1.1 MiB
Syngress - Hack Proofing Linux (2001)
138_linux_FC 6/20/01 9:56 AM Page 1 1YEAR UPGRADE BUYER PROTECTION PLAN ™ Your Guide to Open Source Security • Step-by-Step Instructions for Deploying Open Source Security Tools • Hundreds of Tools & Traps and Damage & Defense Sidebars, Security Alerts,and Exercises! • Bonus WalletCD with Configuration Examples,PacketCaptures, and Programs James Stanger, Ph.D. Patrick T. Lane Edgar Danielyan Technical Editor
138_linux_FM 6/20/01 9:29 AM Page i s o l u t i o n s @ s y n g r e s s . c o m With more than 1,500,000 copies of our MCSE, MCSD, CompTIA, and Cisco study guides in print, we continue to look for ways we can better serve the information needs of our readers. One way we do that is by listening. Readers like yourself have been telling us they want an Internet-based ser- vice that would extend and enhance the value of our books. Based on reader feedback and our own strategic plan, we have created a Web site that we hope will exceed your expectations. Solutions@syngress.com is an interactive treasure trove of useful infor- mation focusing on our book topics and related technologies. The site offers the following features: (cid:2) One-year warranty against content obsolescence due to vendor product upgrades. You can access online updates for any affected chapters. (cid:2) “Ask the Author”™ customer query forms that enable you to post questions to our authors and editors. (cid:2) Exclusive monthly mailings in which our experts provide answers to reader queries and clear explanations of complex material. (cid:2) Regularly updated links to sites specially selected by our editors for readers desiring additional reliable information on key topics. Best of all, the book you’re now holding is your key to this amazing site. Just go to www.syngress.com/solutions, and keep this book handy when you register to verify your purchase. Thank you for giving us the opportunity to serve your needs. And be sure to let us know if there’s anything else we can do to help you get the max- imum value from your investment. We’re listening. www.syngress.com/solutions
138_linux_FM 6/20/01 9:29 AM Page ii
138_linux_FM 6/20/01 9:29 AM Page iii 1YEAR UPGRADE BUYER PROTECTION PLAN ™ LLiinnuuxx::AA GGuuiiddee ttoo OOppeenn SSoouurrccee SSeeccuurriittyy The Only Way to Stop a Hacker Is to Think Like One James Stanger Patrick T. Lane
138_linux_FM 6/20/01 9:29 AM Page iv Syngress Publishing,Inc.,the author(s),and any person or firm involved in the writing,editing,or production (collectively “Makers”) of this book (“the Work”) do not guarantee or warrant the results to be obtained from the Work. There is no guarantee of any kind,expressed or implied,regarding the Work or its contents.The Work is sold AS IS and WITHOUT WARRANTY. You may have other legal rights,which vary from state to state. In no event will Makers be liable to you for damages,including any loss of profits,lost savings,or other inci- dental or consequential damages arising out from the Work or its contents.Because some states do not allow the exclusion or limitation of liability for consequential or incidental damages,the above limitation may not apply to you. You should always use reasonable care,including backup and other appropriate precautions,when working with computers,networks,data,and files. Syngress Media®,Syngress®,and “Career Advancement Through Skill Enhancement®,”are registered trademarks of Syngress Media,Inc. “Ask the Author™,”“Ask the Author UPDATE™,”“Mission Critical™,”and “Hack Proofing™”are trademarks of Syngress Publishing,Inc. Brands and product names mentioned in this book are trademarks or service marks of their respective companies. KEY SERIAL NUMBER 001 NFKA4UR934 002 DFTGEGHFG6 003 9456VMPDSP 004 MKC8EWR535 005 ZL94V343BB 006 AS56J89HGE 007 MJTY3D29H6 008 ADQW9UU6NN 009 5TGBXDQ7TN 010 KRF4W2F6P9 PUBLISHED BY Syngress Publishing,Inc. 800 Hingham Street Rockland,MA 02370 Hack Proofing Linux: A Guide to Open Source Security Copyright © 2001 by Syngress Publishing,Inc. All rights reserved.Printed in the United States of America. Except as permitted under the Copyright Act of 1976,no part of this publication may be reproduced or dis- tributed in any form or by any means,or stored in a database or retrieval system,without the prior written permission of the publisher,with the exception that the program listings may be entered,stored,and executed in a computer system,but they may not be reproduced for publication. Printed in the United States of America 1 2 3 4 5 6 7 8 9 0 ISBN: 1-928994-34-2 Technical Editors:Edgar Danielyan and Larry Karnis Freelance Editorial Manager:Maribeth Corona-Evans Co-Publisher:Richard Kristof Cover Designer:Michael Kavish Acquisitions Editor:Catherine B.Nolan Page Layout and Art by:Shannon Tozier Developmental Editor:Kate Glennon Copy Editor:Beth A.Roberts and Darren Meiss CD Production:Michael Donovan Indexer:Jennifer Coker Distributed by Publishers Group West in the United States.
138_linux_FM 6/20/01 9:29 AM Page v Acknowledgments We would like to acknowledge the following people for their kindness and support in making this book possible. Richard Kristof and Duncan Anderson of Global Knowledge,for their generous access to the IT industry’s best courses,instructors,and training facilities. Ralph Troupe,Rhonda St.John,and the team at Callisma for their invaluable insight into the challenges of designing,deploying and supporting world-class enterprise networks. Karen Cross,Lance Tilford,Meaghan Cunningham,Kim Wylie,Harry Kirchner,Bill Richter,Kevin Votel,and Kent Anderson of Publishers Group West for sharing their incredible marketing experience and expertise. Mary Ging,Caroline Hird,Simon Beale,Caroline Wheeler,Victoria Fuller,Jonathan Bunkell,and Klaus Beran of Harcourt International for making certain that our vision remains worldwide in scope. Anneke Baeten,Annabel Dent,and Laurie Giles of Harcourt Australia for all their help. David Buckland,Wendi Wong,Daniel Loh,Marie Chieng,Lucy Chong,Leslie Lim, Audrey Gan,Charlotte Chan,and Joseph Chan of Transquest Publishers for the enthusiasm with which they receive our books. Kwon Sung June at Acorn Publishing for his support. Ethan Atkin at Cranbury International for his help in expanding the Syngress program. Joe Pisco,Helen Moyer,Paul Zanoli,Alan Steele,and the great folks at InterCity Press for all their help. Philip Allen at Brewer & Lord LLC for all his work and generosity. vv
138_linux_FM 6/20/01 9:29 AM Page vi
138_linux_FM 6/20/01 9:29 AM Page vii Contributors Patrick T. Lane (MCSE,MCP+I,MCT,Network+,i-Net+,CIW) is a Content Architect for ProsoftTraining.com,a leading Internet skills training and curriculum development company.He is the author of more than 20 technical courses and is the Director of the CIW Foundations and CIW Internetworking Professional series.While at ProsoftTraining.com,Patrick helped create the Certified Internet Webmaster (CIW) program and the i-Accelerate program for Intel, Novell,and Microsoft professionals. Patrick consults as a mail,news,FTP,and Web Administrator for sev- eral organizations,including jCert Initiative Inc.and ProsoftTraining.com. He is also a network security consultant and writer who specializes in TCP/IP internetworking,LAN/WAN solutions,network and operating system security,and the Linux and Windows NT/2000 platforms.He has consulted for the University of Phoenix/Apollo Group,Novell,Intel, NETg,WAVE technologies,KT Solutions,SmartForce,and Futurekids. Patrick is a member of the CompTIA Network+ Advisory Committee, and co-author of Syngress Publishing’s E-mail Virus Protection Handbook (ISBN:1-928994-23-7).His work has been published in eight languages and he has been a featured speaker for the SmartForce Seminar Series on E-Business,the Internet World PING Series on Internet Protocol version 6,and the Information Technology Association of America (ITAA).He holds a master’s degree in education. James Stanger (Ph.D.,MCSE,MCT) directs the Linux,Security,and Server Administrator certification tracks for ProsoftTraining.com.Since receiving his Ph.D.in 1997,he has focused on auditing Internet servers and writing courseware,books,and articles about administering and securing Internet servers.James has consulted for IBM,Symantec,Evinci vii
138_linux_FM 6/20/01 9:29 AM Page viii (www.evinci.org),Pomeroy (www.pomeroy.com),Securify (www.securify.com),Brigham Young University,and California State,San Bernardino.He specializes in troubleshooting firewalls,intrusion detec- tion,DNS,e-mail,and Web server implementations. James was the Technical Editor of Syngress Publishing’s E-mail Virus Protection Handbook (ISBN:1-928994-23-7) and has been an instructional designer of security and A+ courses for NetG,Thompson/WAVE learning,and ComputerPREP.Active in the Linux community,James sits on the Linux Professional Institute (www.lpi.org),SAIR (www.linuxcertification.org),and CompTIA Linux+ (www.comptia.org) advisory boards,each of which is dedicated to creating and maintaining industry-respected certifications.As the Vice Chair of the Linux Professional Institute (LPI) Advisory Council,he acts as liaison between the LPI and companies such as IBM,Compaq,and Intel. viii
138_linux_FM 6/20/01 9:29 AM Page ix Technical Editors Edgar Danielyan (CCNA) is a self-employed developer specializing in GCC,X Window,Tcl/Tk,logic programming,Internet security,and TCP/IP;as well as having with BSD,SVR4.2,FreeBSD,SCO,Solaris,and UnixWare.He has a diploma in company law from the British Institute of Legal Executives as well as a paralegal certificate from the University of Southern Colorado.He is currently working as the Network Administrator and Manager of a top-level Armenian domain.He has also worked for the United Nations,the Ministry of Defense of the Republic of Armenia,and Armenian national telephone companies and financial institutions.Edgar speaks four languages,and is a member of ACM,IEEE CS,USENIX,CIPS,ISOC,and IPG. Larry Karnis (RHCE,Master ACE,CITP),is a Senior Consultant for Application Enhancements,a Unix,Linux,and Internet consulting firm located in Toronto,Canada.His first exposure to Unix was over 20 years ago where he used Unix Version 6 while completing a bachelor’s degree in computer science and mathematics.Larry deploys and manages Linux- based solutions such as Web and file and print servers,and Linux firewalls. ix
138_linux_FM 6/20/01 9:29 AM Page x About the CD This book is accompanied by a CD containing files and open source programs used throughout the book.The files include configuration examples,packet captures,and additional resources.We have included the specific open source programs used in the book so you can follow the chapter demonstrations step-by-step on your own systems. Each file on the CD is discussed in detail and referenced throughout the book with the CD icon below.When a specific file or program is required,it directs you to the accompanying CD.The book also directs you to the Web site where you can download the most current version,and find additional resources relating to that pro- gram.For instance,you can download Free Secure Wide Area Network (FreeS/WAN) at www.freeswan.org,or use the version located on the CD.It is recommended that you use the version included on the CD because this will increase the chances that the book demonstrations will be successful,as some of the programs may have changed since this book was printed. The book is written to Red Hat Linux 7.x.Therefore,most of the CD files are Red Hat Package Manager (.rpm) files.There are also many Tape Archive (.tar) files and GNU Zip (.gzip) files.Instructions for unpacking and installing these files are included in their respective locations throughout the book.To mount the CD onto your Linux system,you would issue the following command (for Red Hat systems): mount -t iso9660 /dev/cdrom /mnt/cdrom And to unmount: umount /mnt/cdrom It is recommended that you copy the CD files to your hard drive before working with them.If you use other versions of Linux,you may need to modify the demon- strations,or download a portable version of the open source programs to work with your version of Linux. Look for this CD icon when obtaining files used in the book demonstrations. x
138_linux_ToC 6/20/01 9:27 AM Page xi Contents Foreword xxvii Using the GNU Chapter 1 Introduction to Open General Public License Source Security 1 Introduction 2 The GNU General Public The Tools Used in This Book 3 License (GPL) is the basis Using the GNU General Public License 3 of the open source Fee-Based GPL Software 5 movement. This license is provided by the Gnu is Can I Use GPL Software in My Company? 5 Not Unix (GNU) Soft Skills:Coping with Open Source Quirks 6 organization, which General Lack of Installation and Configuration develops various software packages. The most Support 6 important element of this Infrequent or Irregular Update Schedules 6 license is that instead of Command-Line Dominance 6 protecting a particular person or company, it Lack of Backward Compatibility and No protects the software code Regular Distribution Body 7 that creates the Inconvenient Upgrade Paths 7 application. Conflicts in Supporting Libraries and Limited Platform Support 7 Interface Changes 8 Partially Developed Solutions 8 Should I Use an RPM or Tarballs? 10 Tarball 10 Red Hat Package Manager 11 Debian 11 Obtaining Open Source Software 12 SourceForge 12 Freshmeat 13 Packetstorm 14 xi
138_linux_ToC 6/20/01 9:27 AM Page xii xii Contents SecurityFocus 15 Is That Download Safe? 16 A Brief Encryption Review 16 Symmetric Key Encryption 17 Asymmetric Key Encryption 18 Public Key and Trust Relationships 19 One-Way Encryption 20 GNU Privacy Guard 21 Deploying GNU Privacy Guard 21 Skipping Public Key Verification 29 Using GPG to Verify Signatures on Tarball Packages 30 Using Md5sum 30 Auditing Procedures 31 Locking Down Your Network Hosts 31 Securing Data across the Network 32 Protecting the Network Perimeter 33 Summary 35 Solutions Fast Track 35 Frequently Asked Questions 38 Chapter 2 Hardening the Operating System 41 Introduction 42 Updating the Operating System 42 Red Hat Linux Errata and Update Service Packages 42 Handling Maintenance Issues 43 Red Hat Linux Errata:Fixes and Advisories 44 Bug Fix Case Study 46 Manually Disabling Unnecessary Services and Ports 47 Services to Disable 47 The xinetd.conf File 48 Locking Down Ports 50 Well-Known and Registered Ports 50 Determining Ports to Block 52
138_linux_ToC 6/20/01 9:27 AM Page xiii Contents xiii Blocking Ports 53 Xinetd Services 53 Determining Which Stand-Alone Services 54 Ports to Block Hardening the System with Bastille 55 Bastille Functions 55 When determining which ports to block on your Bastille Versions 63 server, you must first Implementing Bastille 64 determine which services Undoing Bastille Changes 74 you require. In most cases, block all ports that are not Controlling and Auditing Root Access with Sudo 77 exclusively required by System Requirements 79 these services. This is tricky, The Sudo Command 79 because you can easily Downloading Sudo 80 block yourself from services you need, Installing Sudo 82 especially services that use Configuring Sudo 86 ephemeral ports. If your Running Sudo 90 server is an exclusive e-mail server running SMTP and No Password 92 IMAP, you can block all TCP Sudo Logging 93 ports except ports 25 and Managing Your Log Files 96 143, respectively. If your server is an exclusive HTTP Using Logging Enhancers 97 server, you can block all SWATCH 97 ports except TCP port 80. Scanlogd 100 Syslogd-ng 101 Summary 103 Solutions Fast Track 104 Frequently Asked Questions 107 Chapter 3 System Scanning and Probing 109 Introduction 110 Scanning for Viruses Using the AntiVir Antiviru Application 110 Understanding Linux Viruses 110 Using AntiVir 112 Key Mode and Non-Key Mode 114 Licensing AntiVir 114 Exercise:Updating AntiVir 114 Using TkAntivir 116 Required Libraries and Settings 117
138_linux_ToC 6/20/01 9:27 AM Page xiv xiv Contents Scanning Systems for Boot Sector and E-Mail Viruses 117 Additional Information 120 Exercise:Using TkAntivir 120 Learn How to Set Preferences For Scanning Systems for DDoS Attack Software TkAntivir Using a Zombie Zapper 123 How Zombies Work and How to Stop Them 124 When Should I Use a Zombie Zapper? 125 What Zombie Zapper Should I Use? 125 What Does Zombie Zapper Require to Compile? 127 Exercise:Using Zombie Zapper 127 Scanning System Ports Using the Gnome Service Scan Port Scanner 129 Required Libraries 130 Why Use a Port Scanner? 131 Exercise:Using Gnome Service Scanner 131 Using Nmap 133 Isn’t Nmap Just Another Port Scanner? 134 Acquiring and Installing Nmap 136 Common Nmap Options 136 Applied Examples 137 Scanning Entire Networks and Subnets 138 Selective Scanning 139 Adding More Stealth 139 Saving to Text and Reading from Text 140 Testing Firewalls and Intrusion Detection Systems 141 Example:Spoofing the Source Address of a Scan 142 Timing Your Scan Speeds 142 Example:Conducting a Paranoid Scan 143 Exercise:Using Nmap 143 Using Nmap in Interactive Mode 144 Exercise:Using Nmap in Interactive Mode 144
138_linux_ToC 6/20/01 9:27 AM Page xv Contents xv Using NmapFE as a Graphical Front End 146 Exercise:Using NmapFE 147 Using Remote Nmap (Rnmap) as a Central Scanning Device 147 Exercise:Scanning Systems with Rnmap 148 Deploying Cheops to Monitor Your Network 151 How Cheops Works 153 Obtaining Cheops 154 Required Libraries 154 The Cheops Interface 155 Mapping Relations between Computers 157 Cheops Monitoring Methods 157 Connectivity Features 159 Exercise:Installing and Configuring Cheops 160 Deploying Nessus to Test Daemon Security 165 The Nessus Client/Server Relationship 167 Windows Nessus Clients 169 Required Libraries 169 Order of Installation 170 Configuring Plug-Ins 173 Creating a New Nessus User 174 The Rules Database 174 Exercise:Installing Nessus and Conducting a Vulnerability Scan 175 Updating Nessus 179 Understanding Differential,Detached, and Continuous Scans 180 Exercise:Conducting Detached and Differential Scans with Nessus 182 Summary 185 Solutions Fast Track 185 Frequently Asked Questions 189
138_linux_ToC 6/20/01 9:27 AM Page xvi xvi Contents Chapter 4 Implementing an Intrusion Detection System 191 Introduction 192 Understanding IDS Strategies and Types 194 IDS Types 195 Host-Based IDS Applications 196 SECURITY ALERT! Network-Based IDS Applications 196 Although Tripwire has a IDS Applications and Fault Tolerance 197 “file integrity mode,” Tripwire is not really an What Can an IDS Do for Me? 200 integrity checker in the Which IDS Strategy Is Best? 203 classic sense. It does not, for example, test Network-Based IDS Applications and the file’s stability or Firewalls 203 inode number or any other aspect in regards IDS Applications 204 to file storage. Tripwire Installing Tripwire to Detect File Changes on simply compares a file’s Your Operating System 206 new signature with that taken when the Tripwire Dependencies 207 database was created. Availability 208 Other tools may be used to check the Deploying Tripwire 208 integrity of a file’s per- Tripwire Files 208 missions and ownership information. Tripwire Installation Steps 209 Configuring the Tripwire Policy File 209 Creating the Tripwire Policy File 212 Database Initialization Mode 212 Testing E-Mail Capability 214 Integrity Checking Mode 214 Specifying a Different Database 215 Reading Reports 215 Updating Tripwire to Account for Legitimate Changes in the OS 215 Updating the Policy 216 What Do I Do if I Find a Discrepancy? 217 Configuring Tripwire to Inform You Concerning Changes 217 Exercise:Installing Tripwire 217 Exercise:Securing the Tripwire Database 219 Exercise:Using Cron to Run Tripwire Automatically 220
138_linux_ToC 6/20/01 9:27 AM Page xvii Contents xvii Deploying PortSentry to Act as a Host-Based IDS 220 Important PortSentry Files 221 Installing PortSentry 222 Configuring PortSentry to Block Users 222 Optimizing PortSentry to Sense Attack Types 223 Exercise:Installing and Configuring PortSentry 224 Exercise:Clearing Ipchains Rules 227 Exercise:Running an External Command Using PortSentry 227 Installing and Configuring Snort 229 Availability 229 Supporting Libraries 229 Understanding Snort Rules 230 Snort Variables 230 Snort Files and Directories 231 Snort Plug-Ins 232 Starting Snort 233 Logging Snort Entries 236 Running Snort as a Network-Based IDS 236 Ignoring Hosts 237 Additional Logging Options:Text files,Tcpdump,and Databases 237 Configuring Snort to Log to a Database 238 Controlling Logging and Alerts 239 Getting Information 240 Exercise:Installing Snort 240 Exercise:Using Snort as an IDS Application 241 Exercise:Configuring Snort to Log to a Database 243 Exercise:Querying a Snort Database from a Remote Host 251 Identifying Snort Add-Ons 251 SnortSnarf 252
138_linux_ToC 6/20/01 9:27 AM Page xviii xviii Contents Exercise:Using SnortSnarf to Read Snort Logs 252 Analysis Console for Intrusion Databases 252 Summary 254 Solutions Fast Track 254 Frequently Asked Questions 258 Chapter 5 Troubleshooting the Network with Sniffers 261 Introduction 262 Understanding Packet Analysis and TCP Handshakes 264 TCP Handshakes 265 Learn the Flags Used Establishing a TCP Connection 265 in TCP Connections Terminating a TCP Connection 266 Creating Filters Using Tcpdump 268 Flag Description Tcpdump Options 268 SYN Synchronize Tcpdump Expressions 271 sequence Boolean Operators 275 numbers. Used for connection Installing and Using Tcpdump 276 establishment. Configuring Ethereal to Capture Network FIN The sender is finished with the Packets 279 connection. Used Ethereal Options 281 for connection termination. Ethereal Filters 283 RST Reset the Configuring Ethereal and Capturing Packets 283 connection. Viewing Network Traffic between Hosts Using PSH Push the data. EtherApe 288 ACK Acknowledgment Configuring EtherApe and Viewing Network URG Urgent Traffic 289 Summary 293 Solutions Fast Track 294 Frequently Asked Questions 296 Chapter 6 Network Authentication and Encryption 299 Introduction 300 Understanding Network Authentication 300
138_linux_ToC 6/20/01 9:27 AM Page xix Contents xix Attacking Encrypted Protocols 301 Creating Authentication and Encryption Solutions 303 Implementing One-Time Passwords Answer Your (OTP and OPIE) 305 Questions about What Files Does OPIE Replace? 305 Kerberos How Does OPIE Work? 305 OPIE Files and Applications 306 Q: I wish to remove a opiepasswd 307 principal from the keytab of one of my Password Format 308 Kerberos clients. How Using opiekey 309 do I do this? Using opieinfo and opiekey to Generate A: Enter kadmin as an a List 310 administrative user on the Kerberos client Installing OPIE 310 (not the KDC) and use Configuration Options 310 the ketremoveoption. Installation Options 311 For example, if you Uninstalling OPIE 312 wanted to remove the principal for the user Exercise:Installing OPIE 312 named james, you Exercise:Installing the OPIE Client would do the on a Remote Server 315 following: Exercise:Using opie-tk and Allowing terminal$/usr/ kerberos/sbin/kadmin Windows Users to Deploy OPIE. 316 kadmin: ktremove Exercise:Installing opieftpd 318 –p james Implementing Kerberos Version 5 319 kadmin: quit Why Is Kerberos Such a Big Deal? 320 terminal$ Kerberos Terms 321 Kerberos Principals 322 The Kerberos Authentication Process 323 How Information Traverses the Network 324 Creating the Kerberos Database 325 Using kadmin.local 325 Using kadmin 326 Using kadmin on the Client 328 Using kadmin and Creating Kerberos Client Passwords 329 Setting Policies 330 Using Kinit 330
138_linux_ToC 6/20/01 9:27 AM Page xx xx Contents The kinit Command and Time Limits 332 Managing Kerberos Client Credentials 333 The kdestroy Command 333 Exercise:Configuring a KDC 334 Establishing Kerberos Client Trust Relationships with kadmin 337 Additional Daemon Principal Names 339 Logging On to a Kerberos Host Daemon 340 Common Kerberos Client Troubleshooting Issues and Solutions 340 Kerberos Client Applications 341 Kerberos Authentication and klogin 342 Exercise:Configuring a Kerberos Client 342 Summary 345 Solutions Fast Track 345 Frequently Asked Questions 348 Chapter 7 Avoiding Sniffing Attacks through Encryption 353 Secure E-Commerce Introduction 354 Transactions Understanding Network Encryption 354 Capturing and Analyzing Unencrypted If hackers were alerted to Network Traffic 355 an unsecure server, they Using OpenSSH to Encrypt Network Traffic could capture packets going in and out of the between Two Hosts 361 server to gain the data The OpenSSH Suite 362 they sought. For example, Installing OpenSSH 364 if an e-commerce server does not use any type of Configuring SSH 367 network encryption for How SSH Works 368 transactions, there is a Insecure r-command Authentication 368 great deal of data to be gained by a hacker. Secure SSH Authentication 371 Unfortunately, many small Implementing SSH to Secure Data Transmissions companies or over an Insecure Network 373 entrepreneurs set up their own Web servers, Distributing the Public Key 376 unaware of potential Capturing and Analyzing Encyrpted Network security problems, and set Traffic 381 up simple scripts to process payment forms. Summary 385
138_linux_ToC 6/20/01 9:27 AM Page xxi Contents xxi Solutions Fast Track 386 Frequently Asked Questions 388 Chapter 8 Creating Virtual Private Networks 391 Introduction 392 Secure Tunneling with VPNs 392 Telecommuter VPN Solution 392 Router-to-Router VPN Solution 394 Host-to-Host VPN Solution 395 Tunneling Protocols 395 Explaining the IP Security Architecture 396 Using IPSec with a VPN Tunneling Protocol 400 Secure Tunneling with Virtual Private Internet Key Exchange Protocol 401 Networks (VPNs) Creating a VPN by Using FreeS/WAN 402 Downloading and Unpacking FreeS/WAN 404 VPNs provide a private Compiling the Kernel to Run FreeS/WAN 407 data network over public Recompiling FreeS/WAN into the New telecommunication infrastructures, such as Kernel 417 the Internet, by providing Configuring FreeS/WAN 420 authentication and Testing IP Networking 420 encryption through a data “tunnel” between devices. Configuring Public Key Encryption for All data transmitted Secure Authentication of VPN between the devices Endpoints 424 through the tunnel is secure, regardless of what Starting the Tunnel 434 programs the devices are Capturing VPN Tunnel Traffic 436 running. Closing the VPN Tunnel 438 Summary 439 Solutions Fast Track 440 Frequently Asked Questions 441 Chapter 9 Implementing a Firewall with Ipchains and Iptables 445 Introduction 446 Understanding the Need for a Firewall 447 Building a Personal Firewall 449 Understanding Packet Filtering Terminology 450
138_linux_ToC 6/20/01 9:27 AM Page xxii xxii Contents Choosing a Linux Firewall Machine 452 Protecting the Firewall 452 Understand Essential Deploying IP Forwarding and Masquerading 453 Linux Firewall Masquerading 456 Functions Configuring Your Firewall to Filter Network Packets 458 (cid:2) IP address conservation and traffic forwarding Configuring the Kernel 460 Packet Accounting 460 (cid:2) Network differentiation Understanding Tables and Chains in a Linux (cid:2) Protection against Firewall 461 denial-of-service, scanning, and sniffing Built-In Targets and User-Defined Chains 462 attacks Specifying Interfaces 463 (cid:2) IP and port Setting Policies 464 (cid:2) Content filtering Using Ipchains to Masquerade Connections 467 (cid:2) Packet redirection Iptables Masquerading Modules 468 Using Iptables to Masquerade Connections 468 (cid:2) Enhanced authentication and Iptables Modules 470 encryption Exercise:Masquerading Connections (cid:2) Supplemented logging Using Ipchains or Iptables 471 Logging Packets at the Firewall 471 Setting Log Limits 472 Adding and Removing Packet Filtering Rules 472 ICMP Types 473 Exercise:Creating a Personal Firewall and Creating a User-Defined Chain 475 Redirecting Ports in Ipchains and Iptables 477 Configuring a Firewall 478 Setting a Proper Foundation 478 Creating Anti-Spoofing Rules 479 Counting Bandwidth Usage 483 Listing and Resetting Counters 484 Setting Type of Service (ToS) in a Linux Router 484 Setting ToS Values in Ipchains and Iptables 486 Using and Obtaining Automated Firewall Scripts and Graphical Firewall Utilities 488
138_linux_ToC 6/20/01 9:27 AM Page xxiii Contents xxiii Firewall Works in Progress 490 Exercise:Using Firestarter to Create a Personal Firewall 490 Exercise:Using Advanced Firestarter Features 498 Summary 500 Solutions Fast Track 500 Frequently Asked Questions 505 Chapter 10 Deploying the Squid Web Proxy Cache Server 507 Introduction 508 Benefits of Proxy Server Implementation 508 Proxy Caching 508 Network Address Translation 510 Differentiating between a Packet Filter and a Proxy Server 512 Implementing the Squid Web Proxy Cache Server 513 Configure Squid with the /etc/squid/ System Requirements Specific to Proxy squid.conf file Caching 516 Installing Squid 517 Configuring Squid 520 The http_port Tag 522 The Cache_dir Tag 523 The acl Tag 525 The http_access Tag 526 Starting and Testing Squid 528 Configuring Proxy Clients 529 Configuring Netscape Navigator and Lynx 530 Configuring Netscape Navigator 530 Configuring Lynx 532 Configuring Internet Explorer (Optional) 533 Summary 535 Solutions Fast Track 536 Frequently Asked Questions 538
138_linux_ToC 6/20/01 9:27 AM Page xxiv xxiv Contents Chapter 11 Maintaining Firewalls 543 Introduction 544 Testing Firewalls 544 IP Spoofing 546 Open Ports/Daemons 546 Monitoring System Hard Drives,RAM, and Processors 547 Suspicious Users,Logins,and Login Times 547 See How to Use the Check the Rules Database 548 Firelogd Program Verify Connectivity with Company Management and End Users 548 Firelogd(Firewall Log Remain Informed Concerning the Daemon) is a relatively Operating System 549 simple program that can either be run as an Port Scans 549 application or (you might Using Telnet,Ipchains,Netcat,and SendIP to have guessed) as a Probe Your Firewall 550 daemon. It does two things: Ipchains 551 Telnet 551 (cid:2) It reads the kernel log entries and passes Using Multiple Terminals 552 them into a "first in, Netcat 552 first out" (FIFO) pipe, Sample Netcat Commands 554 which Firelogd can then process. Additional Netcat Commands 555 Exercise:Using Netcat 557 (cid:2) Once its buffer is full, it e-mails a report of SendIP:The Packet Forger 558 suspicious traffic to an SendIP Syntax 558 account of your Exercise:Using SendIP to Probe a choosing. You can have it mailed to a local Firewall 560 account, or to a Understanding Firewall Logging,Blocking,and remote system of your Alert Options 563 choice. Firewall Log Daemon 563 Obtaining Firelogd 563 Syntax and Configuration Options 563 Message Format 564 Customizing Messages 566 Reading Log Files Generated by Other Firewalls 568
138_linux_ToC 6/20/01 9:27 AM Page xxv Contents xxv Exercise:Configuring and Compiling Firelogd 568 Fwlogwatch 569 Fwlogwatch Modes 570 Fwlogwatch Options and Generating Reports 572 Exercise:Generating an HTML-Based Firewall Log with Fwlogwatch 575 Automating Fwlogwatch 575 The Fwlogwatch Configuration File 576 Notification Options 579 Response Options 581 Exercise:Configuring Fwlogwatch to Send Automatic Alerts and Block Users 583 Using Fwlogwatch with CGI Scripts 584 Obtaining More Information 586 Viewing the Results 587 Exercise:Using Cron and Fwlogwatch CGI Scripts to Generate an Automatic HTML Report 588 Additional Fwlog Features 590 Obtaining Additional Firewall Logging Tools 590 Summary 593 Solutions Fast Track 593 Frequently Asked Questions 597 Appendix A Bastille Log 599 Appendix B Hack Proofing Linux Fast Track 605 Index 637
138_linux_ToC 6/20/01 9:27 AM Page xxvi
138_linux_pref 6/20/01 9:28 AM Page xxvii Preface Hack Proofing Linux:A Guide to Open Source Security is designed to help you deploy a Linux system on the Internet in a variety of security roles.This book provides prac- tical instructions and pointers concerning the open source security tools that we use every day. First,we show you how to obtain the software;and then,how to use the Bastille application to “harden”your Linux operating system so that it can function securely as it fulfills a specific role of your choice (e.g.,as a Web server,as an E-mail server,and so forth).You will also learn how to use your Linux system as an auditing tool to scan systems for vulnerabilities as well as create an Intrusion Detection System (IDS), which enables your Linux system to log and respond to suspicious activity.From virus protection to encrypting transmissions using Gnu Privacy Guard and FreeSWAN,you will be able to configure your system to secure local data as well as data that will be passed along the network.After reading this book,you will be able to identify open source and “for-fee”tools that can help you further secure your Linux system. We have also included chapters concerning ways to sniff and troubleshoot net- work connections and how to implement strong authentication using One Time Passwords (OTP) and Kerberos.Tools such as Squid proxy server and Ipchains/Iptables will help you use your Linux system so that it can act as a firewall.With the tools on the accompanying CD as well as the advice and instructions given in this book,you will be able to deploy your Linux system in various roles with confidence. We decided to focus on profiling the most commonly used security tools found on the Linux platform.We also decided to emphasize the real-world implementation of these tools,as opposed to just providing conceptual overviews.Finally,we decided to describe the steps you should take when things go wrong.As a result,we have created a book that is a valuable resource that helps you use your Linux system as efficiently as possible. xxvii
138_linux_pref 6/20/01 9:28 AM Page xxviii xxviii Preface One of the most exciting things about this book is that it provides hands-on instructions for implementing security applications.From Gnu Privacy Guard (GPG) and Bastille to FreeSWAN,Kerberos,and firewall troubleshooting utilities,this book shows you how to use your Linux skills to provide the most important security ser- vices such as encryption,authentication,access control,and logging. While writing the book,we had the following three-part structure in mind: (cid:2) Locking Down the Network (Chapters 1 through 4) (cid:2) Securing Data Passing Across the Network (Chapters 5 through 8) (cid:2) Protecting the Network Perimeter with Firewalls (Chapters 9 through 11) Each of these sections is designed to help you find the best solution for your par- ticular situation.Although the book itself isn’t explicitly divided into sections,as you are reading remember this rough division because it will help you to implement security measures in your own environment. Chapter 1 discusses open source concepts,including the GNU General Public License,as presented by the www.gnu.org people (the Free Software Foundation), and then moves on to showing how you can use GPG and Pretty Good Privacy (PGP) to encrypt transmissions and also to check the signatures of files that you download from the Web.It also provides information concerning the steps to take when auditing a network. Chapter 2 shows you how to lock down your operating system so that it provides only those Internet services that you desire.Chapter 3 shows you how to use applica- tions such as AntiVir,Gnome ServiceScan,Nmap,Rnmap,and Nessus to scan for vulnerabilities.In Chapter 4,you will learn about host and network-based IDS applica- tions such as Snort,Tripwire,and PortSentry.Chapter 5 explains how to use network sniffers such as Tcpdump,Ethereal,and EtherApe to their full advantage.With this knowledge,auditing a network and truly understanding what is going on “beneath the hood”will make you a much more effective network security administrator. By the time you finish Chapter 6,you will know how to deploy One Time Passwords and Kerberos,and in Chapter 7,you will understand how to avoid sniffing attacks,and in Chapter 8,you will enable IPSec by deploying FreeSWAN.Chapter 9 empowers you to create personal firewalls as well as packet filtering firewalls using either Ipchains or Iptables.Chapter 10 shows you how to implement Squid so that you can more carefully monitor and process packets.Finally,Chapter 11 provides you with tools that test your firewall implementation. www.syngress.com
138_linux_pref 6/20/01 9:28 AM Page xxix Preface xxix The open source community has fulfilled the need for a powerful,free system that allows you to conduct audits,serve up Web pages,provide e-mail services,or any other Internet service you wish to provide.Once you are able to take advantage of the security software provided by the open source community,you will receive the benefit of having a huge pool of developers working for you.You will gain more freedom because you will be able to choose widely tested security tools provided by a variety of skilled developers.You can even choose (at your own risk) to use rather obscure tools that have been recently created.It is up to you. Open source operating systems and security tools are both a blessing and a curse: You are blessed with (usually) free software,but you are then cursed with having to spend time working with the software’s idiosyncrasies.By reading this book and implementing the tools and practices we’ve described,you should be able to mini- mize the “curse.”It is also our hope that as you read this book you will also become further involved in the open source software movement,which has begun to fulfill its promise of creating powerful,useful software. —James Stanger,Ph.D.,MCSE,MCT www.syngress.com
138_linux_pref 6/20/01 9:28 AM Page xxx
138_linux_01 6/20/01 9:25 AM Page 1 Chapter 1 Introduction to Open Source Security Solutions in this chapter: (cid:2) Using the GNU General Public License (cid:2) Soft Skills: Coping with Open Source Quirks (cid:2) Should I Use an RPM or Tarballs? (cid:2) Obtaining Open Source Software (cid:2) A Brief Encryption Review (cid:2) Public Key and Trust Relationships (cid:2) Auditing Procedures (cid:59) Summary (cid:59) Solutions Fast Track (cid:59) Frequently Asked Questions 1
138_linux_01 6/20/01 9:25 AM Page 2 2 Chapter 1 • Introduction to Open Source Security Introduction In spite of the ups and downs of the dot-com industry,open source software has become a viable alternative to commercial companies such as Microsoft,Sun,and IBM.Although open source software has its quirks and its problems,the open source movement has made its niche in the networking market.As a networking professional,it is in your best interest to understand some of the more important security applications and services that are available. This book is designed to provide experienced systems administrators with open source security tools.Although we have made every effort to include as many people and as many skill sets as possible,this book assumes a fundamental knowledge of Linux.This book focuses on open source Linux applications,dae- mons,and system fixes.In the book’s first chapters,you will learn how to lock down your network.Chapter 2 discusses ways to secure and monitor the oper- ating system,and ways to scan local and remote networks for weaknesses.You will receive detailed information on how to ensure that your system’s services and the root account are as secure as possible. In Chapter 3,you will learn how to deploy antivirus and scanning programs for your local system.By using these scanning programs,you will be able to miti- gate risk and learn more about the nature of services on your network.Scanners such as nmap and nessus will help you learn about the open ports on your net- work,and how these open ports might pose a threat to your system.Chapter 3 gives you detailed information about practical ways to implement intrusion detection on your local system and on your network.Using applications such as Tripwire,Portsentry,and Snort,you will be able to precisely identify system anomalies and detect inappropriate logins.Chapter 5 shows how you can use open source tools such as tcpdump,Ethereal,EtherApe,and Ntop to inspect and gauge traffic on the network. The second part of the book focuses on ways to enhance authentication using open source software.In Chapter 6,you will learn about One Time Passwords (OTP) and Kerberos as ways to ensure that malicious users won’t be able to obtain your passwords as they cross the network.Chapter 7 discusses ways to use Secure Shell (SSH) and Secure Sockets Layer (SSL),which are ways to enable on-the-fly encryption to protect data.In Chapter 8,you will learn about how to enable IPSec on a Linux system so that you can implement a virtual private network (VPN).As you learn more about the primary VPN product called Free Secure Wide Area Network (FreeS/WAN),you will see how it is possible to protect net- work traffic as it passes through your own network,and over the Internet. www.syngress.com
138_linux_01 6/20/01 9:25 AM Page 3 Introduction to Open Source Security • Chapter 1 3 The final part of the book focuses on ways to create an effective network perimeter.Chapter 9,shows how to install and configure Ipchains and Iptables on a Linux system.Kernels earlier than 2.3 can use Ipchains,whereas kernel versions 2.3 and later use Iptables.Regardless of the way you do it,you will learn to filter traffic with these two packet filtering tools. In Chapter 10,you will learn how a proxy server can further enhance your control over your network perimeter.Specifically,you will use the Squid proxy server to control client access to the Internet.You will also learn how to con- figure Linux clients to access the proxy server.Finally,Chapter 11,shows how to troubleshoot and counteract problems with your network perimeter.You will learn how to maintain,test,and log the firewall so that you have a functional bar- rier between you and the outside world. It is our intention to create a book that gives you practical information and advice about the most common open source security tools. The Tools Used in This Book This book was written using version 7.0 of the Red Hat Linux operating system. Although it may not be the “best”Linux distribution (there are at least 100 ver- sions in the world),it is the most popular.We have tried to ensure that the skills and tools you obtain in this book will be portable to other Linux versions,and even other open source operating systems such as FreeBSD (www.freebsd.org). However,each Linux flavor has its own quirks,and you may find it necessary to deviate from some of the instructions in this book. Using the GNU General Public License The GNU General Public License (GPL) is the basis of the open source move- ment.This license is provided by the Gnu is Not Unix (GNU) organization, which develops various software packages.Begun in 1984 by Richard Stallman, GNU has worked to create a license designed to ensure that the open source movement continues to thrive.You can learn more about GNU at the www.gnu.org Web site,shown in Figure 1.1. The most important element of this license is that instead of protecting a par- ticular person or company,it protects the software code that creates the applica- tion.Traditionally,copyrights have enabled individuals to lay claim to a particular piece of software and then sell it for profit.In addition,the copyright enables that individual to then take action against anyone else who uses that code to create www.syngress.com
