The following commands/programs will be used/discussed this week:

passwd
pwck and grpck
chage
rpm -Va
ifconfig (promiscuous?)
tcpd
Tripwire ®
PortSentry SATAN and SAINT
Nessus
nmap and nmapfe
Secure Shell (ssh and sshd)
Snort
ssh and sftp
md5sum and gpg keys
xinetd (/etc/hosts.deny and /etc/hosts.allow)

What services (servers) are vulnerable to attack?
What services should not be installed unless there is a REAL need for them?
What should you do with unwanted services in inetd.conf (or xinetd.d)?
Why is ssh better than telnet?
Why is ftp considered a security risk? How is sftp different? What is tcpd?
What are tcp wrappers, why are they useful?
What is the purpose of the files hosts.allow and hosts.deny in /etc ?
What is the purpose of software like SATAN, SAINT and COPS? Why do you probably NOT want to run them on anyone's network but the one you own?
What is meant by a scanner attack? Can you detect scanner attacks?
What is Nessus used for?
Where would you check to see who is/has been trying to access various services on your machine?
What is a Denial of service attack? (DOS) What about a Distributied Denial of Service Attack? (DDOS)
What good does it do to set the /tmp partition noexec?

Assignment 1

 
1. Go to Snort
2. Go to "Get Snort" in left hand menu
3. Under "Addons and Downloads" click on "binaries" then "linux" in the central menu that comes up
4. Download snort-2.8.0-1.RH5.i386.rpm (at the top) (May have to right click, save link as)
5. Use the rpm utility as root to install snort first. (rpm -Uvh snortfilename.rpm or do it during download)
6. Then go to "downloads" and "rules" and download the rules (unregistered user release and the community rules sections) which whould be at the top of their respective sections
7. mv snortrules-whatever.tar.gz to /etc/snort
8. tar -xzvf snortrules-whatever.tar.gz inside /etc/snort
9. then service snortd restart (do twice, the second time should get two OK's)
10. If not, make sure the rules that are included at the bottom of snort.conf match the rulesets in /etc/snort/rules
11. Most likely it has been added to runlevel 3 for you (check /etc/rc.d/rc3.d and see if snortd is there.
12. Otherwise you will have to add snortd to run level 3 startup
    Most likely via chkconfig --level 3 snortd on
    As it will not show up in the "server settings" "services" GUI until at least one directory in rc#.d has a symbolic link to it.
13. Read on the snort page some of the many options you can add. (Of which there are many, including more pro-active responses.
14. FINALLYCheck out the file "alert" in /var/log/snort to see what's going on ;)

Assignment 2

1. Make sure to run yum install libpcap-devel so you have the libraries
2. Go to the "portsentry" page below
3. Download the portsentry "package"
4. use tar to untar and unzip the package
5. cd into portsentry-2.0b1 and use pico or vi to open portsentry.conf
6. Change the interface address to your ip (use ifconfig to find)
7. search for "iptables"
8. Uncomment the line that mentions iptables and Kill route (remove the # sign) and change /usr/local/bin/iptables to /sbin/iptables and replace the # sign for the ipchains line above that
9. Close portsentry.conf
10. Then, as root, run the next two commands inside that directory
11. Type "make linux"
12. Then "make install"
13. Go to /etc/rc.d/ and edit rc.local and add...
    /usr/local/psionic/portsentry2/portsentry
    echo "35000 61000" > /proc/sys/net/ipv4/ip_local_port_range
14. Now at the command line as root type
    /usr/local/psionic/portsentry2/portsentry
15. Then check out the logs in /var/log (especially read "messages")
16. Note, several of the windows servers are nosey buggers, so we m need to edit portsentry.ignore to keep from locking ourselves out of the internet
    Go to /usr/local/psionic/portsentry2/ and add the following lines to portsentry.ignore 140.198.0.0/16
    192.168.0.0/16

Assignment 3

• Download the tarball for chkrootkit
• as root, untar/unzip the file
• Go into the new chkrootkit directory
• If you read the README file, it tells you to compile it with the command
  make sense
• So, do so, then do ./chkrootkit and look at the results

• A Taste of Computer Security (Good article)
• Open SSH
• Check Rootkit
• Tripwire (Free Linux Version)
• Intrusion Detection with AIDE
• Portsentry Archive
• Linux Security.com
• Nessus
• Shields Up!
• SNORT IDS
• Saint
• Bastille Linux Hardening Script