match the original checksum of the file when first installedM
— The test has detected a file permission or file type error on the fileD
— The test has encountered a device file mismatch in major/minor numberL
— The test has found a symbolic link that has been changed to another file pathU
— The test has found a file that had its user ownership changedG
— The test has found a file that had its group ownership changedT
— The test has encounteredmtime
verification errors on the file
rpm -Va
- The
-Va
option verifies all installed packages and finds any failure in its verification tests (much like the-V
option, but more verbose in its output since it is verifying every installed package). rpm -Vf /bin/ls
- The
-Vf
option verifies individual files in an installed package. This can be useful when performing a quick verification of a suspect file. rpm -K application-1.0.i386.rpm
- The
-K
option is useful for checking the md5 checksum and the GPG signature of an RPM package file. This is useful for checking whether a package about to be installed is signed by Red Hat or any organization for which you have the GPG public key imported into a GPG keyring. A package that has not been properly signed triggers an error message similar to the following:application-1.0.i386.rpm (SHA1) DSA sha1 md5 (GPG) NOT OK (MISSING KEYS: GPG#897da07a)
Exercise caution when installing packages that are unsigned as they are not approved by Red Hat, Inc and could contain malicious code.
/var/lib/rpm/
) be backed up to read-only media, such as CD-ROM, after installation of Red Hat Enterprise Linux. Doing so allows verification of files and packages against the read-only database, rather than against the database on the system, as malicious users may corrupt the database and skew the results.
9.2.3. Other Host-based IDSes
Note
- SWATCH http://sourceforge.net/projects/swatch/ — The Simple WATCHer (SWATCH) uses log files generated by
syslog
to alert administrators of anomalies based on user configuration files. SWATCH was designed to log any event that the user wants to add into the configuration file; however, it has been adopted widely as a host-based IDS. - LIDS http://www.lids.org/ — The Linux Intrusion Detection System (LIDS) is a kernel patch and administration tool that can also control file modification with access control lists (ACLs), and protect processes and files, even from the root user.
9.3. Network-based IDS
- IP Spoofing
- denial-of-service attacks
- arp cache poisoning
- DNS name corruption
- man-in-the-middle attacks
ifconfig
command, such as the following:
ifconfig eth0 promisc
ifconfig
with no options reveals that eth0
is now in promiscuous (PROMISC
) mode.
eth0 Link encap:Ethernet HWaddr 00:00:D0:0D:00:01 inet addr:192.168.1.50 Bcast:192.168.1.255 Mask:255.255.252.0 UP BROADCAST RUNNING PROMISC MULTICAST MTU:1500 Metric:1 RX packets:6222015 errors:0 dropped:0 overruns:138 frame:0 TX packets:5370458 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:100 RX bytes:2505498554 (2389.4 Mb) TX bytes:1521375170 (1450.8 Mb) Interrupt:9 Base address:0xec80 lo Link encap:Local Loopback inet addr:127.0.0.1 Mask:255.0.0.0 UP LOOPBACK RUNNING MTU:16436 Metric:1 RX packets:21621 errors:0 dropped:0 overruns:0 frame:0 TX packets:21621 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:1070918 (1.0 Mb) TX bytes:1070918 (1.0 Mb)
tcpdump
(included with Red Hat Enterprise Linux), we can see the large amounts of traffic flowing throughout a network:
tcpdump: listening on eth0 02:05:53.702142 pinky.example.com.ha-cluster > \ heavenly.example.com.860: udp 92 (DF) 02:05:53.702294 heavenly.example.com.860 > \ pinky.example.com.ha-cluster: udp 32 (DF) 02:05:53.702360 pinky.example.com.55828 > dns1.example.com.domain: \ PTR? 192.35.168.192.in-addr.arpa. (45) (DF) 02:05:53.702706 ns1.example.com.domain > pinky.example.com.55828: \ 6077 NXDomain* 0/1/0 (103) (DF) 02:05:53.886395 shadowman.example.com.netbios-ns > \ 172.16.59.255.netbios-ns: NBT UDP PACKET(137): QUERY; BROADCAST 02:05:54.103355 802.1d config c000.00:05:74:8c:a1:2b.8043 root \ 0001.00:d0:01:23:a5:2b pathcost 3004 age 1 max 20 hello 2 fdelay 15 02:05:54.636436 konsole.example.com.netbios-ns > 172.16.59.255.netbios-ns:\ NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST 02:05:56.323715 pinky.example.com.1013 > heavenly.example.com.860:\ udp 56 (DF) 02:05:56.323882 heavenly.example.com.860 > pinky.example.com.1013:\ udp 28 (DF)
pinky.example.com
) are still being scanned and logged by tcpdump
.
9.3.1. Snort
tcpdump
is a useful auditing tool, it is not considered a true IDS because it does not analyze and flag packets for anomalies. Instead, tcpdump
prints all packet information to the screen or to a log file without any analysis. A proper IDS analyzes the packets, tags potentially malicious packet transmissions, and stores them in a formatted log.
libcap
library and tcpdump
as a packet logging backend.
Note
Chapter 10. Incident Response
10.1. Defining Incident Response
10.2. Creating an Incident Response Plan
- Immediate action to stop or minimize the incident
- Investigation of the incident
- Restoration of affected resources
- Reporting the incident to the proper channels
- A team of in-house experts (a Computer Emergency Response Team)
- A legally reviewed and approved strategy
- Financial support from the company
- Executive/upper management support
- A feasible and tested action plan
- Physical resources, such as redundant storage, standby systems, and backup services
10.2.1. The Computer Emergency Response Team (CERT)
10.2.2. Legal Considerations
10.3. Implementing the Incident Response Plan
top
or ps
. Network administrators are aware of what normal network traffic should look like when running snort
or even tcpdump
. These team members should know their systems and should be able to spot an anomaly more quickly than someone unfamiliar with the infrastructure.