138_linux_01 6/20/01 9:25 AM Page 4 4 Chapter 1 • Introduction to Open Source Security similar functionality.For better or for worse,Richard Stallman,Eric Raymond, and others helped found and popularize the concept of an open software license called the Gnu General Public License (often referred to as the GPL).You can read the GPL at www.gnu.org/copyleft/gpl.html. Figure 1.1 The GNU Web Site This license is part of the “copyleft”movement,which considers itself an alternative to traditional copyright laws.The GPL essentially allows anyone who develops code to ensure that the code remains open,meaning that GPL-licensed code can be taken and improved upon by anyone,as long as the improved code is given to the original writer and the software writing community.Consequently,a piece of code protected by the GPL will,by law,always remain accessible by anyone who wants to read or modify it.Without the GPL license,another person can take the code that you invent,and make it closed and proprietary. The GNU GPL is not the only free software license in existence.Figure 1.2 shows the GNU page dedicated to understanding additional licenses.If you wish,you can read about additional licenses that are similar to the GPL at www.gnu.org/philosophy/license-list.html. For more information about the open source movement,one of the more revealing books is Erik Raymond’s The Cathedral and the Bazaar (O’Reilly & www.syngress.com
138_linux_01 6/20/01 9:25 AM Page 5 Introduction to Open Source Security • Chapter 1 5 Associates,2001).Although somewhat overly enthusiastic,it is a very helpful book in understanding the mindset of many open source code writers. Figure 1.2 Viewing GNU’s Licenses Comment Section Fee-Based GPL Software Contrary to what you might think,open source code protected by the GPL is not necessarily free.Under the terms of the GPL,any person or corporation can take GPL software,modify it,and then package it for sale.However,this person or cor- poration must make this software freely available for anyone to read or modify. Can I Use GPL Software in My Company? The GNU GPL does not ask companies to supply licensing agreements or other- wise register the programs.However,other licenses,which you can read at GNU’s comparative forum,may invoke restrictions that you may have to consider as you implement the software.The software covered in this book is,in one way or another,open software,which means it can be used by any organization. www.syngress.com
138_linux_01 6/20/01 9:25 AM Page 6 6 Chapter 1 • Introduction to Open Source Security Soft Skills: Coping with Open Source Quirks You should consider,however,that open source software can present challenges. Consider them before you delve into the open source world.It is likely that using open source software will require you to use your “soft skills,”such as how to overcome objections and manage constant change.The more important chal- lenges to your soft skills are discussed in the following sections. General Lack of Installation and Configuration Support Although many of the applications you will use are written by clever,knowl- edgeable coders,most of these people create this code on their own time.Thus, no formal support structure exists for the software you use.As a result,you will be forced to rely on knowledgeable individuals to implement and maintain your open source applications. Infrequent or Irregular Update Schedules Many closed-source companies update their software at regular periods.Usually,a for-profit company’s desire to keep sales high by requiring constant for-fee upgrades is tempered by its need to maintain the product’s reputation for stability, ease of use,and longevity.Thus,upgrades will happen at regular intervals. However,the open source community is not held in check by this desire. Generally,software is frequently upgraded.You may,therefore,find that you will have to spend considerable time upgrading the open source products you use. It is also quite unlikely that you will be notified of any problems that have been discovered in the specific version of your application.For example,many for-profit companies spend time publicizing problems and even contacting licensed users to notify them of a security problem.If you use an open source security application,the burden is placed on you:it is assumed that you will take the time to keep current about any developments concerning the application you are using. Command-Line Dominance Many open source applications use command-line interfaces.In the past several years,the trend has been to create a graphical user interface (GUI) for command- www.syngress.com
138_linux_01 6/20/01 9:25 AM Page 7 Introduction to Open Source Security • Chapter 1 7 line applications.Generally,however,these GUI interfaces are not as portable between operating systems.In some cases,the GUI interface,unless superbly written,does not provide the same functionality (that is,you can’t do the same thing with the GUI that you can at the command line). Lack of Backward Compatibility and No Regular Distribution Body When you upgrade an operating system,it is possible that the applications you have been using no longer work,or behave differently.Although the open source community is remarkably well coordinated,you should consider this possibility. Furthermore,it is possible that the software you use may become unavailable, or may become fee based.While discovering that a Web site URL has changed is inconvenient,discovering that an upgrade for your favorite application will now cost you money can raise serious issues about your continued use of the product. Inconvenient Upgrade Paths Many open source applications change their coding rather radically.As a result,a previous version may not be upgradeable,and you may have to reinstall it.Even then,it is possible that a simple reinstallation is not possible.Many open source applications provide their own versions of a Windows-style configuration wizard, but when you upgrade,you may have to install the new files manually. Conflicts in Supporting Libraries and Limited Platform Support Even though you find a piece of software that you really find interesting,it is possible that you will have to take rather intricate steps to make your operating system ready for the application.Most of these steps involve updating system libraries,which are sets of routines and helper applications.Examples of libraries include the Tool Command Language/Tool Kit (tcl/tk) and the Gnome libraries (gnome-lib). Often,steps for upgrading these libraries are poorly documented and rather difficult to follow.Additionally,operating systems such as Linux are loosely inte- grated,which means that no central “brain,”such as a Windows 2000 registry, exists to coordinate library usage.So,even though you may be able to enable your system to accept your cool new application,you may end up causing incompatibilities that cause other applications to fail. www.syngress.com
138_linux_01 6/20/01 9:25 AM Page 8 8 Chapter 1 • Introduction to Open Source Security Another problem with software that isn’t quite “ready for prime time”is that it may be developed for only one Linux flavor,or even only one version of a specific Linux flavor.If you upgrade your system (or one of the libraries),it is possible that the application will stop working Interface Changes Coders and end users rarely want radical changes in a GUI interface to occur. Changing an interface requires more coding work on the part of coders,and it could result in an application losing popularity.However,due to changes in the open source libraries and in coding practices,you may find that commands and interfaces are radically changed from one version to the next. Partially Developed Solutions Sometimes,the code you want to use promises to do things it just can’t deliver. Some expected or advertised features may be missing,or may not be implemented yet.Sometimes,this happens because the open source application’s development team has the best of intentions and is working to complete the project.Other times,the development team runs out of gas,and you end up wishing that the application had delivered on its potential. In such cases,your options are rather limited,unless you have the means at your disposal to deploy your own development team and take up the project where your predecessors left off. Developing & Deploying… Open Source as Malware? Thus far, you have learned about technical issues concerning open source software. However, there are business and security issues as well. If you are a manager, make sure you carefully consider the use of open source software. There may be times when open source software is not appropriate for a certain task. Consider the following questions: (cid:2) Aren’t these hacker programs? (cid:2) Do I have time to train my employees on this software? Continued www.syngress.com
138_linux_01 6/20/01 9:25 AM Page 9 Introduction to Open Source Security • Chapter 1 9 (cid:2) Is the software stable enough to use? (cid:2) Have I had the code reviewed to ensure it is safe? (cid:2) How will I explain the use of open source software to my management? (cid:2) How will I explain the use of open source software to cus- tomers and business partners? The first question is significant. Many open source security applica- tions have been written as proof of concept exploits. A proof of concept exploit is basically an application meant to prove that a theoretical or much-discussed weakness in an operating system really does exist. Other applications are provided to allow hackers to gain information about a network or network host. However, just because an application was cre- ated for malicious intent does not necessarily mean that it has to be used maliciously. In fact, many open source applications have been cre- ated with the best of intentions, only to have them used to cause prob- lems. Therefore, as a manager, you should ensure that all parties involved in maintaining your network understand that simple use of a particular application does not necessarily mean that the user has become a hacker. As you choose the software, make sure that you actually take some time to educate your IT employees so that they use it properly. Have them consider how using the application can affect the network. If used at certain times, using a network probing application may cause too much network traffic and thus impact end-user communication. In addi- tion, when you choose this application, consider that it may still be in beta development, and that certain features are bound to change. Because it is difficult to verify that this code is in fact safe, take the time to review it. If you cannot do it yourself, contact a reliable source to verify that the code does not contain an element, such as a Trojan horse, that can erode your network’s security. Finally, it is possible that you may have to explain why your com- pany uses open source applications. Increasingly, business partners and insurance companies are interested in knowing exactly how you audit your systems. In some situations, you may find yourself having to explain why using open source applications is appropriate. In other cases, you may find that using open source software is wholly inappropriate. www.syngress.com
138_linux_01 6/20/01 9:25 AM Page 10 10 Chapter 1 • Introduction to Open Source Security Should I Use an RPM or Tarballs? In regard to Linux,open source software generally comes in three flavors:source tarball,Red Hat Package Manager (RPM),and Debian.A source tarball is a group of files and directories that usually must be compiled.Generally,tarballs come with a special file called a makefile,which contains instructions that tell the source code where the supporting libraries are for the application you are installing.Many will argue passionately that one is better than the other (or,that one operating system—such as the Debian operating system—is better than all the rest).The best approach to take is to use the right tool for the right job.In some cases,tarballs will work best.In other cases,using RPMs is the best way,as long as the RPM was created by a person who really understands the operating system,and that you have chosen the correct RPM for your operating system version. Tarball When using source tarballs,the most portable and extensible format,the code usually comes in packages that are first run through the tar application,which cre- ates archives of files and directories that can then be easily transported from one system to another.Sometimes,the tarball contents are precompiled binaries,which means that all you have to do is decompress and install the application.Other times,the code comes as C or (less often) C++ “source code,”which must then be compiled using,for example,the makefiles and the Gnu CC (gcc) or Gnu C++ gc++ compilers.These tarball packages are then compressed by using any number of applications.The most common (de)compression programs are GNU Zip (gzip,gunzip,gzcat) programs,which create compressed tarball archives with a tar.gz,.tgz,or tar.Z ending.The gzip command creates the tar.gz ending. The .tgz extension is also created in gzip by those who know that their files may be downloaded by Microsoft-oriented browsers,which often have difficulty downloading files with the tar.gz ending.The .Z extension is created by the Unix command called compress.Slackware systems often use the .tgz tarball ending. The bzip program has also become popular.Compressed bzip files have a .bz ending.Generally,you install a gzipped tarball by using the tar -zxvf command. The source code that comes in source code tarballs can be edited to conform to your own system.Perhaps more importantly,source tarballs allow you to specify compile options that can greatly extend the usefulness of the application or daemon you wish to install.You will be given explicit instructions whenever this is necessary.Also note that tarballs can contain pre-compiled binary applica- tions and supporting files rather than source code. www.syngress.com
138_linux_01 6/20/01 9:25 AM Page 11 Introduction to Open Source Security • Chapter 1 11 Tarballs often require editing of a special file called a makefile.However,this is not necessarily all that difficult.It simply requires that you know where your sup- porting applications and libraries are.In addition,most open source software will contain instructions concerning how to edit the makefile.Most well-known operating systems,such as Red Hat Linux and Slackware,do not require makefile modification. Red Hat Package Manager Originally developed by Red Hat,Red Hat Package Manager (RPM) files have become more universal.TurboLinux,Mandrake,and Kondara,for example,all support this format.RPMs come in either precompiled binary format,or as source RPMs.Make sure that you obtain the correct RPM for your distribution and hardware.You can then install an RPM (barring library and resource con- flicts) by using the rpm -ivh command.These packages usually contain precom- piled binary files,but it is possible to install source RPMs (.srpm) that will deposit source code that you must then compile using make and the appropriate gcc and g++ compilers. RPMs are installed using the RPM utility.To install an RPM,you could enter the following command: host# rpm –ivh packagename.versionnumber.i386.rpm This command uses the -I option,which simply means install.The -vh options have the RPM utility go into verbose mode and report the installation progress using hash marks.You can learn more about the RPM facility by con- sulting the rpm man page.As you will see in later sections,tarball,RPM,and Debian packages can pose threats to your system—after all,they are designed to automatically place code onto your system.Many times,this code is precompiled and “ready to go.”It is possible for malicious users to place code into these pack- ages.You must be extremely careful whenever installing any of these packages. Later in this chapter,you will see how you can at least partially protect yourself by using digital signatures. Debian Debian (.deb) Linux uses .deb packages in a similar way that Red Hat,for example,uses RPMs.Debian packages are installed by using the dpkg -i com- mand.As with tarballs and RPM files,these packages can also contain source files,rather than precompiled binaries. www.syngress.com
138_linux_01 6/20/01 9:25 AM Page 12 12 Chapter 1 • Introduction to Open Source Security Obtaining Open Source Software Now that you have considered some of the more pressing open source issues,it’s time to learn where to get open source security software.As you might suspect, there is no single source.Some of the best Web sites for open source security software include the following (many other sources exist): (cid:2) SourceForge www.sourceforge.com (cid:2) Freshmeat www.freshmeat.net (cid:2) Packetstorm http://packetstorm.securify.com (cid:2) RPMFind www.rpmfind.net (cid:2) LinuxLinks www.linuxlinks.com (cid:2) Tucows www.tucows.com (cid:2) Startplaza www.startplaza.nu (cid:2) SecurityFocus www.securityfocus.com (cid:2) AtStake www.atstake.com SourceForge SourceForge,shown in Figure 1.3,is an especially rich source for security con- tent.From here,you can download applications such as EtherApe,Ethereal,and many others. One of the primary benefits of obtaining software from SourceForge is that you can learn about the development history,learn about the developers of an application,and even send the developers e-mail (good luck getting answers!). You can also learn about what language the program was developed in,and what operating systems the application was specifically developed for.In many ways, this site does much of the research for you. Finally,SourceForge provides a login feature that allows you to: (cid:2) Participate in open discussions concerning software. (cid:2) Register an open source project. (cid:2) Learn about top projects. (cid:2) Obtain information about various topics,including the latest Linux kernel development updates. www.syngress.com
138_linux_01 6/20/01 9:25 AM Page 13 Introduction to Open Source Security • Chapter 1 13 Figure 1.3 The SourceForge Web Site Freshmeat The Freshmeat Web site,shown in Figure 1.4,derives its name from its primary function,which is to provide the latest and greatest software from the open source community.Like SourceForge,this site is not completely devoted to secu- rity.Nevertheless,you should spend time at this site to learn about the latest applications,most of which are created for Linux.By just typing security in the search field,you can learn about the latest applications meant to increase security, as well as those meant to defeat existing security measures. This site also provides a login feature.One of the benefits of logging in is the ability to catch up on the latest projects that have been registered on the site.In less than a week,several hundred new projects can be registered,many of them having to do with security.Another benefit is the ability to search for articles written about the applications in which you are interested.The search feature includes filtering mechanisms designed to help you drill down to the most relevant information. www.syngress.com
138_linux_01 6/20/01 9:25 AM Page 14 14 Chapter 1 • Introduction to Open Source Security Figure 1.4 The Freshmeat Web Site Figure 1.5 The Packetstorm Web Site Packetstorm Packetstorm is specifically devoted to security,and has an extensive collection of files.At this site,shown in Figure 1.5,you can download both “white hat”and “black hat”applications;in other words,you can download applications that help www.syngress.com
138_linux_01 6/20/01 9:25 AM Page 15 Introduction to Open Source Security • Chapter 1 15 detect and/or stop intrusions,or you can download applications specifically designed to break into systems.The developers of the site spend a great deal of time surfing the top Internet sites (including SourceForge and Freshmeat) for the “latest and greatest”files. One of the many convenient features of this site is its listing of the most recent tools,exploits,and warnings the site has obtained.Another is its Forums feature,which allows you to converse with others interested in security.The site also lists the most current advisories,so you can see if anyone has discovered a problem in any of the open source applications you are using. SecurityFocus The SecurityFocus site is a well-organized repository of security files.Its home page is shown in Figure 1.6.As well organized as it is,its collection of files,found in the Tools section,is not as extensive.Still,the site provides informative news about the latest security developments,and does a good job archiving the latest security files. Figure 1.6 The SecurityFocus Web Site www.syngress.com
138_linux_01 6/20/01 9:25 AM Page 16 16 Chapter 1 • Introduction to Open Source Security Is That Download Safe? Another problem with open source code is that you spend a great deal of time downloading files from untrusted sites.As a security professional,you have to consider the possibility that some of these files may have been tampered with. Many in the open source community have encountered files that contain Trojan horses,which are stealthy programs meant to thwart security.Trojan code hides legitimate code.Sometimes,the Trojan can wait to activate,or it can activate itself when you install what appears to be a perfectly legitimate program.Examples of Trojan horses include: (cid:2) Illicit servers Hidden servers that open ports that allow a malicious user (usually) root access to the server. (cid:2) Root kits Programs,such as ps,ls,or su,which will still work,but also thwart security by,for example,key logging the administrator’s password and then sending it to an anonymous FTP.The malicious user can then download the password and log in to the system. So,how can you determine if this download is secure? One of the best ways is to obtain a digital signature for the software package.A digital signature is a small piece of code generated by an encryption algorithm.A signature allows you to determine two things.First,you can learn if the file has been tampered with in any way.Second,you can use the key to verify that the software was in fact authored by the person who claims authorship.Before you learn more about checking signatures,it is important that you first understand the basic encryption principles involved. A Brief Encryption Review One of the most important things you can understand in terms of open source security is how encryption operates on networks.Feel free to skip this section if you already understand these terms.If you don’t,then read on.They will be implied throughout this book. Why is encryption important? At one time,Microsoft’s old LANmanager product (a precursor to Windows NT and 2000) did not encrypt its passwords as it communicated with other hosts.As a result,this particular operating system fell out of favor,forcing Microsoft to improve its product.One of those improvements was the use of encrypted transmissions.Encryption is not a foolproof solution.It is possible to misconfigure your encryption tools,and even properly encrypted www.syngress.com
138_linux_01 6/20/01 9:25 AM Page 17 Introduction to Open Source Security • Chapter 1 17 transmissions are not completely safe.Nevertheless,encryption does tend to raise the bar enough to make most hackers search for other systems to attack. Before we continue,it is important to understand the three types of encryp- tion in general use: (cid:2) Symmetric The use of one key to encrypt and decrypt information. This is a common type of encryption,but can be easily defeated if you misplace the key,or if a malicious user intercepts the key in transit.If a malicious user is able to intercept the key,he or she can then use it to decrypt your secret messages. (cid:2) Asymmetric This type of encryption uses a mathematically related key pair to encrypt and decrypt information.It is commonly used on the Internet and on LANs,because it reduces the likelihood that the key can be learned by a malicious user,and aids in authentication. (cid:2) One way The use of an algorithm to encrypt information so that it is, mathematically speaking,impossible to unencrypt it.One-way encryp- tion is also used to read a file and then create a hash of that file.The resulting hash value is said to be mathematically unrecoverable. You should understand that in regard to networking,the “information”dis- cussed in this section can include a file,or a series of network packets emanating from a network host.Many encryption applications,such as GNU Privacy Guard (GPG) and Pretty Good Privacy (PGP) employ all three of these types of encryp- tion,as you will see later. Symmetric Key Encryption Your car key is a crude,although helpful,example of symmetric encryption. Consider that most people use the same physical key to lock,unlock,and start their cars.If you lose your key,anyone who finds it can locate your car,insert your key in the door and the ignition,and then drive it away.Suppose,now,if you tried to pass this key to another person in a crowded room,and someone you do not trust was to intercept it.You would probably then have a problem:the only thing keeping this untrusted person out of your car is that person’s honesty and his or her knowledge of what your car looks like.If that person wanted to, he or she could find your car,open it,and drive away. The use of symmetric encryption across an untrusted network such as the Internet (or,really,your LAN or enterprise network) presents the same problem www.syngress.com
138_linux_01 6/20/01 9:25 AM Page 18 18 Chapter 1 • Introduction to Open Source Security as the use of a single car key:anyone who intercepts your symmetric key with a packet sniffer can decrypt your messages.This type of attack is a sniffing attack.A sniffing attack is a type of man-in-the-middle attack,where a host that resides in the middle of a connection is able to obtain and then manipulate data.You will learn more about this type of attack in Chapter 7. The obvious response to this analogy and the threat of sniffing attacks would be,“Well,I guess I just won’t send my passwords across the Internet or my net- work.”However,it has traditionally been very difficult to get your job done without sending passwords across the Internet.The ability to communicate securely is the backbone of e-commerce and network communication.So,how will you get that password to a person? Even if you use a telephone (a very slow, awkward option),you are not guaranteed safety.After all,your friend who receives this password could write it down on a sticky note,exposing it to anyone passing by.Besides,what if you needed to get a password not to a person,but to a network host? Another problem with the use of symmetric encryption is that if someone sniffs your symmetrically encrypted message,it is possible for this person to use a password-cracking program to guess the password (the key) you used to encrypt the message.This type of application effectively reverse-engineers the password creation process by taking multiple guesses to try and find the answer.Such appli- cations include L0phtCrack (www.atstake.com/research/redirect.html) and John the Ripper (available at various sites,including http://packetstorm.securify.com). Using such applications,a suitably powerful computer,and enough time,a person can guess the right password.This type of attack is called a brute-force attack. Asymmetric Key Encryption One of the answers to sniffing and brute-force attacks is the use of a pair of keys. Asymmetric encryption allows you to do two things: (cid:2) Encrypt transmissions (cid:2) Authenticate users and hosts For example,suppose that the car key you had in the earlier example con- cerning symmetric encryption was only part of the key necessary to unlock and start the car.Suppose further that this physical key,which you can now publicly distribute,was related to another key locked in your car,and that this locked key then had a way to ask any holder of your public key to further authenticate him- www.syngress.com
138_linux_01 6/20/01 9:25 AM Page 19 Introduction to Open Source Security • Chapter 1 19 self before he gained access to use your car.This is basically how asymmetric key encryption works. The public key can be distributed to anyone.It can be placed on public key servers all over the Internet or to anyone you know (or don’t know,for that matter).However,the private key must be kept,as you might have already guessed,private.The easiest way to understand public key encryption is to under- stand the relationship between each key pair.Each pair is generated at the same time.The algorithm that creates the key pair ensures that this pair is so related that one half of this pair can decrypt the other half. Public Key and Trust Relationships Let’s say that you have generated a key pair.The private key is (hopefully) stored safely on your hard drive,and you are ready to distribute your public key.Your friend has done the same:she has created her private key and is ready to give you her public key.Before both of you can use asymmetric key encryption,you must give each other your public keys. Giving your public key to another person (or host) is often called establishing a trust relationship.Once you have given each other your public keys,you both can then engage in asymmetric key encryption.How? You compose a message, and then you encrypt this message to your friend’s public key.Once this message is encrypted,no one but your friend can read this message.Even though you cre- ated the message,you cannot read it either,because you encrypted it to your friend’s public key. So,all you have to do now is find a way to get this message to your friend. Once you use e-mail or FTP to do this,your friend receives a bunch of garbled text that means nothing.This is the encrypted message.Your friend can then take this message and then decrypt it using her private key.Once this message is decrypted,your friend can read it.With any luck,your friend won’t still think that she received a bunch of garbled text that means nothing.Figure 1.7 illus- trates this process. In Figure 1.7,User A on System A encrypts his message to User B’s public key.In order to encrypt the message to User B’s public key,User A must first enter a password to use his public key to sign the message.The encrypted and signed message is then sent across the Internet,where User B uses her private key to decrypt the message. How has this process solved the symmetric encryption problem? First,the only way that your message can be unencrypted is by using your friend’s private key. www.syngress.com
138_linux_01 6/20/01 9:25 AM Page 20 20 Chapter 1 • Introduction to Open Source Security Figure 1.7 Using Public Keys to Encrypt Transmissions User A's Private Key System A User User A's B's Public Key Public Key The Internet System B User B's Private Key As long as this key remains private,then chances are,so will your letter.Second, notice that you and your friend did not have to distribute the whole password in some way.You only distributed half of the password (the public key).And,usually, it is extremely difficult to guess the private key from the public key.It is,of course,mathematically possible to use the public key to guess the private key,but it would take many million-dollar-plus supercomputers several months to do this. Only state-run organizations such as Scotland Yard and the CIA are likely to devote such resources to your little old message. As far as authentication is concerned,asymmetric encryption accomplishes this by verifying the owner of the public key.You will learn more about this as you learn about IPSec and VPNs later in this book. One-Way Encryption You may ask yourself why anyone would want to irretrievably encrypt a piece of information.After all,doing this makes the information,well,irretrievable—it can’t be used anymore.One-way encryption is not useful for encrypting and www.syngress.com
138_linux_01 6/20/01 9:26 AM Page 21 Introduction to Open Source Security • Chapter 1 21 unencrypting files.It is,however,useful for obtaining a file’s signature.A signature is obtained by running a one-way encryption algorithm on the file.The resulting value,called a hash,is closely related to the contents of the file.This value is so related that if even the slightest change is made to the file’s contents,the hash value will not match.Many applications use one-way encryption to ensure that information is not altered as it passes over the network. GNU Privacy Guard GNU Privacy Guard (GPG) is one of the primary open source tools in use today.You can download it from www.gnupg.org.You can download binaries and source code for all Unix versions.For Linux,g-zipped archives and RPM files are both available.Most distributions (TurboLinux,Red Hat,Caldera,Slackware,etc.) include GPG in their source files.Using GPG,you will be able to encrypt files and e-mail messages.You will also be able to import and export public keys in order to verify PGP- and GPG-generated keys from the tarballs and RPM files you download. Deploying GNU Privacy Guard Although many GUI interfaces are in the planning stage for GPG,the following steps focus on using GPG with the command line.The steps assume that you already have GPG installed on your system.Verify this by using the whereis command: whereis gpg gpg: /usr/bin/gpg If you do not have GPG installed,you can download GPG from www.rpmfind.net,from www.gnupg.org/download.html,or from the CD that accompanies this book (gnupg-1.0.4-11.i386.rpm or the equivalent gnupg-1.0.5.tar.gz). Now that you know the program is installed,your first step is to secure how it allocates memory to nonroot users.GPG requires that most Linux systems run it as SUID root.Any application allocates pages of memory from the system,and GPG wants this memory to be secure.Otherwise,an illicit user could capture this memory and then gain access to the information you are going to encrypt.In order to secure these memory pages,GPG locks this memory before using it.It needs to run as root to lock the memory.As soon as this is done,GPG then runs under the permissions of the owner. www.syngress.com
138_linux_01 6/20/01 9:26 AM Page 22 22 Chapter 1 • Introduction to Open Source Security NOTE Running an application as SUID root means that the application is run as root, even though the owner who starts it is a nonroot user. By default,however,GPG is not installed as SUID root.To make it setuid root,do the following:
- Find the application (in Red Hat Linux,GPG is at /usr/bin/gpg).
- If you are not already root,become root with the command su.
- Issue the command chmod u+s /usr/bin/gpg. If you cannot do this on your own system for some reason,or do not wish to,you can enter the following line into the ~/.gnupg/options file of any non- root user: /usr/bin/gpg --gen-key This command will create the necessary directories and files for GPG to work.Once you create these directories,generate a key pair for the user you are logged in as.You do this by issuing the gpg --genkey command again. GPG will then ask you to select a key type.You will have the option of choosing Digital Signature Algorithm (DSA) and ElGamal (the default) DSA,or ElGamal (sign and encrypt).Each of these options defines different types of signature and encryption algorithms.The first uses both the standard ElGamal key distribution method and the DSA,which is used to sign and encrypt data.DSA is a nonproprietary algorithm,unlike the RSA algorithm, which was previously used.If you only wish to sign and encrypt documents,you can just use DSA.Most people use the first option,which is to both sign and encrypt information.Traditionally,the first choice (the default) is the best. You are then given the choice of the keysize.The default keysize of 1024 bits is actually quite sufficient for most purposes.Selecting anything higher can signif- icantly slow your application.So,select 1,and then press ENTER. Enter 1y to make your key expire one year from now,and then press ENTER. Press y to confirm this choice. Enter your name in the Real name: field. www.syngress.com
138_linux_01 6/20/01 9:26 AM Page 23 Introduction to Open Source Security • Chapter 1 23 WARNING You should write down the e-mail address that you use. You will use this address to refer to your public and private key often, when using GPG or PGP. Next,enter your e-mail address.In the Comment: field,enter GPG signature,or any text you wish,and then press ENTER. You will then be asked to confirm your settings.If you are happy with what you entered,press O (that’s the letter O,not the digit 0),and then press ENTER. Enter a passphrase for your private key.This passphrase should be sufficiently long (at least six passwords),but should also be something you will remember.Press ENTER,confirm the passphrase,and press ENTER again.After doing this,GPG will generate a new key.Move your mouse and/or enter text into the keyboard so that the machine has enough entropy to generate a good private key.Once GPG is fin- ished,you will receive a message that your key is created and signed. Now,verify that GPG correctly created and signed keys for your account with the following commands: gpg --list-secret-key gpg --list-public-key gpg --list-sig These commands list your secret key,your public key,and your signature, respectively.Once you do this,you should create a revocation certificate in case you need to publish the fact that your private key is no longer valid.You do this by following the sequence outlined here: gpg --output revoke.asc --gen-revoke james@root.test.com sec 1024D/3B386145 2000-07-01 jamesroot (root) james@root.test.com Create a revocation certificate for this key? y Please select the reason for the revocation: 1 = Key has been compromised 2 = Key is superseded 3 = Key is no longer used 0 = Cancel (Probably you want to select 1 here) www.syngress.com
138_linux_01 6/20/01 9:26 AM Page 24 24 Chapter 1 • Introduction to Open Source Security Your decision? 1 Enter an optional description; end it with an empty line:
For my keats system root account
Reason for revocation: Key has been compromised For my keats system root account Is this okay? y You need a passphrase to unlock the secret key for user: "jamesroot (root) james@root.test.com" 1024-bit DSA key, ID 3B386145, created 2000-07-01 ASCII armored output forced. Revocation certificate created. Please move it to a medium which you can hide away; if Mallory gets access to this certificate he can use it to make your key unusable. It is smart to print this certificate and store it away, just in case your media become unreadable. But have some caution: The print system of your machine might store the data and make it available to others! After verifying that you have keys and a revocation certificate,you are now able to import and export keys.To export your key,use the following command: gpg --export --armor > yourname.asc This command will create a file that contains your public key.You can then distribute this key to anyone and establish a trust relationship. With this capability,you now can use the RPM command to check the sig- natures and public keys generated by others.For example,suppose you wish to update your version of Red Hat Linux due to a security alert.To help you verify that this package has not been tampered with,and that it has truly originated from Red Hat,you can obtain Red Hat’s signature.Go to www.redhat.com and obtain the public key for the site and the RPM-based download you want. Figure 1.8 shows Red Hat’s public key.As of this writing,the key is located at www.redhat.com/about/contact/redhat2.asc. Now that you have created your own key ring,which is where you will store the public keys of the people with whom you wish to communicate,you can now import the Red Hat public key into GPG using the following GPG command: gpg --import redhat2.asc www.syngress.com
138_linux_01 6/20/01 9:26 AM Page 25 Introduction to Open Source Security • Chapter 1 25 Figure 1.8 The Red Hat Linux Public Key It is possible that the public key you wish to import has a different extension. Now,sign this key.Failure to sign this key will cause it to return error messages when you try to use it.Make sure that you have made absolutely no changes to this key file.Once this key is imported,you need to sign it.Remember,you just downloaded it from a trusted source,and are reasonably sure that you can trust this key.You can sign it using the gpg --sign command,or you can use GPG’s interactive mode,shown in the following sequence: gpg --edit-key security@redhat.com gpg (GnuPG) 1.0.2; Copyright (C) 2000 Free Software Foundation, Inc. This program comes with ABSOLUTELY NO WARRANTY. This is free software, and you are welcome to redistribute it under certain conditions. See the file COPYING for details. pub 1024D/DB42A60E created: 1999-09-23 expires: never trust: -/f sub 2048g/961630A2 created: 1999-09-23 expires: never (1) Red Hat, Inc security@redhat.com Command> sign Are you really sure that you want to sign this key with your key: "yourkey (key) yourkey@yoursystem.domain.com" www.syngress.com
138_linux_01 6/20/01 9:26 AM Page 26 26 Chapter 1 • Introduction to Open Source Security Really sign? y You need a passphrase to unlock the secret key for user: "jamesroot (root) james@root.test.com" 1024-bit DSA key, ID 3B386145, created 2000-07-01 Command> q Save changes y Now,you can issue the following command to check the latest GNU GPG RPM file: rpm -Kv your_rpm.i386.rpm You will receive a message that both the MD5 signature and the PGP signa- ture are acceptable: rpm -Kv your_rpm.i386.rpm your_rpm.i386.rpm: MD5 sum OK: fc28444c7c7dee7d59671ac5e27b2ad0 gpg: Signature made Wed 30 Aug 2000 03:16:54 PM PDT using DSA key IDDB42A60E gpg: Good signature from "Red Hat, Inc security@redhat.com" NOTE Two major ways exist to create and verify signatures. The open source alternative is GPG. The older, but now proprietary, method is through the use of Pretty Good Privacy (PGP). The latest versions of GPG are compat- ible with PGP versions 5.0 and later. However, if a signature was made using PGP 2.6 or earlier, GPG will not be able to read it. PGP version 2.6 and earlier used the IDEA algorithm, which is patented. If you do not find a message similar to this,but instead find a message that reads public key not found,then you know that this public key is not valid for this RPM.You will either have to find the right public key,or find another RPM. You can,of course,use GPG to verify any public key you wish.You have now configured and used GPG to help ensure that the file you are installing is safe. www.syngress.com
138_linux_01 6/20/01 9:26 AM Page 27 Introduction to Open Source Security • Chapter 1 27 NOTE If, while working with GPG, you receive a message that reads gpg: waiting for lock, then a previous instance of GPG had a problem while working with either the public or the private key. As a result, the public and/or pri- vate key ring in the hidden ~./.gnupg directory is locked. Go to the ~./.gnupg directory and remove any file that ends in a .lock extension. Installing PGP Although GPG has become a standard,you can also use the PGP program,which behaves rather differently.You can download PGP from the Massachusetts Institute of Technology Web site at http://web.mit.edu/network/pgp-form.html.You will then have to repeat many of the earlier steps to create a public and private key,and then import the site’s key.Because PGP (and GPG,for that matter) enables pow- erful encryption,MIT will ask you questions concerning your intentions for PGP. Answer these according to your intentions.If you enter the right answers,you will be able to download PGP.Choose the correct file for your distribution.
- MIT uses gzip to compress the RPM files.If you are using Red Hat Linux,the RPM package works best.Use tar to unzip and un-tar the RPM package:tar -zxvf pgprpmfile.tar.gz.
- This process will deposit an RPM file.Run RPM to install it:rpm -ivh pgprpmfile.
- Once you have installed PGP,issue the following command to create a key pair:pgp -kg.
- Choose the DSS/DH option,which is the default.
- Choose 1 to generate a new signing key.
- You will be asked to choose the size of your key.Enter 1024,and then press ENTER.
- Enter a user ID for your public key.Enter your name and e-mail address. This will become your PGP username.This is important,as you will see later when it comes time to edit the RPM configuration file.
