[StuCo 98008]
GNU/Linux for Beginners

Session 10

Host and Network Security

By the end of this lecture you will know

A few simple steps to secure your computer

The main classes of attacks found on the Internet

How to find out information about any computer connected to the Internet

The wealth of information that can be found on a network

BIG WARNING

Some of the techniques presented in this presentation fall in the following categories

Rude

Very rude

Illegal

ALWAYS get explicit permission before toying around with other people's networks/hosts

This is no joke – I've been almost burned...

Multiple Levels of Security
and their associated risks

Physical Security (hopeless)

Anyone who can physically access your computer

The easiest way: take the laptop and run!

Local Security (quite dangerous)

Anyone who has an account on your system

Privilege Escalation

Network Security (easy for personal machines)

Anyone who knows your IP

Goal: gain local access

Physical Access Attacks

The toughest case...

Pick up the laptop and run

Unscrew the hard drive and run

Bootable media (instant root access)

Instant administrative access to all filesystems

Defenses

BIOS password

Encrypted Filesystem

Boot loader password

Local Attacks

Privilege Escalation

Manipulating your regular user privileges to get root access on the system.

Resource Starvation

Making the system too slow/unresponsive to other requests

Password Cracking

Grabbing the password hashes and brute-forcing the passwords.

Privilege Escalation

Incorrect ownership of sudo'ed files -› instant root!

sudo: Allows mortals to execute stuff as the superuser

Configuration file is edited with the command

# visudo

Example entry

alex ALL = NOPASSWD: /root/scripts/adsl-up

SetUserID and SetGroupID programs

# find / \( -perm -02000 -o -perm -04000 \) -ls > setXid

Buffer Overflows

Format String Vulnerabilities

Resource Starvation

Denial of Service from the inside

Use all the CPU/RAM/disk, so that no one else can do anything on the system

$ ulimit -a

Quota support (on ext2/ext3/reiser filesystems)

Process scheduling

$ nice -n -20 ./killcpu

By default, mortals cannot make their processes “urgent”

Password Cracking

Use the shadow password suite

Protects password hashes from mortals

Use strong passwords

At least 6 characters

One character from each of the following

Normal characters (a-z)

Capitals (A-Z)

Numbers (0-9)

Special Characters (!@#$<space>~`+=_-*&^)

No relation with you or your username/real name

Doesn't exist as a word in ANY language

John will otherwise find it...

Network Attacks

Give me your IP and I'll give you...

Denial of Service

The server can no longer communicate with the network

Port Scanning / Banner Grabbing

Ports listening

Versions of services running

Application Vulnerabilities

Getting root on the local machine

Eavesdropping

All your passwords/personal information are belong to us

Denial of Service (DoS attacks)

Saturate the host's network link

Service degradation for legitimate users

Blast a host (or subnet, or domain, or AS) off the Internet!

# ping -f <victim_IP>

Limit rate of requests with netfilter

Fill the victim's TCP connection queue with SYNs

TCP SYN cookies defend against that

echo 1 > /proc/sys/net/ipv4/tcp_syncookies

Port Scanning

# nmap -sS -sV -O <victim_IP>

PORT STATE SERVICE VERSION

22/tcp open ssh OpenSSH 3.6.1p2 (protocol 2.0)

80/tcp open http publicfile httpd

111/tcp open rpcbind 2 (rpc #100000)

Device type: general purpose

Running: Linux 2.4.X|2.5.X

Interesting, let's attack OpenSSH...

Is your machine a web/SSH/RPC server?

No defense – some information needs to be public!

Application Vulnerabilities

New software flaws are found all the time, allowing

Reading local files (/etc/shadow anyone?)

Execution of arbitrary code (/bin/sh)

Example: OpenSSH remote root vulnerability!

Defenses

Only run services when you need to (lsof -i is your friend)

Keep your system patched (up2date, apt-get, YaST etc)

Uninstall applications you don't use

Eavesdropping (packet sniffing)

Access to local network means:

I can read anything that's not encrypted

Usernames/passwords

Your email

Your chat messages

Once I have that, the sky is the limit...

