1. Hacking Linux Systems

2.  Text Editors  vi, ex, pico, jove, GNU emacs  Shells  chs (C Shell), sh (Bourne Shell)  File navigation  cd, ls, cp, mv, mkdir, rm

3.  Directories  /bin: common Linux user commands ( ls, sort, date, chmod)  /sbin: admin commands and daemon processes  /etc: admin config files, passwd file, shadow file  /dev: files representing access points to devices  /usr: user docs, graphical files, libraries  Networking commands  arp, ifconfig, dig, netstat, nslookup, traceroute

4.  Noteworthy commands  mkpassword: generate random password  chage & passwd: force users to change password  useradd: create new user  usermod: modify a user account  groupadd: create new group

5.  Noteworthy commands  pwconv: change password file to shadow file  groups: get info about a user  kill: stop an unwanted service  w: display currently logged in users  umask: set initial file permissions on new files  chmod: change file permissions  chkrootkit: check for installed rootkit

6.  New hardware  Bug fix  New app requires new OS

7.  Secure location  Strong passwords  Shadow passwords:  Use PASSCONV command to move passwords to: /etc/shadow  Format: LoginName.Password.UserID.PrimaryGroupID.Comment:HomeDir ectory:ShellAssigned  eg: mark:x:501:100:Mark Smith:/home/mark:bin/tcsh  Also, generate random passwords with mkpasswd  Also, require password changes: passwd, chage  Remove unused services

8.  Preconfigure default user account and files  /etc/skel  Apply bug fixes  Disable remote access  Or use VPN (Linux uses 3DES)  Use syslog for centralizing log files  Rsyslog, Swatch, Timbersee, IPLog  Verify downloaded files are not compromised  Command: sum checks MD5 info  Monitor network traffic  Ntop, MRTG, IPTraf

9.  Determine if NIC is promiscuous  Ifconfig | grep PROMISC  grep Promisc /var/log/messages  ip link | grep PROMISC  Firewall  < 2.4 Kernel: IPChains  >= 2.4 Kernel: IPTables  Securely erase data  wipe /dev/….  Install/configure a proxy server: Squid  Protect DNS info: BIND