- Enter 0 to keep the key forever.Don’t worry,you can revoke it and generate a new key pair later. www.syngress.com
138_linux_01 6/20/01 9:26 AM Page 28 28 Chapter 1 • Introduction to Open Source Security 9. Enter a passphrase.Make sure this is a solid passphrase (over eight char- acters,containing at least one capital letter and one nonstandard char- acter),but also one that you can remember.Confirm your password by entering it again. 10. You will be asked if you need an encryption key.Press y,and then press ENTER. 11. The choice of key size is up to you.Just remember that the larger the key size,the slower information will be processed.Most people choose either 1024 or 2048. 12. Enter 0 as the “validity period.”As before,this value means that the key is valid forever. 13. PGP will ask you to press random keys on the keyboard so that it can generate enough entropy. 14. When PGP is finished,it will ask you if you want to make this key the default signing key.Press y to indicate yes. 15. Now,you need to enter the public key of the GNU GPG RPM.You do this with the following command:pgp --ka gnugpg.publickey. 16. You will see a list of keys.Indicate that you wish to add these keys to your key ring by pressing y. 17. You will see that several new keys and signatures have been added. 18. Now,you must edit the macros file for your version of RPM.In Red Hat 7.0,this file is in //usr/lib/rpm/macros.Find the following values and change the values according to your own information: %_pgp_name your PGP user name %_pgp_path The path to your public key. For example, /root/.pgp/ Instead of taking this second step,you can set the PGPPATH vari- able in your bash_profile file. 19. You can now use RPM to verify your RPM: rpm -Kv your_rpm.i386.rpm your_rpm.i386.rpm: MD5 sum OK: fc28444c7c7dee7d59671ac5e27b2ad0 gpg: Signature made Wed 30 Aug 2000 03:16:54 PM PDT using DSA key IDDB42A60E www.syngress.com
138_linux_01 6/20/01 9:26 AM Page 29 Introduction to Open Source Security • Chapter 1 29 gpg: Good signature from "Red Hat, Inc security@redhat.com" If you want to learn more about PGP,read the man pages,or issue the following commands: pgp –h pgp -k This book focuses on using GPG. NOTE Thus far, you have learned how to use GPG with the RPM package. Of course, GPG has many other uses. Once you have engaged in a trust relationship with the recipient, you can encrypt files to this person. The following command can encrypt a file named managerreport.txt: gpg --encrypt --r public_keyname_of_recipient managerreport.txt. You will have to enter the password of your private key. Hopefully, you can remember it; otherwise, you will have to generate a new pri- vate/public key pair. After you enter your passphrase, GPG will create a file named managerreport.txt.gpg. You can then send this key to the intended recipient, who can then decrypt it with the following command: gpg --decrypt managerreport .txt.gpg > managerreport.txt. The recipient will, of course, have to enter his or her passphrase to decrypt the message and read it. To create a signature file, you can create an empty file named your- name, and then enter the following command: host# gpg --clearsign yourname. You will then be asked to enter your password. After this sequence is completed, you will see a new file named yourname.asc, which has your signature in it. Skipping Public Key Verification If you want to check a signature to ensure that the contents haven’t been changed,and don’t really wish to verify the original author’s public key,enter the following command: rpm -K --nopgp rpmfile.i386.rpm rpmfile.i386.rpm: md5 gpg OK www.syngress.com
138_linux_01 6/20/01 9:26 AM Page 30 30 Chapter 1 • Introduction to Open Source Security Using GPG to Verify Signatures on Tarball Packages Follow these steps to verify the signature of a gzipped tarball:
- Add the public key of the person or organization that created the package.
- Sign the public key using GPG.You can either use GPG’s --sign com- mand,or you can enter GPG’s interactive mode.
- Once you have added and signed the public key of the person who owns the package,enter the following command:gpg --verify signaturefile.tar.gz taballpackage.gz. You will then receive a message either that the signature is good,or that the public key cannot be found.If the public key cannot be found,you must obtain another public key,or you will not be able to verify who owns the package. Using Md5sum Sometimes,a developer will use the md5sum command to generate a hash of the file.You can use this hash and the md5sum command to ensure that the file has not been altered.The easiest way to do this is to read the hash that the developer generated,download the binary in question,and then run md5sum against it. For example,suppose that you learn that the wu-ftpd daemon (the daemon responsible for providing FTP on many sites) has a security problem.You wish to install the latest secure version.After downloading it,you run md5sum against the file: md5sum wu-ftpd-2.8.1-6.i386.rpm t412cfhh5bf1376cia9da6c5dd86a463 wu-ftpd-2.6.1-6.i386.rpm However,you notice that the developer’s md5sum value for the same pro- gram reads as follows: y415cfgz5bf1356cib8da6c5dd8da0k5 You should then delete the file and find another source where you can verify the md5sum hash. www.syngress.com
138_linux_01 6/20/01 9:26 AM Page 31 Introduction to Open Source Security • Chapter 1 31 Auditing Procedures As you use the software discussed in this book,you will generally be deploying it assuming three major roles,which we discuss in the next sections: (cid:2) Locking down your network (cid:2) Securing data across the network (cid:2) Protecting the network perimeter Locking Down Your Network Hosts As you lock down your network,you will have to focus on individual hosts.As shown in Figure 1.9,you will audit the daemons that this host runs.For example, you will use scanners to determine what ports are open,and if those daemons pre- sent a danger to your system.An auditor also seeks to enhance login security,to enhance logging,and to discover what,if any,virus protection measures are present. Figure 1.9 System Aspects to Audit Daemons (Web, FTP, and so forth) Login Security Enhanced Logging Audited System Virus Protection and Intrusion Detection Another part of scanning local systems is enabling ways to detect unautho- rized login.As you approach your systems using the open source tools in this book,you will find that many are geared to help you enhance the security in each of these areas. www.syngress.com
138_linux_01 6/20/01 9:26 AM Page 32 32 Chapter 1 • Introduction to Open Source Security Securing Data across the Network Figure 1.10 shows how it is possible to create an auditing station on a network. This station can monitor the transmissions from other hosts.The auditing host has the following responsibilities: (cid:2) Obtain relevant data concerning the network without affecting the performance of the network. (cid:2) Provide remote administration capabilities. (cid:2) Generate logs so that information can be carefully scanned. Figure 1.10 Auditing Network Transmissions Auditing Station Network Host Network Host Network Network Host Network Host Intrusion detection systems can use this structure,although structures that are more complex exist.For example,it is possible to divide the tasks of the auditing host among multiple hosts.The chief benefit of dividing tasks is redundancy—if one element of the network goes down,the network can still be monitored and protected. The structure outlined previously can be responsible for passive monitoring or active monitoring.Passive monitoring is simply the ability to listen to network traffic and log it.Active monitoring involves the ability to either: www.syngress.com
138_linux_01 6/20/01 9:26 AM Page 33 Introduction to Open Source Security • Chapter 1 33 (cid:2) Monitor traffic and then send alerts concerning the traffic that is discovered. (cid:2) Actually intercept and forbid this traffic. You will learn more about intrusion detection in later chapters. Protecting the Network Perimeter As you configure your firewall to establish a network perimeter,you will have to take the following actions: (cid:2) Logging (cid:2) Firewall reconfiguration (cid:2) Troubleshooting (cid:2) Enabling and disabling traffic emanating from inside the network (cid:2) Enabling and disabling traffic emanating from outside the network Figure 1.11 shows two networks communicating over the Internet.Each uses a firewall to monitor,log,and forbid traffic.As you audit,you will have to per- form the following tasks: (cid:2) Use tools to send packets that traverse the firewall.These packets will help you determine just how well your firewall limits traffic. (cid:2) Determine which internal services require access outside of the firewall. (cid:2) Redirect packets from a proxy server to your firewall. (cid:2) Scan logs to determine if any break-ins have occurred. www.syngress.com
138_linux_01 6/20/01 9:26 AM Page 34 34 Chapter 1 • Introduction to Open Source Security Figure 1.11 Auditing a Firewall Host Host Ethernet Host Host Firewall Internet Firewall Host Host Ethernet Host Host www.syngress.com
138_linux_01 6/20/01 9:26 AM Page 35 Introduction to Open Source Security • Chapter 1 35 Summary This introduction provided practical knowledge of the open source community, and how it can help you with your security concerns.You learned about several key open source sites,how the open source movement protects software instead of individuals and corporations,and you reviewed your knowledge of encryption. You learned how to verify the integrity of the files you download from people you don’t know.Using GPG (and,if you wish,PGP),you can verify RPM and tarball packages. This book is designed to deploy open source tools in three key areas (host security,network security,and perimeter security).We hope that this book will be of practical importance to you.It is designed to give you advice concerning trou- bleshooting Linux using open source tools. Solutions Fast Track Using the GNU General Public License (cid:59) The GPL protects the software code,not a corporation or an individual. (cid:59) Protecting code rather than individuals is a radical change,because it allows code to be improved upon without being made completely proprietary. (cid:59) Open source code does not necessarily have to be free.For example, companies such as Red Hat and Caldera sell their products,which are based on the open source Linux kernel. Soft Skills: Coping with Open Source Quirks (cid:59) As you use open source code,remember that this code may represent a work in progress. (cid:59) Sometimes,open source code changes radically,forcing you to retrain users.You may find that updates happen irregularly,and that it is some- times more challenging to update open source code.Furthermore,once you upgrade the code,you may be presented with an application that behaves very differently,or has a radically different interface. www.syngress.com
138_linux_01 6/20/01 9:26 AM Page 36 36 Chapter 1 • Introduction to Open Source Security (cid:59) Before installing open source software,make sure that your operating system contains all of the necessary supporting applications and libraries. Should I Use an RPM or Tarballs? (cid:59) RPMs sometimes offer convenience.However,precompiled RPMs often do not have all of the features necessary to implement a truly useful product. (cid:59) Tarballs often require editing of a special file called a makefile.However, this is not necessarily all that difficult.It simply requires that you know where your supporting applications and libraries are.Also,most open source software will contain instructions concerning how to edit the makefile.Most well-known operating systems,such as Red Hat Linux and Slackware,do not require makefile modification. (cid:59) RPMs often contain useful startup scripts that are not found elsewhere. Sometimes,it is useful to install the RPM,then the tarball version,and then combine elements from the two for a complete solution. Obtaining Open Source Software (cid:59) Sites such as SourceForge (www.sourceforge.com),RPMFind (www.rpmfind.net),and SecurityFocus (www.securityfocus.com) are valuable software sources. (cid:59) Be especially careful when downloading any source code,regardless of format.Digital signatures can help you determine the author of a package,as well as whether a package has been altered. (cid:59) The Gnu Privacy Guard (GPG) and Pretty Good Privacy (PGP) pack- ages are available to help you verify signatures.They do not stop the execution of malicious code,however.They simply inform you about the nature of the code’s author,and of any changes that may have occurred to the code. www.syngress.com
138_linux_01 6/20/01 9:26 AM Page 37 Introduction to Open Source Security • Chapter 1 37 A Brief Encryption Review (cid:59) Symmetric encryption is the use of one key to encrypt and decrypt information.If a malicious user is able to intercept the key,he or she can then use it to decrypt your secret messages. (cid:59) Asymmetric encryption uses a mathematically related key pair to encrypt and decrypt information.This type of encryption is commonly used on the Internet and on LANs,because it reduces the likelihood that the key can be learned by a malicious user,and aids in authentication. (cid:59) One-way encryption is the use of an algorithm to encrypt information so that it is,mathematically speaking,impossible to unencrypt.One-way encryption is also used to read a file and then create a hash of that file. The resulting hash value is said to be mathematically unrecoverable. Hash code is often used to compare one value to another during the login process:the person logging in enters a username and password,and the authentication mechanism creates a hash of these two values and compares it to the hash values generated from the /etc/passwd and /etc/shadow databases.If the values match,access is allowed. Public Key and Trust Relationships (cid:59) You must generate a key pair to begin using your public key to authen- ticate yourself or to encrypt network transmissions. (cid:59) Establishing a trust relationship involves exchanging public keys. Sometimes,individual users must give public keys.At other times,public keys are exchanged between network hosts. (cid:59) Never reveal your private key.If your private key is made available to a third party,this person will be able to read all of your encrypted files. Auditing Procedures (cid:59) As an auditor,your job is to lock down your network,which means that you must consider the security of each host using tools that allow you to determine changes in files and directories,and who has scanned and accessed your system.You must also monitor network transmission and www.syngress.com
138_linux_01 6/20/01 9:26 AM Page 38 38 Chapter 1 • Introduction to Open Source Security configure your firewall to establish an effective network perimeter that separates your network from all others. (cid:59) An Intrusion Detection System (IDS) acts as an auditing host or series of auditing hosts that allow you to monitor and secure data as it passes across the network. (cid:59) Protecting the network perimeter involves proper firewall and proxy server configuration,logging,and monitoring. Frequently Asked Questions The following Frequently Asked Questions, answered by the authors of this book, are designed to both measure your understanding of the concepts presented in this chapter and to assist you with real-life implementation of these concepts. To have your questions about this chapter answered by the author, browse to www.syngress.com/solutions and click on the “Ask the Author” form. Q: Copyright has been around a long time.I don’t understand all of the fuss people are making about the GPL.Can’t people just create code and not pro- vide a license at all? A: The GPL protects the source code of an application so that it always remains public.No one person can then patent this code and make it his or her own. If you were to create a piece of software and not license it,then very quickly, this code could become proprietary.The creators of the GPL hope that as more and more people view the same piece of code,it will improve,and everyone will benefit. Q: When verifying a signature with GPG,I keep getting a message that the public key can’t be found,even though I know that I loaded the public key into GPG.What is wrong with RPM and/or PGP? A: Nothing.There is something wrong with the package you downloaded. Either that,or you somehow made an inadvertent change to the public key before you imported it. Q: The BSD version of Unix existed before Linux.Why has Linux become so popular? www.syngress.com
138_linux_01 6/20/01 9:26 AM Page 39 Introduction to Open Source Security • Chapter 1 39 A: One reason is because Linux follows the GNU GPL,which has allowed the open source community to embrace it and develop many,many applications and daemons for it.Also,the Regents of the University of California held the copyright for all of the BSD developed code.It was not always available in source.One of the reasons for that is that until BSD 4.4,there was still pro- prietary AT&T source code in the BSD distributions.One of the specific objectives of BSD 4.4 was to eliminate any AT&T property.Therefore,while BSD was still license encumbered,Linux was freely available (in source and binary). Q: In your auditing discussion,you discuss the idea of passive and active auditing. Don’t intrusion detection applications also do signature-based and anomaly- based detection? A: Yes,they do.You will learn more about these two intrusion detection methods in later chapters.Signature-based detection means that you predefine what an attack looks like,and then configure your network monitoring soft- ware to look for that signature.Anomaly-based detection requires the intru- sion detection system to actually listen to the network and gather evidence about “normal”traffic.Then,if any traffic occurs that seems different,the intrusion detection system will respond by,for example,sending out an alert to the network administrator. www.syngress.com
138_linux_01 6/20/01 9:26 AM Page 40
138_linux_02 6/20/01 9:33 AM Page 41 Chapter 2 Hardening the Operating System Solutions in this chapter: (cid:2) Updating the Operating System (cid:2) Handling Maintenance Issues (cid:2) Manually Disabling Unnecessary Services and Ports (cid:2) Locking Down Ports (cid:2) Hardening the System with Bastille (cid:2) Controlling and Auditing Root Access with Sudo (cid:2) Managing Your Log Files (cid:2) Using Logging Enhancers (cid:59) Summary (cid:59) Solutions Fast Track (cid:59) Frequently Asked Questions 41
138_linux_02 6/20/01 9:33 AM Page 42 42 Chapter 2 • Hardening the Operating System Introduction Linux is capable of high-end security;however,the out-of-the-box configurations must be altered to meet the security needs of most businesses with an Internet presence.This chapter shows you the steps for securing a Linux system—called hardening the server—using both manual methods and open source security solu- tions.The hardening process focuses on the operating system,and is important regardless of the services offered by the server.The steps will vary slightly between services,such as e-mail and Hypertext Transfer Protocol (HTTP),but are essential for protecting any server that is connected to a network,especially the Internet.Hardening the operating system allows the server to operate effi- ciently and securely. This chapter includes the essential steps an administrator must follow to harden a Unix system;specifically,a Red Hat Linux system.These steps include updating the system,disabling unnecessary services,locking down ports,logging, and maintenance.Open source programs allow administrators to automate these processes using Bastille,sudo,logging enhancers such as SWATCH,and antivirus software.Before you implement these programs,you should first understand how to harden a system manually. Updating the Operating System An operating system may contain many security vulnerabilities and software bugs when it is first released.Vendors,such as Red Hat,provide updates to the oper- ating system to fix these vulnerabilities and bugs.In fact,many consulting firms recommend that companies do not purchase and implement new operating sys- tems until the first update is available.In most cases,the first update will fix many of the problems encountered with the first release of the operating system.In this section,you will learn where to find the most current Red Hat Linux errata and updates. Red Hat Linux Errata and Update Service Packages The first step in hardening a Linux server is to apply the most current errata and Update Service Package to the operating system.The Update Service Package provides the latest fixes and additions to the operating system.It is a collection of fixes,corrections,and updates to the Red Hat products,such as bug fixes,security www.syngress.com
138_linux_02 6/20/01 9:33 AM Page 43 Hardening the Operating System • Chapter 2 43 advisories,package enhancements,and add-on software.Updates can be down- loaded individually as errata,but it is a good idea to start with the latest Update Service Package,and then install errata as necessary.However,you must pay to receive the Update Service Packages,and the errata are free.Many errata and Update Service Packages are not required upgrades.You need to read the docu- mentation to determine if you need to install it. The Update Service Packages include all of the errata in one package to keep your system up to date.After you pay for the service,you can order Update Service Packages on CD,or download them directly from the Red Hat Web site. To find out more about the Update Service Packages,visit www.redhat.com/ support/services/update.html (Figure 2.1).You will learn more about errata in the maintenance section of this chapter. Figure 2.1 Red Hat Errata and Updates Handling Maintenance Issues You should apply the latest service pack and updates before the server goes live, and constantly maintain the server after it is deployed to make sure the most cur- rent required patches are installed.The more time an operating system is available to the public,the more time malicious hackers have to exploit discovered vulner- abilities.Vendors offer patches to fix these vulnerabilities as quickly as possible;in some cases,the fixes are available at the vendor’s site the same day. www.syngress.com
138_linux_02 6/20/01 9:33 AM Page 44 44 Chapter 2 • Hardening the Operating System Administrators must also regularly test their systems using security analyzer software.Security analyzer software scans systems to uncover security vulnerabili- ties,and recommends fixes to close the security hole.(These tools are discussed in detail in Chapter 3.) This section discusses the maintenance required to ensure that your systems are safe from the daily threats of the Internet. Red Hat Linux Errata: Fixes and Advisories Once your Red Hat system is live,you must make sure that the most current required Red Hat errata are installed.These errata include bug fixes,corrections, and updates to Red Hat products.You should always check the Red Hat site at www.redhat.com/apps/support/updates.html for the latest errata news.The fol- lowing list defines the different types of errata found at the Red Hat Updates and Errata site. (cid:2) Bug fixes Address coding errors discovered after the release of the product,and may be critical to program functionality.These Red Hat Package Manager tools (RPMs) can be downloaded for free.Bug fixes provide a fix to specific issues,such as a certain error message that may occur when completing an operating system task.Bug fixes should only be installed if your system experiences a specific problem.Another helpful resource is Bugzilla,the Red Hat bug-tracking system at http://bugzilla.redhat.com/bugzilla. (cid:2) Security advisories Provide updates that eliminate security vulnerabil- ities on the system.Red Hat recommends that all administrators down- load and install the security upgrades to avoid denial-of-service (DoS) and intrusion attacks that can result from these weaknesses.For example, a security update can be downloaded for a vulnerability that caused a memory overflow due to improper input verification in Netscape’s Joint Photographic Experts Group (JPEG) code. (cid:2) Package enhancements Provide updates to the functions and features of the operating system or specific applications.Package enhancements are usually not critical to the system’s integrity;they often fix function- ality programs,such as an RPM that provides new features. Here are the steps for accessing Linux bug fixes,security advisories,and package enhancements: www.syngress.com
138_linux_02 6/20/01 9:33 AM Page 45 Hardening the Operating System • Chapter 2 45
- To download bug fixes,point your browser to www.redhat.com/ apps/support/updates.html.Under the “Errata:Fixes and Advisories” section,click the Red Hat Linux Bug Fixes link.The latest bug fixes are available for download on this page.Click each bug to learn more, and determine whether it affects your system.Some fixes do not include software downloads,such as RPMs;instead,they explain how to con- figure your system to fix the problem.
- To download security advisories,point your browser to www.redhat .com/apps/support/updates.html.Under the “Errata:Fixes and Advisories”section,click the Red Hat Linux Security Advisories link.The available security fixes are listed as shown in Figure 2.2.For example,one download contains three security hole fixes,as well as additional support for Pentium 4 processors.This affects Red Hat 6.x and 7.0 users.It is imperative for Linux administrators to check this Web site on a regular basis,determine if the changes are necessary,and imple- ment the vulnerability fix. Figure 2.2 Available Security Fixes for Red Hat Linux
- To download package enhancements,point your browser to www.redhat.com/apps/support/updates.html.Under the “Errata: Fixes and Advisories”section,click the All Red Hat Linux Errata link,and then the Package Enhancements link.A Red Hat Linux www.syngress.com
138_linux_02 6/20/01 9:33 AM Page 46 46 Chapter 2 • Hardening the Operating System Package Enhancements link may also exist on the main Errata page.The available package enhancements are listed.Check the list to see if any enhancements affect your operating system or applications.If an enhancement exists,and installing it would benefit your system,down- load and install the corresponding package. Bug Fix Case Study In a production environment,a problem may exist if a system has an i810 chipset and is running Red Hat Linux 6.2.The correct amount of system RAM may not be available to the system.Consequently,the system cannot maximize RAM usage,and may not run certain programs because it thinks it does not have enough RAM.A fix for this problem is available at the Red Hat Updates and Errata Web site. According to the bug fix,an administrator needs to manually enter the amount of RAM for the system.To check if the problem exists on a system,the administrator must log on as root and enter: cat /proc/meminfo If the memTotal value is not within a few MB of the actual system RAM,the administrator needs to manually enter the correct amount of system RAM.To accomplish this task,the administrator must have root access and edit the /etc/lilo.conf file by entering: vi /etc/lilo.conf The administrator must locate the current kernel image and add a new line by pressing i (to enter vi’s insert mode) and entering the following: append="mem=[total amount of ram (in MB)]" Figure 2.3 displays an edited lilo.conf file for a system that has 256MB of RAM.One MB should be subtracted from the total because the final megabyte is not available on all systems. The administrator must write and quit the lilo.conf file by pressing ESC (to exit vi’s insert mode) and entering: :wq Then he or she must load the updated lilo.conf file into memory by entering: /sbin/lilo www.syngress.com
138_linux_02 6/20/01 9:33 AM Page 47 Hardening the Operating System • Chapter 2 47 Figure 2.3 Editing the Lilo.conf File to Fix a Bug The administrator must reboot the machine.Afterward,he or she must check the RAM allocation by entering: cat /proc/meminfo If it is within a few MB of the actual RAM,the bug has been fixed.If not, the administrator must repeat the case study steps to ensure that the correct amount of RAM is allocated to the OS. Manually Disabling Unnecessary Services and Ports To harden a server,you must first disable any unnecessary services and ports.This process involves removing any unnecessary services,such as the Linux rlogin ser- vice,and locking down unnecessary Transmission Control Protocol/User Datagram Protocol (TCP/UDP) ports.Once these services and ports are secure, you must then regularly maintain the system. This section shows you how to manually disable several vulnerable services. Later in this lesson,you learn how to disable unnecessary services and ports using the open source program Bastille. Services to Disable Linux,by nature,is more secure than most operating systems.Regardless,there are still uncertainties to every new Linux kernel that is released,and many secu- rity vulnerabilities that have not been discovered.Most Linux services are not vulnerable to these exploits.However,an administrator can reduce the amount of risk by removing unnecessary services.Red Hat Linux includes many services,so www.syngress.com
138_linux_02 6/20/01 9:33 AM Page 48 48 Chapter 2 • Hardening the Operating System it makes sense that an administrator customize the system to suit the company needs.Remember,you are removing risk when you remove unnecessary services. The xinetd.conf File The /etc/xinetd.conf file (previously the inetd.conf file) controls many Unix ser- vices,including File Transfer Protocol (FTP) and Telnet.It determines what ser- vices are available to the system.The xinetd (like inetd) service is a “super server” listening for incoming network activity for a range of services.It determines the actual nature of the service being requested and launches the appropriate server. The primary reason for the design is to avoid having to start and run a large number of low-volume servers.Additionally,xinetd’s ability to launch services on demand means that only the needed number of servers is run. The etc/xinted.conf file directs requests for xinetd services to the /etc/xinetd.d directory.Each xinetd service has a configuration file in the xinetd.d directory.If a service is commented out in its specified configuration file,the service is unavailable.Because xinetd is so powerful,only the root should be able to configure its services. The /etc/xinetd.d directory makes it simple to disable services that your system is not using.For example,you can disable the FTP and Telnet services by commenting out the FTP and Telnet entries in the respective file and restarting the service.If the service is commented out,it will not restart.The next section demonstrates how to disable the Telnet,FTP,and rlogin services. Telnet and FTP Most administrators find it convenient to log in to their Unix machines over a network for administration purposes.This allows the administrator to work remotely while maintaining network services.However,in a high-security envi- ronment,only physical access may be permitted for administering a server.In this case,you should disable the Telnet interactive login utility.Once disabled,no one can access the machine via Telnet.
- To disable Telnet,you must edit the /etc/xinetd.d/telnet file.Open the Telnet file,as shown in Figure 2.4,using vi or an editor of your choice.
- Comment out the service telnet line by adding a number sign (#) before service telnet: #service telnet
- Write and quit the file. www.syngress.com
138_linux_02 6/20/01 9:33 AM Page 49 Hardening the Operating System • Chapter 2 49 Figure 2.4 Disabling Telnet Using the /xinetd.d/telnet File 4. Next,you must restart xinetd by entering: /etc/rc.d/init.d/xinetd restart Stopping xinetd: [OK} Starting xinetd: [OK} 5. Attempt to log on to the system using Telnet.You should fail. 6. Note that commenting out the service line in the respective xinetd.d directory can disable many services. 7. Disable the FTP service using the same method (e.g.,edit the /xinetd.d/wu-ftpd file by commenting out the service ftp line and restarting xinetd). 8. Attempt to access the system via FTP.You should be unable to log in to the server. The Rlogin Service The remote login (rlogin) service is enabled by default in the /etc/xinetd.d/ rlogin file.Rlogin has security vulnerabilities because it can bypass the password prompt to access a system remotely.There are two services associated with rlogin: login and RSH (remote shell).To disable these services,open the /xinetd.d/ rlogin file and comment out the service login line.Then,open the /etc/ xinetd.d/rsh file and comment out the service shell line.Restart xinetd to ensure that your system is no longer offering these services. www.syngress.com
138_linux_02 6/20/01 9:33 AM Page 50 50 Chapter 2 • Hardening the Operating System Locking Down Ports TCP/IP networks assign a port to each service,such as HTTP,Simple Mail Transfer Protocol (SMTP),and Post Office Protocol version 3 (POP3).This port is given a number,called a port number,used to link incoming data to the correct service.For example,if a client browser is requesting to view a server’s Web page, the request will be directed to port 80 on the server.The Web service receives the request and sends the Web page to the client.Each service is assigned a port number,and each port number has a TCP and UDP port.For example,port 53 is used for the Domain Name System (DNS) and has a TCP port and a UDP port. TCP port 53 is used for zone transfers between DNS servers;UDP port 53 is used for common DNS queries—resolving domain names to IP addresses. Well-Known and Registered Ports There are two ranges of ports used for TCP/IP networks:well-known ports and registered ports.The well-known ports are the network services that have been assigned a specific port number (as defined by /etc/services).For example,SMTP is assigned port 25,and HTTP is assigned port 80.Servers listen on the network for requests at the well-known ports.Registered ports are temporary ports,usu- ally used by clients,and will vary each time a service is used.Registered ports are also called ephemeral ports,because they last for only a brief time.The port is then abandoned and can be used by other services. The port number ranges are classified,as shown in Table 2.1,according to Request for Comments (RFC) 1700.To access RFC 1700,go to ftp://ftp.isi.edu/ in-notes/rfc1700.txt. Table 2.1 Port Number Ranges for Various Types Type Port Number Range Well-known 1 to 1023 Registered 1024 to 65535 NOTE Connections to ports number 1023 and below are assumed to run with root-level privileges. This means that untrusted services should never be configured with a port number below 1024. www.syngress.com
138_linux_02 6/20/01 9:33 AM Page 51 Hardening the Operating System • Chapter 2 51 You will see how well-known ports work with registered ports shortly. Table 2.2 is a list of well-known TCP/UDP port numbers. Table 2.2 Commonly Used Well-Known TCP/UDP Port Numbers Protocol Port Number FTP (Default data) 20 FTP (Connection dialog, control) 21 Telnet 23 SMTP 25 DNS 53 DHCP BOOTP Server 67 DHCP BOOTP Client 68 TFTP 69 Gopher 70 HTTP 80 POP3 110 NNTP 119 NetBIOS Session Service 139 Internet Message Access Protocol (IMAP), version 2 143 To explain how well-known ports work with registered ports,let’s look at a typical Web site connection from a Web browser to a Web server.The client sends the HTTP request from a registered TCP port,such as port 1025.The request is routed across the network to the well-known TCP port 80 of a Web server.Once a session is established,the server continues to use port 80,and the client uses var- ious registered ports,such as TCP port 1025 and 1026,to transfer the HTTP data. Figure 2.5 is a packet capture that displays the establishment of a TCP session between a client and server,and the transmission of HTTP data between them. In frame 2 of the packet capture,the source address (24.130.10.35) is the client computer requesting the Web page.The destination address (192.0.34.65) is the Web server,which hosts the Internet Corporation of Assigned Names and Numbers (ICANN) Web site.In the Info field,the 1025 > 80 indicates that the source TCP port is 1025.The 80 indicates that the destination TCP port is 80. The first three frames display the TCP handshake,which establishes a TCP con- nection between the client and server.In the frames that follow,the client requests HTTP data from the server.The request determines the HTTP version www.syngress.com
138_linux_02 6/20/01 9:33 AM Page 52 52 Chapter 2 • Hardening the Operating System that the client and server will use.The client then requests and downloads the contents of the Web page. Figure 2.5 Port Usage in a Client/Server HTTP Session Determining Ports to Block When determining which ports to block on your server,you must first deter- mine which services you require.In most cases,block all ports that are not exclu- sively required by these services.This is tricky,because you can easily block yourself from services you need,especially services that use ephemeral ports,as explained earlier. If your server is an exclusive e-mail server running SMTP and IMAP,you can block all TCP ports except ports 25 and 143,respectively.If your server is an exclusive HTTP server,you can block all ports except TCP port 80.In both cases,you can block all UDP ports since SMTP and IMAP all use TCP services exclusively.However,if you want to use your server as an HTTP client (i.e.,for accessing operating system updates) or as an e-mail client to a remote mail server, you will restrict the system.Clients require registered UDP ports for DNS,as well as registered TCP ports for establishing connections with Web servers. If you open only the corresponding UDP ports 25,80,and 143,DNS requests are blocked because DNS queries use UDP port 53,and DNS answers use a UDP registered port (e.g.,the response stating that www.syngress.com= 205.181.158.215).Even if you open port 53,a different registered port may be www.syngress.com
138_linux_02 6/20/01 9:33 AM Page 53 Hardening the Operating System • Chapter 2 53 assigned each time for the answer.Attempting to allow access to a randomly assigned registered port is almost impossible and a waste of time.The same problem applies with TCP connections that require ephemeral ports. Therefore,you should either open all TCP/UDP registered ports (so you can use your server as a client),or block them (except for the services you require) and access resources,such as operating system updates,another way.Many admin- istrators order the Red Hat Linux Update CDs,which are re-mastered every eight weeks,that contain all current updates (www.redhat.com/products/soft- ware/linux/updatecd/).You can also simply download the updates from another computer. Blocking Ports To block TCP/UDP services in Linux,you must disable the service that uses the specific port.The following section discusses disabling ports using xinetd,and disabling ports assigned to stand-alone services. Xinetd Services Many services are disabled by their respective files in the /etc/xinetd.d directory by commenting out the service that uses the port.You learned how to comment out xinetd services earlier in this chapter.For example,to disable port 79 (used for finger services,which gives out user data that can be used by malicious hackers),you would comment out the service finger entry in /etc/xinetd.d/ finger file.Refer to Table 2.2 to view other ports you may wish to block.It lists common ports blocked by firewalls.However,these ports can also be blocked at the server itself.Follow these steps to disable port 79:
- To disable port 79,you must edit the /etc/xinetd.d/finger file.Open the finger file and locate the service finger line.
- Comment out the finger service line,and then write and quit the file.
- Next,you must restart xinetd by entering: /etc/rc.d/init.d/xinetd restart
- If you have a finger program installed on your system,or access to a finger gateway,attempt a finger request to your system.You should fail. Note that you can use xinetd to disable many other ports. www.syngress.com
138_linux_02 6/20/01 9:33 AM Page 54 54 Chapter 2 • Hardening the Operating System Stand-Alone Services To disable ports whose corresponding services are not included in the /etc/xinetd.d directory,you must kill the service’s process and make sure that ser- vice does not automatically restart upon reboot.These services are called stand- alone services.For example,port 111 is assigned a stand-alone portmapper service not required for most e-mail servers.The portmapper service,which is technically part of the Sun Remote Procedure Call (RPC) service,runs on server machines and assigns port numbers to RPC packets,such as NIS and NFS packets.Because these RPC services are not used by most e-mail services,port 111 is not neces- sary.To disable port 111,you must disable the portmapper service as follows:
- To disable the portmapper service,identify the process identifier (PID) for portmap by entering: ps aux | grep portmap
- The second column lists the PID number.The last column lists the pro- cess using that PID.To stop the portmapper service,identify the PID number and enter: kill –9 [PID NUMBER]
- To make sure the service does not restart during reboot,enter: ntsysv
- Scroll down to the portmap service and uncheck the check box next to the service.Click OK.The portmap service will no longer restart at bootup. NOTE Some ports, such as port 80, are not activated unless the service is installed. For example, if you have not installed Apache server, then port 80 is not used. There is no need to block the port because it is already disabled. www.syngress.com
138_linux_02 6/20/01 9:33 AM Page 55 Hardening the Operating System • Chapter 2 55 Hardening the System with Bastille Bastille is an open source program that facilitates the hardening of a Linux system. It performs many of the tasks discussed in this chapter,including downloading operating system updates and disabling services and ports that are not required for the system’s job functions.The program also offers a wider range of additional ser- vices,from installing a firewall (ipchains) to implementing secure shell (SSH). Bastille is powerful and can save administrators time from configuring each individual file and program throughout the operating system.Instead,the admin- istrator answers a series of “Yes”and “No”questions through an interactive text- based interface.The program automatically implements the administrator’s preferences based on the answers to the questions. Bastille is written specifically to Red Hat Linux and Mandrake Linux,but can be easily modified to run on most Unix flavors.The specific Red Hat/Mandrake content has been generalized,and now the hard-code filenames are represented as variables.These variables are set automatically at runtime. Bastille Functions The following list highlights the security features offered by Bastille to secure your system.You will choose which feature you want to implement on your system during the question-and-answer period.For example,many servers do not need to provide firewall or Network Address Translation (NAT),so you may not need to configure ipchains.This list may vary as new versions of Bastille are released and the program becomes more powerful.More information about each of these features is explained in the program. (cid:2) Run the ipchains script You can configure your system as a packet filter.This allows your system to perform NAT,serve as a small firewall, and deny certain connection types to your server. (cid:2) Download and install RPM updates The most recent versions of the RPMs used on your system are downloaded and installed.These RPM downloads are obtained from the Red Hat Errata page (www.redhat.com/support/errata). (cid:2) Apply restrictive permissions on administrator utilities Allows only the root to read and execute common Administrator utilities such as ifconfig,linuxconf,ping,traceroute,and runlevel).It disables the SUID root status for these programs,so nonroot users cannot use them. www.syngress.com
138_linux_02 6/20/01 9:34 AM Page 56 56 Chapter 2 • Hardening the Operating System (cid:2) Create a second root account A second UID 0 (root) account allows administrators to track the original root account.This is helpful for tracking hackers because Bastille notifies the second account to orig- inal account logins.If you always use the second account,then you know when a security breach may have occurred. (cid:2) Disable r-protocols The r-protocols allow users to log on to remote systems using IP-based authentication.IP-based authentication permits only specific IP addresses to remotely log on to a system.Because this authentication is based on the IP address,a hacker who has discovered an authorized IP address can create spoofed packets that appear to be from the authorized system. (cid:2) Implement password aging Default Red Hat Linux systems allow passwords to expire after 99,999 days.Because this is too long in a secure environment,Bastille offers to change the password expiration time to 180 days.These configurations are written to the /etc/login.defs file,as shown in Figure 2.6. Figure 2.6 The /etc/login.defs File Configured for 180-Day Password Expiration (cid:2) Password protect the LILO prompt Allows users with the correct password to add arguments to the LILO prompt.Otherwise,only the default value (usually linux) is allowed.Be careful to implement this www.syngress.com
138_linux_02 6/20/01 9:34 AM Page 57 Hardening the Operating System • Chapter 2 57 change if you have a dual-boot system,because the name of the oper- ating system,such as dos,is often typed at the LILO prompt to access other operating systems. (cid:2) Disable CTRL-ALT-DELETE rebooting This disallows rebooting the machine by this method. (cid:2) Password protect single-user mode If a user gains access to your physical system,he or she can enter single-user mode by typing init 1. Once in single-user mode,that user has root access,and no one else can access the machine.By placing a password on single-user mode,run- level 1 is protected (the password is the root password). (cid:2) Optimize TCP Wrappers This choice modifies the inetd.conf (pre- Red Hat Linux 7 versions only) and /etc/hosts.allow files so that inetd must contact TCP Wrappers whenever it gets a request,instead of auto- matically running the requested service.TCP Wrappers will determine if the requesting IP address is allowed to run the particular service.If the request is not allowed,the request is denied and the attempt is logged. Although IP-based authentication can be vulnerable,this optimization adds a layer of security to the process. (cid:2) Add Authorized Use banners These banners automatically appear whenever anyone logs on to the system.Authorized Use banners are helpful in prosecuting malicious hackers,and should be added to every system on your network that allows access to the network.An informa- tion bulletin from the U.S.Department of Energy’s Computer Incident Advisory Capability can be found at http://ciac.llnl.gov/ciac/bulletins/ j-043.shtml. The bulletin is titled “Creating Login Banners”and explains what is required within login banners for government computers.It also includes how to create banners and provides the text from the approved banner for Federal Government computer systems.Bastille uses a modi- fied version of this login banner.If you choose to create a login banner, it will resemble Figure 2.7.You can modify the banner text to suit your security needs in the etc/motd file. (cid:2) Disable the compiler Most hackers access systems through regular user accounts.Once they have access to the system,they compile mali- cious programs to attack the system and other systems.Disabling the compiler denies users from compiling programs,which reduces the www.syngress.com
138_linux_02 6/20/01 9:34 AM Page 58 58 Chapter 2 • Hardening the Operating System security risk.This step is recommended for dedicated servers and fire- walls,but may be too strict for workstations used by employees who require use of the compiler for their job tasks. Figure 2.7 The etc/motd File Displaying Banner Text (cid:2) Limit system resource usage If you limit system resource usage,you can reduce the chances of server failure from a DoS attack.If you choose to limit system resource usage in Bastille,the following changes will occur: (cid:2) Individual file size is limited to 40MB. (cid:2) Each individual user is limited to 150 processes. (cid:2) The allowable core files number is configured to zero.Core files are used for system troubleshooting.They are large and exploitable if a hacker gains control of them:they can grow and consume your file system. These limits are written to the /etc/security/limits.conf file,as shown in Figures 2.8 and 2.9. (cid:2) Restrict console access Anyone with access to the console has special rights,such as CD-ROM mounting.Bastille can specify which user accounts are allowed to log on via the console. www.syngress.com
138_linux_02 6/20/01 9:34 AM Page 59 Hardening the Operating System • Chapter 2 59 Figure 2.8 The /etc/security/limits.conf File Figure 2.9 The /etc/security/limits.conf File Configured to Limit the Allowable Core Files, User File Sizes, and User Processes (cid:2) Additional and remote logging Two additional logs can be added to /var/log/: (cid:2) /var/log/kernel (kernel messages) (cid:2) /var/log/syslog (error and warning severity messages) You can also log to a remote logging host if one exists. (cid:2) Process accounting setup Allows you to log the commands of all users.It also records when the commands were executed.This log file is helpful in retracing a hacker’s steps into your system,but the file can become large quickly.If the hacker has root access,the hacker can remove this accounting log. www.syngress.com
138_linux_02 6/20/01 9:34 AM Page 60 60 Chapter 2 • Hardening the Operating System (cid:2) Disable unnecessary daemons As discussed earlier in this chapter, only the required services should run on a system.All other services should be removed.Bastille allows you to disable daemons that are often unnecessary and pose potential security risks.If you performed a custom Red Hat installation with “everything,”you will be asked if you want to disable the services shown in Table 2.3. Table 2.3 Disabling Unnecessary Daemons Reason for Service Description Disabling Ampd Monitors battery power on Often unnecessary laptop computers Network File System Unix network file systems Potential security risk (NFS) and Samba used for sharing files Atd At daemon used for Potential security risk scheduling commands PCMCIA services Used for laptop computers Often unnecessary Dynamic Host Used by DHCP servers Often unnecessary Configuration Protocol (DHCP) daemon News server daemon Used by news servers Often unnecessary Routing daemon Used by routers Often unnecessary Network Information Unix network naming and Potential security risk System (NIS) server and administration system and often unnecessary client programs Simple Network Used to manage network Potential security risk Management Protocol devices and often unnecessary (SNMP) daemon Sendmail daemon mode Used by sendmail servers Often unnecessary (cid:2) Download and install Secure Shell (SSH) A standard for securely logging on to remote systems.SSH encrypts usernames,passwords,and all information between hosts as they communicate across the network. Standard telnet connections send the information in clear text.Therefore, you should always use SSH to ensure secure remote connections. (cid:2) Deactivate and chroot named Similar to other services,named should be deactivated if the service is not required (e.g.,if the server will www.syngress.com
138_linux_02 6/20/01 9:34 AM Page 61 Hardening the Operating System • Chapter 2 61 not answer DNS queries).Bastille also offers to change the root direc- tory of named to a child node on the directory tree,which is /home/dns.This new directory is considered a “chroot’ed prison” because the daemon is limited to only part of the file system and can only access the required files needed to function.These prisons are not entirely secure,but they do offer another layer of security to fend off a would-be hacker.This change is transparent,except that all configuration files and editing must occur in /home/dns.In addition,if you control named with ndc,you must enter:ndc -c /home/dns/var/run/ndc. NOTE The chroot() system call makes the current working directory act as if it were /. Consequently, a process that has used the chroot() system call cannot cd to higher-level directories. This prevents anyone exploiting the service from general access to the system. (cid:2) Harden Apache Web server httpd should be deactivated if the service is not required.If you decide to use Apache,you can perform the steps shown in the “Hardening the Apache Web Server”sidebar in Bastille to run the service. Damage & Defense… Hardening the Apache Web Server Bastille has a reputation for being unable to secure the Apache Web server. If you implement the following steps for hardening Apache, be aware that security issues may still arise.