Defense: Encrypt anything that requires authentication

Regular Email

Web mail

FTP/SSH/telnet

Packet Sniffers and Paraphernalia

tcpdump – shows you sniffed packets

ethereal – reconstructs TCP streams, captures data

ngrep – net grep: Looks for strings in sniffed traffic

dsniff – user-friendly spying and much more

Keeping Your Computer Secure

Turn off all unnecessary services

# lsof -i will tell you what's listening for network connections

Look into /etc/rcN.d (where N is your default runlevel) for stuff that gets executed after booting. Delete everything you don't need

Patch your system regularly (up2date, apt-get, YaST)

Only use the “root” account when you have to!

Never authenticate over unencrypted connections

SSH, not telnet

Get your emails over TLS

Click on “Secure Login” for webmail

netfilter : a stateful firewall

Control unauthorized access to your computer over the network (sort of)

Netfilter is controlled by user space application iptables

iptables -L lists the current ruleset

netfilter can filter according to:

Owner of process (allow certain users to do certain things)

Source/destination IP/port (allow access only to public services)

Rate of network traffic (guard against DoS)

State (only allow packets from existing/related connections)

Logging (in /var/log/messages)

Lessons Learned

There's lots of information on a network for the inquiring mind

Minimalism is the safest approach (get rid of junk)

Pessimism (assuming that people are attacking you all the time) is also not a bad idea.

Any GNU/Linux system can be

Extremely™ safe as a client

Very safe as a server

A lesson learned the hard way:

Someone complaining that “I have security problems, people are attacking me all the time!”, is NOT asking you to audit his/her host/network.

Sometimes what you consider help, might be treated as an intrusion.

There are really no easy solutions against attackers who can sit at the keyboard of the machine in question. Encrypted filesystems provide a level of protection, but they are cumbersome (to date, at least) to use.

On a well built/tuned/administered GNU/Linux system, local users cannot do lots of damage, since any malicious action will be captured in some system log.

Any administrator worth his/her salt is keeping an eye on the log files under /var/log

When someone can connect to your machine and incite it to execute commands, that person is considered as having local access.

If someone connects to my machine with SSH and gets a shell, that person has local access.

Privilege Escalation is, in a nutshell, the art of using your normal, restricted privileges, to get superuser privileges and thus complete control of the system.

On a multiuser system, it is extremely important to set proper limits. Someone might even non-maliciously hog the CPU of your server, while other users cannot get their work done!

John: http://www.openwall.com/john

Word lists: ftp://ftp.ox.ac.uk/pub/wordlists

An easy way to create secure passwords, is to think of a phrase, title or quote that you like:

“Welcome To The Machine” : Pink Floyd

becomes WttM:PF

which is a fair password. Add some numbers to stiffen it up a little:

Wt1M:PF should give John a serious headache!

If your IP is routable (i.e. A real Internet address, and not just some NATed local address), anyone can see your machine from the entire Internet.

D.J.Bernstein's SYN cookies page:

http://cr.yp.to/syncookies

The first step of attacking someone, is figuring out how they are vulnerable. Port scanning is an absolute must, to find out any services that might be vulnerable to remote attacks, or authentication services that might allow an attacker to guess/brute force a set of credentials.

The best tactic is NOT to run a service, if you don't need it.

If you're not running a web server, you're automatically invulnerable to the hundreds of attacks that float around the Internet and take advantage of web server vulnerabilities.

If you have to provide a service (e.g. your company's web server), make sure that it only supports the necessary sets of plugins/extentions. This will minimize exposure to remote threats. Also, make sure that you follow some security-related mailing list (like BUGTRAQ) to be notified when a new security vulnerability that affects your servers is publicized.

Every time you get your email, you send your credentials to the mail server. If this connection is unencrypted, anyone who is on the same network with you (e.g. the same wireless access point), can read your credentials and then impersonate you.

Session 10 - Security

[StuCo 98008] Introduction to GNU/Linux

gnu linux security firewall DoS iptables netfilter password cracking sniffing tcpdump ethereal nessus nmap

In this session we will cover the basics of security on a GNU/Linux system. We will start from physical security countermeasures (not really specific to GNU/Linux, but still important to know), local security considerations (password cracking, permissions problems, use of sudo), and will top that with network security issues (portscanning, DoS attacks, unnecessary services, traffic sniffing etc).
Tools we will use:
+ nmap
+ ethereal
+ nessus
+ dsniff
+ tcpdump
+ airsnort
+ John the Ripper

2003-10-10T16:23:49