Linux Security Tools Keeping your servers safe Ubuntu NY Local Community Team Carl Schmidtmann Faultline Network Solutions, Inc.
Outline ● General Linux security procedures ● Security tools included ● Security tools from repository ● Security tools available from others ● Commercial tools
General Security ● Mandatory good passwords ● Don't install what you don't understand ● Know your users ● Keep up to date with patches ● Good safety habits ● Backups! Backups! Backups!
Security Out of the Box ● Logfiles – syslog, /var/log ● Nightly scripts ● sudo ● Firewall rules – iptables, pf ● Secure access ssh, openssl keys ● Password management – pam ● SELinux – Security Enhanced Linux ● Jails - chroot
Available Packages ● Anti-virus – clamav ● Spam filter – SpamAssassin ● Network sniffer - nmap ● Network/System monitor – nagios, snmpd ● System IDS – tripwire ● VPN – openvpn ● Secure FTP – sftp, vsftp
Available Packages ● ClamAV Anti Virus ● ● clamd – daemon handles actual scanning ● freshclam – performs av database updates ● clamscan – scans files, directories, disks ● mail servers, mail clients
Available Packages ● SpamAssassin – spam dectection ● spamassassin.apache.org ● /etc/mail/spamassassin ● spamd ● Mail servers, mail clients
Available Packages ● NMap – Network scanner ● ● Scans by network or a single address ● Detects systems and reports all open ports ● Can detect system type ● Can detect some types of zombie machines
Available Packages ● Nagios – system, services monitoring ● ● Nagios server collects information from clients ● Plugins available for just about anything ● Tests system availability, load, service availability ● Easily extended via new plugins
Available Packages ● Tripwire – Intrusion Detection ● ● Records a fingerprint of your system's files ● Scans for any changes to that fingerprint
Available Packages ● OpenVPN – Virtual Private Network ● ● Available for Linux, Unix, Windows, Mac OSX and probably more ● Server needs fixed IP ● Clients can connect to multiple servers ● Uses ssl certificates for authentication
Available Packages ● Secure FTP – sftp, vsftpd ● sftp uses ssh tunnel for ftp connections ● vsftpd – Very Secure FTP Daemon
Third Party Packages ● IDS/IPS – ossec ● System/Network monitoring – zenoss
Third Party Packages ● Ossec – Intrusion Detection/Prevention System ● ● Monitors logfiles ● Updates firewall rules in real time ● Notifies on security problems found ● Extensible with new agents
Third Party Packages ● Zenoss – system monitoring ● ● Collects data usually with snmp ● Monitors and graphs system status ● Sends alerts when problem found ● Extensible with plugins ● Very configurable
Commercial Packages ● Ubuntu ● RedHat Enterprise Linux ● Tripwire ● Zenoss ● IBM, HP, etc