- Run Apache as localhost only This action is especially helpful for Web designers and programmers because it allows them to work on their code and view their progress without opening the Web server to others network users. They access their local Web server by entering http://localhost. Continued www.syngress.com
138_linux_02 6/20/01 9:34 AM Page 62 62 Chapter 2 • Hardening the Operating System 2. Bind the Web server to a specific interface Allows you to bind the Web server’s IP address to an interface, such as an Ethernet network interface card (NIC). The option overrides the previous localhost-only action. 3. Disable symbolic links Symbolic links are “pointers” to other files in a file system. They are capable of allowing Web site visitors to access files outside of the Web server directo- ries. If you disable symbolic links, you limit the files accessible to visitors on the Web server. 4. Deactivate server-side includes Server-side includes (SSIs) are interpreters or programs on a Web server that are acti- vated by a client. SSIs can create HTML on the fly, which reduces bandwidth usage. SSIs are HTML directives to run programs on the server and add the programs’ output to the page being returned to the client. The problem is that crackers could cause the program to run in an insecure way, and in some cases could even cause other programs to run. Consequently, SSIs are considered insecure and have fallen out of favor. If you do not use SSIs on your Apache Web server, you should deactivate them. 5. Disable CGI scripts Common Gateway Interface (CGI) scripts allow a Web server to communicate with an application, such as a database, and then return that data to a client. CGI scripts should be limited to certain users, depending on the CGI scripts. For example, many scripts are used to process Web page forms, which are available to the public. Some scripts may be used to access private databases, which require limited access. If you do not use CGI scripts on your Apache Web server, you should deactivate them. 6. Disable indexes A world-readable file or directory allows Web site visitors access to files or directories. An automati- cally generated index file will list the contents of these files and directories. Listing them is usually a bad idea unless you want the files to be listed for HTTP downloads (Web-based file archives) or similar uses. (cid:2) Disable printing Printing should only be enabled if your system needs to print.If printing is not required,Bastille removes SUID root on lpr, and disables lpr and lpd.As stated in the configuration script,if you www.syngress.com
138_linux_02 6/20/01 9:34 AM Page 63 Hardening the Operating System • Chapter 2 63 disable SUID root on lpr and need to print,you must undo the setting by entering the following: /bin/chmod 06555 /usr/bin/lpr /usr/bin/lprm /sbin/chkconfig lpd on (cid:2) Disable FTP daemon user privileges By default (in the wu-ftpd configuration file),FTP clients cannot connect anonymously and upload files via FTP.Users with accounts on the system can still access the FTP server.This is dangerous if they access the server over a public network because the FTP passwords are sent as clear text,which can be captured by anyone with a packet sniffer.Anyone who has upload privileges can compromise the FTP daemon,because uploading files cause most attacks that allow root access. (cid:2) Disable anonymous download Allows anyone to download files from your FTP server without a unique username and password.Instead, it is recommended that you use an Apache Web-based file archive to allow the public to download files. Bastille Versions Bastille 1.1.0 and later incorporates several important changes that make the pro- gram even more powerful and easy to use.The examples in this book use Bastille 1.1.1.It is recommended that you implement at least version 1.1.0 because of the following enhancements: (cid:2) Nonvirgin system install Bastille runs on systems that are already in production.Previous versions only allowed Bastille to run on systems with a new install only. (cid:2) Multiple runnings Bastille can be run many times on the same system. Therefore,administrators can change settings as needed. (cid:2) Log-only feature Administrators can run Bastille without actually implementing the changes.Instead,the changes are written to a log file. This is helpful because it allows an administrator to decide what will work best for his or her system without being forced to commit to the changes.One wrong choice in Bastille can restrict the system’s function- ality,and not allow the server to perform its job (hence,the all-important www.syngress.com
138_linux_02 6/20/01 9:34 AM Page 64 64 Chapter 2 • Hardening the Operating System Undo feature).To run the program in log-only mode,enter the following at the prompt when using interactive mode: ./InteractiveBastille.pl -v (cid:2) Distribution support Bastille is written specifically to Red Hat Linux and Mandrake Linux.The specific Red Hat/Mandrake content has been generalized,and hard-code filenames are now represented as variables. These variables are set automatically at runtime. (cid:2) Undo feature Administrators can undo settings through various methods that are listed at the end of this section. Implementing Bastille Bastille is available for free download at www.bastille-linux.org.This tarball is also on the CD accompanying this book (Bastille-1.1.1.tar.gz).The program is offered in tarball format and must be installed by a root user in his or her root directory (a tarball is a collection of archived files that have been archived using the Unix tar program and have the .tar extension).Because Bastille is actually a collection of Perl scripts,you must also ensure that Perl 5.0 or later is installed on your system. The program automatically implements the administrator’s preferences based on the answers to the questions,and saves them in the /root/Bastille/config file, as shown in Figure 2.10. Figure 2.10 Bastille Configuration File www.syngress.com
138_linux_02 6/20/01 9:34 AM Page 65 Hardening the Operating System • Chapter 2 65 Bastille allows the same configuration to be implemented on other systems. To do this,administrators need to install Bastille on that machine,copy the config file and the BackEnd.pl file to the new system’s ~/Bastille directory,and then run the command: ./BackEnd.pl Damage & Defense… Logging Your Configurations in Bastille As with many security programs, Bastille is relatively simple to imple- ment, but it’s easy to lose track of the changes you implemented. This can be a problem if you are unable to perform a typical operation on the system, or are denied access to a command or service. Many times, it is because you locked down part of the system by mistake, or misjudged the impact of a particular Bastille choice. It is always a good idea to create a hard-copy log of the options you select in Bastille, or any security configurations you implement on your system. When you configure Bastille on your systems, use the Bastille log included in Appendix A of this book. It includes each configuration ques- tion and an area for your manual input. Make copies of the Appendix A, fill out the table during configuration, and keep the hard copies in a safe place. If your system goes down, you can access the hard copies and recreate your Bastille configurations. Of course, if your system became unusable due to Bastille, it will help you determine what went wrong. This is especially helpful if you are unable to access the /root/Bastille/ config file, which saves the administrator’s preferences based on the answers to the Bastille questions. Follow these steps to install and configure Bastille:
- Log in as root.
- Copy the Bastille tarball to your root directory.You can access the tarball from the CD accompanying this book (Bastille-1.1.1.tar.gz),or from www.bastille-linux.org.This lab is written for version 1.1.1,so we recom- mend that you use the version on the CD.The filename will resemble: www.syngress.com
138_linux_02 6/20/01 9:34 AM Page 66 66 Chapter 2 • Hardening the Operating System Bastille-1.1.1.tar.gz 3. In the root directory,decompress the image by entering: tar –zxvf Bastille-1.1.1.tar.gz 4. Access the newly created Bastille directory in your root directory. cd Bastille 5. To run the Perl configuration scripts in the interactive text-based mode, enter the following in the Bastille directory: ./InteractiveBastille.pl The opening Bastille screen appears,as shown in Figure 2.11. Figure 2.11 Interactive Bastille Opening Screen 6. All choices you implement in Bastille are logged to the /root/Bastille/ config file.If you want to log your choices without implementing them, you can append the -v option.Your choices are still logged to the /root/Bastille/config file,which is the same file to which the actions are logged.Therefore,we strongly recommend that you make a backup of the config file before running Bastille and keep a manual log. www.syngress.com
138_linux_02 6/20/01 9:34 AM Page 67 Hardening the Operating System • Chapter 2 67 7. The opening screen appears,identifying how to navigate through the Bastille configuration process.Select Next to access the first configura- tion screen,as shown in Figure 2.12. Figure 2.12 Bastille Linux Question-and-Answer Script 8. Table 2.5 leads you through the configuration process.The configuration used in this example performs a few basic hardening techniques on a Red Hat Linux 7.0 system with a custom installation with everything installed.The main purpose is to show you what Bastille offers and how to use it.You can use Bastille to secure a system based on your system’s services and needs,which will vary from the example.The bolded sec- tions in the Choice column are choices you will skip for this example. The default answers are displayed for your interest.You will install many of these services later in this book,such as SSH. Table 2.5 Simple Bastille Configurations Question Choice Module 1: IPChains.pm
- Would you like to run the ipchains script? (Choosing No “No” will skip to Module 2; you will implement ipchains later in this book.)
- Do you need the advanced networking options? No
- DNS servers 0.0.0.0/0 Continued www.syngress.com
138_linux_02 6/20/01 9:34 AM Page 68 68 Chapter 2 • Hardening the Operating System Table 2.5 Continued Question Choice 4. Public interfaces eth+ ppp+ slip+ 5. TCP services to audit (name or port number). telnet ftp imap pop-3 finger sunrpc exec login linuxconf ssh 6. UDP services to audit (name or port number); the 31337 “Back Orifice” port number on Microsoft clients is listed by default. 7. ICMP services to audit (name or port number); an (Blank) example is the Microsoft “echo-request” service (Microsoft ping and tracert commands). 8. TCP service names or port numbers to allow on public (Blank) interfaces (typical workstations should not allow any services). 9. UDP service names or port numbers to allow on (Blank) public interfaces (typical workstations should not allow any services). 10. Force passive mode (i.e., for clients connecting to an No FTP server). 11. TCP services to block (if you force passive mode, you 1024 2049 can skip this step). 2065:2090 6000:6020 7100 12. UDP services to block. 1066 2049 6770 13. ICMP allowed types. Destination- unreachable echo-reply time- exceeded 14. Enable source address verification. Yes 15. Reject method. DENY 16. Interfaces for DHCP queries. (Blank) 17. NTP servers to query. (Blank) 18. ICMP types to disallow outbound. Destination- unreachable time- exceeded Continued www.syngress.com
138_linux_02 6/20/01 9:34 AM Page 69 Hardening the Operating System • Chapter 2 69 Table 2.5 Continued Question Choice Module 2: PatchDownload.pm
- Would you like to download and install the updated No RPMs? Module 3: FilePermissions.pm
- Would you like to set more restrictive permissions on Yes the administration utilities?
- Would you like to disable SUID status for mount/ No umount?
- Would you like to disable SUID status for ping? Yes
- Would you like to disable SUID status for dump and No restore?
- Would you like to disable SUID status for cardctl? No
- Would you like to disable SUID status for at? No
- Would you like to disable SUID status for DOSEMU? No
- Would you like to disable SUID status for news server No tools?
- Would you like to disable SUID status for printing No utilities?
- Would you like to disable SUID status for the r-tools? No
- Would you like to disable SUID status for usernetctl? No
- Would you like to disable SUID status for traceroute? Yes Module 4: AccountSecurity.pm
- Would you like to set up a second UID 0 account? No 1a. What should we name the second UID 0 account? admin
- May we take strong steps to disallow the dangerous No r-protocols?
- Would you like to enforce password aging? Yes
- Would you like to create a nonroot user account? Yes 4a. What should we name your nonroot account? dave
- Would you like to restrict the use of cron to adminis- No trator accounts? No Continued www.syngress.com
138_linux_02 6/20/01 9:34 AM Page 70 70 Chapter 2 • Hardening the Operating System Table 2.5 Continued Question Choice Module 5: BootSecurity.pm
- Would you like to password protect the LILO prompt? No 1a. Enter LILO password, please. (Blank)
- Would you like to reduce the LILO delay time to zero? No
- Do you ever boot Linux from the hard drive? Yes
- Would you like to write the LILO changes to a boot No floppy? 4a. Floppy drive device name. fd0
- Would you like to disable CTRL-ALT-DELETE rebooting? No
- Would you like to password protect single-user mode? Yes Module 6: SecureInetd.pm
- Would you like to modify inetd.conf and /etc/hosts No .allow to optimize use of Wrappers?
- Would you like to set sshd to accept connections only No from a small list of IP addresses? 2a. IP addresses to accept SSH from: (Blank)
- Would you like to make Authorized Use banners? Yes Module 7: DisableUserTools.pm
- Would you like to disable the compiler? No Module 8: ConfigureMiscPAM.pm
- Would you like to put limits on system resource usage? Yes
- Should we restrict console access to a small group of user accounts? No 2a. What accounts should be able to log in at console? root Module 9: Logging.pm
- Would you like to add additional logging? No
- Do you have a remote logging host? No 2a. What is the IP address of the machine you want to 127.0.0.1 log to? Continued www.syngress.com
138_linux_02 6/20/01 9:34 AM Page 71 Hardening the Operating System • Chapter 2 71 Table 2.5 Continued Question Choice 3. Would you like to set up process accounting? No Module 10: MiscellaneousDaemons.pm
- Would you like to disable apmd? No
- Would you like to deactivate NFS and Samba? No
- Would you like to disable atd? No
- Would you like to disable PCMCIA services? No
- Would you like to disable the DHCP daemon? No
- Would you like to disable GPM? No
- Would you like to disable the news server daemon? No
- Would you like to deactivate the routing daemons? No
- Would you like to deactivate NIS server and client No programs?
- Would you like to disable SNMPD? No Module 11: Sendmail.pm
- Do you want to leave sendmail running in daemon Yes mode?
- Would you like to run sendmail via cron to process No the queue?
- Would you like to disable the VRFY and EXPN send- No mail commands? Module 12: RemoteAccess.pm
- Would you like to download and install SSH? No Module 13: DNS.pm
- Would you like to chroot named and set it to run as a No nonroot user?
- Would you like to deactivate named, at least for now? No Module 14: Apache.pm
- Would you like to deactivate the Apache Web server? No
- Would you like to bind the Web server to listen only to No the localhost? Continued www.syngress.com
138_linux_02 6/20/01 9:34 AM Page 72 72 Chapter 2 • Hardening the Operating System Table 2.5 Continued Question Choice 3. Would you like to bind the Web server to a particular No interface? 3a. Address to bind the Web server to? 127.0.0.1 4. Would you like to deactivate the following of No symbolic links? 5. Would you like to deactivate server-side includes? No 6. Would you like to disable CGI scripts, at least for No now? 7. Would you like to disable indexes? No Module 15: Printing.pm
- Would you like to disable printing? No Module 16: FTP.pm
- Would you like to disable user privileges on the FTP No daemon?
- Would you like to disable anonymous download? No
- Bastille asks if you wish to implement these changes,as shown in Figure 2.13. Figure 2.13 Implementing Bastille Changes www.syngress.com
138_linux_02 6/20/01 9:34 AM Page 73 Hardening the Operating System • Chapter 2 73 10. Select Yes.The credits will appear.Press TAB to return to the prompt. 11. To test the changes you made to your system,enter the following ping and traceroute commands as root.The commands should run successfully. ping www.bastille-linux.org traceroute www.bastille-linux org 12. Create a password for the dave account you created in Bastille by entering: passwd dave Changing password for user dave New UNIX password: Retype new UNIX password: passwd: all authentication tokens updated successfully 13. Log in as user dave.The “NOTICE TO USERS”authorization banner will appear (the etc/motd file),warning that the computer system is for authorized use only.The banner will appear when any user,including users with SUID status,log on to the system. 14. Enter the ping and traceroute commands again as dave.The commands should fail,because only users with SUID status are allowed to run these commands.The error messages will appear as follows: ping www.bastille-linux.org /bin/ping: Permission denied traceroute www.bastille-linux.org traceroute: command not found 15. You also implemented password aging to 180 days.Observe the changes you made to the login.def file by entering: cat /etc/login.defs | less Press any key to display the next page.Press q to access the prompt. 16. You applied limits to system resources by limiting individual file size to 40MB,limiting individual users to 150 processes,and configuring the allowable core files number to zero.Observe the changes you made to the limits.conf file by entering: cat /etc/security/limits.conf | less www.syngress.com
138_linux_02 6/20/01 9:34 AM Page 74 74 Chapter 2 • Hardening the Operating System Press any key to display the next page.Press q to access the prompt. 17. Log in as root so you can add an account in the next step. 18. You password protected single-user mode.If a user gains access to your physical system,he or she must enter a password to enter single-user mode.This will keep anyone from accessing single-user mode,giving him or her root access and no one else access to the machine.The pass- word is the root password.To test this action,follow these steps: 19. Reboot the system. 20. At the lilo prompt,enter: linux init 1 21. The following instructions will appear.Enter your root password as requested: Telling INIT to go to single user mode. INIT: Going single user Give root password for maintenance (or type Control-D for normal startup): ******** 22. You will access single-user mode,but only if you enter the root pass- word.Access run-level 3 by entering: init 3 Undoing Bastille Changes At the time of this writing,a reliable automatic undo feature did not exist in Bastille.To undo the changes,you can run through the configuration questions again and select different answers.There are two other options.There is a Perl script named Undo.pl in the Bastille directory that is designed to undo all changes except for RPM installations.There is also a backup directory located at /root/Bastille/undo/backup that contains all the original system files that Bastille modified.The backup directory structure is the same as the system’s directory,so you can manually replace the files fairly easily. You cannot undo your Bastille configurations by simply removing Bastille.If you do this,your changes will still be written to their specific files.If you want to remove the program and your settings,you must undo your changes,and then remove the Bastille directory. www.syngress.com
138_linux_02 6/20/01 9:34 AM Page 75 Hardening the Operating System • Chapter 2 75 The following steps demonstrate three ways to undo the changes that you implemented in Table 2.5.
- One method to undo Bastille configurations is to run through the con- figuration questions again and select different answers.If you choose this method,access the Bastille directory and enter: ./InteractiveBastille.pl
- Run through the selection from Table 2.5 again,but replace several of the “Yes”configurations with a “No”answer,as shown in Table 2.6. Table 2.6 Undoing Bastille Configurations Question Choice Module 3: FilePermissions.pm
- Would you like to set more restrictive permissions on No the administration utilities?
- Would you like to disable SUID status for ping? No
- Would you like to disable SUID status for traceroute? No Module 4: AccountSecurity.pm
- Would you like to enforce password aging? No
- Would you like to create a nonroot user account? No Module 5: BootSecurity.pm
- Would you like to password protect single-user mode? No Module 6: SecureInetd.pm
- Would you like to make Authorized Use banners? No Module 8: ConfigureMiscPAM.pm
- Would you like to put limits on system resource usage? No
- Bastille asks if you wish to implement these changes.Select Yes.The credits will appear.Press TAB to return to the prompt. www.syngress.com
138_linux_02 6/20/01 9:34 AM Page 76 76 Chapter 2 • Hardening the Operating System 4. The dave account you created will not be deleted because you only specified that you did not want to create a new account during the undo process.To delete the dave account,enter: userdel –r dave The command will remove all entries for dave in the system account files and the dave account’s home directory. 5. The Authorized Use banner may still appear at logon.To manually delete the Authorized Use banner,delete the banner text in the /etc/motd file,or replace the motd file with the backup file.The loca- tion of the backup file is explained in step 7. 6. A second method to undo Bastille configurations is to run the automated Perl script that will undo the changes.The script is named Undo.pl,and is designed to undo all changes except for RPM installations.To run the Undo.pl script,access the Bastille directory and enter: ./Undo 7. A third method to undo Bastille configurations is to manually remove the changes.This can be done by replacing each file that was changed with the backup files in the Bastille directory.The backup directory is located at: /root/Bastille/undo/backup The backup files contain the original files before they were changed, so the original configurations are intact.Bastille makes a backup file of each file before the file is modified.A Bastille backup directory is shown in Figure 2.14. Figure 2.14 Bastille Backup Directory Example www.syngress.com
138_linux_02 6/20/01 9:34 AM Page 77 Hardening the Operating System • Chapter 2 77 8. For example,to change password aging back to its default 99,999 days, replace the login.defs file with the backup file.Enter the following: cd /root/Bastille/undo/backup/etc/login.defs cp logindefs /etc/login.defs cp: overwrite ‘/etc/login.defs’? y The backup file replaces the current file,thus returning the password expiration configuration to its default setting. As you can see,Bastille is a powerful security tool that helps you harden your system.It is relatively simple to use,and can save administrators a great deal of time because it automatically configures the required files for each selection. Administrators do not have to manually write to each file,or disable services individually.Bastille is recommended for any Unix system that offers services, whether it is a LAN or Internet server. Controlling and Auditing Root Access with Sudo Superuser Do (sudo) is an open source security tool that allows an administrator to give specific users or groups the ability to run certain commands as root or as another user.The program can also log commands and arguments entered by specified system users.The developers of sudo state that the basic philosophy (www.courtesan.com/sudo/readme.html) of the program is to “give as few privi- leges as possible but still allow people to get their work done.”Sudo was first released to the public in the summer of 1986,and Todd Miller of Courtesan Consulting currently maintains the program and distributes it freely under a BSD-style license.The Sudo Main Page is located at www.courtesan.com/sudo, as shown in Figure 2.15. The program is a command-line tool that operates one command at a time. Table 2.7 lists several important features of sudo. Table 2.7 Sudo Features Feature Description Command logging Commands and argument can be logged. Commands entered can be traced to the user. Ideal for system auditing. Continued www.syngress.com
138_linux_02 6/20/01 9:34 AM Page 78 78 Chapter 2 • Hardening the Operating System Table 2.7 Continued Feature Description Centralized logging of Sudo can be used with the system log daemon multiple systems (syslog) to log all commands to a central host. Command restrictions Each user or group of users can be limited to what commands they are allowed to enter on the system. Ticketing system The ticketing system sets a time limit by creating a ticket when a user logs on to sudo. The ticket is valid for a configurable amount of time. Each new command refreshes the ticket for the predefined amount of time. The default time is five minutes. Centralized administration of The sudo configurations are written to the multiple systems /etc/sudoers file. This file can be used on multiple systems and allows administration from a central host. The file is designed to allow user privileges on a host-by-host basis. Figure 2.15 Sudo Home Page www.syngress.com
138_linux_02 6/20/01 9:34 AM Page 79 Hardening the Operating System • Chapter 2 79 Because sudo logs all commands run as root (or specified otherwise),many administrators use it instead of using the root shell.This allows them to log their own commands for troubleshooting and additional security. The ticketing system is ideal because if the root user walks away from the system while still logged in (a very bad idea),another user cannot access the system simply because he or she has physical access to the keyboard. After the ticket expires,users must log on to the system again.A shorter time is recommended,such as the default five minutes.The ticketing system also allows users to remove their ticket file. System Requirements To install and run sudo from the source distribution,you must have a system run- ning Unix.Almost all versions of Unix support the sudo source distribution, including almost all flavors of POSIX,BSD,and SYSV.You must also install the C compiler and the make utility. Sudo is known to run on the following Unix flavors:Auspex,SunOS,Solaris, ISC,RISCos,SCO,HP-UX,Ultrix,IRIX,NEXTSTEP,DEC Unix,AIX, ConvexOS,BSD/OS,OpenBSD,Linux,UnixWare,Pyramid,ATT,SINIX, ReliantUNIX,NCR,Unicos,DG/UX,Dynix/ptx,DC-Osx,HI-UX/MPP, SVR4,and NonStop-UX.It also runs on MacOSX Server.To see if your OS version is compatible,visit www.courtesan.com/sudo/runson.html.In the fol- lowing examples,the Linux 2.2.16 kernel (included with Red Hat Linux 7) will be used on an i586 system. The Sudo Command The sudo command allows a user to execute a command as a superuser or another user.All configurations for sudo are written to the /etc/sudoers file.The sudoers file specifies whether that command is allowed by that particular user. In order to use sudo,the user must have already supplied a username and password.If a user attempts to run the command via sudo and that user is not in the sudoers file,an e-mail is automatically sent to the administrator,indicating that an unauthorized user is accessing the system. Once a user logs in to sudo,a ticket is issued that is valid by default for five minutes.A user can update the ticket by issuing the –v flag,which will validate the ticket for another five minutes.The command is entered as follows: sudo –v www.syngress.com
138_linux_02 6/20/01 9:34 AM Page 80 80 Chapter 2 • Hardening the Operating System If an unauthorized user runs the -v flag,an e-mail will not be sent to the administrator.The -v flag informs the unauthorized user that he or she is not a valid user.If the user enters command via sudo anyway,an e-mail will then be sent to the administrator. Sudo logs login attempts,successful and unsuccessful,to the syslog(3) file by default.However,this can be changed during sudo configuration.Some of the command-line options listed in Table 2.8 are used by sudo. Table 2.8 Selected Sudo Command Options Option Option Name Description -V Version Prints version number and exits. -l List Lists the commands that are allowed and denied by current user. -h Help Prints usage message and exits. -v Validate Updates the user’s ticket for a configured amount of time (default is five minutes). If required, the user must re-enter the user password. -k Kill Expires the user’s ticket. Completing this option requires the user to re-enter the user password to update the ticket. -K Sure kill Removes the user’s ticket entirely. User must log in with username and password after running this option. -u User Runs the specific command as the username specified. The user specified can be any user except root. If you want to enter a uid, enter #uid instead of the username. Downloading Sudo Sudo can be downloaded from multiple sites,all specified at the sudo Web site (www.courtesan.com/sudo).For this demonstration,I used version 1.6.3p6, which is included on the companion CD (sudo-1.6.3p6.tar.gz).Other versions should be similar.For sudo download locations (many exist) via FTP and HTTP, visit the following Web addresses: (cid:2) FTP www.courtesan.com/sudo/ftp.html (cid:2) HTTP www.courtesan.com/sudo/www.html www.syngress.com
138_linux_02 6/20/01 9:34 AM Page 81 Hardening the Operating System • Chapter 2 81 The master FTP and HTTP sites for sudo are located and maintained by Courtesan Consulting at: (cid:2) FTP ftp://ftp.courtesan.com/pub/sudo (cid:2) HTTP www.courtesan.com/sudo/dist Many distributions exist for the different Unix flavors.Download the version specific to your system.For example,follow these steps to download sudo for Red Hat Linux:
- Access the sudo master http download site at www.courtesan.com/ sudo/dist.
- Download the latest version of sudo displayed at the bottom of the directory.For example,in Figure 2.16,you will select sudo- 1.6.3p6.tar.gz.Later versions will function in this example. Figure 2.16 Downloading Sudo
- Download the tarball to any directory you choose.Unlike Bastille,you are not required to run the program in the root directory only.Sudo has been downloaded to the /root directory for this example. www.syngress.com
138_linux_02 6/20/01 9:34 AM Page 82 82 Chapter 2 • Hardening the Operating System Installing Sudo To install sudo,you must first download the specific sudo tarball.After download, locate the directory where you downloaded sudo and follow these steps:
- Access the directory where you downloaded sudo,and decompress the tar file (your sudo version number will vary depending on the version of sudo that you downloaded) by entering: tar –zxvf sudo-1.6.3p6.tar.gz
- A directory will be created,such as sudo-1.6.3p6.
- Access the sudo directory by entering: cd sudo-1.6.3p6
- To creates a makefile and config.h file that will allow you to configure sudo,enter: ./configure
- You can add options to the ./configure command to customize your sudo installation.Simply append the options listed in Table 2.9 to your ./configure command.The entire list of options is available in the /sudo/INSTALL file. Table 2.9 Sudo ./configure Options Default Option Description (if applicable) --bindir=DIR Sudo installed in DIR. EPREFIX/bin --sbindir=DIR Visudo installed in DIR. EPREFIX/sbin --sysconfdir=DIR Sudoers file installed in DIR. /etc --mandir=DIR Man pages installed in DIR. PREFIX/man --with-skey Support S/Key One Time n/a Password (OTP). --with-SecurID=DIR Support SecurID. DIR is the n/a directory where sdiclient.a, sdi_athd.h, sdconf.h, and sdacmvls.h will be located. Continued www.syngress.com
138_linux_02 6/20/01 9:34 AM Page 83 Hardening the Operating System • Chapter 2 83 Table 2.9 Continued Default Option Description (if applicable) --with-fwtk=DIR Support TIS Firewall Toolkit n/a (FWTK) ‘authsrv’. DIR is the base directory where the compiled FWTK package will be located. --with-kerb4 Support Kerberos v4. n/a Cygnus Network Security (CNS) is the only tested package. --with-kerb5 Support Kerberos v5. For n/a authentication, Kerberos passphrases are used, not the Kerberos cookie scheme. MIT Kerberos V, release 1.1 (will not work with versions earlier than 1.1) is the only test package, but CNS should also work. --disable-shadow Disable shadow passwords. Supported. Shadow password used if it exists. --with-sudoers-uid Defines the UID (User ID) 0 that owns the sudoers file. Actually configured in the makefile. --with-sudoers-gid Defines the GUI (Group ID) n/a that owns the sudoers file. Actually configured in the makefile. --without-passwd Disables authentication n/a using the passwd or shadow file. Do not disable this authentication method unless you are using another authentication method. Continued www.syngress.com
138_linux_02 6/20/01 9:34 AM Page 84 84 Chapter 2 • Hardening the Operating System Table 2.9 Continued Default Option Description (if applicable) --with-logging=TYPE Defines logging method. syslog The types include syslog, file, or both. syslog allows centralized logging and is recommended. --with-logpath=PATH Defines the location of the Default is /var/log/ sudo log file. sudo. If your system does not have this directory, it defaults to /var/adm/sudo .log or /usr/adm/ sudo.log. --with-mailto Defines the user account root that sudo mail will be sent. Mail usually indicates an alert. --with-mailsubject Defines the subject of the “*** SECURITY sudo mail. information for hostname***” --with-runas-default=USER Defines the default user for root the sudo command. By default, sudo gives root privileges if the –u flag is not specified. --with-passwd-tries=TRIES Defines the number of Three tries password attempts given to a user. --with-timeout=MINUTES Defines the number of min- Five minutes. utes before another sudo Configure minutes password is required to zero and sudo will always request a password. --with-password- Defines the number of min- Five minutes. timeout=MINUTES utes that sudo waits before Configure minutes the sudo password prompt to zero for no pass- times out. word timeout. Continued www.syngress.com
138_linux_02 6/20/01 9:34 AM Page 85 Hardening the Operating System • Chapter 2 85 Table 2.9 Continued Default Option Description (if applicable) --with-editor=PATH Defines the default editor vi system path path used by visudo. You can also list several editors in a colon-separated list. visudo checks the USER environment variable and selects the defined one. It can also select the first editor that is installed on the list. 6. You can also edit makefile to change the default paths for installation,as well as the other configurations listed in Table 2.8.If you require this change,open makefile in a text editor.For example,enter: vi Makefile 7. Locate the “Where to install things...”section of makefile,as shown in Figure 2.17. Figure 2.17 Sudo Makefile www.syngress.com
138_linux_02 6/20/01 9:34 AM Page 86 86 Chapter 2 • Hardening the Operating System 8. Change the default paths if necessary.For this example,we recommend that you use the default paths. 9. Quit the file.If you use the vi text editor,enter: :q 10. (Optional) You can also change the default installation paths when you run the ./configure command (you ran the configure command in a previous step).To do this,enter an option after the command.For example,by default the sudoers file is installed in the /etc directory.You can change this location by entering: ./configure --sysconfdir=DIR where DIR is the new installation directory. 11. To compile sudo,run the make command by entering: make 12. (Optional) You will probably need GNU if you install sudo in a direc- tory other than the source file directory.If you have errors during instal- lation,read the TROUBLESHOOTING and PORTING files. 13. To install sudo,you must be the root user.Run the make install com- mand to install the man pages,visudo,and a basic sudoers file by entering: make install NOTE Any existing sudoers file will not be overwritten. 14. You have installed sudo.The next section explains how to configure it to suit your system’s needs. Configuring Sudo To configure sudo,you must edit the %/sudo-1.6.3p6/sudoers file.The sudoers file defines which users are allowed to execute what commands.Only the root user is www.syngress.com
138_linux_02 6/20/01 9:34 AM Page 87 Hardening the Operating System • Chapter 2 87 allowed to edit the file,and it must be edited with the visudo command.A sample.sudoers file is included in the sudo directory,and is shown in Figure 2.18. Figure 2.18 Sample.Sudoers File The visudo command opens the sudoers file,by default,in the vi text editor. The vi commands are used to edit and write the file.You can change the default text editor used by visudo using the compile time option.Visudo uses the EDITOR environment variable.The visudo command performs the following tasks when editing the sudoers file: (cid:2) Checks for parse errors Visudo will not save any changes if a syntax error exists.It will state the line number of the error and prompt you for guidance.You will be offered a “What Now?”prompt and three choices: “e”to re-edit the file,“x”to exit without saving,and “Q”to quit and save changes.A syntax error result is shown in Figure 2.19. NOTE If a syntax error exists in the sudoers file and you choose Q to quit and save the visudo changes, sudo will not run until the problem is corrected. You must run visudo again, fix the problem, and save the file again. It is recommended that you select e to attempt to fix the problem, or x to exit without saving (if you are not sure of what went wrong). www.syngress.com
138_linux_02 6/20/01 9:34 AM Page 88 88 Chapter 2 • Hardening the Operating System (cid:2) Prevents multiple edits to the file simultaneously If you attempt to run visudo while the sudoers file is being edited,you will receive an error message informing you to try again at a later time. Figure 2.19 Visudo Parse Error The sudoers file consists of two different types of entries,user specifications and aliases.The following examples show you how to use user specifications,which define which user is allowed to run what commands.Aliases are basically variables. The sudoers file contains a root entry.The default sudoers file is shown in Figure 2.20.The user privilege specification is listed as: root ALL=(ALL) ALL This configuration allows the root user to issue all commands. Figure 2.20 Default Sudoers File Allowing the Root User Access to All Commands To allow other users to run commands as root,you must enter those users in the sudoers file.You must also list the host on which they are allowed to run the commands.Last,you must list the specific commands that those users are allowed to run as root.In the following steps,you will create user bob and allow him to run several commands as root using sudo on your system. www.syngress.com
138_linux_02 6/20/01 9:34 AM Page 89 Hardening the Operating System • Chapter 2 89
- Open the sudoers file by entering: visudo
- The sudoers file opens in vi.Locate the “User privilege specification” section.After the root entry,enter the following (press i to insert text): bob your-hostname = /sbin/ifconfig, /bin/kill, /bin/ls This line allows user bob to run the ifconfig,kill,and ls commands as root.Your screen should resemble Figure 2.21 (except the host name). Figure 2.21 User Privilege Specification in Sudoers File
- Press ESC to write and quit the file.Then,enter: :wq This command writes and quits the file using vi.