10.4. Investigating the Incident
script
command, as in the following example:
script -q <file-name>
script
log. Always save the log file on media other than the hard drive of the compromised system — a floppy disk or CD-ROM works particularly well for this purpose.
10.4.1. Collecting an Evidential Image
dd
command that is part of the coreutils
package in Red Hat Enterprise Linux to create a monolithic image of an exploited system as evidence in an investigation or for comparison with trusted images. Suppose there is a single hard drive from a system you want to image. Attach that drive as a slave to the system and then use dd
to create the image file, such as the following:
dd if=/dev/hdd bs=1k conv=noerror,sync of=/home/evidence/image1
image1
using a 1k block size for speed. The conv=noerror,sync
options force dd
to continue reading and dumping data even if bad sectors are encountered on the suspect drive. It is now possible to study the resulting image file or even attempt to recover deleted files.
10.4.2. Gathering Post-Breach Information
Note
Table 10.1. File Auditing Tools
Command | Function | Example |
---|---|---|
dd | Creates a bit-image copy (or disk dump) of files and partitions. Combined with a check of the md5sums of each image, administrators can compare a pre-breach image of a partition or file with a breached system to see if the sums match. | dd if=/bin/ls of=ls.dd |md5sum ls.dd >ls-sum.txt |
grep | Finds useful string (text) information inside files and directories as well as reveals permissions, script changes, file attributes, and more. Used mostly as a piped command of for commands like ls , ps , or ifconfig . | ps auxw |grep /bin |
strings | Prints the strings of printable characters within a file. It is most useful for auditing executables for anomalies such as mail commands to unknown addresses or logging to a non-standard log file. | strings /bin/ps |grep 'mail' |
file | Determines the characteristics of files based on format, encoding, linked-libraries (if any), and file type (binary, text, and more). It is useful for determining whether an executable such as /bin/ls has been modified using static libraries, which is a sure sign that the executable has been replaced with one installed by a malicious user. | file /bin/ls |
find | Searches directories for particular files. It is a useful tool for searching the directory structure by keyword, date and time of access, permissions, and more. It can also be useful for administrators that perform general system audits of particular directories or files. | find -atime +12 -name *log* -perm u+rw |
stat | Displays file status information, including time last accessed, permissions, UID and GID bit settings, and more. It can be useful for checking when a breached system executable was last used or modified. | stat /bin/netstat |
md5sum | Calculates the 128-bit checksum using the md5 hash algorithm. Use this command to create a text file that lists all crucial executables that are often modified or replaced in a security compromise. Redirect the sums to a file to create a simple database of checksums and then copy the file onto a read-only medium such as CD-ROM. | md5sum /usr/bin/gdm >>md5sum.txt |
10.5. Restoring and Recovering Resources
10.5.1. Reinstalling the System
10.5.2. Patching the System
10.6. Reporting the Incident
Part V. Appendixes
Appendix A. Hardware and Network Protection
- Computing involves more than just workstations running desktop software. Modern organizations require massive computational power and highly-available services, which can include mainframes, compute or application clusters, powerful workstations, and specialized appliances. With these organizational requirements, however, come increased susceptibility to hardware failure, natural disasters, and tampering or theft of equipment.
- Connectivity is the method by which an administrator intends to connect disparate resources to a network. An administrator may use Ethernet (hubbed or switched CAT-5/RJ-45 cabling), token ring, 10-base-2 coaxial cable, or even wireless (802.11x) technologies. Depending on which medium an administrator chooses, certain media and network topologies require complementary technologies such as hubs, routers, switches, base stations, and access points. Determining a functional network architecture allows an easier administrative process if security issues arise.
A.1. Secure Network Topologies
A.1.1. Physical Topologies
A.1.1.1. Ring Topology
A.1.1.2. Linear Bus Topology
A.1.1.3. Star Topology
A.1.2. Transmission Considerations
A.1.3. Wireless Networks
A.1.3.1. 802.11x Security
dsniff
and snort
. To prevent such aberrant usage of private wireless networks, the 802.11b standard uses the Wired Equivalent Privacy (WEP) protocol, which is an RC4-based 64- or 128-bit encrypted key shared between each node or between the WAP and the node. This key encrypts transmissions and decrypts incoming packets dynamically and transparently. Administrators often fail to employ this shared-key encryption scheme, however; either they forget to do so or choose not to do so because of performance degradation (especially over long distances). However, enabling WEP on a wireless network can greatly reduce the possibility of data interception.
http://standards.ieee.org/getieee802/802.11.html
A.1.4. Network Segmentation and DMZs
iptables
or using dedicated hardware firewalls allow for complex routing and forwarding rules. Administrators can use these policies to segment inbound traffic to specific services at specified addresses and ports while allowing only LAN access to internal services, which can prevent IP spoofing exploits. For more information about implementing iptables
, refer to Chapter 7, Firewalls.
