1. ServiceTrak Meets NLOG/NMAP Jon Finke Rensselaer Polytechnic Institute

2. Objectives l Identify existing security exposures l Identify potential security exposures l Validate meta system configuration l Build on existing work Internal - Simon, ServiceTrak External - NMAP/NLOG

3. Computing Environment l Computer Center Machines Unix - Centrally administered WinTel - Mixed administration l Departmental Machines Unix Administered by CC Staff Unix Administered by non CC Staff WinTel - Mixed Administration

4. NLOG/NMAP l NMAP port scans networks Matches TCP/IP Fingerprint for OS Identifies open ports (services) l NLOG Provides some data management Provides a web interface

5. ServiceTrak l Tracks Services and Servers Web interface to Simon host info

6. Host Groups lpr_ok pop_ok Public Workstations lpr_Specials pop_Specials Private Workstations Public_AIX Public_Irix Public_Solaris Private_AIX Private_Irix Private_Solaris AIX_Workstations Irix_Workstations Solaris_Workstations All_Workstations

7. Service “Safety” l My Standards History of attack/exposure - SMTP Encourage Exposure - Telnet Not required for user workstation Specific servers only (ftp, dns, etc) l Set for the needs of my department Your Mileage May Vary

8. Similar Hosts l Do all hosts offer the SAME services l Do the services make sense for that group? l Is the OS fingerprint correct for each host?

9. Remote Access Hosts

10. Ssh (22/tcp) Remote Access NMAP l Safety Level: Safe l Secure Shell l TSV File

11. Safety Level Breakdown l Special Group of ALL HOSTS Which ones are running unsafe protocols? Do we care?

12. Protocol Specific Lists l Service specialists interested in their particular service. Hostmaster interested in DNS servers Webmaster interested in WWW servers l Operating system specialists interested in their own OS.

13. Problems l NLOG can crash some services l Trips scan detectors Irate email from other sys admins l False reports from detection tools Back Officer Friendly l Policy Issues

14. Our Results l Identified some exposures OS upgrade turned some things on l Identified site configuration errors “Trusted” unix host running NT l Integration of NLOG info with existing tools helpful.

15. Lessons Learned l Host grouping is VERY useful NLOG may be a good approach l OS (via TCP Fingerprint) very handy l Policy Issues Let someone else run it and take the heat…..

16. ServiceTrak Meets NLOG/NMAP Jon Finke Rensselaer Polytechnic Institute finkej@rpi.edu http://www.rpi.edu/~finkej