- Now you must create user bob.Enter: useradd bob
- Create a password for user bob by entering: passwd bob Changing password for user bob New UNIX password: Retype new UNIX password: passwd: all authentication tokens updated successfully www.syngress.com
138_linux_02 6/20/01 9:34 AM Page 90 90 Chapter 2 • Hardening the Operating System NOTE By default, all commands you list in sudoers will run as root unless you specify otherwise. For example, bob could run commands as user bugman if desired. You would enter: bob your-hostname = (bugman) /sbin/ifconfig In this case, the ifconfig command will run as user bugman. You can allow bob to enter commands as several different users. bob your-hostname = (bugman) /sbin/ifconfig, (root) /bin/kill, /bin/ls The kill and ls commands will run as root, while the ifconfig com- mand runs as bugman. At the command line, bob will enter: sudo –u bugman /sbin/ifconfig Running Sudo You have configured sudo to allow user bob root privileges for the ifconfig,kill, and ls commands.When bob wants to run these commands,he must first enter the sudo command,and then his password.
- Log on as user bob.
- To find out what commands bob has root access to,enter the following: sudo –l
- If this is your first time running sudo as user bob,a warning will display: We trust you have received the usual lecture from the local System Administrator. It usually boils down to these two things: #1) Respect the privacy of others. #2) Think before you type
- A password prompt appears.Do not enter the root password.Enter bob’s password. Password: www.syngress.com
138_linux_02 6/20/01 9:34 AM Page 91 Hardening the Operating System • Chapter 2 91 5. The commands that bob is allowed to run on this host are listed,as shown in Figure 2.22. Figure 2.22 Commands That User bob Can Run as Root 6. To test your sudo configurations,run an ifconfig option that requires root permission without using sudo.Enter: /sbin/ifconfig eth0 down Permission is denied because bob is not allowed to deactivate the system’s interface. 7. To deactivate the interface,bob must use sudo.Enter: sudo /sbin/ifconfig eth0 down You will be successful.Please note that sudo will ask for the bob’s password if bob’s ticket has expired (the default is five minutes).If you run this command within five minutes from the last,you will not be prompted for a password. 8. Reactivate the interface.Enter: sudo /sbin/ifconfig eth0 up 9. Next,restart one of the httpd processes using the kill command by entering: ps aux | grep httpd 10. Choose an Apache PID from the list that appears.(If Apache is not installed,select a different service process to restart.) Enter: kill –HUP [PID NUMBER] www.syngress.com
138_linux_02 6/20/01 9:34 AM Page 92 92 Chapter 2 • Hardening the Operating System 11. You are not allowed to restart the httpd process because you are not root.You will receive the following result: bash: kill: (PID NUMBER) – Not owner 12. Instead,use sudo to run the command as root by entering: sudo kill –HUP (PID NUMBER) You should be successful. 13. Next,you will list the root user directory as user bob using the ls com- mand.Enter: ls /root Permission is denied because you are not root. 14. Again,use sudo to run the command as root: sudo ls /root Permission is granted and the root user’s directory is displayed. 15. To expire bob’s timestamp,enter the command sudo -k. Bob will have to enter a password the next time he uses sudo. No Password In some situations,entering a password each time sudo is run is redundant because the user has already logged on to the system.Sudo offers a way around this monotonous task by using the NOPASSWD tag in the sudoers file.
- To remove the password requirement in the sudoers file,log on as root and enter: visudo
- The sudoers file opens in vi.Modify bob’s user privilege specification to match the following (press i to insert text): bob your-hostname = NOPASSWD: /sbin/ifconfig, /bin/kill, /bin/ls
- Press ESC.Enter :wq to write and quit the file.
- Log on as bob.Deactivate the interface using sudo: sudo /sbin/ifconfig eth0 down www.syngress.com
138_linux_02 6/20/01 9:34 AM Page 93 Hardening the Operating System • Chapter 2 93 You will not be prompted for your password and the command will run as root. 5. Reactivate the interface.Enter: sudo /sbin/ifconfig eth0 up Sudo Logging As mentioned previously,sudo logs which users run what commands.Logging does not occur automatically.You must set up sudo and syslogd to log commands. This involves two steps.First,you must create a sudo logfile in /var/log.Second, you must configure syslog.conf to log sudo commands.The following steps show you how to configure sudo logging.
- Log on as root.Create a sudo log file in /var/log/.Enter: touch /var/log/sudo
- Next,you must add a line in the syslog.conf file to direct logging to your sudo logging file.Open syslog.conf by entering the following: vi /etc/syslog.conf
- Enter the following line at the end of the syslog.conf file (press i to insert text).If you installed Bastille earlier in this lesson,insert the line before or after the Bastille insert.The white space must be created using the TAB key,not the SPACEBAR. local2.debug /var/log/sudo
- This syslog.conf entry logs all successful and unsuccessful sudo com- mands to the /var/log/sudo file.You can also log to a network host by indicating the network host instead of a local directory.The syslog.conf file is shown in Figure 2.23.
- Press ESC to write and quit the file.Then,enter: :wq
- Since you have modified the syslog.conf file,you need to restart syslogd. To send a HUP signal to syslogd,you must first know the syslogd pro- cess identifier (PID).To identify the syslogd PID,enter: ps aux | grep syslogd www.syngress.com
138_linux_02 6/20/01 9:34 AM Page 94 94 Chapter 2 • Hardening the Operating System Figure 2.23 Editing the Syslog.conf File for Sudo Logging 7. The second column lists the PID number.The last column lists the pro- cess using that PID.To restart syslogd,identify the PID number and enter: kill –HUP [PID NUMBER] 8. First,you will generate log entries for user bob.Log on as user bob. 9. Enter the following ifconfig commands while logged on as user bob: sudo –l sudo /sbin/ifconfig eth0 down sudo /sbin/ifconfig eth0 up 10. Restart one of the httpd processes (or another process) using the kill command by entering: ps aux | grep httpd 11. Choose an Apache (httpd) PID from the list that appears.Enter: sudo kill –HUP [PID NUMBER] 12. Now list the root user directory as user bob.Enter: sudo ls /root www.syngress.com
138_linux_02 6/20/01 9:34 AM Page 95 Hardening the Operating System • Chapter 2 95 13. Log on as root and view the sudo log file.All the sudo commands that bob entered are listed,as shown in Figure 2.24. Figure 2.24 Sudo Log File Displaying User bob’s Commands 14. You can log any root commands by simply typing sudo before each command.For example,make sure that you are logged on as root and enter the following commands (or any commands you choose): sudo useradd susan sudo passwd susan sudo vi /hosts 15. Access and view the sudo log file by entering: sudo cat /var/log/sudo All root user entries are logged,including the cat command you just entered,as shown in Figure 2.25. Figure 2.25 Sudo Log File Displaying Root User Commands www.syngress.com
138_linux_02 6/20/01 9:34 AM Page 96 96 Chapter 2 • Hardening the Operating System As you can see,sudo is extremely helpful for controlling and auditing root access.It allows a system administrator to distribute root system tasks without dis- tributing the root password.An administrator can control what root access is needed for each user,and can customize system access based on those needs. Sudo is used almost entirely by system administrators,and is a great way to train new system administrators.New administrators can be given a new account with only selected root privileges.The master administrator can then review the work of the administrator in training. This section discussed one of the many ways to use sudo;it focused primarily on user specifications in the sudoers file.For more information on extending sudo,such as using aliases,please consult the sudoers man file. Managing Your Log Files Another aspect of system security is managing your log files.By default,Linux offer modest logging so that administrators can see who and what has accessed their system.More logging is available (both more detail and logging on more services),but Linux keeps it brief so that you don’t fill your hard disk with log information.This section briefly discusses helpful commands and programs that provide access to system logs. Linux offers commands that allow administrators to access useful log files. Two commands of interest are last and lastlog.The message file also offers useful data for determining possible security breaches on your system. The last command displays data such as who is logged on to the system,who recently logged on,and when the system has rebooted.For example,you may receive data such as the following: root tty1 Fri May 25 13:53 still logged on frank pts/0 209.113.84.112 Fri May 25 12:13 – 14:36 (02:22) reboot system boot 2.2.12-20 Fri May 25 12:06 (04:18) The lastlog command displays the users and services that have accounts on your machine.It lists the last time each account logged in to the system,or if the account has ever logged in.Each service in Linux is given an account.This is very helpful because if a service logged in without your knowledge,a hacker may be responsible.This would indicate that the hacker controls your system and is currently exploiting it.It could also mean that another administrator started the service without telling you. www.syngress.com
138_linux_02 6/20/01 9:34 AM Page 97 Hardening the Operating System • Chapter 2 97 The messages file is a log file that displays a list of recent activity on the system.For example,it lists if a password was changed and who changed it.It identifies when a user session opens and closes.It also lists the time and data each event took place.It can be viewed by entering the following command: tail /var/log/messages If you prefer a GUI to view your log files,a program called SWATCH (not installed by default) allows an instant and real-time display for various log files.It can view any log files you specify and is discussed in the next section. The Linux logs should be checked frequently to determine if any security violations have occurred on your system.Logs do not offer solutions,so you must analyze the data and decide how to counteract the attack. Using Logging Enhancers Logging enhancers are tools that simplify logging by allowing logging informa- tion to be filtered and often displaying logs in simplified formats.Many open source logging programs exist to make system administration much easier. Viewing text-based files with hundreds or thousands of entries can be burden- some,especially if you are only looking for one specific error entry.Logging enhancers can make logging a much more user-friendly experience,and greatly expand and customize the information you need to log. The next sections explain three popular logging services used by administra- tors:SWATCH,scanlogd,and the next generation of syslogd (syslogd-ng). SWATCH Simple WATCHer or Simple WATCHdog (SWATCH) is an open source package that allows administrators to efficiently monitor system activity.It can monitor events on a system,or a large number of systems,by monitoring system logs for specified events.SWATCH’S main function is to monitor messages actively as they are written to a log files through the Unix syslog utility. SWATCH requires Perl 5 to function. SWATCH is efficient because it allows administrators to modify the SWATCH configuration file (/etc/swatchrc) to filter logging entries and respond to certain events.For example,SWATCH can monitor the system for bad login attempts,and e-mail the administrator whenever this failed authentication event occurs.It can monitor and alter when system halts and reboots occur,when a user upgrades to root using the su command,when the file system is full,and www.syngress.com
138_linux_02 6/20/01 9:34 AM Page 98 98 Chapter 2 • Hardening the Operating System when someone is sniffing the system.It can monitor anything desired from the log files. To learn about SWATCH and download the program,you need to visit the SWATCH home page (Figure 2.26) at www.stanford.edu/~atkins/swatch or at www.engr.ucsb.edu/~eta/swatch.This RPM is also available on the accompa- nying CD (swatch-3.064-1.noarch.rpm). Figure 2.26 SWATCH Home Page NOTE At the time of this writing, version 3 of SWATCH was available for down- load. It has a different configuration file format than previous versions, and much of the code has been rewritten to take advantage of Perl 5. If you use previous configuration files, you must use the --old-style-config switch during configuration. SWATCH uses two required fields:pattern(s) and action(s). (cid:2) Patterns The SWATCH configuration file looks for patterns in logging entries.For example,bad login attempts display a “Failed Authentication” error. www.syngress.com
138_linux_02 6/20/01 9:34 AM Page 99 Hardening the Operating System • Chapter 2 99 (cid:2) Actions Whenever a pattern is discovered,SWATCH seeks an action, such as e-mailing the administrator of the failed login attempt. Two optional fields are used to further customize the configuration file: (cid:2) Throttle Throttle determines the amount of time that SWATCH will ignore repeated logged entries before listing the entry again.This saves administrators time from viewing 300 identical “Failed Authentication” errors.However,a secure system should limit the number of login attempts.The throttle entry is defined as HH:MM:SS,where H repre- sents hours,M represents minutes,and S represents seconds. (cid:2) Timestamp Timestamp defines the length and location of the time- stamp.The timestamp entry is defined as start:length. The following are two examples from the SWATCH configuration file. SWATCH will actively watch for these messages as they are written to their respective log files through the syslog utility.The first example monitors logging for failed login attempts and e-mails root when a failed login attempt occurs. #Failed login attempts watchfor /failed/ echo bold mail addresses=root,subject=Failed Authentication The second example monitors your log files and e-mails root when a user sued to gain root access. #Users sued to gain root access watchfor /su:/ echo bold mail addresses=root,subject=User sued to root SWATCH filters logging files so that administrators only receive the informa- tion they require.It saves a lot of time and trouble once configured and is recom- mended for system administrators who are overwhelmed by log files (and perhaps do not use them for that reason).To download an RPM version of SWATCH, visit www.rpmfind.net. www.syngress.com
138_linux_02 6/20/01 9:34 AM Page 100 100 Chapter 2 • Hardening the Operating System Scanlogd Scanlogd is an open source program that detects and logs TCP-port scanning on a system.For example,it can detect nmap scans.Nmap is a program used by hackers to create a “map”of your network.It is often the first step a hacker takes once he or she has access to your network to determine which system to hack.Nmap lists the systems and the services on the network.Scanlogd can alert an administrator when the network is being mapped,but it cannot stop the intrusion. SECURITY ALERT! Scanlogd was originally designed to illustrate attacks, not to fix them. Therefore, even though it is safe to run on your system, it does not pre- vent hacking attacks. You must read the system log to discover what happened to your system, and then determine the appropriate solution. Scanlogd writes one line per scan using the syslog(3) mechanism.It also logs when a source address sends many packets to several different ports in a short amount of time.You can learn about scanlogd and download the program at www.openwall.com/scanlogd.The scanlogd home page is shown in Figure 2.27. Figure 2.27 Scanlogd Home Page www.syngress.com
138_linux_02 6/20/01 9:34 AM Page 101 Hardening the Operating System • Chapter 2 101 Because scanlogd is only meant to detect scans,it is totally safe to run on your system.It must have access to raw IP packets to function,and can capture packets coming in and out of the system interface,or across the network to which the system is attached.In addition,scanlogd v2 supports the raw socket interface on libnids,libpcap,and Linux. Syslogd-ng Syslogd-ng is a logging daemon that is the replacement for the traditional syslogd. The “ng”is an acronym for “next generation.”The original syslogd was the gen- eral Unix logging daemon that handled requests for syslog services,but was diffi- cult to configure.Syslogd-ng is easier to configure and offers additional logging features,such as more configurations.For example,syslogd-ng allows administra- tors to filter messages based on priority,as well as the content of the messages. You can also forward logs on TCP,sort logs to different destinations,and create a direct log stream to various hosts.It will eventually support log files that are pro- tected with hash encryption.The syslog-ng home page is shown in Figure 2.28 and is located at www.balabit.hu/en/products/syslog-ng. Figure 2.28 Syslog-ng Home Page The basic problem with system logs is that they contain a lot of unimportant information.This information is often called noise.Many events are lost because www.syngress.com
138_linux_02 6/20/01 9:34 AM Page 102 102 Chapter 2 • Hardening the Operating System they are buried in the noise.Syslogd made it difficult to choose only the important messages. The reason this occurs is that messages are sent to different destinations depending on the assigned facility/priority pair.These destinations are very broad,and include general facilities such as mail,news,auth,and so forth,and priorities ranging from alert to debug.Many programs use the facilities,so many unneeded messages are written to their logs.In many cases,the message and the facility are not even related.Syslogd-ng filters messages based on message content in addition to the facility/priority pair.Using this method,only the messages that are needed are logged. Syslogd-ng has been tested on Linux,BSDi,and Solaris.At the time of this writing,the latest stable version was 1.4.10.You can learn more about syslog-ng and download it from the Balabit site at www.balabit.hu/en/products/syslog-ng/ downloads.The site also contains information on installing and configuring the service. www.syngress.com
138_linux_02 6/20/01 9:34 AM Page 103 Hardening the Operating System • Chapter 2 103 Summary This chapter covered the basics of hardening a server to avoid security vulnerabil- ities using Linux.The main sections covered disabling unnecessary services, locking down ports,Bastille,sudo,and logging enhancers. It is extremely important to install the latest service pack or updates to the operating system,which fix many security vulnerabilities and bugs before you install any programs.Many services provided with operating systems are not required and can be removed.The key to remember is that the fewer services running,the less potential vulnerability.TCP/UDP ports were covered in this chapter,and how each port is used by specific services.If you block ports on your server,you block the services that use those ports.Locking down ports is an excellent way to reduce exploitations of your system. Maintaining your server involves downloading service packs and updates,and requires regularly installing bug fixes,security patches,and software updates.These items are available through the operating system vendors,as well as the specific vendors that created the software that you implement. Bastille is an open source program that facilitates the hardening of a Linux system.It performs many of the tasks listed previously,including downloading operating system updates and disabling services and ports that are not required for the system’s job functions.Bastille is powerful and can save administrators time from configuring each individual file and program throughout the operating system.Instead,administrators answer a series of “Yes”and “No”questions through an interactive text-based interface.The program automatically imple- ments the administrators’preferences based on the answers to the questions. Superuser Do (sudo) is an open source security tool that allows an adminis- trator to give specific users or groups the ability to run certain commands as root or as another user.The program can also log commands and arguments entered by specified system users.The developers of sudo state that the basic philosophy (www.courtesan.com/sudo/readme.html) of the program is to “give as few privi- leges as possible,but still allow people to get their work done.” Logging enhancers are tools that simplify logging by allowing logging infor- mation to be filtered and often displaying logs in simplified formats.Many open source logging programs exist to make system administration easier.You were introduced in this chapter to SWATCH,scanlogd,and syslog-ng. SWATCH is an open source package that allows administrators to efficiently monitor system activity.It can monitor events on a system,or a large number of systems,by monitoring system logs for specified events.SWATCH’s main function www.syngress.com
138_linux_02 6/20/01 9:34 AM Page 104 104 Chapter 2 • Hardening the Operating System is to monitor messages actively as they are written to log files through the Unix syslog utility. Scanlogd is an open source program that detects and logs TCP-port scanning on a system.Scanlogd can alert an administrator when the network is being mapped,but it cannot stop the intrusion. Syslogd-ng is a logging daemon that is the replacement for the traditional syslogd.The “ng”is an acronym for “next generation.”The original syslogd was the general Unix logging daemon that handled request for syslog services,but was difficult to configure.Syslogd-ng is easier to configure and offers additional logging features,such as more configurations.For example,syslogd-ng allows administrators to filter messages based on priority,as well as the content of the messages. Solutions Fast Track Updating the Operating Systems (cid:59) Operating system releases usually contain software bugs and security vulnerabilities. (cid:59) Operating system vendors or organizations offer fixes,corrections,and updates to the system.For example,Red Hat offers this material at its Web site,which includes Update Service Packages and the Red Hat Network. (cid:59) You should always ensure your system has the latest necessary upgrades. Many errata and Update Service Packages are not required for every system.You should always read the associated documentation to deter- mine if you need to install it. Handling Maintenance Issues (cid:59) After your system goes live,you must always maintain it by making sure the most current patches and errata are installed,which include the fixes, corrections,and updates to the system,as well as the applications run- ning on it. (cid:59) You should always check the Red Hat site at www.redhat.com/apps/ support/updates.html for the latest errata news. www.syngress.com
138_linux_02 6/20/01 9:34 AM Page 105 Hardening the Operating System • Chapter 2 105 (cid:59) For example,Red Hat security advisories provide updates that eliminate security vulnerabilities on the system.Red Hat recommends that all administrators download and install the security upgrades to avoid denial-of-service (DoS) and intrusion attacks that can result from these weaknesses. Manually Disabling Unnecessary Services and Ports (cid:59) You should always disable vulnerable services and ports on your system that are not used.You are removing risk when you remove unnecessary services. (cid:59) The /etc/xinetd.d directory makes it simple to disable services that your system is not using.For example,you can disable the FTP and Telnet services by commenting out the FTP and Telnet entries in the respective file and restarting the service.If the service is commented out,it will not restart. Locking Down Ports (cid:59) When determining which ports to block on your server,you must first determine which services you require.In most cases,block all ports that are not exclusively required by these services. (cid:59) To block TCP/UDP services in Linux,you must disable the service that uses the specific port. Hardening the System with Bastille (cid:59) The Bastille program facilitates the hardening of a Linux system.It saves administrators time from configuring each individual file and program throughout the operating system. (cid:59) Administrators answer a series of “Yes”and “No”questions through an interactive text-based interface.The program automatically implements the administrators’preferences based on the answers to the questions. www.syngress.com
138_linux_02 6/20/01 9:34 AM Page 106 106 Chapter 2 • Hardening the Operating System (cid:59) Bastille can download and install RPM updates,apply restrictive permis- sions on administrator utilities,disable unnecessary services and ports, and much more. Controlling and Auditing Root Access with Sudo (cid:59) Sudo (Superuser Do) allows an administrator to give specific users or groups the ability to run certain commands as root or as another user. (cid:59) Sudo features command logging,command restrictions,centralized administration of multiple systems,and much more. (cid:59) The sudo command is used to execute a command as a superuser or another user.In order to use the sudo command,the user must supply a username and password.If a user attempts to run the command via sudo and that user is not entered in the sudoers file,an e-mail is automatically sent to the administrator,indicating that an unauthorized user is accessing the system. Managing Your Log Files (cid:59) Logging allows administrators to see who and what has accessed their system.Many helpful Linux log files are located in the /var/log directory. (cid:59) Linux offers commands that allow administrators to access useful log files.Two commands of interest are last and lastlog.The message file also offers useful data for determining possible security breaches on your system. (cid:59) The Linux logs should be checked frequently to determine if any secu- rity violations have occurred on your system.Logs do not offer solu- tions,so you must analyze the data and decide how to counteract the attack. Using Logging Enhancers (cid:59) Logging enhancers are tools that simplify logging by allowing logging information to be filtered and often displaying logs in simplified formats. www.syngress.com
138_linux_02 6/20/01 9:34 AM Page 107 Hardening the Operating System • Chapter 2 107 (cid:59) Viewing text-based files with hundreds or thousands of entries can be burdensome,especially if you are only looking for one specific error entry. (cid:59) Three popular logging services used by administrators are SWATCH, scanlogd,and the next generation of syslogd (syslogd-ng). Frequently Asked Questions The following Frequently Asked Questions, answered by the authors of this book, are designed to both measure your understanding of the concepts presented in this chapter and to assist you with real-life implementation of these concepts. To have your questions about this chapter answered by the author, browse to www.syngress.com/solutions and click on the “Ask the Author” form. Q: I have a server that is strictly a mail server and uses SMTP and POP3. However,I want to download security patches from my vendor’s Web site directly to the server.Even though I open the TCP/UDP port 80 (HTTP) and port 53 (DNS),I am unable to download the patches on the mail server. A: If security is a priority,you should order update CDs through your vendor, such Red Hat’s Update Service Packages,and install them via your CD drive. You can also simply download your updates from another system on your network. Q: Should I place my e-mail server behind the firewall,or in a service network (that is,a “demilitarized zone”)? A: Standard practice is to place the e-mail server in the DMZ.A DMZ is usually comprised of a screening router that blocks most attacks (denial-of-service, system scanning,attacks against Microsoft NetBIOS ports,etc.),and a firewall device that authoritatively blocks incoming traffic,effectively separating the internal network from the world.The DMZ exists between the screening router and the firewall.However,it is often a best practice to place the e-mail server behind the firewall itself.If you do this,however,you must make sure your firewall is configured correctly.Otherwise,a malicious user can take advantage of a misconfigured firewall and gain access to your internal network. www.syngress.com
138_linux_02 6/20/01 9:34 AM Page 108 108 Chapter 2 • Hardening the Operating System Q:When I install Bastille and run configure,why does the program report that the C compiler cannot create an executable? A:This error most likely indicates that your system does not have a functioning compiler.If often occurs because you do not have a license,or part of the compiler suite cannot be located.Access and view the config.log to deter- mine the cause.Many compiler components are found in /usr/css/bin.This path may not be identified in the environment variable PATH. Q: By default,sudo uses syslog(3) for logging.Since I did not change this default during setup,why am I not generating any logging messages? A: In order to generate sudo log files,you need to create a /var/log/sudo file, and add an entry to the syslog.conf file.Since the default log facility is local2, you must add the following line with TAB keys separating the facility (local2.debug) from the destination (a local logging file). local2.debug /var/log/sudo You must then restart syslogd to ensure that it re-reads the file. Q: I am tired of entering my password in sudo each time my ticket expires. How can I avoid this hassle? A: Use the NOPASSWD tag in sudoers for specific users and commands by inserting the tag before the command list.If you want to disable all sudo pass- words,there are two methods.You can run configure with the --without- passwd option,or you can add !authenticate to the Default line in sudoers. Finally,you can disable passwords to users and hosts in sudoers by adding spe- cific user or host Defaults entries.See the sudo man file for specifics on dis- abling sudo password prompts. www.syngress.com
138_linux_03 6/20/01 9:35 AM Page 109 Chapter 3 System Scanning and Probing Solutions in this chapter: (cid:2) Scanning for Viruses Using the AntiVir Antivirus Application (cid:2) Scanning Systems for DDoS Attack Software Using a Zombie Zapper (cid:2) Scanning System Ports Using the Gnome Service Scan Port Scanner (cid:2) Using Nmap (cid:2) Using Nmapfe as a Graphical Front End (cid:2) Using Remote Nmap as a Central Scanning Device (cid:2) Deploying Cheops to Monitor Your Network (cid:2) Deploying Nessus to Test Daemon Security (cid:59) Summary (cid:59) Solutions Fast Track (cid:59) Frequently Asked Questions 109
138_linux_03 6/20/01 9:35 AM Page 110 110 Chapter 3 • System Scanning and Probing Introduction You now have hardened your system using open source tools.Changes are con- stantly made to production systems.In addition,malicious users are constantly discovering and exploiting new weaknesses.This chapter discusses ways to scan your systems for weaknesses that may already exist or may develop.You will learn how to scan your hard drive,and then scour running processes to determine if any problems exist. Finally,you will learn how to deploy the Nessus scanner to test for common server weaknesses.By the end of this chapter,you will have a system that is rea- sonably secure,and can actually test additional servers for vulnerabilities. Scanning for Viruses Using the AntiVir Antivirus Application The AntiVir for Servers binary is a truly impressive command-line virus scanner sold by H+BDEV.It is capable of searching for the latest Linux viruses,and once you purchase the product,you can obtain daily virus definition updates.Although AntiVir is not part of the GNU GPL,it is nevertheless free to use.You can obtain AntiVir from either of the following locations: (cid:2) www.hbedv.com The main distribution site. (cid:2) www.freshmeat.net This site has only information about the daemon and links to the AntiVir site. Understanding Linux Viruses You may be thinking to yourself,“Come on,who ever heard of a Linux virus?” It is true that Linux viruses are far less common than those in the Windows world are,but in fact,Linux viruses are becoming increasingly common. For example,the Linux/Bliss virus (also known as the “Bliss”or simply as the “Linux virus,”can infect standard Linux Executable and Linking Format (ELF) binaries.It can also spread to other systems all by itself,which means that it is acts like a worm,a program that can replicate itself from system to system without any user intervention.Understand,however,that the way this virus replicates itself is by searching for /etc/hosts.equiv files and then exploiting them.If you have deployed Bastille,you likely will not have any problem. www.syngress.com
138_linux_03 6/20/01 9:35 AM Page 111 System Scanning and Probing • Chapter 3 111 NOTE Executable and Linking Format (ELF) is a binary executable file format standardized by commercial Unix systems and adopted by Linux. In Linux, executable files are called ELF-style files. Other link formats that may be supported by your kernel include common object file format (COFF) and the now deprecated a.out format. This virus can actually replace the ELF binaries that allow write access with its own binaries.When the hapless user (or system) tries to execute these infected binaries,it will not be able to do so.Consequently,elements of the system will crash.Additional viruses and Trojans exist,including Loadable Kernel Module (LKM) root kits.LKM root kits work by installing hidden Linux modules and replacing legitimate applications with those designed to ignore Trojan processes. Your updated version of AntiVir should capture many of these Trojans.LKM- based root kits such as Adore (available at various sites,including http://packet- storm.securify.com) are particularly powerful and difficult to find,however.In many cases,a system reinstall is necessary to ensure that the compromised system is again secure. Linux viruses do exist,and the very presence of Linux viruses and virus scan- ners such as AntiVir and others suggests that Linux could stand to do some more maturing as a product.However,management can now take Linux seriously,now that you can answer “yes”to the question,“Can you protect this system against viruses?”After all,what good manager would really believe that your Linux system is magically impervious to virus attacks? For example,AntiVir will find (and,if so ordered,delete) the following virus types: (cid:2) Macro viruses Viruses that exist in complex documents,such as Word and StarOffice files. (cid:2) Boot sector viruses Small programs that infect system initialization files (that is,the files that the system uses to boot up). (cid:2) E-mail viruses AntiVir scans for all of the latest e-mail viruses, including the Anna Kournikova virus. (cid:2) Distributed denial-of-service (DDoS) daemons AntiVir scans for DDoS daemons,such as Tribe Flood Network 2000. www.syngress.com
138_linux_03 6/20/01 9:35 AM Page 112 112 Chapter 3 • System Scanning and Probing You can learn more about the currently available antivirus products at www.cn.is.fh-furtwangen.de/~link/security/av-linux_e.txt.As of this writing, the Packetstorm site has an extensive collection of antivirus applications at http://packetstorm.securify.com/viral-db/avp-linux. Using AntiVir As with any other virus scanner,AntiVir can do the following: (cid:2) Check the system’s boot record. (cid:2) Search directories and subdirectories. (cid:2) Automatically delete infected files. (cid:2) Save scans into a log file. (cid:2) Use an internal scheduler,or an external scheduler,such as at or cron. (cid:2) Scan NFS-mounted drives. (cid:2) Delete infected files. (cid:2) Move infected files to a central “quarantine”area of your own choosing. AntiVir scans the files you specify using its virus definition file,which is located at /usr/lib/AntiVir/antivir.vdf.Run without arguments,AntiVir will scan only the current directory.For a more extensive scan,you must specify arguments to change this default behavior.For example,to have AntiVir scan the /var/log/ directory,you would have to issue the following command: antivir /var/log -s -allfiles -s -nolnk -r4 You can review all of the command-line options by issuing the antivir -h command,which is handy when you have forgotten exactly how to use the pro- gram.Figure 3.1 shows all of the command-line options available to you. Table 3.1 lists some of the more relevant arguments to AntiVir. Table 3.1 AntiVir Options Argument Description -allfiles Scans all files in the directory. -z Scans archived files. -onefs Scans only locally mounted drives (does not scan NFS-mounted drives). Continued www.syngress.com
138_linux_03 6/20/01 9:35 AM Page 113 System Scanning and Probing • Chapter 3 113 Table 3.1 Continued Argument Description -del Removes infected files. -r4 Places AntiVir into verbose mode, which means that you will be able to see extensive output. If you choose to save logs of the scan, your logs will also contain this information. -ro Overwrites the existing log file. -ra Appends new scan information to the existing log file. -rf Allows you to specify the location and name of the log file (e.g., /root/antivirlog.txt). -s Recursively scans all subdirectories. Figure 3.1 Command-Line Arguments www.syngress.com
138_linux_03 6/20/01 9:35 AM Page 114 114 Chapter 3 • System Scanning and Probing Key Mode and Non-Key Mode AntiVir is sold by a for-profit company,and it gives you some licensing options when running the program.First,you can run the program without any license at all.This will place the program into “non-key mode,”which limits the pro- gram so that the -s,-nolnk,and -onefs options will not work.Consequently, you will not be able to,for example,tell AntiVir to search the entire drive by issuing the following command: antivir / -s -allfiles -s -nolnk -r4 Licensing AntiVir If you plan to use this application for private use,you can download and install the program,and then apply for a private license at www.antivir.de/order/ privreg/order_e.htm. Eventually,you will receive a license file named hbedv.key.Once you have this license,you must place it in the /usr/lib/AntiVir directory.Once you start (or restart) AntiVir,you can use all of the options the program has to offer. Exercise: Updating AntiVir An antivirus application is only as useful as its virus definition file.If you are run- ning in non-key mode,you cannot install any updates for AntiVir.Those who legally obtain and use the private license are entitled to one update every two months.If you purchase AntiVir,you can obtain daily updates. To obtain an update,go to www.hbedv.com/download/download.htm and download the appropriate .vdf file for your application.Once you obtain a key, place it in the /usr/lib/AntiVir/ directory. Installing version 6.6.0.0 of AntiVir is simplicity itself.This exercise assumes that you have already downloaded and registered AntiVir.
- Create a directory named antivir.
- Obtain the file named avlxsrv.tgz from the CD that accompanies this book and place it in the antivir directory.Normally,when a tarball is unzipped,the package will create its own directory.However,this isn’t the case with AntiVir.You can also install the Red Hat Packet Manager (RPM) if you wish.
- Issue the following command:tar -zxvf avlxsrv.tgz. www.syngress.com
138_linux_03 6/20/01 9:35 AM Page 115 System Scanning and Probing • Chapter 3 115 4. Several files will be generated,including the install.sh script.Issue the following command,exactly as shown: ./install.sh 5. The preceding command tells the system to run the install.sh script. Upon doing so,you will see that the program creates the /usr/lib/ AntiVir directory.You will be asked if you want to create a symbolic link (the program uses the word symlink.Press y to indicate yes.The symbolic link this creates is from the /usr/lib/AntiVir/antivir directory to the /usr/bin directory.Establishing this symbolic link allows AntiVir to start without you having to enter the entire path (e.g.,/usr/bin/antivir). NOTE A symbolic link is similar to a Windows shortcut, although more powerful. It is a reference to another file system object on any file system (on the local system or on another network) supported by Linux. In Unix, you can create a symbolic link that leads to a binary by using the ln -s command: ln -s existingItem newItem 6. You have now installed AntiVir.However,you still cannot use all of AntiVir’s options.Now,open a browser and go to www.antivir.de/ order/privreg/order_e.htm. 7. Enter the relevant information,and then order your key.The key will be sent to you in a few minutes. 8. Once you obtain the key,copy it to the /usr/lib/AntiVir/ directory.Now, scan your local directory for a virus by issuing the following command: antivir 9. The system will load its file (/usr/lib/AnviVir/antivir.vdf),and then scan the directory.In all likelihood,it will find nothing.Now,scan all files and all subdirectories in your home directory: antivir /root -allfiles -s www.syngress.com
138_linux_03 6/20/01 9:35 AM Page 116 116 Chapter 3 • System Scanning and Probing 10. Thus far,AntiVir hasn’t been very forthcoming about what it finds.Also, notice how all output goes onto the screen,rather than to a log file.You can change this by issuing the following command: antivir ~ -allfiles -s -r4 -rf/log.txt -ro This command has AntiVir go into verbose mode,and then deposit all of its standard output into a file in your current directory named log.txt.The -ro command will erase any file named log.txt and replace it with what it finds.If you want to append information to the end of the log.txt file,instead of overwriting it,use the -ra option. 11. The following command,for example,searches the var/spool/ directory, which can contain mail files: "/var/spool/*" -s -rf/log.txt -ro 12. Now,change to the /etc/cron.daily directory. 13. Using a text editor such as vi or pico,create a file named antivir.cron, and enter the following code: #!/bin/sh antivir / -allfiles -s -r4 -rf/root/log.txt -ro This command has crontab run AntiVir so that it scans the entire hard drive for viruses,and then creates a log file named log.txt in the /root directory.Because you have created this cron entry in the /etc/cron.daily/ directory,the job will be run every day. To learn more about AntiVir options,consult the README file that comes with the program.You can also learn more about the program by typing antivir -h and scrolling through the options. Using TkAntivir The command-line interface is very useful when you want to administer the system quickly,or when you have to remotely administer a system using SSH or Telnet.However,a rather elegant GUI front end called TkAntivir is available for free at the Geiges Software Training and Consulting Web page at www.geiges.de/ tkantivir or from the accompanying CD (tkav.gz or the equivalent tkantivir-1.30- 1.i386.rpm. When you download TkAntivir,make sure that you obtain the version that supports your language.The program was developed in Germany,and if you are www.syngress.com
138_linux_03 6/20/01 9:35 AM Page 117 System Scanning and Probing • Chapter 3 117 not careful,you will install the German language version,rather than the English version. Required Libraries and Settings Before you try to install TkAntivir,you must have the following libraries and settings: (cid:2) Tcl/Tk version 8.x or higher Most systems already have Tcl/Tk installed,but you may have to upgrade the version on your system.A default installation of Red Hat 7.0 has adequate versions of this library already installed. (cid:2) A resolution of at least 800 x 600 You may have to run Xconfigurator or XF86Setup to reconfigure your X settings. NOTE Although TkAntivir is designed to run in any X-Windows environment, it runs best in KDE, which is not surprising, since the KDE interface was first developed in Germany. The application runs on the Gnome desktop as well. You can download Gnome at www.gnome.org. If you are run- ning certain versions of the Blackbox window manager, TkAntivir will go through the loading procedure, but will not run. Try running KDE or Gnome to solve this problem. You have the option of installing TkAntivir using tarball or RPM packages.In this particular instance,Red Hat systems seem to respond better to the RPM. Scanning Systems for Boot Sector and E-Mail Viruses The TkAntivir interface,shown in Figure 3.2,is relatively intuitive and allows you to concentrate on what you want AntiVir to do,as opposed to getting the com- mand-line syntax correct.The Scanning options section allows you to specify the path you wish to search.You can also use this section to search only for certain file types,which is useful when scanning e-mail spooling directories for suspect attachments.The Options section allows you to skip checking the system boot www.syngress.com
138_linux_03 6/20/01 9:35 AM Page 118 118 Chapter 3 • System Scanning and Probing record and symbolic links,which helps the scan finish faster,because it won’t have to scan the same file repeatedly.This section also allows you to specify whether you want to search for compressed files (e.g.,files compressed by zip or gzip).Verbose scan mode allows you to receive more information in your log file. Figure 3.2 The TkAntivir Interface The Repair options section allows you to determine what AntiVir will do when it finds a virus.Notice that it is set to ignore by default,which is wise.Virus applications,like any scanning or monitoring application,are susceptible to false positives,which are instances when an application identifies a perfectly benign file,process,or activity as somehow threatening.If you tell AntiVir to delete any file that it thinks is defective,and AntiVir makes a mistake,you may end up deleting an important system file,or removing a user’s important report.Either way,you could cause problems for yourself if you automate file removal. Finally,the Macro repair options section allows you to determine what will be done with macros created by various applications,including Microsoft Word.If, for example,you have a Linux server acting as a file and print server,you may want to consider some of these options.Again,remember that mistakenly deleting files can cause serious problems because Unix/Linux has no native undelete facility. www.syngress.com
138_linux_03 6/20/01 9:35 AM Page 119 System Scanning and Probing • Chapter 3 119 The Scan icon,at the upper-left portion of the interface,allows you to acti- vate the settings you enter.The Scheduler icon brings up the Scheduler interface, shown in Figure 3.3.From here,you can: (cid:2) Choose the path that a particular job will scan. You can also include subdirectories. (cid:2) Tell AntiVir when it should run. You can schedule a one-time event,or schedule AntiVir to run every day,every week,or after a cer- tain number of days.Figure 3.3 shows that a job is scheduled to run at 2:00 A.M. each week.The job will run on Monday of each week.If you click Single Events,you will be able to configure AntiVir to run at a certain time on the same day,or the next day,or after a certain number of days.Once you are finished configuring the time,you can then click Add a Job.You can also review and update existing jobs,simply by highlighting the existing job and then clicking either Job Info or Update. Figure 3.3 Scheduling a Scan The Report Viewer icon allows you to view reports generated earlier,or reports generated on other systems.Once you click this icon,you will see the www.syngress.com
138_linux_03 6/20/01 9:35 AM Page 120 120 Chapter 3 • System Scanning and Probing Open dialog box,shown in Figure 3.4.Once this dialog box opens,you can then navigate to the log file you want to read,and then open it. Figure 3.4 The Open Dialog Box in TkAntivir Additional Information The Preferences tab allows you to change the location of AntiVir binary,the TkAntivir files,or the log file.The AntiVir and VDV info file allows you to deter- mine when it is time to download and install a new .vdf file.Now that you are familiar with the requirements for TkAntivir,it is time to install and use it. Exercise: Using TkAntivir
- Make sure that you have all of the required libraries.Review this section for more details.