A.2. Hardware Security
Appendix B. Common Exploits and Attacks
Table B.1. Common Exploits
Exploit | Description | Notes | |||
---|---|---|---|---|---|
Null or Default Passwords | Leaving administrative passwords blank or using a default password set by the product vendor. This is most common in hardware such as routers and firewalls, though some services that run on Linux can contain default administrator passwords (though Red Hat Enterprise Linux does not ship with them). |
| |||
Default Shared Keys | Secure services sometimes package default security keys for development or evaluation testing purposes. If these keys are left unchanged and are placed in a production environment on the Internet, all users with the same default keys have access to that shared-key resource, and any sensitive information contained in it. |
| |||
IP Spoofing | A remote machine acts as a node on your local network, finds vulnerabilities with your servers, and installs a backdoor program or trojan horse to gain control over your network resources. |
| |||
Eavesdropping | Collecting data that passes between two active nodes on a network by eavesdropping on the connection between the two nodes. |
| |||
Service Vulnerabilities | An attacker finds a flaw or loophole in a service run over the Internet; through this vulnerability, the attacker compromises the entire system and any data that it may hold, and could possibly compromise other systems on the network. |
| |||
Application Vulnerabilities | Attackers find faults in desktop and workstation applications (such as e-mail clients) and execute arbitrary code, implant trojan horses for future compromise, or crash systems. Further exploitation can occur if the compromised workstation has administrative privileges on the rest of the network. |
| |||
Denial of Service (DoS) Attacks | Attacker or group of attackers coordinate against an organization's network or server resources by sending unauthorized packets to the target host (either server, router, or workstation). This forces the resource to become unavailable to legitimate users. |
|
Appendix C. Common Ports
/etc/services
file. For the official list of Well Known, Registered, and Dynamic ports as designated by the Internet Assigned Numbers Authority (IANA), refer to the following URL:
Note
Table C.1. Well Known Ports
Port # / Layer | Name | Comment |
---|---|---|
1 | tcpmux | TCP port service multiplexer |
5 | rje | Remote Job Entry |
7 | echo | Echo service |
9 | discard | Null service for connection testing |
11 | systat | System Status service for listing connected ports |
13 | daytime | Sends date and time to requesting host |
17 | qotd | Sends quote of the day to connected host |
18 | msp | Message Send Protocol |
19 | chargen | Character Generation service; sends endless stream of characters |
20 | ftp-data | FTP data port |
21 | ftp | File Transfer Protocol (FTP) port; sometimes used by File Service Protocol (FSP) |
22 | ssh | Secure Shell (SSH) service |
23 | telnet | The Telnet service |
25 | smtp | Simple Mail Transfer Protocol (SMTP) |
37 | time | Time Protocol |
39 | rlp | Resource Location Protocol |
42 | nameserver | Internet Name Service |
43 | nicname | WHOIS directory service |
49 | tacacs | Terminal Access Controller Access Control System for TCP/IP based authentication and access |
50 | re-mail-ck | Remote Mail Checking Protocol |
53 | domain | domain name services (such as BIND) |
63 | whois++ | WHOIS++, extended WHOIS services |
67 | bootps | Bootstrap Protocol (BOOTP) services; also used by Dynamic Host Configuration Protocol (DHCP) services |
68 | bootpc | Bootstrap (BOOTP) client; also used by Dynamic Host Configuration Protocol (DHCP) clients |
69 | tftp | Trivial File Transfer Protocol (TFTP) |
70 | gopher | Gopher Internet document search and retrieval |
71 | netrjs-1 | Remote Job Service |
72 | netrjs-2 | Remote Job Service |
73 | netrjs-3 | Remote Job Service |
73 | netrjs-4 | Remote Job Service |
79 | finger | Finger service for user contact information |
80 | http | HyperText Transfer Protocol (HTTP) for World Wide Web (WWW) services |
88 | kerberos | Kerberos network authentication system |
95 | supdup | Telnet protocol extension |
101 | hostname | Hostname services on SRI-NIC machines |
102/tcp | iso-tsap | ISO Development Environment (ISODE) network applications |
105 | csnet-ns | Mailbox nameserver; also used by CSO nameserver |
107 | rtelnet | Remote Telnet |
109 | pop2 | Post Office Protocol version 2 |
110 | pop3 | Post Office Protocol version 3 |
111 | sunrpc | Remote Procedure Call (RPC) Protocol for remote command execution, used by Network Filesystem (NFS) |
113 | auth | Authentication and Ident protocols |
115 | sftp | Simple File Transfer Protocol services |
117 | uucp-path | Unix-to-Unix Copy Protocol (UUCP) Path services |
119 | nntp | Network News Transfer Protocol (NNTP) for the USENET discussion system |
123 | ntp | Network Time Protocol (NTP) |
137 | netbios-ns | NETBIOS Name Service used in Red Hat Enterprise Linux by Samba |
138 | netbios-dgm | NETBIOS Datagram Service used in Red Hat Enterprise Linux by Samba |
139 | netbios-ssn | NETBIOS Session Service used in Red Hat Enterprise Linux by Samba |
143 | imap | Internet Message Access Protocol (IMAP) |
161 | snmp | Simple Network Management Protocol (SNMP) |
