1. Securing services in a unix-based environment
Ports and Packets
Securing services in a unix-based environment

2. Overview Why Linux and not Windows? Why is this important?
What are some things we can do to be more secure?
Firewalling
TCP Wrappers
Port Knocking
Mitigating weaknesses
Conclusion

3. Why Linux and not Windows?
Short answer: Most internet/web services operate out of UNIX-based environments
Different approaches to client and server security.

4. Why is this important? There is a lot of attack surface
Various businesses and entities rely on web accessible services
There is a necessity for both accessibility and security
Balance
We don’t personally code everything we run

5. Good security policies
Know what you’re securing
Who needs access?
AV/ AV filtering
Run light

6. Firewall Iptables Fairly easy to manage
Built into almost every recent Linux kernel.
Fairly easy to manage
Made up of “Chains” with different types and rules
Rules can be made for one IP, many IPs, based on connection state, port, TCP vs UDP, etc.

7. Firewall -- Set Default Behaviours
Iptables --policy INPUT DROP
Request timed out
Iptables --policy OUTPUT ACCEPT
Reply from *
Iptables --policy FORWARD REJECT
Destination not reachable

8. Iptables isn’t perfect
Don’t keep logs on their own
Can falsely reject if not careful
Can falsely accept if not careful
Accountability

9. Enter: The TCP Wrappers
So close to being a firewall…
Keep logs
Fairly easy to make rules
Requires programs are specially compiled against libwrap
Broad rules
Transparent to user for the most part

10. TCP wrapping isn’t perfect either
Act upon data POST-entry
VERY broad rules

11. Port Knocking Desired port is closed
Packets are sent to a specific sequence of ports
When the port-knocking software detects that the correct sequence is entered, desired port opens for connections
Pretty cool, huh?
There are ports!

12. Sample Knockd Configuration
[openSSH]
sequence = 7000,8000,9000
seq_timeout = 5
command = /sbin/iptables -I INPUT -s %IP% -p tcp --dport 22 -j ACCEPT
tcpflags = syn
[closeSSH]
sequence = 9000,8000,7000
command = /sbin/iptables -D INPUT -s %IP% -p tcp --dport 22 –j DROP

13. Getting in and out of SSH
To open SSH port
for x in ; do nmap -Pn --host_timeout max-retries 0 -p $x ; done
To close the SSH port
for x in ; do nmap -Pn --host_timeout max-retries 0 -p $x ; done
Or you can use a utility called knock ;)

14. The problem with port knocking
Vulnerable to discovery by traffic analysis
Not cryptographically sound
Programmatically breaking in with port knocking alone is easy, and just a little time consuming.
Any port can be described with 16 bits. Or 2 bytes.
That’s 2 ASCII characters. Or one Unicode character.
Being that most people who use port knocking only use 3 ports, that means around 6 ASCII characters need to be guessed, essentially.

15. DMZ Networking
Public facing servers separate from more sensitive servers
Stricter firewalling and security on non-DMZ servers/services
Often explained with casino analogy

16. So is there no way to be safe?
Conclusion:
Layer security
Maintain high security standards
Watch logs
Use log management software, automation, ing, etc.
Fail2Ban
Be paranoid

17. Bibliography
Hansteen, Peter N. "Why Not Use Port Knocking." That Grumpy BSD Guy. N.p., 11 Apr Web. 20 Feb < port-knocking.html>.
"Web Server Survey." Security Space. E-Soft Inc., 1 Dec Web. 20 Feb <
"OS/Linux Distributions using Apache." Security Space. E-Soft Inc., 1 Dec Web. 20 Feb < .

20. How can we be safe? Paid services Free/open-source software Experience
Baseline procedures
Customer precautions 5

21. Updating Pretty simple: stay up to date!
Subscribe to vulnerability sites and social media
Patch problems ASAP
Backups
Backups of backups
Offsite backups of the backups of the backups… 6

23. Title and Content Layout with List
Click to edit Master text styles
Second level
Third level
Fourth level
Fifth level

24. Title and Content Layout with Chart

25. Two Content Layout with Table
First bullet point here
Second bullet point here
Third bullet point here
Group 1
Group 2
Class 1 82 95
Class 2 76 88
Class 3 84 90

26. Title and Content Layout with SmartArt
Step 1 Title
Task description
Step 2 Title
Step 3 Title