- Verify that you have 800 x 600 resolution.Consult your man pages for Xconfigurator or XF86Setup.You can also directly edit your X- Windows configuration file (XF86Config).
- Download and install TkAntivir from www.geiges.de/tkantivir.Although your situation may vary,the RPM file works best on Red Hat systems. Once you obtain the RPM file,check its MD5 signature,and then install it using the rpm -ivh command. www.syngress.com
138_linux_03 6/20/01 9:35 AM Page 121 System Scanning and Probing • Chapter 3 121 4. Enter the following command to create a log file directory off of the /usr/lib/AntiVir/log/ directory: mkdir /usr/lib/AntiVir/log/ 5. Once you install TkAntivir,run the program by issuing the tkantivir command. 6. You will see a dialog box informing you that the configuration is not complete.Click OK to bring up the configuration window.Enter the information shown in Figure 3.5.Make sure that you enter this text exactly as shown—Linux systems are always case sensitive. Figure 3.5 Setting Preferences for TkAntivir 7. Click OK.You will see the splash screen shown in Figure 3.6. Figure 3.6 The TkAntivir Splash Screen 8. You will then see the main interface.If you do not see this interface, either you need to use KDE or Gnome,or you need to change your monitor resolution. www.syngress.com
138_linux_03 6/20/01 9:35 AM Page 122 122 Chapter 3 • System Scanning and Probing 9. Once the interface appears,scan your entire directory.Make the changes shown in Figure 3.7. Figure 3.7 Configuring TkAntivir to Scan the Entire Home Directory 10. Click the Scan icon.You will see a pop-up window similar to that shown in Figure 3.8 asking you if you are ready to issue this command. Figure 3.8 Confirming a Disk Scan with TkAntivir 11. Click Yes.You will then see a window informing you that the scan is taking place.If the scan takes place very quickly,you likely have not downloaded and properly installed your key.The scan may take some time,depending on the speed of your system’s processor and the size of your hard drive.Once the scan finishes,TkAntivir will generate a report. Scroll down the report to view all of the files.In the results shown in www.syngress.com
138_linux_03 6/20/01 9:35 AM Page 123 System Scanning and Probing • Chapter 3 123 Figure 3.9,AntiVir was able to find two viruses.Your system is now pro- tected against Linux viruses. Figure 3.9 Viewing TkAntivir Scanning Results Scanning Systems for DDoS Attack Software Using a Zombie Zapper Since late 1999,many sites have become the victims of devastating denial-of-service (DoS) attacks.A DoS attack is basically where an attacker finds a way to disable the services (in this case,the network’s Web sites) so that they cannot be provided to anyone.In February 2000,a series of attacks against Web sites such as www.cnn.com,www.ebay.com,and www.amazon.com caused these sites to be knocked off the Internet. The specific type of attack waged against the preceding Web sites was unique, because it involved multiple attacking machines controlled by one attacker. Because of these attacks,a new security term,a distributed denial of service (DDoS) attack was born.In a DDoS attack,an attacker instructs several compromised sys- tems to flood a target system with service requests.The resulting attack can bring down almost any Web site,or generate so much traffic that an entire network can no longer communicate with the rest of the Internet. Attackers are able to wage these DoS attacks by first finding and hacking into insecure systems on the Internet.Then,they install programs such as Tribe Flood Network 2000 (Tfn2k),stacheldraht,and others.The compromised systems now www.syngress.com
138_linux_03 6/20/01 9:35 AM Page 124 124 Chapter 3 • System Scanning and Probing have illicit programs,called zombies,installed on them.Traditionally,zombies have been Unix/Linux systems (because it is easy to program network services on these systems).Prime targets for zombies are computers used by colleges and uni- versities.There are several reasons for this: (cid:2) These systems typically have a large number of users—students. Consequently,it is easy to hide a rogue account/program. (cid:2) These systems have user populations that change regularly.Again,this makes it easy to hide zombie programs.In addition,due to the turnover of students and courses,university networks often do not employ strin- gent security techniques. (cid:2) Computers in academic environments typically have access to very high- speed Internet connections.This makes it possible for the zombie to blast the system under attack with an especially high volume of traffic. For additional information about DDoS attacks,consult www.cert.org/ incident_notes/IN-99-07.html. How Zombies Work and How to Stop Them Once a zombie is commanded to attack a victim,it will generally continue the attack until it is forced to stop.This is where zombie zapper utilities become useful.Such programs are able to act as clients to the DDoS servers that are sending packets to victim hosts.Zombie zapping utilities are useful when you suspect that your system is acting as a zombie,and you wish to quickly disable the illicit zombie server (that is,stop it from generating the DOS packets) without shutting down your entire system. Rather than trying to learn how to use,say,the Tfn2k client,you can use a zombie zapper to shut down the zombie.However,you should understand that most zombie zappers are somewhat limited in what they can do: (cid:2) Zombie zappers are programmed to shut down only certain DDoS servers.If a malicious user has created a new one that uses a different port,your zombie zapper will likely not work. (cid:2) If the malicious user has changed the password of the illicit server that has turned one of your hosts into a zombie,then it is likely that your zombie zapper software will not work.For example,the installation process for Tfn2k requires the malicious user to create a new password. Thus,most zombie zappers won’t work against this product.Still,zombie www.syngress.com
138_linux_03 6/20/01 9:35 AM Page 125 System Scanning and Probing • Chapter 3 125 zappers are useful for other DDoS servers,because most people who install them are either relatively inexperienced,or are in too much of a hurry to change the password. (cid:2) If you try to use a zombie zapper against a remote computer,it is pos- sible that a firewall that lies between you and the remote computer will block the packets you send.DDoS attacks have been widely publicized, and many systems administrators have created firewall rules that will block out all DDoS traffic,including that sent by your application. (cid:2) Because DDoS attack servers spoof packets,you may be using your zombie zapper against the wrong host. (cid:2) Your attempt to disable a zombie computer on someone else’s network may be misconstrued as an attack—you may get some interesting calls from that system administrator. When Should I Use a Zombie Zapper? In spite of the reasons why you should be careful,installing and using a zombie zapper is useful in a number of situations.You can configure your intrusion detection service (IDS) devices to automatically run a zombie zapper against an offending system.This way,the problem is automatically solved.You will learn about how IDS applications and firewalls can respond automatically to threats in Chapters 9 and 11. If you notice large amounts of unknown traffic when you monitor your net- work or network perimeter,you can use a zombie zapper against the host or hosts generating this traffic.Chapter 4 will show you how an IDS application can help you scan for problem traffic.In Chapter 5,you will learn how to use packet sniffers to check the complexion of traffic on your LAN. You should understand that although DDoS attacks are not new,it is likely that they will continue.After all,the Melissa,I Love You,and Anna Kournikova e-mail viruses are all very similar to the 1989 Robert Morris worm attack (the first large-scale attack of Internet connected servers). What Zombie Zapper Should I Use? Many different utilities exist for disabling zombies.You can learn about these at various sites,including http://packetstorm.securify.com,by doing a search for zombie and zapper.One of the more useful utilities is Zombie Zapper,available at www.syngress.com
138_linux_03 6/20/01 9:35 AM Page 126 126 Chapter 3 • System Scanning and Probing the Bindview site (www.bindview.com).As of this writing,the URL is http://razor.bindview.com/tools/ZombieZapper_form.shtml.The utility is also available on the CD accompanying this book (zombie-1.2.tgz). Zombie Zapper Commands When compiled,Zombie Zapper is designed to be run by using the ./ com- mand.If you enter ./zz without any arguments,you will receive the following: ./zz Zombie Zapper v1.2 - DDoS killer Bugs/comments to thegnome@razor.bindview.com More info and free tools at http://razor.bindview.com Copyright (c) 2000 BindView Development === You must specify target(s) or a class C to send to USAGE: ./zz [-a 0-5] [-c class C] [-d dev] [-h] [-m host] [-s src] [-u udp] [-v] hosts -a antiddos type to kill: 0 types 1-4 (default) 1 trinoo 2 tfn 3 stacheldraht 4 trinoo on Windows 5 shaft (requires you use the -m option) -c class C in x.x.x.0 form -f time in seconds to send packets (default 1) -d grab local IP from dev (default eth0) -h this help screen -m my host being flooded (used with -a 5 above, only one host) -s spoofed source address (just in case) -u UDP source port for trinoo (default 53) -v verbose mode (use twice for more verbosity) host(s) are target hosts (ignored if using -c) www.syngress.com
138_linux_03 6/20/01 9:35 AM Page 127 System Scanning and Probing • Chapter 3 127 Table 3.2 provides a brief overview of some of the more common commands. Table 3.2 Common Zombie Zapper Commands Command Definition -a Allows you to specify the address to where you will send the packets. -c You can specify an entire class C address when sending stop packets. -s Allows you to spoof your own address. This and the -u option allow you to defeat some firewall rules when trying to disable zombies on remote networks. -u Allows you to change the default UDP port for sending stop packets. 0-5 Each number enables Zombie Zapper to imitate a specific DDoS client. If, for example, you think you have found a tfn client, you would issue a command with the number 2 in it. What Does Zombie Zapper Require to Compile? You will need the following to install Zombie Zapper: (cid:2) A standard Linux system. (cid:2) Libnet This set of supporting libraries allows your system to generate packets for use on a network.You need these libraries because the cre- ators of Zombie Zapper used them in development,and the program will not compile properly unless you have them installed on your system. These libraries are popular,and are often used by other developers.You can download the Libnet libraries at www.canvasnet.com/libnet. Exercise: Using Zombie Zapper
- Obtain the Zombie Zapper source code from the accompanying CD or at www.bindview.com.Once you have unzipped and untarred the file using the tar -zxvf command,you are ready to compile.See the pre- ceding URLs for obtaining Zombie Zapper. Before you can compile this code,you must first obtain and install the Libnet libraries.A version of Libnet (libnet-0.10.8.tar.gz) is available www.syngress.com
138_linux_03 6/20/01 9:35 AM Page 128 128 Chapter 3 • System Scanning and Probing on the accompanying CD.Once you have obtained Libnet,unzip and untar it using the tar -zxvf command.The ./configure script will install Libnet into the directories appropriate to your system. 2. Install Libnet by changing to the Libnet.x.x directory,and then using the configure script: ./configure 3. When the configure script is finished,type make. 4. Type make install. 5. Although optional for installing Zombie Zapper,you can now install the supplemental and utility libraries by typing make supp and then make util. 6. Now that you have installed Libnet,you can compile Zombie Zapper. Because the code for Zombie Zapper relies on this library,you must tell the GCC compiler that the Libnet library exists.Issue the following command: gcc ‘libnet-config -defines‘ -o zz zz.c -lnet 7. This command tells the GCC compiler to use the libnet-config file, which is found in the /usr/bin/ directory for most Linux systems.You will not have to edit this file.When you type this command,make sure that you use the “backtic”character,which is the character above the TAB key on your keyboard.Do not use an apostrophe.If you do not use the backtic character,GCC will not search for libnet-config,and Libnet will give you a message informing you that you need to define some values in the libnet-config script.Ignore this message,and type the cor- rect character. 8. Now that zz is compiled,you can use it.Issue the following command: ./zz 9. You will see a Help menu informing you how to use the program.This confirms that you have compiled the program correctly. 10. Now,suppose that you notice that your internal network of 192.168.5.0 has several hosts on it that are sending tfn packets.As long as the tfn server is using a default password,the following command will stop the server: ./zz -c 192.168.5.0 www.syngress.com
138_linux_03 6/20/01 9:35 AM Page 129 System Scanning and Probing • Chapter 3 129 11. The servers that a malicious hacker has turned into zombies on this par- ticular class C subnet should stop immediately.You cannot use the -c command with class A or class B network addresses.To do this,you would have to specify the IP address,along with the type of server you wish to shut down.For example,if you suspected the server at 207.192.45.2 to be attacking you with the stacheldraht DDoS server, you would issue the following command: ./zz -a 3 207.192.45.2 12. To learn more about the nature of the packets you are sending,you can use the -vv command: ./zz -a 3 -vv 207.192.45.2 13. If you wish to spoof your own address so that the malicious user can’t learn who deactivated his or her zombies,you would use the -s com- mand,followed by an IP address of your choosing: ./zz -a 3 -vv 207.192.45.2 -s 10.1.2.3 Scanning System Ports Using the Gnome Service Scan Port Scanner Gnome Service Scan (GSS) is a simple port scanner.It is quite fast,and has a GUI interface.It is also easy to install,and uses the same libraries as the Gnome (that is, Ximian) desktop.The main GserviceScan window is shown in Figure 3.10. You can download the source code for GSS at www.gnome.org/applist/ view.php3?name=Gnome%20Service%20Scanner.The Preferences section,shown in Figure 3.11,allows you to further customize GSS. Setting longer TCP and UDP timeout values may ensure that you obtain results that are more accurate.Longer timeout values,however,mean longer, more time-consuming scans,so strike a balance.A good idea would be a default of 7 and 10 seconds for the TCP and UPD timeout values,respectively.In addi- tion,if your network is experiencing DNS problems,you can disable DNS so that you at least learn the IP address and the open ports of the remote host. www.syngress.com
138_linux_03 6/20/01 9:35 AM Page 130 130 Chapter 3 • System Scanning and Probing Figure 3.10 The Main GserviceScan Screen Figure 3.11 Customizing GSS Required Libraries To install GserviceScan,you must have the Gnome desktop installed,complete with all packages from the www.gnome.org site.If you don’t have Gnome installed,log on to your Linux system and issue the following command: lynx -source http://go-gnome.com/ | sh. www.syngress.com
138_linux_03 6/20/01 9:35 AM Page 131 System Scanning and Probing • Chapter 3 131 Of course,you can install the appropriate RPMs from the Red Hat distribu- tion CDs.However,if you install Gnome from the Gnome site,the latest Gnome updates and features become available to you. This command tells Lynx,a text-based Web browser,to contact the http:// go-gnome.com site and download a shell program.After the small program down- loads,a graphical wizard will guide you through the rest of the process.You can customize the packages you wish to install;you do not have to install the packages relating to software development.You can then install the GSS by obtaining the gservicescan-0.8.tar.gz file from the accompanying CD,or from the Gnome home page (www.gnome.org),which will have the latest version. NOTE The command for checking for the presence of an RPM is rpm -qa | grep text_string, where text_string is part of the package name for which you are searching. Why Use a Port Scanner? Systems administrators find port scanners useful when auditing their own sys- tems.Although a simple port scanner such as GSS does not actually test for flaws in binaries and Web applications,a good port scanner can help you isolate which ports are open,and then take any action that is necessary. Port scanning a machine may set off an alarm for the system’s administrator, who might take a dim view of your actions.Be extremely careful using any of the applications in this chapter.Improper use of these applications could lead to a strong reprimand,dismissal,or telephone calls from irate systems administrators. You should conduct port scans only on systems that you administer.Even then, you should scan them only if you have explicit permission,as your scan can set off triggers and alerts that can cause many people a great deal of work.Unless you have explicit (sometimes,even written) permission from the system adminis- trator,you may cause a serious violation of your security policy. Exercise: Using Gnome Service Scanner
- If necessary,open the Lynx browser and issue the command given earlier to download and install the necessary Gnome libraries.If you do not have Lynx installed,download it from www.rpmfind.net. www.syngress.com
138_linux_03 6/20/01 9:35 AM Page 132 132 Chapter 3 • System Scanning and Probing 2. In the Start Address field,enter the beginning host IP address for your particular network or network segment. 3. In the End Address field,enter the last host IP address of this network or network segment.Remember,you should not conduct port scans on systems that are not yours. 4. In the Protocol section,make sure that the TCP button is selected. Using the arrow,select 110 (the port for POP3 e-mail). 5. Click Scan.You will see a list of several hosts,some of which will have open ports.See Figure 3.12. Figure 3.12 Viewing Gnome Service Scanner Results You now know that various hosts in your network are up (“Connection refused”),which are not responding (“No route to host”),and which are acting as POP3 e-mail servers. www.syngress.com
138_linux_03 6/20/01 9:35 AM Page 133 System Scanning and Probing • Chapter 3 133 Using Nmap Nmap is an advanced port scanner.It is also capable of identifying the version of an operating system.You can download Nmap,shown in Figure 3.13,at www.insecure.org.Perhaps the best thing about Nmap is that its developer, Fyodor,is extremely talented,active,and a good collaborator.He and his col- leagues update Nmap often,and the updates usually bring desirable new features and improvements. Figure 3.13 Nmap Tools & Traps… Nmap: A Tool for Hackers or Security Professionals? You may be wondering whether Nmap is actually a “hacker tool” meant to help compromise the security of a network. Nmap was first intro- duced as a hacking tool, but has been quickly adopted by IT profes- sionals. It provides excellent information concerning hosts on your network. It also allows your IT professionals to: (cid:2) Audit your network Using this application, your employees can quickly scan a network for hosts that have unsecured ports. Continued www.syngress.com
138_linux_03 6/20/01 9:35 AM Page 134 134 Chapter 3 • System Scanning and Probing (cid:2) Test firewall configurations Nmap will help to ensure that the firewall blocks as many packets as it can, without com- promising your ability to communicate with the outside world. (cid:2) Identify the nature of suspicious remote systems Although scanning a host that has scanned you may be con- sidered bad etiquette, doing so can help your employees quickly size up a threat. (cid:2) Test your router and switch configuration TCP/IP has built- in testing features that allow one echo request to cause an entire network of hosts to respond to a host. While this fea- ture may be useful in determining if all hosts can traverse the default gateway, it can also have disastrous effects if exploited by a malicious user. Using readily available soft- ware, a malicious user can use your network to attack other networks. While it is true that you would not want any stranger to use Nmap against your hosts, it is a valuable tool in the hands of someone who knows how to use the information it presents to help secure your network. Isn’t Nmap Just Another Port Scanner? Nmap is essentially a network host scanner,like GSS.However,it has additional features that make it the most popular Unix-based scanner,including: (cid:2) Fast ping and port scan capabilities You can find out if systems are up,and what ports are open. (cid:2) Operating system fingerprinting Nmap has the ability to guess the operating system of the host it is scanning.Although Nmap must make a guess,it is a very well informed one.This is because Nmap contains an extensive database of TCP-,UDP-,and IP-based responses from hun- dreds of different operating systems.Nmap can query your system,and then compare its responses to this database.Vendors are required to make their versions of TCP/IP compliant to technical specifications found in documents called Request for Comments (RFCs).These files are avail- able at various places on the Internet,including www.faqs.org/rfcs/ index.html.However,each vendor implements TCP/IP in a slightly www.syngress.com
138_linux_03 6/20/01 9:35 AM Page 135 System Scanning and Probing • Chapter 3 135 different fashion,and Nmap is able to compare these differences and then inform you about the operating system. (cid:2) Sequence prediction All TCP-based communications require each system to establish a pattern to which it will conform when sending TCP packets.This pattern is established during the three-way TCP handshake.Nmap is able to determine elements of this pattern.In some systems,such as all versions of Windows NT 4.0 before Service Pack 5, these sequences are not sufficiently randomized,and are easy to predict. In the past,hackers have been able to identify such simple TCP sequences,and use them to hijack connections.Nmap provides this information.Most Internet-ready operating systems,such as modern versions of Linux,have truly random sequencing,and are much more difficult to predict. (cid:2) Ability to imitate all different aspects of a TCP-based connec- tion When a TCP connection begins,it takes some modest amount of time (a few milliseconds) to establish the connection,a process called the handshake.Many firewalls are configured to drop initial SYN packets for certain systems,because network administrators do not want anyone in the outside world to establish contact to the system (without going through a firewall).Most scanners use the SYN packet,and will thus be dropped.Nmap is able to generate packets that many firewalls will allow, and thus Nmap can traverse through a firewall to map remote hosts and networks. (cid:2) Spoofing features Many network administrators will try to learn exactly who conducted a scan of their network.Using Nmap’s spoofing feature,it is possible for a malicious user to imitate another host. Consequently,the systems administrator may be led to believe that some innocent third party initiated a scan;IT professionals can use the spoofing feature to test firewall configurations. (cid:2) The ability to control scan speed and sequence Many Intrusion Detection System (IDS) applications will generate alerts if they notice that a network’s hosts are being scanned sequentially.An IDS will also report an attack if it notices that a series of hosts has been scanned quickly.Using Nmap,you can slow an attack.Whereas a malicious user would use Nmap to thwart security,IT professionals can use it to help audit a firewall. www.syngress.com
138_linux_03 6/20/01 9:36 AM Page 136 136 Chapter 3 • System Scanning and Probing (cid:2) The ability to save output to text files This feature makes it pos- sible to use Nmap output in other programs,or to save output for future reference. (cid:2) The ability to read input information from text files This feature makes is possible to read input information from text files. Acquiring and Installing Nmap Nmap is self-contained,and can thus be run on many Unix systems.Generally, installing the RPM is more reliable than the tarball on Red Hat systems.In this particular case,there are no compilation options as of yet,so there is no reason not to use the RPM file if your distribution supports it (available on the CD accom- panying this book:nmap-2.53-1.i386.rpm).You can verify your installation with: rpm -qa | grep nmap Common Nmap Options One of the exciting things about Nmap is its sheer versatility.You can use it as a basic port scanner for a system on your internal network,or you can have it identify the operating system version of a remote system on another firewall-pro- tected network.You can use it to run a single scan,or use it in interactive mode to run multiple scans from the same system at the same time. The two scan options given in the next section are common in various scan- ning applications.However,they are less effective because many firewalls are con- figured to reject a SYN connection that is first initiated from the outside world. These scans will also appear on the logs of your firewall or IDS applications: (cid:2) P0 By default,Nmap sends an ICMP message to each remote host.This option turns off this default behavior.This option is useful when scan- ning systems that do not appear to be up,because they do not respond to ICMP ping packets.If you use this option,you should understand that the information Nmap provides may not be accurate. (cid:2) -sP Has Nmap use only ICMP to conduct a standard ping scan.Nmap options preceded with the -s option are considered “stealth”options that help Nmap conduct less obvious scans. (cid:2) -PT Tells Nmap to use a TCP packet to ping the host instead of an ICMP packet.This option is useful when testing a firewall to see if it can www.syngress.com
138_linux_03 6/20/01 9:36 AM Page 137 System Scanning and Probing • Chapter 3 137 block both ICMP and TCP packets intelligently.When you use the -PT option,Nmap will send out a TCP ACK packet,and then wait for hosts to send back an RST packet.Many firewalls will allow ACK and RST packets to traverse the firewall,and thus you can scan the entire network. (cid:2) -sT Conducts a full TCP connection to each port on the remote system. (cid:2) -sS Uses the SYN feature of TCP.When TCP begins a connection,it will send a SYN packet to the remote host to tell it to begin a connec- tion.When Nmap sends a SYN packet,it essentially creates a half-open connection.Even if the remote computer doesn’t want to communicate with your host,Nmap is still able to gather sufficient information from this scan to learn the open ports. (cid:2) -0 Tells Nmap to guess the operating system version.This is a much- touted feature of Nmap,because it allows illicit users to quickly deter- mine the type of operating system in use so that they can then research vulnerabilities associated with it.Nmap uses a database of operating system signatures.Once the application conducts the scan,it compares the information it obtains from the scanned host and compares it to its database.The creators of Nmap spend a great deal of time trying to keep this feature as up to date as possible by making sure that Nmap’s signa- ture database is current.One of the ways that Nmap accomplishes oper- ating system guessing is that it understands how each particular operating system implements specific TCP/IP applications. (cid:2) -v Has Nmap go into verbose mode so that you can gain more infor- mation about what Nmap is pumping out to a remote host,and what the remote host is sending back.If you specify -v -v,Nmap will give you even more information,depending on your scan. Applied Examples Suppose you just want to conduct a ping scan of your local network to see what hosts are currently up.Suppose further that your network address is 10.100.100.0 with a subnet mask of 255.255.255.0.You would issue the following command: nmap -sP 10.100.100.0/24 www.syngress.com
138_linux_03 6/20/01 9:36 AM Page 138 138 Chapter 3 • System Scanning and Probing If you add the -v option,you will also see a list of systems that are down. Using the -sT option is useful when pinging remote hosts over routers or fire- walls that do not allow ICMP packets. The following command will conduct a “half open”TCP scan,give you Nmap’s best guess concerning the operating system,and not ping the host beforehand: nmap -sS -O -P0 host. If you specify the -v option,you will see further details concerning how Nmap operates. Scanning Entire Networks and Subnets If you want to scan an entire network,Nmap supports wildcards and Classless Internet Domain Routing (CIDR) notation.Nmap uses the standard wildcard of “.”.CIDR notation is where you use /24 to indicate a standard class C subnet mask of 255.255.255.0,which indicates that we want 24 bits of subnet mask starting from bit 1.The remaining 8 bits are used as the node number for our network.The 172.16.0.0/18 subnet uses 2 bits of subnet mask to divide the single class B network number (172.16) into four additional,separate subnets (172.16.0,172.16.64,172.16.128,and 172.16.192).Each subnet would then have 14 bits of node number addressing: nmap -P0 -oN output.txt 172.16.0.0/18 .".*" nmap -P0 -oN output.txt 192.168.0.0/24 You should use quotation marks around wild cards,such as those used in the preceding code.Otherwise,Linux may interpret the commands as the filename wildcard,resulting in the rewriting of any files in the current directory that match the pattern.You can also use single quotes,if you wish. These commands would scan all of the hosts,making sure to save the results in the file named output.txt.Using CIDR notation allows you to scan networks that use custom subnet masks.For example,suppose that you have a network address of 172.16.0.0/8,and a subnet mask of 255.0.0.0.To properly scan this subnet,you would use the following command: nmap -P0 -oN output.txt 172.16.0.0/8 The 172.16.0.0/18 subnet uses 2 bits of subnet mask to divide the single class B network number (172.16) into four additional,separate subnets (172.16.0, www.syngress.com
138_linux_03 6/20/01 9:36 AM Page 139 System Scanning and Probing • Chapter 3 139 172.16.64,172.16.128,and 172.16.192).Each subnet would then have 14 bits of node number addressing. Selective Scanning Suppose,now,that you want to scan only certain ports on the hosts that belong to an entire subnet.Doing this can help you selectively scan for only a specific service on a network,such as a Web and DNS server,as shown here: nmap -sX -p 22,53 -oN syngress.txt 192.168.0.0/24 NOTE The following operating systems do not respond accurately to “Xmas” scans, because they do not follow standard RFCs: Microsoft CISCO All BSD systems that are not FreeBSD or NetBSD IRIX HP/UX Adding More Stealth You have already seen how Nmap is capable of manipulating aspects of TCP to hide its scans from firewalls.Additional stealth options include: (cid:2) -sF Using a TCP packet with the FIN bit sent,Nmap can send out packets to all ports on a host. (cid:2) -sX Called the “Xmas Tree”packet argument,if you specify this argu- ment,the FIN,URG and PUSH flags will all be set. (cid:2) -sN Called the “Null scan,”this argument turns off all flags,sending out an essentially empty bit.If the system responds,Nmap knows that the host is up,and can deduce information it derives from the remote system’s return packet.Microsoft systems do not reply to this packet,and if you are careful in your network scans,you can use Nmap to help dis- tinguish Microsoft systems from all others. www.syngress.com
138_linux_03 6/20/01 9:36 AM Page 140 140 Chapter 3 • System Scanning and Probing (cid:2) -D This option allows you to specify several additional hosts who will appear as originators of the scan.Hackers often use this option to con- fuse systems administrators,who will usually not be able to tell from where the scan truly came.As a systems administrator,you can use it to test your intrusion detection systems and firewalls to see how well they find and log all scans of your network.When using the -D option,you would separate each bogus host with a comma: nmap -sF -v 192.34.35.0/24 -D bogushost1, bogushost2, bogushost3 If you specify the ME option,you will increase the likelihood that your system will be hidden from all IDS logs. To scan the 192.15.3.10/24 network protected by a firewall that denies all SYN packets,issue the following command: nmap -sF -v 192.15.3.0/24 The following command would conduct the same scan and specify bogus scanning hosts: nmap -sF -v 192.15.3.0/24 -D www.yourwebserver.com,www .yoursecondwebserver.com,www.yourftpserver.com,ME,www .youre-mailserver.com As you use Nmap,experiment with the -sX and -xN arguments to see if they are useful in your particular situation.It is important to understand that you can specify only one TCP option at a time.This means that you cannot use both the -sF and -sS arguments in the same command. Saving to Text and Reading from Text You may have already noticed that some of these scans can be quite lengthy.For example,if you do a detailed scan of all ports on an entire network of 253 hosts, you may not be able to see all of them on your display,no matter how long you can scroll your terminal.Nmap provides the following options to save output into a text file: (cid:2) -oN filename Places the scan results in a text file that you can read later. (cid:2) -oM filename Places the scan into machine-readable format.If,for example,you scan a network,you can then use this file with another www.syngress.com
138_linux_03 6/20/01 9:36 AM Page 141 System Scanning and Probing • Chapter 3 141 application,such as Cheops or an IDS to generate a network map. See later in this chapter and Chapter 4 for more information. (cid:2) -iL Allows Nmap to read information from a text file.For example,if you already have a text file that contains the IP addresses or host names of a text file,you can specify this filename rather than an IP or host range. For example,if you wished to save Nmap output into a file named file.txt, you would issue the following command: nmap -v -oN file.txt -O host.yourcompany.com Testing Firewalls and Intrusion Detection Systems You may wish to use Nmap in a network that uses a well-configured firewall or an IDS).If so,you may want to conduct scans that cannot be easily detected,or are actually able to traverse a firewall without being blocked.The following options are effective in these cases: (cid:2) -f Has Nmap break up its scans into smaller IP packets.This way,a fire- wall will not be able to capture and log the packets as easily. (cid:2) -S Address Allows you to specify the originating address of the scan. Originally meant to allow Nmap to work with various operating sys- tems that would not report the IP address to Nmap,it is possible to use this feature to spoof the source address of the scan.Generally,if you use this argument to spoof the source of the attack,you will also need to use the -e -P0 options.The -e option allows you to specify the interface to use (usually eth0).The -P0 option,as you have already learned,tells Nmap not to conduct a ping scan.The -D option is quite similar to this option,as it provides disinformation to any target host that may be recording your scan. (cid:2) -g port By default,Nmap will open an ephemeral port (i.e.,one above 1024) to begin a scan.Many firewalls are configured to block these ports.However,firewalls are often configured to allow incoming traffic through certain well-known port address (such as ports 80,110,53).By specifying a port the firewall allows,you (or a malicious user) can find a way through the firewall to conduct your scans. www.syngress.com
138_linux_03 6/20/01 9:36 AM Page 142 142 Chapter 3 • System Scanning and Probing Example: Spoofing the Source Address of a Scan Suppose that your system actually has the IP address of 192.168.3.4,but you wish all of the Nmap packets your system issues to be marked with the IP address of 20.20.20.20.You would issue the following command against a system named sandi: nmap -S 20.20.20.20 -e eth0 -P0 -sS -v sandi The -P0 (no ping) and -sS (TCP SYN stealth port scan) enable Nmap to con- duct a TCP-based scan that does not first send out a ping packet.The -sS option helps the scan get past firewalls,which will often filter out initial SYN packets. To have your system use port 53 to originate packets to conduct the same scan,you would issue the following command: nmap -g 53 -S 20.20.20.20 -e eth0 -P0 -sS -v sandi Timing Your Scan Speeds Many intrusion detection systems will send alerts if a large scan occurs.You can use Nmap to test these IDS applications by using the -T argument,which allows you to have Nmap wait a certain interval between sending packets.The idea behind this option is that if a scan is spread out over time,the IDS will not be able to find it as quickly.This argument takes six options: (cid:2) paranoid Has Nmap send a packet only after five minutes have passed. You can specify the number 0,instead of paranoid,if you wish. (cid:2) sneaky Nmap will wait 15 seconds to send another packet.You can specify the number 1,instead of sneaky,if you wish. (cid:2) polite Waits 0.4 seconds to send packets.You can specify the number 2, instead of polite,if you wish. (cid:2) normal The default setting that has Nmap send another packet as soon as the target host sends a reply.You can specify the number 3,instead of normal,if you wish. (cid:2) aggressive and insane These options actually speed up the scan,and are useful only if you want to conduct quick ping and port scans.Be careful with these settings,as they may negatively affect network perfor- mance by generating a large amount of network traffic.Numbers 4 and 5 represent aggressive and insane,respectively. www.syngress.com
138_linux_03 6/20/01 9:36 AM Page 143 System Scanning and Probing • Chapter 3 143 Example: Conducting a Paranoid Scan To conduct a paranoid scan against a host,you would issue the following command: nmap -S 20.20.20.20 -e eth -P0 -sS -v -T paranoid sandi Remember however,that this scan will take some time to complete,because the paranoid setting has Nmap wait five minutes between sending packets. NOTE As you run Nmap, you may find that it takes considerable time to com- plete the scan. Usually, this is because some of the options you specify may cause Nmap to wait for some time before it can process the packets it generates. Sometimes, the scan is slowed by the firewalls or routers that exist between you and the host you are scanning. If you use mul- tiple arguments, or scan multiple remote systems, you may find that the scan will take several minutes to complete. Exercise: Using Nmap
- Copy nmap-2.53-1.i386.rpm from the accompanying CD,or go to www.insecure.org and download the Nmap RPM.
- Install the RPM using the following command: rpm -ivh RPM_File
- Now,issue the following command to a system running any Microsoft product: nmap -O -sS host You should see a list of the open ports,as well as Nmap’s guess con- cerning the operating system.Now,issue the same command on a Linux system.You will see a listing of the open ports,as well as a guess con- cerning the system kernel.Notice that it will not return information concerning whether this system is a Red Hat or Caldera system.This is because Nmap focuses on the kernel used,rather than any other feature. Now,save your query into a log file: nmap -O -sS host -v -oN file.txt hostname www.syngress.com
138_linux_03 6/20/01 9:36 AM Page 144 144 Chapter 3 • System Scanning and Probing 4. You will see that the scan is reported to standard output,as well as sent to the text file.Open file.txt to view your scan.Now,use Nmap to issue a ping scan of your entire network,but also have Nmap spoof the source IP address. 5. Although this will take some time,use the Nmap paranoid feature to conduct a scan of a host.Be prepared to come back after several hours to view the results. Using Nmap in Interactive Mode Thus far,you have used Nmap to issue single commands.Nmap’s “interactive mode”allows you to do two things that you should be aware of as a systems administrator: (cid:2) It can conduct multiple Nmap sessions/. (cid:2) It can disguise the fact that it is running on your system.Using the “spoof”feature,it is possible to make Nmap appear as an innocuous program,such as vi,or a daemon such as named (for DNS) or sendmail. To run Nmap interactively,you would issue the following command: nmap --interactive You will then see the following command prompt:nmap>. From here,you can issue Nmap commands.Figure 3.14 shows a sequence where the user starts Nmap,issues a simple scan of the entire 192.168.2.0/24 network,and then scans a system named Jacob.Notice how both requests go into the background,and that the second request finishes after the first request.All of these questions are answered later. Consider the usefulness of interactive mode when using the paranoid flag. You could,for example,issue several paranoid scans that could take days to com- plete.You could walk away,and then return and read the text file after the scan is complete.Because such scans can take several days to complete,it has become necessary for hackers to try to hide the process that spawns these scans.As a sys- tems administrator,you would likely not use this feature.However,you should be aware that seemingly benign processes may,in fact,be instances of Nmap. www.syngress.com
138_linux_03 6/20/01 9:36 AM Page 145 System Scanning and Probing • Chapter 3 145 Figure 3.14 Viewing Nmap’s Interactive Mode Exercise: Using Nmap in Interactive Mode
- Begin an interactive Nmap session: nmap --interactive
- Scan a remote system using the following command: nmap> n -sF -O -v hostname
- You will see that this scan did not go into the background.This is because you did not use the f command.Do so now,making sure to save your scan into a text file (otherwise,you will not be able to view the scan): nmap> f -sF -O -v hostname -oN scan.txt
- You should immediately see the prompt again and a PID number,such as [PID:9034].Just about as quickly,you will notice that this process fin- ishes.This is because you launched a scan as a background process,and this background process is complete.Open a second terminal to view the scan.txt file.Close the file when you are finished.