162 | snmptrap | Traps for SNMP |
163 | cmip-man | Common Management Information Protocol (CMIP) |
164 | cmip-agent | Common Management Information Protocol (CMIP) |
174 | mailq | MAILQ email transport queue |
177 | xdmcp | X Display Manager Control Protocol (XDMCP) |
178 | nextstep | NeXTStep window server |
179 | bgp | Border Gateway Protocol |
191 | prospero | Prospero distributed filesystem services |
194 | irc | Internet Relay Chat (IRC) |
199 | smux | SNMP UNIX Multiplexer |
201 | at-rtmp | AppleTalk routing |
202 | at-nbp | AppleTalk name binding |
204 | at-echo | AppleTalk echo |
206 | at-zis | AppleTalk zone information |
209 | qmtp | Quick Mail Transfer Protocol (QMTP) |
210 | z39.50 | NISO Z39.50 database |
213 | ipx | Internetwork Packet Exchange (IPX), a datagram protocol commonly used in Novell Netware environments |
220 | imap3 | Internet Message Access Protocol version 3 |
245 | link | LINK / 3-DNS iQuery service |
347 | fatserv | FATMEN file and tape management server |
363 | rsvp_tunnel | RSVP Tunnel |
369 | rpc2portmap | Coda file system portmapper |
370 | codaauth2 | Coda file system authentication services |
372 | ulistproc | UNIX LISTSERV |
389 | ldap | Lightweight Directory Access Protocol (LDAP) |
427 | svrloc | Service Location Protocol (SLP) |
434 | mobileip-agent | Mobile Internet Protocol (IP) agent |
435 | mobilip-mn | Mobile Internet Protocol (IP) manager |
443 | https | Secure Hypertext Transfer Protocol (HTTP) |
444 | snpp | Simple Network Paging Protocol |
445 | microsoft-ds | Server Message Block (SMB) over TCP/IP |
464 | kpasswd | Kerberos password and key changing services |
468 | photuris | Photuris session key management protocol |
487 | saft | Simple Asynchronous File Transfer (SAFT) protocol |
488 | gss-http | Generic Security Services (GSS) for HTTP |
496 | pim-rp-disc | Rendezvous Point Discovery (RP-DISC) for Protocol Independent Multicast (PIM) services |
500 | isakmp | Internet Security Association and Key Management Protocol (ISAKMP) |
535 | iiop | Internet Inter-Orb Protocol (IIOP) |
538 | gdomap | GNUstep Distributed Objects Mapper (GDOMAP) |
546 | dhcpv6-client | Dynamic Host Configuration Protocol (DHCP) version 6 client |
547 | dhcpv6-server | Dynamic Host Configuration Protocol (DHCP) version 6 Service |
554 | rtsp | Real Time Stream Control Protocol (RTSP) |
563 | nntps | Network News Transport Protocol over Secure Sockets Layer (NNTPS) |
565 | whoami | whoami user ID listing |
587 | submission | Mail Message Submission Agent (MSA) |
610 | npmp-local | Network Peripheral Management Protocol (NPMP) local / Distributed Queueing System (DQS) |
611 | npmp-gui | Network Peripheral Management Protocol (NPMP) GUI / Distributed Queueing System (DQS) |
612 | hmmp-ind | HyperMedia Management Protocol (HMMP) Indication / DQS |
631 | ipp | Internet Printing Protocol (IPP) |
636 | ldaps | Lightweight Directory Access Protocol over Secure Sockets Layer (LDAPS) |
674 | acap | Application Configuration Access Protocol (ACAP) |
694 | ha-cluster | Heartbeat services for High-Availability Clusters |
749 | kerberos-adm | Kerberos version 5 (v5) 'kadmin' database administration |
750 | kerberos-iv | Kerberos version 4 (v4) services |
765 | webster | Network Dictionary |
767 | phonebook | Network Phonebook |
873 | rsync | rsync file transfer services |
992 | telnets | Telnet over Secure Sockets Layer (TelnetS) |
993 | imaps | Internet Message Access Protocol over Secure Sockets Layer (IMAPS) |
994 | ircs | Internet Relay Chat over Secure Sockets Layer (IRCS) |
995 | pop3s | Post Office Protocol version 3 over Secure Sockets Layer (POP3S) |
Table C.2. UNIX Specific Ports
Port # / Layer | Name | Comment |
---|---|---|
512/tcp | exec | Authentication for remote process execution |
512/udp | biff [comsat] | Asynchrous mail client (biff) and service (comsat) |
513/tcp | login | Remote Login (rlogin) |
513/udp | who [whod] | whod user logging daemon |
514/tcp | shell [cmd] | Remote shell (rshell) and remote copy (rcp) with no logging |
514/udp | syslog | UNIX system logging service |
515 | printer [spooler] | Line printer (lpr) spooler |
517/udp | talk | Talk remote calling service and client |
518/udp | ntalk | Network talk (ntalk) remote calling service and client |
519 | utime [unixtime] | UNIX time (utime) protocol |
520/tcp | efs | Extended Filename Server (EFS) |
520/udp | router [route, routed] | Routing Information Protocol (RIP) |
521 | ripng | Routing Information Protocol for Internet Protocol version 6 (IPv6) |
525 | timed [timeserver] | Time daemon (timed) |
526/tcp | tempo [newdate] | Tempo |
530/tcp | courier [rpc] | Courier Remote Procedure Call (RPC) protocol |
531/tcp | conference [chat] | Internet Relay Chat |
532 | netnews | Netnews newsgroup service |
533/udp | netwall | Netwall for emergency broadcasts |
540/tcp | uucp [uucpd] | UNIX-to-UNIX copy services |
543/tcp | klogin | Kerberos version 5 (v5) remote login |
544/tcp | kshell | Kerberos version 5 (v5) remote shell |
548 | afpovertcp | Appletalk Filing Protocol (AFP) over Transmission Control Protocol (TCP) |
556 | remotefs [rfs_server, rfs] | Brunhoff's Remote Filesystem (RFS) |
Table C.3. Registered Ports
Port # / Layer | Name | Comment |
---|---|---|
1080 | socks | SOCKS network application proxy services |
