1. Linux Security Tools Keeping your servers safe Ubuntu NY Local Community Team Carl Schmidtmann Faultline Network Solutions, Inc. www.Faultline.com

2. Outline ● General Linux security procedures ● Security tools included ● Security tools from repository ● Security tools available from others ● Commercial tools

3. General Security ● Mandatory good passwords ● Don't install what you don't understand ● Know your users ● Keep up to date with patches ● Good safety habits ● Backups! Backups! Backups!

4. Security Out of the Box ● Logfiles – syslog, /var/log ● Nightly scripts ● sudo ● Firewall rules – iptables, pf ● Secure access ssh, openssl keys ● Password management – pam ● SELinux – Security Enhanced Linux ● Jails - chroot

5. Available Packages ● Anti-virus – clamav ● Spam filter – SpamAssassin ● Network sniffer - nmap ● Network/System monitor – nagios, snmpd ● System IDS – tripwire ● VPN – openvpn ● Secure FTP – sftp, vsftp

6. Available Packages ● ClamAV Anti Virus ● www.clamav.org www.clamav.org ● clamd – daemon handles actual scanning ● freshclam – performs av database updates ● clamscan – scans files, directories, disks ● mail servers, mail clients

7. Available Packages ● SpamAssassin – spam dectection ● spamassassin.apache.org ● /etc/mail/spamassassin ● spamd ● Mail servers, mail clients

8. Available Packages ● NMap – Network scanner ● www.nmap.org www.nmap.org ● Scans by network or a single address ● Detects systems and reports all open ports ● Can detect system type ● Can detect some types of zombie machines

9. Available Packages ● Nagios – system, services monitoring ● www.nagios.org www.nagios.org ● Nagios server collects information from clients ● Plugins available for just about anything ● Tests system availability, load, service availability ● Easily extended via new plugins

10. Available Packages ● Tripwire – Intrusion Detection ● www.tripwire.org www.tripwire.org ● Records a fingerprint of your system's files ● Scans for any changes to that fingerprint

11. Available Packages ● OpenVPN – Virtual Private Network ● www.openvpn.org www.openvpn.org ● Available for Linux, Unix, Windows, Mac OSX and probably more ● Server needs fixed IP ● Clients can connect to multiple servers ● Uses ssl certificates for authentication

12. Available Packages ● Secure FTP – sftp, vsftpd ● sftp uses ssh tunnel for ftp connections ● vsftpd – Very Secure FTP Daemon

13. Third Party Packages ● IDS/IPS – ossec ● System/Network monitoring – zenoss

14. Third Party Packages ● Ossec – Intrusion Detection/Prevention System ● www.ossec.net www.ossec.net ● Monitors logfiles ● Updates firewall rules in real time ● Notifies on security problems found ● Extensible with new agents

15. Third Party Packages ● Zenoss – system monitoring ● www.zenoss.com www.zenoss.com ● Collects data usually with snmp ● Monitors and graphs system status ● Sends alerts when problem found ● Extensible with plugins ● Very configurable

16. Commercial Packages ● Ubuntu ● RedHat Enterprise Linux ● Tripwire ● Zenoss ● IBM, HP, etc