- Now,issue the following command to begin a paranoid scan of the same host.This time,disguise this scan as a process named /var/syngress: nmap> f -spoof "/"/var/syngress" " -sF -O -v hostname -oN -T 0 scanparanoid.txt www.syngress.com
138_linux_03 6/20/01 9:36 AM Page 146 146 Chapter 3 • System Scanning and Probing 6. Now,go to the second terminal and issue the following command: ps aux | grep syngress 7. You will see that the syngress process is running;actually,it is the Nmap scan taking place.You just as easily could have named this process named, httpd,sendmail,or any other daemon.As a systems administrator,consider the usefulness of carefully documenting the role of each of your servers so that if you see a suspicious service running,you can shut it down. Now that you are familiar with Nmap,consult the Nmap man page,as well as additional information at www.insecure.org. Using NmapFE as a Graphical Front End You are not limited to a command-line interface.The Nmap Front End (NmapFE) provides a well-written,stable GUI that allows you to control almost every aspect of Nmap.You can download NmapFE at www.insecure.org.It is available in both a tarball and an RPM (the RPM is available on the CD accompanying this book: nmap-frontend-0.2.53-1.i386.rpm).As with Nmap,the latter works best in Red Hat systems.Figure 3.15 shows the NmapFE interface after it has issued a FIN Stealth scan,in fast mode,using only a TCP ping that has been fragmented. Figure 3.15 The NmapFE Interface www.syngress.com
138_linux_03 6/20/01 9:36 AM Page 147 System Scanning and Probing • Chapter 3 147 Exercise: Using NmapFE
- Copy nmap-frontend-0.2.53-1.i386.rpm from the accompanyiong CD, or go to www.insecure.org and download the latest stable version of NmapFE.
- Install it using the rpm -ivh command.
- The GUI is quite intuitive.Issue commands at will.Notice,however, that although you can specify decoys and fragment,you cannot specify paranoid scans. NOTE You should note, however, that this interface is somewhat unstable, and given to faults that lead to complete crashes (core dumps). This is espe- cially the case in systems that have been upgraded (say, from Red Hat version 7.0 to 7.1). It is possible that upgrades create conflicts in some of the supporting libraries. Using Remote Nmap as a Central Scanning Device Thus far,you have used your local copy of Nmap to scan remote systems.Remote Nmap (Rnmap) enables a client system to connect to a central Nmap server. Developed by Tuomo Makinen,it is designed to allow network administrators a central Nmap source that is easy to administer and update.It is currently in beta, but both the client and the server are quite strong.Rnmap has the following features: (cid:2) User authentication (cid:2) A command-line and GUI client (cid:2) Available encryption (still in beta form) You can download Rnmap from http://rnmap.sourceforge.net.Rnmap is written in the Python scripting language,which means that your Linux system must have Python installed.Standard installations usually have Python installed, but you can check for its presence using the following RPM command: rpm -qa pyth www.syngress.com
138_linux_03 6/20/01 9:36 AM Page 148 148 Chapter 3 • System Scanning and Probing If you do not see any references to Python,download it from www.rpmfind .net,or obtain it from your installation disks.If you do not use RPM,you can search for the file using the find command: find / -name python Usually,the python interpreter is located at /usr/bin/python.Once Python is installed,you can then use the client and the server after unzipping them from their tarfile.No compilation is necessary,because the scripts for the server and the front end use the python interpreter.Because Python is portable between various operating systems,Rnmap is equally as portable. Exercise: Scanning Systems with Rnmap
- Copy rnmap_0.5.2-beta.tar.gz from the accompanying CD.Alternatively, go to http://rnmap.sourceforge.net and obtain version 0.5-beta of Rnmap.You must also have the Nmap application on the machine that will act as the server.If you wish to install a more current version of Rnmap,do so.However,the steps of this exercise are written for version 0.5-beta.
- Once you have downloaded Rnmap,unzip and untar the file using the following command: tar -zxvf Rnmapfile.tar.gz
- Unzipping and untarring this file creates the Rnmap directory.Change to it now.
- Make sure that you have Nmap installed.The server uses the standard Nmap binary to make queries and then provide access to the client.
- Once you have verified that Nmap is installed and have uncompressed the Rnmap files,you are ready to go.Remember,because Rnmap is written in Python,you do not have to compile anything.Remember, though,that Rnmap supports user-based access.In the server subdirec- tory,issue the following command to add a user: ./rnmap-adduser
- You will be asked for a username.Enter your username of choice.
- Enter a password.You will be asked to confirm it. www.syngress.com
138_linux_03 6/20/01 9:36 AM Page 149 System Scanning and Probing • Chapter 3 149 8. When you confirm your password,you may receive several error mes- sages.This is because you have not yet started the server.Generally,it is best to add a user first,because the server tends to not re-read the users.list file,which contains the username and password information. Once you start (or restart) Rnmapd,it will then correctly read the file. 9. Now that you have added a user,change to the server subdirectory,and begin the server as shown: ./rnmapd 10. You are now ready to use the client to connect to this server.Change to the client subdirectory.If you are in the server subdirectory,all you have to do is enter the following command: cd ../client 11. List the directory.You will see that two files are in it.The file named grnmp.py is the GUI client,and the file named rnmpa.py is the com- mand-line client.The GUI client is useful when using Rnmap interac- tively (i.e.,when you are sitting in front of the computer).The command-line client is useful when using Telnet or SSH.To use the GUI client,issue the following command: ./grnmap.py You will see the client shown in Figure 3.16. 12. Enter the name of the host you wish to scan. 13. Enter the Login ID and password you created in steps 6 and 7. 14. Select OS Detect,Verbose,Fragment IP,and FIN scan,and then click Scan.If you have entered the right password and the server is run- ning,the scan will complete.If you receive a message that reads “Can’t connect to remote host,”then the server is not running.If you receive an “Access denied”message,then you have used the wrong password. Verify your username and password information in the client,and then retry the connection.If this doesn’t work,add a new username and password,and kill and restart the server if necessary.When you are successful,you will see a screen similar to Figure 3.17. www.syngress.com
138_linux_03 6/20/01 9:36 AM Page 150 150 Chapter 3 • System Scanning and Probing 15. Now that you have verified the server is running,transfer the grnmap.py file to a remote Linux host and use it to contact your server.As long as this remote Linux host is using Python,it will work.Notice that this file is extremely small,and is thus quite handy.You can keep it on any system,or even on a floppy,along with several other files.Finally,you could use this file on a Windows system,if you wish,because Windows systems support the Python language and interpreter.For more informa- tion,go to www.python.org. Figure 3.16 The Rnmap GUI Client www.syngress.com
138_linux_03 6/20/01 9:36 AM Page 151 System Scanning and Probing • Chapter 3 151 Figure 3.17 A Completed Rnmap Scan Deploying Cheops to Monitor Your Network Cheops,developed by Mark Spencer,is intended as a network management tool. Its chief functioning features include: (cid:2) Automatic network scans to add all hosts present on the network (cid:2) A graphical network map of each host that shows the default gateway for the network (cid:2) The ability to provide crude port scans for each host (cid:2) Operating system identification (cid:2) Active monitoring of remote systems to see if the host is up,or if a particular service is up and running (cid:2) The ability to manually add or delete a host from the map www.syngress.com
138_linux_03 6/20/01 9:36 AM Page 152 152 Chapter 3 • System Scanning and Probing (cid:2) The ability to add an entire IP network or DNS domain to the map, and then have Cheops automatically add new hosts to the map (cid:2) The use of the Simple Network Management Protocol (SNMP) to query hosts (cid:2) Resolution of DNS names (including reverse DNS lookup) (cid:2) Use of ping or traceroute on each host on the map (cid:2) Ability to access the network services (e.g.,FTP,Telnet,and SSH) provided by a host on the map NOTE The most impressive feature that Cheops offers is scalability. You can configure Cheops to launch any application you wish to further help you determine the nature of a host. You will learn how to do this in the exer- cise later in this section. Billed as a graphical network neighborhood,Cheops is related to applications such as HP OpenView.HP OpenView is a sophisticated,expensive graphical front end that uses SNMP,a protocol that allows you to monitor remote systems. Both Cheops and HP OpenView allow you to create a graphical map of the net- work,and then manage any host on that map.Although Cheops is not nearly as sophisticated,it still allows you to quickly learn which hosts are up on a partic- ular network segment. The Simple Network Management Protocol (SNMP) helps you gain infor- mation from remote systems.It can also be used to set operating system values.It is commonly used on routers,as it can be used to change routing values,IP addresses,and any element of the operating system.SNMP requires that the remote system install small daemons,called agents,that accept commands from an application commonly called a “Network Management Station”(NMS). Examples of NMS applications include snmpwalk,snmpget,and Scotty.In the Windows world,the HP OpenView application is especially popular.Using NMS applications,it is possible to issue queries to agents to learn information such as: (cid:2) The configuration of the operating system,including IP addresses,active interfaces,and defined users. www.syngress.com
138_linux_03 6/20/01 9:36 AM Page 153 System Scanning and Probing • Chapter 3 153 (cid:2) Processes currently running on the operating system. (cid:2) The amount of IP,ICMP,TCP,and UDP traffic that has passed through an interface. (cid:2) A count of the number of routers a packet is supposed to travel through before it reaches a particular network.This number is often known as a hop count. If the system agents are allowed to write values to the operating system,it is possible to have these agents actually change the configuration of the operating system.For example,agents can change the IP address on some operating sys- tems.For more information about how SNMP works,install the UCD SNMP tools (discussed later in this chapter),and consult the snmpwalk and snmpget man pages.You can also learn more about SNMP at the Research Web site (www.snmp.org). How Cheops Works Cheops issues network broadcasts,and then processes these replies to discover remote hosts.Some older versions of Cheops use an application called Queso to read the replies of remote systems.Queso is similar to Nmap,although not as sophisticated or recent.Still,like Nmap,Queso uses stack fingerprinting to guess the operating system of a remote server.Once Cheops makes a guess as to the remote operating system,it will provide an icon that represents that remote host’s operating system.Although Queso is quite old,it is still remarkably accurate for today’s systems.Newer versions of Cheops use Nmap.However,some of the newer betas do not work as well on Linux systems,so it is recommended that you use Cheops version 0.59a-1 which can be found on the accompnying CD. An equivalent RPM version is also on the CD.You will see how it is possible to use Nmap with Cheops later in this chapter. NOTE Cheops also issues standard ping scan and port scan techniques to learn about a host’s available systems. One of its more useful features is the ability to specifically listen to remote system SNMP ports (161 and 162). www.syngress.com
138_linux_03 6/20/01 9:36 AM Page 154 154 Chapter 3 • System Scanning and Probing Obtaining Cheops You can obtain Cheops from any Red Hat 7.0 Power Tools CD,or from www.marko.net/cheops.Although the site provides a tarball file,the RPM works best for Red Hat systems. Required Libraries Cheops will run well on most Linux systems (we tested Cheops on Caldera, TurboLinux,Red Hat,and SuSE).You must,however,have the following gtk, glib,and SNMP packages installed first: (cid:2) gtk+10-1.0.6-9 or higher. (cid:2) glib10-1.x (cid:2) ucd-snmp (cid:2) ucd-snmp-devel (cid:2) ucd-snmp-utils (cid:2) All libraries associated with a graphics editing application called “The Gimp”(www.gimp.org),especially the gimp-devel package.Any package for Red Hat 6.2 or later,for example,will work,if you are using Red Hat Linux.Once you have installed GIMP and the additional libraries mentioned previously,you then have the libraries necessary to run Cheops. Open source applications often require that you spend time adjusting sup- porting libraries on your system.Sometimes,adjusting one supporting library requires you to adjust other libraries,because of dependencies.Sometimes,this can be very frustrating.The following is a list of all gtk libraries installed on a Red Hat 7.0 and Red Hat 7.1 system,respectively: (cid:2) gtkglarea-1.2.1-1 (cid:2) pygtk-libglade-0.6.6-4_helix_2 (cid:2) rep-gtk-gnome-0.15-0_helix_2 (cid:2) gtk+-devel-1.2.8-7_helix_1 (cid:2) gtk-engines-0.10-9_helix_1 (cid:2) gtk+10-1.0.6-9 www.syngress.com
138_linux_03 6/20/01 9:36 AM Page 155 System Scanning and Probing • Chapter 3 155 (cid:2) pygtk-0.6.6-4_helix_2 (cid:2) rep-gtk-libglade-0.15-0_helix_2 (cid:2) gtkmm-1.2.1-8 (cid:2) gtk+-1.2.8-7_helix_1 (cid:2) rep-gtk-0.15-0_helix_2 (cid:2) pygtk-0.6.6-4 (cid:2) rep-gtk-libglade-0.13-3 (cid:2) gtk+-1.2.8-7 (cid:2) gtk-engines-0.10-9 (cid:2) pygtk-libglade-0.6.6-4 (cid:2) rep-gtk-gnome-0.13-3 (cid:2) gtk+10-1.0.6-9 (cid:2) gtk+-devel-1.2.8-7 (cid:2) rep-gtk-0.13-3 (cid:2) gtkmm-1.2.1-8 Other combinations are possible;your system’s supporting libraries may vary. You can obtain the gtk+ and glib libraries either from your distribution disk,or www.rpmfind.net.The SNMP packages are important only for their libraries.You do not have to run the SNMP daemon in order to use Cheops,because the application simply uses the libraries,not the actual daemon.Most Linux distribu- tions include these SNMP packages,although you can obtain these at www.rpmfind.net as well. The Cheops Interface When you first start Cheops,you will see the Cheops Auto-scan dialog box, shown in Figure 3.18.If you click Yes,Cheops will begin to scan your network. Figure 3.18 The Cheops Initial Scan Dialog Box www.syngress.com
138_linux_03 6/20/01 9:36 AM Page 156 156 Chapter 3 • System Scanning and Probing Once Cheops finishes processing replies from remote hosts,the main Cheops interface will appear,as shown in Figure 3.19. Figure 3.19 Viewing a Small LAN in Cheops Of course,it is possible to map much larger networks.In fact,Cheops has been used to map hundreds of hosts,as well as trace the routers between hosts all across the Internet. NOTE As with many applications, Cheops works best on a nonswitched LAN. However, it is possible for it to obtain valid responses in switched environment. Cheops refers to the default screen as a page.You can create additional pages for additional networks or hosts,if you wish.You can then right-click on individual hosts to conduct simple port scans. www.syngress.com
138_linux_03 6/20/01 9:36 AM Page 157 System Scanning and Probing • Chapter 3 157 Mapping Relations between Computers Nmap allows you to determine routing in your network.You can do this by right-clicking on the actual page,and then select the Map | Map option. Mapping the network will cause Cheops to automatically generate lines between each host.These lines,shown in Figure 3.20,show how each host is related to the network’s default gateway. Figure 3.20 Viewing a Small Network Map Generated by Cheops Cheops Monitoring Methods Cheops is capable of two types of monitoring.First,it can have your Linux system issue simple ping requests to see if a remote host is up.If the host is up and responding,it receives a green icon.If a host does not respond,the network host will appear red.You should understand,of course,that a host is not neces- sarily down just because a host does not respond to ping requests.It is possible, for example,that an intervening firewall is blocking ping requests between your host and the remote system .It is also possible that the host you are monitoring has been configured to not respond to ping requests. The second type of monitoring at least partially solves this problem.Instead of relying on a crude ping request,Cheops allows you to pick a specific service www.syngress.com
138_linux_03 6/20/01 9:36 AM Page 158 158 Chapter 3 • System Scanning and Probing offered by the remote host.If,for example,you wish to monitor Apache Server on a remote Solaris host,you can configure the monitor daemon to test that port. To enable monitoring for a specific host,all you have to do is right-click on its icon,and then select the Monitoring? option.Figure 3.21 shows monitoring being enabled on the FTP and Web servers for the machine named sandi.stangernet.com. Figure 3.21 Monitoring Systems Using Cheops Once you click Save or Close (available in version 0.59 of Cheops),you will then be able to monitor if and when the Web and FTP server goes down by seeing the icon turn from green to red.You can also view past alerts by going to View | Event log to bring up the General Event Log,shown in Figure 3.22.You can then acknowledge an individual message,or all messages.Acknowledging the messages clears them from the log. Figure 3.22 The General Event Log www.syngress.com
138_linux_03 6/20/01 9:36 AM Page 159 System Scanning and Probing • Chapter 3 159 Connectivity Features You can use Cheops to connect to remote systems.If their services,such as Web, FTP,SSH,and Telnet,are up and running,all you have to do is right-click on the icon,and then select the service you want to use.When you right-click on the icon,the resulting menu is context sensitive for each system.This list will contain only those services that are currently running on this system.If,for example, system A is running SSH and a Web server,and system B is running a Telnet and an FTP server,the menu will be different for each system. However,two menu items will always be the same:ping and traceroute.You can specify different “helper”applications with this interface.For example,when you indicate that you want to use traceroute,Cheops will automatically open a terminal.You may not like the looks of this default terminal.In some cases,the default terminal may not appear correctly in your X session.You can change the default terminal by going to the File | Options menu and selecting the Helpers tab.You can then use the drop-down box to specify another terminal emulator,or you can enter your own command. Notes from the Underground… Cheops-ng Cheops-ng is a more recent version of Cheops. It uses an agent-manager structure. However, when it comes to Linux systems, Cheops-ng is not as stable as Cheops is. At your own risk, you can download Cheops-ng at http://sourceforge.net/projects/cheops-ng. If you use a Linux system, using the RPM is highly recommended. Version 0.0.1.3 does not compile properly on Red Hat 7.0 when installing it from a tarball. You must also install Nmap. However, the OS detection feature cur- rently does not work properly in Cheops-ng version 0.1.1 (the RPM ver- sion), because it searches for Nmap in the wrong location. Additional required libraries for Cheops-ng include adns (www.gnu.org/software/ adns), gnome, and libpcap (libpcap is on the accompanying CD). All but adns are installed by default in Red Hat 7.0 systems, and all of the RPM packages are available at www.rpmfind.net. Once you install Cheops-ng, you first run the /usr/sbin/cheops-agent daemon. You can then use the cheops-ng client to access the agent to Continued www.syngress.com
138_linux_03 6/20/01 9:36 AM Page 160 160 Chapter 3 • System Scanning and Probing map the network. One of the exciting things about Cheops-ng (when it works) is that you can use the Cheops-ng client to contact remote agents. These agents can then scan your system. The connection is encrypted, so any transmissions you make are relatively secure. This chapter does not focus on Cheops-ng because it is not stable at this point. Cheops-ng is, however, a promising project. Check its home page over time to see if it becomes truly stable. Now that you have learned about the most salient features of Cheops,it’s time to investigate how the program works.Although many different Cheops fea- tures vary from version to version,one of the more stable versions is 0.59a,and it is used in the following exercise. Exercise: Installing and Configuring Cheops
- Install Cheops and all supporting libraries.
- Start Cheops by issuing the following command:cheops &.
- Indicate that you do want to automatically scan for network hosts.What did you find?
- If you did not find anything,go to Page | Edit.This menu allows you to configure the networks that Cheops will scan and report.If necessary, remove any entries that are not appropriate for your network by clicking Remove Host/Network.Now,click Add Host/Network.
- Add the network address,followed by the subnet mask.Remember,a network address does not contain the host portion of your particular IP address.When you are finished,click OK.
- Click Update.
- Now,quit and restart Cheops.Have Cheops rescan your network to dis- cover hosts.
- You may have to add a few more hosts that were not scanned.You can do this by going to Page | Add host,and then entering the name or IP address of the host you want.
- Now,go to Page | Map to see how well Cheops maps the topology of your network.It is possible that Cheops will see your system as a router, even if it is not.This is a quirk of Cheops,because sometimes it will www.syngress.com
138_linux_03 6/20/01 9:36 AM Page 161 System Scanning and Probing • Chapter 3 161 identify the computer from which it is run as the router.Remember, this is open source code,after all. 10. The default setting is to use large icons to represent the hosts.Right- click on an empty part of the page,then select the View | List option, and then select the View | Small Icons option.You can return to the default view by selecting View | Icons. 11. Now,enable monitoring for a remote system.Ping the host to make sure it is up and responding to ping requests. 12. Instead of having to ping the system yourself,have Cheops do it for you. Highlight the system,and then right-click it. 13. Select the Monitoring? option. 14. First,do a simple monitoring test.Select the Availability (Ping) option. Change the frequency to 1 minute by changing the every entry to 1. 15. Click Save. 16. The icon for the host you are monitoring should be green.Now,shut down the remote system. 17. The icon for that host will turn red after a short time,because it has been configured to report the remote server’s condition.Now,open the Event log and view the alert. 18. Now,restart the remote system.You will see that the icon automatically turns green.Edit this setting so that it is more reasonable. 19. Next,right-click on this server and select the Scan? option.Cheops will conduct a scan,and when it is finished,Cheops will generate a report. Now,click More,and you will see a report similar to that shown in Figure 3.23. 20. Notice that the bottom window gives you more information about the daemons running on the remote system.Cheops 0.59a-1 uses a program called Queso to learn the operating system type.Because Cheops is a TCP/IP fingerprinting application,it is somewhat effective,but it is not maintained as actively as is Nmap.Configure Cheops to offer Nmap as a plug-in.Go to File | Options,and then select the Services tab. 21. You will see a list of predefined services.This window allows you to configure applications to contact different systems or ports.If,for example,you enter 0 in the Port field,and Cheops recognizes this www.syngress.com
138_linux_03 6/20/01 9:36 AM Page 162 162 Chapter 3 • System Scanning and Probing remote system as a responding system,Cheops will provide this option when you right-click on a host.You can then launch the application specified in the Command text box.If you enter an actual port,such as port 80,then this option will be presented only if that particular port is open.You can also use macros to make your commands more context specific.The %i macro,for example,allows you to specify the remote system’s IP address.Cheops will fill this value in automatically.The %h macro allows you to specify the remote system’s host name.Additional macros exist,and are explained in the interface.Now,click Add and enter Nmap in the Name field. Figure 3.23 Viewing a System Scan in Cheops 22. In the Port field,enter 0. 23. In the Command field,enter the following text string: %x -T 'We are going to Nmap %h' -e sh -c '/usr/bin/nmap -sS -O -P0 %I && read a' Make sure there is no space between the two ampersand characters, &&.In addition,make sure you use the standard apostrophe character (the one below the double quotes character to the right of your key- board) to enclose the Nmap command. www.syngress.com
138_linux_03 6/20/01 9:36 AM Page 163 System Scanning and Probing • Chapter 3 163 This text string has Cheops launch a terminal with the title of ‘We are going to Nmap hostname’,and then execute a shell,which then launches Nmap to conduct a stealth scan,an operating system identifica- tion.The host will not be pinged during the scan.The final part of the command has the terminal remain on the screen so you can read it. Otherwise,the terminal would completely disappear as soon as Nmap finished,making it impossible to read the output.Figure 3.24 shows the completed command. Figure 3.24 Creating an Entry for Nmap in Cheops 24. Click OK. 25. When you are finished,you will see your entry among all of the others, as shown in Figure 3.25. Figure 3.25 Viewing Cheops Command Entries www.syngress.com
138_linux_03 6/20/01 9:36 AM Page 164 164 Chapter 3 • System Scanning and Probing 26. Click Save to return to the Cheops main interface. 27. Right-click a functioning host.You will see your new entry appear. 28. Select your new Nmap entry and note the scan. 29. You have now configured Cheops to conduct a useful scan of your net- work hosts using a current piece of software. 30. Consider additional commands you could configure,including dig,snm- pwalk,and any other application that can help you further monitor your network. 31. Now,create another plug-in option by entering the following command: %x -t 'SNMPWALK of %h' -e sh -c 'snmpwalk %i publicname |less && read a' 32. This command has the program named snmpwalk query the system using the public name of “publicname.”Any system that has SNMP installed,and uses the public name of “publicname”will respond.You should,of course,change the public name to the one used on your sys- tems and routers. 33. Consider additional plug-ins.You can configure plug-ins to use com- mands such as snmpget,snmpset,host,GSS,or any others you wish you use.In addition,consider the different types of systems you wish to scan.For example,what applications would you want to configure if you used Cheops to monitor a DNS server,as opposed to monitoring a col- lection of routers and switches? 34. Cheops can send you its log messages by e-mail.This is an excellent way to check Cheops logs without first having to log in to the server.Go to File | Options,then select the Event Log tab.Enter the host name or IP address of the e-mail server you normally check every day to get your e-mail.Each event that Cheops logs,such as when your Web server goes down or comes back up,will be sent to you as it happens. You can now monitor systems and gather information about the services they are offering from a central console.You will find that such software significantly increases your ability to monitor the network and determine if any hosts have been brought down by attacks. www.syngress.com
138_linux_03 6/20/01 9:36 AM Page 165 System Scanning and Probing • Chapter 3 165 NOTE Cheops may crash and lose all of the service plug-ins you have defined, as well as the default plug-ins. You will find out that you have lost all of these services when you right-click an icon and are unable to choose any. Remember that Cheops creates the .cheops directory in your home direc- tory. If you lose your services, search for the ~/.cheops/services file. If it is empty, but present, delete the file. You will then get at least your default services back. However, you will lose all of the plug-ins you have config- ured. The best way to protect yourself against losing these plug-ins is to create a backup of the ~/.cheops/services file. If it is lost, you can then recopy the backup file in the place of the original. Deploying Nessus to Test Daemon Security Thus far,you have learned how to use port scanning and monitoring devices. These applications are quite effective in determining if your server is up and run- ning.They are perfect tools if you want to find out what type of service is lis- tening.However,using vulnerability detection software,you can find out exactly what specific application is listening on that port.A good hacker is well informed concerning the popular servers on the Internet,and can quickly take advantage of a specific daemon that has a security problem. Nessus allows you to proactively scan your systems to determine its weak- nesses.Nessus is comprised of a server and a client.The server runs only on Linux systems,whereas clients exist for Linux,Windows,and Macintosh systems. The Nessus home page is shown in Figure 3.26. Although no scanner can offer you a 100-percent solution,this scanner is updated often,and is in wide use.It will scan for the following types of problems: (cid:2) Old daemon and service versions that have known security issues (including sendmail,Finger,NIS,and NFS) (cid:2) Writeable anonymous FTP directories (cid:2) Open X Windows ports.X Windows ports can allow unauthorized users easy access to the system. www.syngress.com
138_linux_03 6/20/01 9:36 AM Page 166 166 Chapter 3 • System Scanning and Probing Figure 3.26 The Nessus Home Page (cid:2) CGI issues concerning Web servers (cid:2) Backdoors,Trojans,and DDOS daemons,such as TFN2k (cid:2) Extraneous services that have been activated and left running on a system.Just because you have deactivated a service using Bastille,doesn’t mean that the service will remain deactivated. (cid:2) Backdoors,which are daemons and applications that defeat your system’s authentication measures by opening ports that are tied directly to a login shell. Nessus uses special files,called plug-ins,to provide the “brains”for Nessus. You will learn how to update these plug-ins later in this chapter.Current ver- sions of Nessus use port 1241.Older versions of Nessus (anything earlier than version 1.0) used port 3001. www.syngress.com
138_linux_03 6/20/01 9:36 AM Page 167 System Scanning and Probing • Chapter 3 167 SECURITY ALERT! Like many scanners, Nessus contains various plug-ins that simulate attacks. Some of these plug-ins simulate attacks so effectively that they can crash systems. Although Nessus cannot destroy information on a remote system, it can: (cid:2) Issue an attack against the system so that it crashes. In other words, Nessus can conduct a DoS attack on your system while testing its ability to withstand DoS attacks. (cid:2) Generate vast amounts of network traffic that can affect end users on the network. It is a good idea to schedule your Nessus scans for off-peak hours. Be prepared to restart various servers. Most importantly, make sure that any server you scan with Nessus can be brought offline for a short period of time. The last thing you want to do is bring about an unplanned crash to a production server in the middle of the business day. The Nessus Client/Server Relationship The Nessus client,shown in Figure 3.27,allows you to connect to the Nessus daemon,which is usually on a remote server.Several different clients exist, including those for Windows,Macintosh,and Unix/Linux systems.You will learn more about the Windows client shortly.You can configure your Nessus daemon to expect encrypted (called “cipher”) or plaintext authentication.The wisest course of action is,of course,to choose cipher authentication,because it is more secure and because Nessus defaults to cipher mode. When you launch the client for the first time,it will take some time to create a public key pair,which will be used to authenticate with any Nessus daemon. In Figure 3.27,the Linux Nessus client has logged in to the host named Keats,using the username of nessusremote.It is very important that you under- stand that you must first log in to the Nessus server.Here are some addition things to remember when using any Nessus client: (cid:2) When the client first launches after compilation,it will ask you to create a password.This password has nothing to do with authenticating with the server.It is simply there to prevent an unauthorized user from accessing the client. www.syngress.com
138_linux_03 6/20/01 9:36 AM Page 168 168 Chapter 3 • System Scanning and Probing Figure 3.27 The Nessus Client (cid:2) Whenever you launch any Nessus client,the client is not logged on to any Nessus daemon.You will have to enter the Nessus host name,port, and login name,and then click Log In to connect.You must,of course, have the correct account created on the Nessus host,or authentication will fail.You will learn more about creating usernames for remote hosts later in this chapter. (cid:2) Once you log in,you will be presented with a list of plug-ins.You can then choose and configure them according to your preferences.If you are not logged in,the plug-ins menu will be blank. (cid:2) When you have logged in and chosen the plug-ins you wish to use,you must then click the Target Selection tab to choose a target host. Once you have completed a scan,you will see a report similar to that shown in Figure 3.28.When you have finished a scan,Nessus will do one of two things—either finish and inform you that no errors were found,or issue a reports www.syngress.com
138_linux_03 6/20/01 9:36 AM Page 169 System Scanning and Probing • Chapter 3 169 summary.You can double-click on the left-hand pane to see the individual alerts. As shown in Figure 3.28,you can then expand these alerts to learn more about the nature of the problem and how to solve it. Figure 3.28 Viewing a Report Generated by the Linux Nessus Client Windows Nessus Clients Several Windows clients exist,although WinNessus is the most reliable.As you can see in Figure 3.29,its interface is almost identical to the Linux client. Required Libraries Nessus requires the following libraries and applications: (cid:2) GTK The Gimp Toolkit,available at www.gimp.org,or at www.rpmfind.net. (cid:2) Nmap Available at www.insecure.org. (cid:2) m4 A macro utility used by many applications and daemons.It is standard equipment for most systems.You can obtain it from www.rpmfind.net. www.syngress.com
138_linux_03 6/20/01 9:36 AM Page 170 170 Chapter 3 • System Scanning and Probing Figure 3.29 The WinNessus Client In short,if you have installed the Graphics Image Manipulation Program (GIMP),you can install Nessus. Order of Installation Although the prebuilt RPM packages are useful,they do not provide additional features that allow you to conduct unattended and partial scans.You will learn more about these shortly.Thus,you should install Nessus from the tarball format. Regardless of the Nessus version you install,you must install the following tarball files in the following order,as root:
- nessus-libraries-1.0.7a.tar.gz
- libnasl-1.0.7a-1.tar.gz
- nessus-core-1.0.7a-1.tar.gz
- nessus-plugins-1.0.7a-1.tar.gz These files are all available at www.nessus.org and on the CD accompanying this book.Compiling these individual libraries is straightforward. www.syngress.com
138_linux_03 6/20/01 9:36 AM Page 171 System Scanning and Probing • Chapter 3 171
- Once you run gunzip against the nessus-libraries tarball,the tarball will create the nessus-libraries directory.Change to this directory,and then run the following commands: ./configure make make install
- Make sure that /usr/local/bin is in your system path If you install Nessus using RPMs,all files are installed in /usr/bin.You can verify your system path by entering the following command: echo $PATH
- Repeat these steps for the libnasl package.
- Once you get to the nessus-core package,you have one compilation option available to you.The following command and argument allows Nessus to conduct differential,detached,and continuous scans (you will learn more about these,later): ./configure --enable-save-kb --enable-save-sessions
- Once you have compiled the nessus-core package,repeat the ./configure,make,and make install steps for the nessus-plugins.
- Then,using a text editor,enter the following line into the /etc/ld.so.conf file: ./usr/local/lib
- To make sure these changes take effect,enter the following command, still as root: ldconfig What If I Don’t Want to Use X? If you want your server to act as a Nessus daemon,and not support the X client, you can disable gtk support by issuing the following argument to the ./configure script when installing the nessus-core package: ./configure --disable-gtk ; make && make install www.syngress.com
138_linux_03 6/20/01 9:36 AM Page 172 172 Chapter 3 • System Scanning and Probing RPM-Based Installations If you wish to install Nessus by using the RPMs,you would install the files in the following order:
- nessus-common-1.0.7a-1.i386.rpm
- nessus-server-1.0.7a-1.i386.rpm
- nessus-plugins-1.0.7a-1.i386.rpm
- nessus-devel-1.0.7a-1.i386.rpm
- nessus-client-1.0.7a-1.i386.rpm Each of these files is available at the www.nessus.org site and on the CD accompanying this book.Look for a special link at www.nessus.org that takes you directly to the RPM files.Understand,however,that most RPM binary installa- tions have not been compiled with the --enable-save-kb feature,which allows you to conduct detached and differential scans.If you do not want to use the X client when installing with RPMs,do not install the nessus-client package. NOTE When you first create a remote user using nessus-useradd, this remote user will use a one-time password that is passed across the network. Although the password is encrypted, it is still never a good idea to allow even encrypted passwords to regularly cross a network. Nessus, however, does this only once, because as soon as a Nessus user authenticates using the one-time password, the public keys are exchanged, and all sub- sequent authentication occurs using your public key. No password infor- mation will ever cross over the network, at least as far as this Nessus client and server are concerned. You can learn about a particular nessusd’s configuration, including its ability to conduct differential and detached scans, by issuing the fol- lowing command: /usr/local/sbin/nessusd -d The resulting output will inform you about the server version, as well as its ability to enter KB saving mode. www.syngress.com
138_linux_03 6/20/01 9:36 AM Page 173 System Scanning and Probing • Chapter 3 173 Configuring Plug-Ins Some of the plug-ins require you to enter additional settings in order to run effectively.For example,FTP,e-mail,and login checks often require you to enter default user account information.It is also possible to configure the FTP plug-in to actually store a file in the FTP directory to prove that it is writeable. Additional options exist,including those for Nmap.Figure 3.30 shows some of the options that you can configure. Figure 3.30 Configuring Nessus Preferences These options are available once you open the Nessus client and connect to a Nessus server.For specific steps on connecting the client to the server,consult the exercise later in this section.Notice that you can configure Nessus to forego using ICMP,and you can configure various Nmap settings.The preferences you configure here will apply to all scans you make using this client.The client will try to impose these settings on all additional servers. www.syngress.com
138_linux_03 6/20/01 9:36 AM Page 174 174 Chapter 3 • System Scanning and Probing Creating a New Nessus User Before you can use your Nessus client,you must define a user using /usr/local/ sbin/nessus-adduser,an interactive application that creates users in the ~/.nessus .keys file.Two types of users exist in regard to Nessus: (cid:2) Local These users are listed as username@127.0.0.1.These users can access Nessus only from the local system. (cid:2) Remote Users that are allowed to access nessusd remote systems.They will be listed as username@remote-ip-address,where remote-ip-address is the one you specify in the /usr/local/sbin/nessus-adduser program. Nessus-adduser allows you to add the users who are allowed to connect to the Nessus daemon and conduct scans.The process of adding local and remote users is quite different.Although you use nessus-adduser to add both,when you specify that you want to add a local user,Nessus will create a local key pair for this user. This key pair will be used to authenticate with the local nesssd daemon only. If you wish to add a remote user,you must first take the following steps:
- Using useradd or Linuxconf,add the user who will become a remote Nessus user.
- Launch nessus-useradd and add this same user.
- Tell nessus-useradd that this user is not a local user.