1236 | bvcontrol [rmtcfg] | Remote configuration server for Gracilis Packeten network switches[a] |
1300 | h323hostcallsc | H.323 telecommunication Host Call Secure |
1433 | ms-sql-s | Microsoft SQL Server |
1434 | ms-sql-m | Microsoft SQL Monitor |
1494 | ica | Citrix ICA Client |
1512 | wins | Microsoft Windows Internet Name Server |
1524 | ingreslock | Ingres Database Management System (DBMS) lock services |
1525 | prospero-np | Prospero non-privileged |
1645 | datametrics [old-radius] | Datametrics / old radius entry |
1646 | sa-msg-port [oldradacct] | sa-msg-port / old radacct entry |
1649 | kermit | Kermit file transfer and management service |
1701 | l2tp [l2f] | Layer 2 Tunneling Protocol (LT2P) / Layer 2 Forwarding (L2F) |
1718 | h323gatedisc | H.323 telecommunication Gatekeeper Discovery |
1719 | h323gatestat | H.323 telecommunication Gatekeeper Status |
1720 | h323hostcall | H.323 telecommunication Host Call setup |
1758 | tftp-mcast | Trivial FTP Multicast |
1759/udp | mtftp | Multicast Trivial FTP (MTFTP) |
1789 | hello | Hello router communication protocol |
1812 | radius | Radius dial-up authentication and accounting services |
1813 | radius-acct | Radius Accounting |
1911 | mtp | Starlight Networks Multimedia Transport Protocol (MTP) |
1985 | hsrp | Cisco Hot Standby Router Protocol |
1986 | licensedaemon | Cisco License Management Daemon |
1997 | gdp-port | Cisco Gateway Discovery Protocol (GDP) |
2049 | nfs [nfsd] | Network File System (NFS) |
2102 | zephyr-srv | Zephyr distributed messaging Server |
2103 | zephyr-clt | Zephyr client |
2104 | zephyr-hm | Zephyr host manager |
2401 | cvspserver | Concurrent Versions System (CVS) client/server operations |
2430/tcp | venus | Venus cache manager for Coda file system (codacon port) |
2430/udp | venus | Venus cache manager for Coda file system (callback/wbc interface) |
2431/tcp | venus-se | Venus Transmission Control Protocol (TCP) side effects |
2431/udp | venus-se | Venus User Datagram Protocol (UDP) side effects |
2432/udp | codasrv | Coda file system server port |
2433/tcp | codasrv-se | Coda file system TCP side effects |
2433/udp | codasrv-se | Coda file system UDP SFTP side effect |
2600 | hpstgmgr [zebrasrv] | Zebra routing[b] |
2601 | discp-client [zebra] | discp client; Zebra integrated shell |
2602 | discp-server [ripd] | discp server; Routing Information Protocol daemon (ripd) |
2603 | servicemeter [ripngd] | Service Meter; RIP daemon for IPv6 |
2604 | nsc-ccs [ospfd] | NSC CCS; Open Shortest Path First daemon (ospfd) |
2605 | nsc-posa | NSC POSA; Border Gateway Protocol daemon (bgpd) |
2606 | netmon [ospf6d] | Dell Netmon; OSPF for IPv6 daemon (ospf6d) |
2809 | corbaloc | Common Object Request Broker Architecture (CORBA) naming service locator |
3130 | icpv2 | Internet Cache Protocol version 2 (v2); used by Squid proxy caching server |
3306 | mysql | MySQL database service |
3346 | trnsprntproxy | Transparent proxy |
4011 | pxe | Pre-execution Environment (PXE) service |
4321 | rwhois | Remote Whois (rwhois) service |
4444 | krb524 | Kerberos version 5 (v5) to version 4 (v4) ticket translator |
5002 | rfe | Radio Free Ethernet (RFE) audio broadcasting system |
5308 | cfengine | Configuration engine (Cfengine) |
5999 | cvsup [CVSup] | CVSup file transfer and update tool |
6000/tcp | x11 [X] | X Window System services |
7000 | afs3-fileserver | Andrew File System (AFS) file server |
7001 | afs3-callback | AFS port for callbacks to cache manager |
7002 | afs3-prserver | AFS user and group database |
7003 | afs3-vlserver | AFS volume location database |
7004 | afs3-kaserver | AFS Kerberos authentication service |
7005 | afs3-volser | AFS volume management server |
7006 | afs3-errors | AFS error interpretation service |
7007 | afs3-bos | AFS basic overseer process |
7008 | afs3-update | AFS server-to-server updater |
7009 | afs3-rmtsys | AFS remote cache manager service |
9876 | sd | Session Director for IP multicast conferencing |
10080 | amanda | Advanced Maryland Automatic Network Disk Archiver (Amanda) backup services |
11371 | pgpkeyserver | Pretty Good Privacy (PGP) / GNU Privacy Guard (GPG) public keyserver |
11720 | h323callsigalt | H.323 Call Signal Alternate |
13720 | bprd | Veritas NetBackup Request Daemon (bprd) |
13721 | bpdbm | Veritas NetBackup Database Manager (bpdbm) |
13722 | bpjava-msvc | Veritas NetBackup Java / Microsoft Visual C++ (MSVC) protocol |
13724 | vnetd | Veritas network utility |
13782 | bpcd | Veritas NetBackup |
13783 | vopied | Veritas VOPIE authentication daemon |
22273 | wnn6 [wnn4] | Kana/Kanji conversion system[c] |
26000 | quake | Quake (and related) multi-player game servers |
26208 | wnn6-ds | Wnn6 Kana/Kanji server |
33434 | traceroute | Traceroute network tracking tool |
[a]
Comment from /etc/services : "Port 1236 is registered as `bvcontrol', but is also used by the Gracilis Packeten remote config server. The official name is listed as the primary name, with the unregistered name as an alias."
[b]
Comment from /etc/services : "Ports numbered 2600 through 2606 are used by the zebra package without being registered. The primary names are the registered names, and the unregistered names used by zebra are listed as aliases."
[c]
Comment from /etc/services : "This port is registered as wnn6, but also used under the unregistered name 'wnn4' by the FreeWnn package."
