Linux Security An overview notes from Linux Network Security HowTO

Basic Approach Focus on OSI model Most initial probes are service-level attacks –enter through a port –try to compromise the server –use the “server” to gain access to other info and accounts One of the fundamental security policies is to limit the number of services offered.

Basic Linux Approaches tcp wrappers firewall software –ipfwadm –ipchains application security login security –kerberos, etc

tcp wrappers Used in conjunction with inetd services not managed by inetd are NOT protected by this approach Generally a simple approach host.allow and host.deny files control access

How tcp wrappers works client SERVER tcp wrapper software host.allow and host.deny 2. Check for authorization 1. Request service server 3. Launch server if ok 4. Client connects

inetd.conf format finger stream tcp nowait root /usr/sbin/tcpd in.fingerd as before Actually invokes tcp_wrapper daemon to check and tcpd launches the service (finger in this case) if OKed.

hosts.allow and hosts.deny in /etc Two files configure the tcpd rules entry servicelist: hostlist [:shellcmd] ftpd ALL ALL except ftpd defender.pcs.cnu.edu.pcs.cnu.edu LOCAL (no. in name ALL ALL except LOCAL,... traps

hosts.allow and hosts.deny Which comes first? hosts.allow takes precedence –if this file grants access, the client gets access in spite of the info in hosts.deny hosts.deny will stop if match exists there if neither matches, service is granted. Example: in.tftpd, in.fingerd: ALL EXCEPT LOCAL,.your.domain (in hosts.deny and nothing in hosts.allow) only local hosts and xxx.your.domain can tftp or finger

Remember! ONLY WORKS for INETD launched services! Check for others with netstat!

Proactive measures Many services do a reverse DNS verification to authenticate machines. ident is a service which will track which users are using specific services. Examine your own machines for vulnerabilities –use SATAN and similar network scanners –find ports providing services and review.

Replace insecure services with secure versions: qmail for sendmail Keep up-to-date versions of your software to handle problems like –SYN flooding fixed in kernel updates –Pentium FOOF reboot (in a cgi etc) reboots machine but fixed in kernel update –ping floods : stop at firewall –ping o’ death with response too large for kernel makes machine hang or crash, fixed in update Proactive measures

NFS –file system running over RPC..tcp/ip –allows you to mount file systems –an unknown machine can mount and the root from that machine can have root access map external root user to a nobody user be conservative with permissions you offer NIS … use NIS+ Proactive measures

Other Concepts VPNs ipfwadm (ip firewall administration) –older version of the software –not typically used ipchains –similar to ipfwadm –allows for much more complex rules more on ipfwadm and ipchains

Application Security Applications (servers) are also independently configurable –wuftpd –apache only used when –firewall passed AND –tcp wrappers allows Covered with specific services

Password Security and Encryption Shadow passwords Kerberos and PGP SSL and S-HTTP ssh IPSEC - secure tunnels / VPN PAM plugable authentication modules separates the process from applications, like ODBC and databases CIPE encrypyts at network level CFS crypotgraphic file system