|
Table C.4. Datagram Deliver Protocol Ports
Port # / Layer | Name | Comment |
---|---|---|
1/ddp | rtmp | Routing Table Management Protocol |
2/ddp | nbp | Name Binding Protocol |
4/ddp | echo | AppleTalk Echo Protocol |
6/ddp | zip | Zone Information Protocol |
Table C.5. Kerberos (Project Athena/MIT) Ports
Port # / Layer | Name | Comment |
---|---|---|
751 | kerberos_master | Kerberos authentication |
752 | passwd_server | Kerberos Password (kpasswd) server |
754 | krb5_prop | Kerberos v5 slave propagation |
760 | krbupdate [kreg] | Kerberos registration |
1109 | kpop | Kerberos Post Office Protocol (KPOP) |
2053 | knetd | Kerberos de-multiplexor |
2105 | eklogin | Kerberos v5 encrypted remote login (rlogin) |
Table C.6. Unregistered Ports
Port # / Layer | Name | Comment |
---|---|---|
15/tcp | netstat | Network Status (netstat) |
98/tcp | linuxconf | Linuxconf Linux administration tool |
106 | poppassd | Post Office Protocol password change daemon (POPPASSD) |
465/tcp | smtps | Simple Mail Transfer Protocol over Secure Sockets Layer (SMTPS) |
616/tcp | gii | Gated (routing daemon) Interactive Interface |
808 | omirr [omirrd] | Online Mirror (Omirr) file mirroring services |
871/tcp | supfileserv | Software Upgrade Protocol (SUP) server |
901/tcp | swat | Samba Web Administration Tool (SWAT) |
953 | rndc | Berkeley Internet Name Domain version 9 (BIND 9) remote configuration tool |
1127/tcp | supfiledbg | Software Upgrade Protocol (SUP) debugging |
1178/tcp | skkserv | Simple Kana to Kanji (SKK) Japanese input server |
1313/tcp | xtel | French Minitel text information system |
1529/tcp | support [prmsd, gnatsd] | GNATS bug tracking system |
2003/tcp | cfinger | GNU finger |
2150 | ninstall | Network Installation Service |
2988 | afbackup | afbackup client-server backup system |
3128/tcp | squid | Squid Web proxy cache |
3455 | prsvp | RSVP port |
5432 | postgres | PostgreSQL database |
4557/tcp | fax | FAX transmission service (old service) |
4559/tcp | hylafax | HylaFAX client-server protocol (new service) |
5232 | sgi-dgl | SGI Distributed Graphics Library |
5354 | noclog | NOCOL network operation center logging daemon (noclogd) |
5355 | hostmon | NOCOL network operation center host monitoring |
5680/tcp | canna | Canna Japanese character input interface |
6010/tcp | x11-ssh-offset | Secure Shell (SSH) X11 forwarding offset |
6667 | ircd | Internet Relay Chat daemon (ircd) |
7100/tcp | xfs | X Font Server (XFS) |
7666/tcp | tircproxy | Tircproxy IRC proxy service |
8008 | http-alt | Hypertext Tranfer Protocol (HTTP) alternate |
8080 | webcache | World Wide Web (WWW) caching service |
8081 | tproxy | Transparent Proxy |
9100/tcp | jetdirect [laserjet, hplj] | Hewlett-Packard (HP) JetDirect network printing service |
9359 | mandelspawn [mandelbrot] | Parallel mandelbrot spawning program for the X Window System |
10081 | kamanda | Amanda backup service over Kerberos |
10082/tcp | amandaidx | Amanda index server |
10083/tcp | amidxtape | Amanda tape server |
20011 | isdnlog | Integrated Services Digital Network (ISDN) logging system |
20012 | vboxd | ISDN voice box daemon (vboxd) |
22305/tcp | wnn4_Kr | kWnn Korean input system |
22289/tcp | wnn4_Cn | cWnn Chinese input system |
22321/tcp | wnn4_Tw | tWnn Chinese input system (Taiwan) |
24554 | binkp | Binkley TCP/IP Fidonet mailer daemon |
27374 | asp | Address Search Protocol |
60177 | tfido | Ifmail FidoNet compatible mailer service |
60179 | fido | FidoNet electronic mail and news network |
Appendix D. Revision History
Revision History | |||
---|---|---|---|
Revision 2-9.402 | Fri Oct 25 2013 | Rüdiger Landmann | |
| |||
Revision 2-9 | 2012-07-18 | Anthony Towns | |
| |||
Revision 1-0 | Wed Sep 17 2008 | Don Domingo | |
|
Index
Symbols
- 802.11x, Wireless Networks
- and security, Wireless Networks
A
- Apache HTTP Server
- cgi security, Restrict Permissions for Executable Directories
- directives, Securing the Apache HTTP Server
- introducing, Securing the Apache HTTP Server
- attackers and risks, Attackers and Vulnerabilities
B
- basic input output system (see BIOS)
- BIOS
- non-x86 equivalents
- passwords, Securing Non-x86 Platforms
- security, BIOS and Boot Loader Security
- passwords, BIOS Passwords
- black hat hacker (see crackers)
- boot loaders
- GRUB
- password protecting, Password Protecting GRUB
- security, Boot Loader Passwords
C
- co-location services, Hardware Security
- collecting evidence (see incident response)
- file auditing tools, Gathering Post-Breach Information
- dd, Gathering Post-Breach Information
- file, Gathering Post-Breach Information
- find, Gathering Post-Breach Information
- grep, Gathering Post-Breach Information
- md5sum, Gathering Post-Breach Information
- script, Investigating the Incident
- stat, Gathering Post-Breach Information
- strings, Gathering Post-Breach Information
- common exploits and attacks, Common Exploits and Attacks
- table, Common Exploits and Attacks
- common ports
- table, Common Ports
- communication ports, Common Ports
- communication tools
- computer emergency response team, The Computer Emergency Response Team (CERT)
- controls, Security Controls
- administrative, Administrative Controls
- physical, Physical Controls
- technical, Technical Controls
- cracker
- black hat hacker, Shades of Grey
- crackers
- definition, A Quick History of Hackers
- cupsd, Identifying and Configuring Services
D
- dd
- collecting evidence with, Collecting an Evidential Image
- file auditing using, Gathering Post-Breach Information
- Demilitarized Zone, DMZs and iptables
- Denial of Service (DoS)
- distributed, Security Today
- DMZ (see Demilitarized Zone) (see networks)
E
- EFI Shell
- security
- passwords, Securing Non-x86 Platforms
F
- file
- file auditing using, Gathering Post-Breach Information
- file auditing
- find
- file auditing using, Gathering Post-Breach Information
- firewall types, Firewalls
- firewalls, Firewalls
- additional resources, Additional Resources
- and connection tracking, iptables and Connection Tracking
- and viruses, Viruses and Spoofed IP Addresses
- personal, Personal Firewalls
- policies, Basic Firewall Policies
- stateful, iptables and Connection Tracking
- types, Firewalls
- Firewalls
- iptables, Netfilter and iptables
- FTP
- anonymous access, Anonymous Access
- anonymous upload, Anonymous Upload
- greeting banner, FTP Greeting Banner
- introducing, Securing FTP
- TCP wrappers and, Use TCP Wrappers To Control Access
- user accounts, User Accounts
- vsftpd, Securing FTP
G
- grep
- file auditing using, Gathering Post-Breach Information
- grey hat hacker (see hackers)
H
- hacker ethic, A Quick History of Hackers
- hackers
- black hat (see cracker)
- definition, A Quick History of Hackers
- grey hat, Shades of Grey
- white hat, Shades of Grey
- hardware, Hardware and Network Protection
- and security, Hardware Security
- laptops, Hardware Security
- servers, Hardware Security
- workstations, Hardware Security
I
- IDS (see intrusion detection systems)
- incident response
- and legal issues, Legal Considerations
- collecting evidence
- using dd, Collecting an Evidential Image
- computer emergency response team (CERT), The Computer Emergency Response Team (CERT)
- creating a plan, Creating an Incident Response Plan
- definition of, Defining Incident Response
- gathering post-breach information, Gathering Post-Breach Information
- implementation, Implementing the Incident Response Plan
- introducing, Incident Response
- investigation, Investigating the Incident
- post-mortem, Investigating the Incident
- reporting the incident, Reporting the Incident
- restoring and recovering resources, Restoring and Recovering Resources
- incident response plan, Creating an Incident Response Plan
- insecure services, Insecure Services
- rsh, Insecure Services
- Telnet, Insecure Services
- vsftpd, Insecure Services
- introduction, Introduction
- categories, using this manual, Introduction
- other Red Hat Enterprise Linux manuals, Introduction
- topics, Introduction
- intrusion detection systems, Intrusion Detection
- and log files, Host-based IDS
- defining, Defining Intrusion Detection Systems
- host-based, Host-based IDS
- network-based, Network-based IDS
- Snort, Snort
- RPM Package Manager (RPM), RPM as an IDS
- Tripwire, Tripwire
- types, IDS Types
- ip6tables, ip6tables
- IPsec, IPsec
- configuration, IPsec Network-to-Network configuration
- host-to-host, IPsec Host-to-Host Configuration
- host-to-host, IPsec Host-to-Host Configuration
- installing, IPsec Installation
- network-to-network, IPsec Network-to-Network configuration
- phases, IPsec
- iptables, Netfilter and iptables
- additional resources, Additional Resources
- and DMZs, DMZs and iptables
- and viruses, Viruses and Spoofed IP Addresses
- chains, Using iptables
- FORWARD, FORWARD and NAT Rules
- INPUT, Common iptables Filtering
- OUTPUT, Common iptables Filtering
- POSTROUTING, FORWARD and NAT Rules
- PREROUTING, FORWARD and NAT Rules, DMZs and iptables
- connection tracking, iptables and Connection Tracking
- states, iptables and Connection Tracking
- policies, Basic Firewall Policies
- rules, Saving and Restoring iptables Rules
- common, Common iptables Filtering
- forwarding, FORWARD and NAT Rules
- NAT, FORWARD and NAT Rules, DMZs and iptables
- restoring, Saving and Restoring iptables Rules
- saving, Saving and Restoring iptables Rules
- stateful inspection, iptables and Connection Tracking
- states, iptables and Connection Tracking
- using, Using iptables
K
- Kerberos
L
- legal issues, Legal Considerations
- lpd, Identifying and Configuring Services
- lsof, Verifying Which Ports Are Listening
M
- md5sum
- file auditing using, Gathering Post-Breach Information
N
- NAT (see Network Address Translation)
- Nessus, Nessus
- Netfilter, Netfilter and iptables
- additional resources, Additional Resources
- Netfilter 6, ip6tables
- netstat, Verifying Which Ports Are Listening
- Network Address Translation, FORWARD and NAT Rules
- with iptables, FORWARD and NAT Rules
- network services, Available Network Services
- buffer overflow
- ExecShield, Risks To Services
- identifying and configuring, Identifying and Configuring Services
- risks, Risks To Services
- buffer overflow, Risks To Services
- denial-of-service, Risks To Services
- script vulnerability, Risks To Services
- network topologies, Secure Network Topologies
- linear bus, Physical Topologies
- ring, Physical Topologies
- star, Physical Topologies
- networks, Hardware and Network Protection
- and security, Secure Network Topologies
- de-militarized zones (DMZs), Network Segmentation and DMZs
- hubs, Transmission Considerations
- segmentation, Network Segmentation and DMZs
- switches, Transmission Considerations
- wireless, Wireless Networks
- NFS, Securing NFS
- and Sendmail, NFS and Sendmail
- network design, Carefully Plan the Network
- syntax errors, Beware of Syntax Errors
- Nikto, Nikto
- NIS
- introducing, Securing NIS
- IPTables, Assign Static Ports and Use IPTables Rules
- Kerberos, Use Kerberos Authentication
- NIS domain name, Use a Password-like NIS Domain Name and Hostname
- planning network, Carefully Plan the Network
- securenets, Edit the /var/yp/securenets File
- static ports, Assign Static Ports and Use IPTables Rules
- nmap, Verifying Which Ports Are Listening
- Nmap, Scanning Hosts with Nmap
- command line version, Using Nmap
O
P
- password aging, Password Aging
- password security, Password Security
- aging, Password Aging
- and PAM, Forcing Strong Passwords
- auditing tools, Forcing Strong Passwords
- Crack, Forcing Strong Passwords
- John the Ripper, Forcing Strong Passwords
- Slurpie, Forcing Strong Passwords
- enforcement, Forcing Strong Passwords
- in an organization, Creating User Passwords Within an Organization
- methodology, Secure Password Creation Methodology
- strong passwords, Creating Strong Passwords
- passwords
- within an organization, Creating User Passwords Within an Organization
- pluggable authentication modules (PAM)
- strong password enforcement, Forcing Strong Passwords
- portmap, Identifying and Configuring Services
- and IPTables, Protect portmap With IPTables
- and TCP wrappers, Protect portmap With TCP Wrappers
- ports
- common, Common Ports
- monitoring, Verifying Which Ports Are Listening
- post-mortem, Investigating the Incident
R
- reporting the incident, Reporting the Incident
- restoring and recovering resources, Restoring and Recovering Resources
- patching the system, Patching the System
- reinstalling the system, Reinstalling the System
- risks
- insecure services, Inherently Insecure Services
- networks, Threats to Network Security
- architectures, Insecure Architectures
- open ports, Unused Services and Open Ports
- patches and errata, Unpatched Services
- servers, Threats to Server Security
- inattentive administration, Inattentive Administration
- workstations and PCs, Threats to Workstation and Home PC Security, Bad Passwords
- applications, Vulnerable Client Applications
- root, Allowing Root Access
- allowing access, Allowing Root Access
- disallowing access, Disallowing Root Access
- limiting access, Limiting Root Access
- and su, The su Command
- and sudo, The sudo Command
- with User Manager, The su Command
- methods of disabling, Disallowing Root Access
- changing the root shell, Disallowing Root Access
- disabling access via tty, Disallowing Root Access
- disabling SSH logins, Disallowing Root Access
- with PAM, Disallowing Root Access
- root user (see root)
- RPM
- and intrusion detection, RPM as an IDS
- importing GPG key, Using the Red Hat Errata Website
- verifying signed packages, Verifying Signed Packages, Installing Signed Packages
S
- security considerations
- hardware, Hardware and Network Protection
- network transmission, Transmission Considerations
- physical networks, Hardware and Network Protection
- wireless, Wireless Networks
- security errata, Security Updates
- applying changes, Applying the Changes
- via Red Hat errata website, Using the Red Hat Errata Website
- via Red Hat Network, Using Red Hat Network
- when to reboot, Applying the Changes
- security overview, Security Overview
- conclusion, Conclusion
- controls (see controls)
- defining computer security, What is Computer Security?
- Denial of Service (DoS), Security Today
- evolution of computer security, How did Computer Security Come about?
- viruses, Security Today
- sendmail, Identifying and Configuring Services
- Sendmail
- and NFS, NFS and Sendmail
- introducing, Securing Sendmail
- limiting DoS, Limiting a Denial of Service Attack
- server security
- Apache HTTP Server, Securing the Apache HTTP Server
- cgi security, Restrict Permissions for Executable Directories
- directives, Securing the Apache HTTP Server
- FTP, Securing FTP
- anonymous access, Anonymous Access
- anonymous upload, Anonymous Upload
- greeting banner, FTP Greeting Banner
- TCP wrappers and, Use TCP Wrappers To Control Access
- user accounts, User Accounts
- vsftpd, Securing FTP
- NFS, Securing NFS
- network design, Carefully Plan the Network
- syntax errors, Beware of Syntax Errors
- NIS, Securing NIS
- IPTables, Assign Static Ports and Use IPTables Rules
- Kerberos, Use Kerberos Authentication
- NIS domain name, Use a Password-like NIS Domain Name and Hostname
- planning network, Carefully Plan the Network
- securenets, Edit the /var/yp/securenets File
- static ports, Assign Static Ports and Use IPTables Rules
- overview of, Server Security
- portmap, Securing Portmap
- ports
- monitoring, Verifying Which Ports Are Listening
- Sendmail, Securing Sendmail
- and NFS, NFS and Sendmail
- limiting DoS, Limiting a Denial of Service Attack
- TCP wrappers, Enhancing Security With TCP Wrappers
- attack warnings, TCP Wrappers and Attack Warnings
- banners, TCP Wrappers and Connection Banners
- logging, TCP Wrappers and Enhanced Logging
- xinetd, Enhancing Security With xinetd
- managing resources with, Controlling Server Resources
- preventing DoS with, Controlling Server Resources
- SENSOR trap, Setting a Trap
- services, Verifying Which Ports Are Listening
- Services Configuration Tool, Identifying and Configuring Services
- Snort, Snort
- sshd, Identifying and Configuring Services
- stat
- file auditing using, Gathering Post-Breach Information
- strings
- file auditing using, Gathering Post-Breach Information
- su
- and root, The su Command
- sudo
- and root, The sudo Command
T
- TCP wrappers
- and FTP, Use TCP Wrappers To Control Access
- and portmap, Protect portmap With TCP Wrappers
- attack warnings, TCP Wrappers and Attack Warnings
- banners, TCP Wrappers and Connection Banners
- logging, TCP Wrappers and Enhanced Logging
- Tripwire, Tripwire
U
- updates (see security errata)
V
- Virtual Private Networks, Virtual Private Networks
- IPsec, IPsec
- configuration, IPsec Network-to-Network configuration
- host-to-host, IPsec Host-to-Host Configuration
- installing, IPsec Installation
- viruses
- trojans, Security Today
- VLAD the Scanner, VLAD the Scanner
- VPN, Virtual Private Networks
- vulnerabilities
- assessing with Nessus, Nessus
- assessing with Nikto, Nikto
- assessing with Nmap, Scanning Hosts with Nmap
- assessing with VLAD the Scanner, VLAD the Scanner
- assessment, Vulnerability Assessment
- defining, Defining Assessment and Testing
- establishing a methodology, Establishing a Methodology
- testing, Defining Assessment and Testing
W
- white hat hacker (see hackers)
- Wi-Fi networks (see 802.11x)
- wireless security, Wireless Networks
- 802.11x, Wireless Networks
- workstation security, Workstation Security
- BIOS, BIOS and Boot Loader Security
- boot loaders
- passwords, Boot Loader Passwords
- evaluating
- administrative control, Evaluating Workstation Security
- BIOS, Evaluating Workstation Security
- boot loaders, Evaluating Workstation Security
- communications, Evaluating Workstation Security
- passwords, Evaluating Workstation Security
- personal firewalls, Evaluating Workstation Security
X
- xinetd, Identifying and Configuring Services
- managing resources with, Controlling Server Resources
- preventing DoS with, Controlling Server Resources
- SENSOR trap, Setting a Trap