- Specify the IP address of the machine from which this user can connect. It is best to specify a single machine,but if you wish,you can specify an entire network.However,most versions of Nessus will automatically map this user account to the one IP address on the network that first makes the connection.Thus,even though you think you have allowed a user named nesussadmin to connect to a nessus daemon from the entire 192.168.3.0 network,if you connect to this daemon from the 192.168.3.75 host,this one host will be the only one that can use the nessusadmin account. The Rules Database Whenever you configure a new client in nessus-adduser,you will be asked whether you wish to apply a set of rules on this user.These rules determine the hosts that this user can scan.If the rules database is left blank,then the user can www.syngress.com
138_linux_03 6/20/01 9:36 AM Page 175 System Scanning and Probing • Chapter 3 175 scan all hosts.The following is an example of a rule set that allows a user to scan one host,and nothing more: accept 10.100.100.1/24 default deny The default deny entry forbids everything that is not specifically allowed.This particular list is likely too restrictive to be useful.Try the following: accept 10.100.100.0/24 192.168.2.0/24 default deny Now,a user with this rule set applied can scan all hosts in the 10.100.100.0/24 and 192.168.2.0/24 networks.For more information about Nessus,consult the nessus,nessusd,and nessus-adduser man pages,or the FAQ page at www.nessus.org. SECURITY ALERT! There may be times that you will have to reconfigure a server, and you may lose the private key of your Nessus server. If this happens, this server’s public key that your client uses to connect to this Nessus host will also become invalid. You will know this when your client informs you about a “spoof alert.” If this happens, edit or delete the .nessus.keys file in your home directory. When you add a new user to your Nessus host, you can then connect to this host. It will then send you a new public key, and you will be able to authenticate again using public key pairs. Exercise: Installing Nessus and Conducting a Vulnerability Scan
- Install Nessus from a tarball or from an RPM using the instructions given earlier. www.syngress.com
138_linux_03 6/20/01 9:36 AM Page 176 176 Chapter 3 • System Scanning and Probing NOTE If you install from an RPM, you will not be able to conduct differential and detached scans. If you install Nessus using tarball files, make sure that you specify ./configure --enable-save-kb --enable-save-sessions when you install the nessus-core files. 2. Log on locally to the system that will house the Nessus daemon. 3. Start Nessus using either of the following commands: /etc/rc.d/init.d/nessus start or (to manually run nessusd as a daemon): /usr/sbin/nessusd -D NOTE When installing Nessus, if you see a message informing you that there was an error in loading shared libraries, and that the libnasl.so.0 module can’t be found, you have not modified the /etc/ld.so.conf file to contain a reference to /usr/local/lib, and then run ldconfig. Even if you have, try it again. If you wish to stop nessus, issue the following command: killall -9 nessusd. 4. Issue the following command to create a local account that can administer the system (you can,of course,specify any user or password you wish): nessusd -P root,password 5. You now have established a username and password for a local user.Now, create a username and password for your local system named nessus: useradd nessus passwd nessus New UNIX password: Retype UNIX password: www.syngress.com
138_linux_03 6/20/01 9:36 AM Page 177 System Scanning and Probing • Chapter 3 177 This account is not used by nessusd.However,the nessus-adduser program will sense that this account exists,which will make it easier for you to allow remote clients to use this account. 6. Next,issue the following command: /usr/sbin/nessus-adduser 7. When prompted for a username,enter remotenessus. 8. Indicate that you want to use the cipher authentication method (the default) by simply pressing ENTER. 9. Nessus will ask you if the user you are adding is a local user.Indicate no (the default) by entering n,and then press ENTER. 10. You will then be asked to provide the IP address for the source host.This IP address should be of the client that will access the computer.If,for example,you are going to access this system from a remote host with the IP address of 10.100.100.1,enter 10.100.100.1,then press ENTER.Note: If you have only one Linux system,enter the IP address of that system. 11. Nessus will then ask you for a one-time password for this user.This pass- word is important,because nessusd and the Nessus client will use this pass- word once to initiate the public key exchange.Once this password is used, it will be discarded in favor of the public keys.Make sure you remember this password.Once you have entered this password,press ENTER. 12. Nessus will then ask you to enter rules for the remotenessus user.These rules determine exactly which networks and hosts this user will be able to scan.If you leave the rule empty,then no limitations will be applied, and this user account will be able to scan all systems.Leave this rule blank for this user,and press CTRL + D. 13. You will be given a chance to review the settings for remotenessus user.If they are acceptable,enter y to the question “Is that OK?”and press ENTER. 14. Once you have added this user,you will receive a “user added”message. If you see any other message,you must add this user again.The chief reason for errors is the failure to use useradd and passwd to add the user to the Linux database.To confirm that you have added this user,enter the following command: /usr/sbin/nessusd -L www.syngress.com
138_linux_03 6/20/01 9:36 AM Page 178 178 Chapter 3 • System Scanning and Probing 15. Notice that you can see the remotenessus account you just added.It cur- rently says that the account is based on a user password,rather than a user key.Notice also that it reads remotenessus@x.x.x.x.This means that remotenessus can only be used by that specific IP address.Understand that if the IP address is not the same as the system you are trying to use as a client,you will not be able to connect.Make sure that this account has the proper IP address of the system you will use as a client. 16. Open a nessus client on the machine with the IP address you listed in step 8.If,for example,you wish to use the Linux nessus client,you would enter the following at a command prompt:nessus &. 17. You will be prompted to create a password to protect the client against unauthorized use.Enter a password and confirm it,and then you will see the Nessus client main window.You are not currently logged in. 18. Prepare to log in to the remote nessus server.In the Nessus host tab, enter the name or IP address of the host running nessusd.In the Port window,make sure it reads 1241,because you are connecting to a newer server.In the Login field,enter remotenessus and click Log In. 19. You will be connected.The best way to tell that you are connected is that the Plug-ins window will appear automatically.If the client hangs after a minute or so,you have failed authentication.Once you are con- nected,go back to your server and issue the /usr/sbin/nessusd -L command again to view the key for the remotenessus user.You will notice that this user now has a user key entry.From now on,you will authenticate using public keys,rather than sending passwords across the network. 20. Now,use your Nessus client to conduct a remote scan.Select Enable All But Dangerous Plug-Ins,and then select the Prefs tab.Scroll down until you see the Nmap section.Choose the options you feel are appropriate for your situation,and then scroll down further to the FTP login account entries.Enter anonymous and an e-mail address here. 21. Scroll down further until you see the imap and POP3 valid account entries.Enter a username and password for each account.Make good guesses,as these will be used on every e-mail server you scan. 22. Click on the Target Selection tab and enter a remote server.Make sure that this server is not a critical server,and that you have authoriza- tion to scan these servers. www.syngress.com
138_linux_03 6/20/01 9:36 AM Page 179 System Scanning and Probing • Chapter 3 179 23. Once you have entered this server’s host name or IP address,click Start The Scan. 24. Nessus will show you a progress screen,similar to that shown in Figure 3.31. Figure 3.31 Nessus Scanning a System 25. After some time,the scan will finish.Depending on the nature of the host you have scanned,you will receive a detailed report explaining what Nessus has found.The report includes a description of the problem,a determination of the severity of the problem,and advice on how to fix it. Updating Nessus As with antivirus or IP fingerprinting programs,a scanner is only as good as its database of vulnerabilities.If the Nessus database could never be updated,the application would be worse than useless,because the old information would lull you into a false sense of security.Fortunately,the Nessus project has been quite active,and it has a good record for providing regular plug-in updates.Some of the plug-ins are written by Nessus developers;however,the majority are donated by Nessus users. www.syngress.com
138_linux_03 6/20/01 9:36 AM Page 180 180 Chapter 3 • System Scanning and Probing The most efficient way to update your Nessus daemon is to issue the fol- lowing command as long as you have Nessus 1.0 or later: nessus-update-plugins If you wish to update your Nessus plug-ins manually,follow these steps:
- Go to www.nessus.org and find the downloads page (as of this writing, www.nessus.org/plugins).
- Download the plug-ins.Usually,you can download all of the plug-ins,or choose to download only certain plug-ins that interest you.
- Copy any and all plug-ins to the following directory.The default direc- tory is /usr/local/lib/nessus/plugins/.It is possible that you have speci- fied a different directory in the /etc/nessus/nessus.conf file.
- Restart nessus.You can do this by using its system V script (/etc/rc.d/init.d/nessus start),or by finding the daemon’s PID,and then issuing the kill -HUP command. Understanding Differential, Detached, and Continuous Scans Earlier,you learned about options to specify when compiling the nessus-core files.These options,--enable-save-kb and --enable-save-sessions,allow the Nessus client and server to communicate in a more sophisticated way.Specifically, the compilation option allows the client to “remember”past sessions and to con- figure a nessus daemon to conduct a scan all by itself.These capabilities are respectively called differential and detached scanning.The ability to save sessions allows you to begin sessions that have been interrupted.All of these features will be enabled by default in later versions of Nessus;for now,you must compile them yourself. A differential scan is where Nessus can compare its current scan to past scan results and then provide you with a short list of changes.From this list,you can identify what daemons have been updated,shut down,or turned on.The two benefits of a differential scan are that you can quickly identify changes in a net- work host,and you will not have to generate as much network traffic.The --enable-save-kb option creates,among other things,an additional tab,KB, in the Nessus client.Figure 3.32 shows the KB tab. www.syngress.com
138_linux_03 6/20/01 9:36 AM Page 181 System Scanning and Probing • Chapter 3 181 Figure 3.32 Configuring Nessus to Do a Differential Scan in the KB Tab A detached scan allows you to use your client to attach to the Nessus daemon,request a scan,and then disconnect.Normally,if this were to happen, nessusd would cancel the scan.However,if you have enabled the --enable-save- kb feature,the scan will continue,and nessusd will then e-mail you the results of the scan.You can also use this feature to have Nessus conduct a new scan after a certain number of hours have passed.Figure 3.33 shows how to configure a properly configured client and server to conduct a detached scan.It is vital that you enter a valid e-mail address;because you will end communication with the server before the scan completes,you will not be able to view the results any other way. You have likely noticed the Continuous scan option.This allows you to repeat a scan multiple times.You can set the delay between two scans in seconds. Thus,to set a scan to happen daily,you could choose the Continuous scan option,and then specify the value of 28800 (eight hours),or 144000 (five days). For more information about KB saving,consult the following URL:www .nessus.org/doc/kb_saving.html. www.syngress.com
138_linux_03 6/20/01 9:36 AM Page 182 182 Chapter 3 • System Scanning and Probing Figure 3.33 Configuring the Nessus Client for a Detached Scan SECURITY ALERT! Improper use of detached and differential scans can seriously impact host and network performance. Be very careful when configuring these options, or you may inadvertently conduct a DoS attack against your own network. Exercise: Conducting Detached and Differential Scans with Nessus
- Make sure that the sendmail daemon is started: /etc/rc.d /init.d/sendmail start www.syngress.com
138_linux_03 6/20/01 9:36 AM Page 183 System Scanning and Probing • Chapter 3 183 2. Make sure that sendmail is in your path.If you are using the BASH shell,issue the following command: echo $PATH lots of output :/usr/sbin/ Another way to do this is to just type which sendmail and examine the full path to the executable.That path should be in the output of the echo $PATH command. 3. If sendmail is not in your path,enter the following: PATH=$PATH:/usr/sbin 4. Now,open your Linux nessus client. 5. Log in to your nessus daemon. NOTE Make sure the nessus daemon is compiled to allow detached scans. Use the /usr/local/sbin/nessusd-d command to learn more about the daemon’s configuration. 6. In the Linux Nessus client,select the plug-ins that you want to use. Configure any plug-ins as necessary. 7. Click on the Scan options tab,and select both the Optimize the test and Detached scan options.You will have to acknowledge that these scans can be dangerous. 8. Enter an e-mail address you can readily check in the Send results to this email address section. 9. When you have verified all settings,click Start The Scan.After some time,you will receive an e-mail report concerning the scan.If you receive no e-mail report,then the scan did not find any vulnerabilities. 10. Now,you are ready to do a differential scan.First,conduct a full scan of a host. www.syngress.com
138_linux_03 6/20/01 9:36 AM Page 184 184 Chapter 3 • System Scanning and Probing 11. Once this scan has completed,click on the KB tab and select the Enable KB saving,Reuse the knowledge bases about all the hosts for the test,and Only show differences with the previous scan buttons. 12. Conduct your scan of the same host again. 13. The scan will not execute any new commands,because you have effec- tively told Nessus to skip these tests,because you already know about the weaknesses.Now,if you update Nessus and it receives additional plug-ins,only these plug-ins will be used for future scans.Be careful, however,with this setting.If you leave it enabled,Nessus will not con- duct these scans on this host,which could lead you into a false sense of security. 14. Disable KB saving for now. 15. To enable continuous scans,prepare your scan,and then select the Scan options tab.Select the Continuous scan button,and then enter an appropriate value,such as 201600 for a weekly scan (every seven days). Next,begin your scan.The initial scan will begin and (eventually) finish, and then it will begin again automatically in seven days,if nessusd is still running and available. www.syngress.com
138_linux_03 6/20/01 9:36 AM Page 185 System Scanning and Probing • Chapter 3 185 Summary In this chapter,you learned how to scan your operating system for viruses.You then learned more about how to stop DDoS attacks.Although applications such as Zombie Zapper are not foolproof,they can still help you prepare against such attacks.You should remain current about DDoS attacks and learn more about related tools that can help you recover from this type of security breach.This way, if a system is compromised,you can recover from the event in a graceful way, rather than simply shutting down your system. You then learned how to scan your system’s ports using tools such as Gnome Service Scan and Nmap.The latter program is somewhat more sophisticated,in that it allows you to learn the version of the operating system you are using,the open ports,and the system’s TCP sequencing abilities.Nmap is an important tool to understand,because it is used in many other applications,including Cheops and Nessus. Although not specifically a security application,Cheops enables you to mon- itor systems on your network,and provides a graphical map.This map is func- tional,in that you can then right-click on host icons to access these services. Finally,you learned how to use Nessus,a powerful vulnerability scanning tool. Nessus provides you with the ability to update its configuration,and is able to conduct detailed tests of any host on your network. You now have a thorough understanding of the tools required to lock down and test your system’s services.In the next chapter,you will learn more about how to enhance host and network logging so that you can discover if your system has been compromised. Solutions Fast Track Scanning for Viruses Using the AntiVir Antivirus Application (cid:59) Virus scanners will perform the following tasks:check the system’s boot record;search directories and subdirectories;automatically delete infected files;save scans into a log file;use an internal scheduler,or an external scheduler,such as at or cron;scan NFS-mounted drives;delete infected files;and move infected files to a central,“quarantine”area of your own choosing. www.syngress.com
138_linux_03 6/20/01 9:36 AM Page 186 186 Chapter 3 • System Scanning and Probing (cid:59) The AntiVir for Servers binary is a truly impressive command-line virus scanner sold by H+BDEV.It is capable of searching for and deleting macro viruses,boot sector viruses,e-mail viruses,and DDoS daemons. (cid:59) An antivirus application is only as useful as its virus definition file.Your application should provide you with frequent updates. Scanning Systems for DDoS Attack Software Using a Zombie Zapper (cid:59) Attackers wage denial of service (DoS) attacks by first finding and hacking into insecure systems on the Internet.Then,they install pro- grams such as Tribe Flood Network 2000 (Tfn2k),stacheldraht,and others.The compromised systems now have illicit programs installed on them called zombies. (cid:59) Once a zombie is commanded to attack a victim,it will generally con- tinue the attack until it is forced to stop.If you notice large amounts of unknown traffic when you monitor your network or network perimeter, you can use a zombie zapper against the host or hosts generating this traffic. (cid:59) Limitations of a zombie zapper can include the following:they are pro- grammed to shut down only certain DDoS servers;it may be blocked by a firewall;the malicious user may have changed the password of the illicit server;or the attack server may have spoofed packets. Scanning System Ports Using the Gnome Service Scan Port Scanner (cid:59) Systems administrators find port scanners useful when auditing their own systems.Although a simple port scanner such as GSS does not actu- ally test for flaws in binaries and Web applications,a good port scanner can help you isolate which ports are open,and then take any action that is necessary. (cid:59) Port scanning a machine may set off an alarm for the system’s adminis- trator,who might take a dim view of your actions.Unless you have explicit (sometimes,even written) permission from the system adminis- trator,you may cause a serious violation of your security policy. www.syngress.com
138_linux_03 6/20/01 9:36 AM Page 187 System Scanning and Probing • Chapter 3 187 Using Nmap (cid:59) Nmap is an advanced Unix-based port scanner.It can be used to audit your network,test your router and switch configurations,test your fire- wall configurations,and identify the nature of suspicious remote systems. (cid:59) You can use Nmap as a basic port scanner for a system on your internal network,or you can have it identify the operating system version of a remote system on another firewall-protected network.Nmap is capable of manipulating aspects of TCP to hide its scans from firewalls. (cid:59) Nmap’s “interactive mode”allows you to do two things that you should be aware of as a systems administrator:It can conduct multiple Nmap sessions,and it can disguise the fact that it is running on your system. Using Nmapfe as a Graphical Front End (cid:59) The Nmap Front End (NmapFE) provides a well-written,stable GUI that allows you to control almost every aspect of Nmap. (cid:59) Note that this interface is somewhat unstable,and given to faults that lead to complete crashes (core dumps).This is especially the case in sys- tems that have been upgraded (say,from Red Hat version 7.0 to 7.1). Using Remote Nmap as a Central Scanning Device (cid:59) Remote Nmap (Rnmap) enables a client system to connect to a central Nmap server.It is currently in beta,but both the client and the server are quite strong. (cid:59) Rnmap has the following features:user authentication,a command-line and GUI client,and available encryption (still in beta form).Rnmap is written in the Python scripting language,which means that your Linux system must have Python installed. Deploying Cheops to Monitor Your Network (cid:59) Billed as a graphical network neighborhood,Cheops is related to appli- cations such as HP OpenView.Both Cheops and HP OpenView allow www.syngress.com
138_linux_03 6/20/01 9:36 AM Page 188 188 Chapter 3 • System Scanning and Probing you to create a graphical map of the network,and then manage any host on that map.Although Cheops is not nearly as sophisticated,it still allows you to quickly learn which hosts are up on a particular network segment. (cid:59) Cheops issues network broadcasts,and then processes these replies to dis- cover remote hosts.Some older versions of Cheops use an application called Queso to read the replies of remote systems.Queso is similar to Nmap,although not as sophisticated or as recent.As with Nmap,Queso does use stack fingerprinting to guess the operating system of a remote server. (cid:59) Cheops is capable of two types of monitoring.First,it can have your Linux system issue simple ping requests to see if a remote host is up. Second,instead of relying on a crude ping request,Cheops allows you to pick a specific service offered by the remote host. Deploying Nessus to Test Daemon Security (cid:59) Using vulnerability detection software,you can find out exactly what specific application is listening on that port.A good hacker is well informed concerning the popular servers on the Internet,and can quickly take advantage of a specific daemon that has a security problem. Nessus allows you to proactively scan your system to determine its weaknesses. (cid:59) The Nessus client allows you to connect to the Nessus daemon,which is usually on a remote server.Several different clients exist,including those for Windows,Macintosh,and Unix/Linux systems. (cid:59) The Nessus project has been quite active,and has a good record for pro- viding regular plug-in updates. (cid:59) When you launch the client for the first time,it will take some time to create a public key pair,which will be used to authenticate with any Nessus daemon. (cid:59) The compilation option allows the client to “remember”past sessions and to configure a nessus daemon to conduct a scan all by itself.These capabil- ities are respectively called differential and detached scanning.The ability to save sessions allows you to begin sessions that have been interrupted. www.syngress.com
138_linux_03 6/20/01 9:36 AM Page 189 System Scanning and Probing • Chapter 3 189 Frequently Asked Questions The following Frequently Asked Questions, answered by the authors of this book, are designed to both measure your understanding of the concepts presented in this chapter and to assist you with real-life implementation of these concepts. To have your questions about this chapter answered by the author, browse to www.syngress.com/solutions and click on the “Ask the Author” form. Q: I have downloaded and compiled AntiVir.However,it says that I am running in “non-key mode,”and won’t allow me to scan any subdirectories off the /directory.Why not? A: You need to obtain the license key from www.hbedv.com.You can either purchase a license,or use the private license,if you are qualified.Once you obtain this key,rerun AntiVir.You will see that the “non-key mode”message no longer appears.This key will also allow you to obtain an update every two months.If you do not want to obtain a license,you can still scan each subdi- rectory manually. Q: Although I can compile and configure TkAntivir,I can’t seem to get it to run.I was able to start it,and saw the “splash screen,”but then I saw nothing. What is wrong? A: Some window manager environments do not support TkAntivir well.Try running TkAntivir in Gnome or KDE.In addition,you need to have suffi- cient resolution (at least 800 x 600) in order for TkAntivir to run. Q: The configuration script for TkAntivir crashes every time I run it.What can I do? A: Make sure that you have the correct libraries and resolution for the program. See the instructions earlier in this chapter,as well as information at the TkAntivir site (www.geiges.de/tkantivir).If your system supports RPM files, try using RPM instead. Q: Is it legal for me to scan other people’s systems using Gnome Service Scan or Nmap? A: While legal issues are rather complex,it is never acceptable to scan systems that are not your own.You should scan only those systems for which you are www.syngress.com
138_linux_03 6/20/01 9:36 AM Page 190 190 Chapter 3 • System Scanning and Probing directly responsible.You can also scan any system if you have been given explicit permission to do so. Q: When using Rnmap,I keep getting an “Access is denied message.”Why? A: You must add a user using the ./rnmap-adduser command.You can receive this message only if Rnmap is running.Otherwise,you would receive a “Can’t connect to remote host”message.A common mistake is to assume that the GUI interface will remember the password.This is not the case,and you will have to re-enter the password each time you want to connect to the remote Rnmap server. Q: I want to enable KB saving sessions for Nessus,but I can’t see the KB tab. Which client has this tab? A: You must manually compile KB and session-saving support.If you installed Nessus using an RPM,these features are not enabled. www.syngress.com
138_linux_04 6/20/01 9:38 AM Page 191 Chapter 4 Implementing an Intrusion Detection System Solutions in this chapter: (cid:2) Understanding IDS Strategies and Types (cid:2) Installing Tripwire to Detect File Changes (cid:2) Updating Tripwire to Account for Legitimate Changes in the OS (cid:2) Configuring Tripwire to Inform You Concerning Changes (cid:2) Deploying PortSentry to Act as a Host- Based IDS (cid:2) Configuring PortSentry to Block Users (cid:2) Optimizing PortSentry to Sense Attack Types (cid:2) Installing and Configuring Snort (cid:2) Running Snort as a Network-Based IDS (cid:2) Configuring Snort to Log to a Database (cid:2) Identifying Snort Add-Ons (cid:59) Summary (cid:59) Solutions Fast Track (cid:59) Frequently Asked Questions 191
138_linux_04 6/20/01 9:38 AM Page 192 192 Chapter 4 • Implementing an Intrusion Detection System Introduction Perhaps the best way to ensure system security is to have your system or network report certain changes to you.In this chapter,you will learn more about open source intrusion detection tools that can help you detect activity at the system and network level. Chances are,your home or place of work has an alarm system.A home alarm is an intrusion detection device.Generally a system device at your home—or at your place of work or in your car—will do the following: (cid:2) Accept programming to work reliably when you are away. (cid:2) Actively monitor the likely break-in points. (cid:2) Use motion sensors to aid in monitoring an empty home. (cid:2) Detect an unwanted intruder. (cid:2) Send an alert to you or a trusted third party in case of an event. In regards to computing,an Intrusion Detection System (IDS) is any system or set of systems that has the ability to detect a change in the status of your system or network.An IDS can then send you alerts or take appropriate predefined actions to help you protect your network.In the introduction to this book,you learned that an IDS auditing station can monitor traffic.An IDS can be something as simple as a network host using a simple application,such as Tcpdump,to learn about the condition of a network,or it can be a more complex system that uses multiple hosts to help capture,process,and analyze traffic.Because an IDS can contain multiple hosts and applications,this chapter often uses the term IDS application to refer to a specific IDS element.Generally,an IDS will have the following five elements: (cid:2) An information gathering device One of the IDS elements must have the ability to capture data.For example,it must be able to detect changes on a hard drive,capture network packets,or read open system files. (cid:2) An internal process monitoring mechanism The IDS should have the ability to monitor itself and conduct self checks so that it can inform you (or a person you designate) that it is working properly.For example, Tripwire can warn you about a problem by using cron to alert you that the database is missing.An IDS such as Snort can inform you about problems by sending messages to the /var/log/messages file. www.syngress.com
138_linux_04 6/20/01 9:38 AM Page 193 Implementing an Intrusion Detection System • Chapter 4 193 (cid:2) Information storage capability The IDS must be able to store the network packet information it obtains in a carefully organized way that allows you to store data in an organized manner. (cid:2) A command and control device The IDS must provide a way for you to easily control its behavior. (cid:2) An analysis device The IDS should provide you with the ability to search your organized data store using queries and/or applications. You will see in the following sections how each of these IDS elements is implemented. Tools & Traps… False Alarms If your car alarm system is like most others, it sometimes goes off because it mistakes legitimate activity for a break-in. And, the alarm will usually go off at the most inconvenient time possible. Especially at first, you will find that your IDS will mistake legitimate activity for an attack. Whenever an IDS triggers an alert by mistake, it is said to have gener- ated a false positive. Generally, a false positive is caused by any one (or more) of the following: (cid:2) The IDS application has been improperly configured so that it reacts to legitimate traffic. (cid:2) The type of network traffic has changed, and the IDS is unaware of the change. (cid:2) You need to update the IDS application. Sometimes an update means that you have to edit the configuration file. In other cases, you will need to download new plug-ins and files so that the IDS application is able to cope with new types of network data or new signatures. (cid:2) It is the nature of the beast. Sometimes, an IDS application just won’t be as reliable as you’d like. It is the nature of most IDS applications to make mistakes, because IDS applications are just barely leaving their infancy. Even the most costly and perfectly marketed IDS is bound to generate false positives; Continued www.syngress.com
138_linux_04 6/20/01 9:38 AM Page 194 194 Chapter 4 • Implementing an Intrusion Detection System this problem has nothing to do with the nature of open source applications. So, as you go about installing IDS applications, you will at first be very pleased that you are logging anything at all. You will be excited that you are receiving alerts about internet Control Message Protocol (ICMP) packets and User Datagram Protocol (UDP) echoes. After a while, how- ever, you will find yourself hoping that you can make all of this infor- mation cohere into something useful. At this point, you will begin to tell a true alert from a false positive. Understanding IDS Strategies and Types Two general strategies are used when it comes to detecting intrusions: (cid:2) Rule-based IDS applications (also called signature-based) This is the most common type of IDS,mainly because it is easier to install.After you are able to get the IDS to load all of the signatures properly,you are on your way to establishing an effective IDS.The challenge in regards to a signature-based IDS is making sure that the rules remain current. Similar to an anti-virus application,if you have old signatures,the IDS will not capture and react to the latest attacks. (cid:2) Anomaly-based IDS applications This type of IDS first spends time gathering a sample of baseline (acceptable) network activity.The IDS stores this information in a database,then responds to traffic that falls outside the accepted baseline of activity.This type of IDS application is generally more challenging to configure,because it is rather difficult to determine exactly what “acceptable”and “normal”is,in regards to net- work traffic. Rule-based IDS applications sometimes rely upon the terms rule and signature, which are used interchangeably.Traditionally,the term signature refers to an actual attack that has been identified.Any time,for example,that a port scan occurs,the fact that a number of ports have been scanned in a short period of time com- prises a signature.A rule,on the other hand,is the piece of code that you use to inform your IDS application about a specific signature.Therefore,a rule enables an IDS to recognize an attack,log it,then send out alerts and/or reconfigure operating system or firewall parameters. www.syngress.com
138_linux_04 6/20/01 9:38 AM Page 195 Implementing an Intrusion Detection System • Chapter 4 195 IDS applications do their work either continuously in “real-time,”or at cer- tain intervals.Real-time intrusion detection is often useful in the following cases: (cid:2) You are using a host-based IDS application,and you wish to supplement your host’s security. (cid:2) Your network has had a history of attacks,and you wish to use your net- work-based IDS application to trace and/or stop them. (cid:2) You have systems that are capable of logging large amounts of traffic. (cid:2) You have the time to check all of the logs generated by the IDS. Continuous intrusion detection may seem to be the only real option,but this is not always the case.This strategy can often provide too much information,and so you may want to enact interval-based intrusion detection.Possible times to acti- vate your IDS may include: (cid:2) Any time when you are not able to monitor traffic,such as after your regularly scheduled work times and during weekends and holidays. (cid:2) At random times during the regular workday.This strategy reduces the amount of log files,yet also gives you an idea of what is happening on your network. You may also wish to have your IDS application generate new log files after a certain period of time.For example,if you are logging to a database,have the IDS archive its log files and begin a new log file.This way,you can search through a manageable 2MB log file,as opposed to a monstrous 2GB file. IDS Types Although there are many different IDS application vendors,two different types of IDS applications exist: (cid:2) Host-based An IDS application that either scans system logs and open network connections,or that scans the hard disk and then alerts you if an event occurs. (cid:2) Network-based An IDS application that listens for traffic as it passes across the network. www.syngress.com
138_linux_04 6/20/01 9:38 AM Page 196 196 Chapter 4 • Implementing an Intrusion Detection System Host-Based IDS Applications As you might suspect,a host-based IDS application resides on a single network host and then monitors activity specific to that one host.All host-based IDS applications run as daemons.Two types of host-based IDS applications exist: (cid:2) Log analyzers (cid:2) System drive analyzers Log analysis IDS applications generally run as daemons and scan log files in real time.They search for open network connections,and/or monitor the ports on your system.Each time a port is opened,the log analysis IDS application will then listen in to find out what is happening on these ports. System drive analyzers scan a system’s hard drives and other peripherals (removable drives,tape drives,print devices,and so forth) and then create a database.This database contains a record of the “original”condition of the system’s hard drives,for example.Then,whenever the drive analyzer detects a change,it can take action by,for example,logging the change or sending an alert. All host-based IDS applications require some sort of policy file that deter- mines the behavior of the application. Network-Based IDS Applications Network-based applications operate at the application through network layers of the Open Systems Interconnection Reference Model (OSI/RM).They have become quite popular,because it is generally considered that they are the easiest to configure,and most network administrators simply like being able to look at all of the network packets as they cross the network.However,after the novelty of seeing the packets wears off,more-seasoned professionals realize that network- based IDS applications tend to generate a great deal of traffic,which few people take the time to properly analyze.Still,network-based IDS applications are extremely helpful when you wish to analyze network traffic. Although not necessary,using several different hosts when creating a net- work-based IDS application is often wise.The use of multiple hosts can help ensure that you have enough processing power and storage space to properly cap- ture,store,and analyze traffic.Figure 4.1 shows how a network IDS can break up these duties among several different systems on the network. The network IDS shown in Figure 4.1 greatly simplifies the flow of informa- tion in a network-based IDS.As network traffic is generated,the sensor pulls the www.syngress.com
138_linux_04 6/20/01 9:38 AM Page 197 Implementing an Intrusion Detection System • Chapter 4 197 packets into the host.Then,the Monitor and Storage host pulls the file that con- tains the packets from the sensor.The Analyzer/Control station can then either read the packets where they are stored,or it can actually pull selected log files from the Monitor and Storage station. Figure 4.1 A Sample Intrusion Detection System Internet Firewall Network Host Network Host Sensor Router Network Traffic Monitor and Storage Network Host Network Host Analyzer/Control Station IDS Applications and Fault Tolerance You may be asking yourself why anyone would use so many systems just to implement an IDS.It is important that your IDS does not have a single point of failure.The use of redundant systems provides fault tolerance and enhanced per- formance.In regards to fault tolerance,a dedicated system—such as an IDS sensor—will generally fail less often than a system responsible for multiple responsibilities,such as a single system that is responsible for monitoring,storage, and analysis.The principle that applies to computing also applies to mechanical devices,such as engines:The more moving parts you have,the greater the chance that one of these parts will fail.When it comes to computing,distributing tasks among several different machines actually reduces the chance of a problem. www.syngress.com
138_linux_04 6/20/01 9:38 AM Page 198 198 Chapter 4 • Implementing an Intrusion Detection System Distributing tasks ensures that if one element fails,then your IDS has not been completely shut down.For example,should the Analyzer/Control station fail,intrusion detection will still occur,because the sensor can still grab packets.If the Monitor and Storage station fails,the IDS will still be able to gather the information.Fixes can be made quickly,and you can concentrate on only one element of the broken IDS,rather than trying to figure out exactly which ele- ment has failed. The information can stay on the Monitor and Storage device,or it can be brought to the Analyzer/Control station.The Monitor and Storage device may have all log files ready to be served up via a Web server.The Analyzer/Control station may be nothing more than a simple Linux host using a Web browser.The administrator at the Analyzer/Control station can then use a Web browser to access the Monitor and Storage device’s Web server.Also,network administrators commonly use a program such as Secure Shell (SSH) to open a terminal-based connection and then query the database or log files directly. Of course,dividing tasks even further between hosts is possible,or simply making one host responsible for all tasks.Ultimately,your management team is responsible for determining the needs for your network.As far as performance is concerned,consider that in many cases,an effective IDS application requires a great deal of processor time in order to work well.Log files require a great deal of hard drive space,especially in busy networks.Thus,simply for the sake of perfor- mance,consider using multiple systems to gather,store,and analyze information. NOTE Whenever you transfer information between different hosts, make sure that this information is encrypted and authenticated. If you do not do so, a malicious user may be able to “sniff” the network and gather sensi- tive information about your network. Information can include the pass- words used to access systems, as well as the actual log files themselves. www.syngress.com
138_linux_04 6/20/01 9:38 AM Page 199 Implementing an Intrusion Detection System • Chapter 4 199 Damage & Defense… IDS Implementation Three factors will determine your ability to implement an IDS: (cid:2) Security policy The very first thing that you should imple- ment is a comprehensive security policy. Your security policy is the first tool necessary to implement any security measure. (cid:2) Cost Although an open source IDS can be very cost effective, you may not have enough resources available to implement a multiple-host IDS. (cid:2) Support staff Make sure that you have enough people to properly implement, maintain, and analyze the IDS you wish to implement. It is rather common for an IDS application to log activity, only to have the systems administrators ignore this information because they are too busy to read the logs. NOTE Most network-based IDS applications do not work properly in a switched network. Many systems administrators have voiced frustration that their IDSs don’t work properly, only to learn that the reason is that the net- work uses virtual LANS (vlans), which do not broadcast traffic, as does a standard hub-based Ethernet network. You have several options, listed here in order of preference: (cid:2) Configure your network switch to allow one port to monitor all traffic, then plug your host into this monitor port. (cid:2) Find a location between the switch and the router, and plug in a standard hub. (cid:2) Obtain a network-based IDS, such as Ettercap (http://ettercap .sourceforge.net), that helps sniff traffic in switched networks. The best option is to configure your switch so that it will monitor all traffic. Introducing a new piece of hardware can increase network latency and even introduce security problems, if you do not enforce sufficient physical security. www.syngress.com
138_linux_04 6/20/01 9:38 AM Page 200 200 Chapter 4 • Implementing an Intrusion Detection System What Can an IDS Do for Me? Thus far,you have learned about IDS responsibilities in a general way.An IDS can provide the services presented in Table 4.1. Table 4.1 Services Provided by an IDS Service Description Traffic identification An IDS application must always accurately identify the nature of the break-in or the nature of the traffic, including source and destination ports and addresses. Logging enhancement Most IDS applications require that you establish and threshold limits. After a limit (threshold) has been exceeded, enforcement the IDS application will then send alerts and/or log behavior. An IDS generally extends your logging capability by placing additional information into a log file or into a database. Alerting An IDS often has the ability to send alert messages to the network administrator or responsible party. System reconfiguration Many IDS applications provide you with the ability to reconfigure the operating system or a firewall in case of an attack. For example, PortSentry has the ability to automatically update the /etc/hosts.deny file and effectively deny access to any services offered by xinetd. Drive verification This offers the ability to take a snapshot of the network or operating system, then send you alerts when an anomalous event occurs. The following sections describe each of the IDS services in greater detail. Traffic Identification Perhaps the most important element of an IDS that logs network traffic is that it can inform you about all details of a packet that enters your network.A host- based IDS can identify the following items: (cid:2) Protocol type The IDS will inform you about the nature of packets on the network.It will report whether the packet is UDP,TCP,ICMP, and so forth. www.syngress.com
138_linux_04 6/20/01 9:38 AM Page 201 Implementing an Intrusion Detection System • Chapter 4 201 (cid:2) Origin The source IP address of the system.Hopefully,this is a source IP address that has not been spoofed. (cid:2) Destination Where the packet was sent. (cid:2) Source port If the packet is a UDP or TCP packet,the application will tell you which port the originating host used. (cid:2) Destination port For UDP and TCP packets,the port on the destina- tion host. (cid:2) Checksums The checksums that guard the integrity of the transmitted packets. (cid:2) Sequence numbers If,for example,your network host receives a number of ping packets,the IDS can tell you the order in which they were generated.Understanding the sequence numbers can help you understand the nature of the attack. (cid:2) Packet information Many IDS applications can delve deep into the packet and analyze its contents. One of the more useful elements of an IDS is that it can make educated guesses about the nature of traffic.Part of the ability to monitor traffic is the ability for the IDS to suggest that a portion of traffic may constitute a port scan or other network security problem.This can help you take steps to block it by, for example,reconfiguring the firewall or moving a network host. Logging Enhancement Logging enhancement is closely related to traffic identification,because most of the time,the additional information discussed earlier is placed in some sort of log file on the local system or on a remote system.Using enhanced logging informa- tion,you can conduct tracebacks,which give you the ability to learn the source of a network packet.Many times,however,achieving an accurate traceback is not possible,because more experienced hackers are able to spoof IP connections.Be careful:You may think that you have identified and caught a malicious user,but in fact,the person with the suspect IP address and host name may know nothing about the attacks waged against you. An IDS provides a detailed audit trail.As a security administrator,it is your job to become a forensics expert—you get to slice open a connection log or packet and then view it for suspicious activity.Sometimes,this practice can be quite tedious,but the payoff is that you get peace of mind knowing the exact nature of packets entering your network and network hosts. www.syngress.com
138_linux_04 6/20/01 9:38 AM Page 202 202 Chapter 4 • Implementing an Intrusion Detection System An IDS stores its information in several places: (cid:2) System logs Many IDS applications are configured to send messages directly to pre-existing system log files—such as /var/log/messages and /var/log/security—in Red Hat Linux,either directly or through syslog. (cid:2) Simple text files and directories Directories and text files that act just like /var/log/messages,but are specifically created by the IDS appli- cation.Sometimes,the IDS will create a separate directory for each new host it detects.Each directory could,for example,be named after the IP address of each host.The IDS will then populate the appropriate direc- tory with separate files for each specific protocol used.This way,you can then identify the nature of the traffic on the network. (cid:2) Databases The most elegant way to store information is in a database.A database generally stores the information in a far more logical way,and it allows the information to be searched efficiently.After the information is stored in a database,it is then possible to port this information to a Web server,which makes it possible to read IDS information from any Web browser or use third-party analysis tools to analyze the gathered data. Threshold Enforcement When a threshold is met,an IDS can do several things.It can send the event to a special alert log file,send an alert to a remote system,send an e-mail,or even reconfigure a host or a firewall.Not all IDS applications have this ability,how- ever.Many IDS applications can be configured to inform you about sudden increases in traffic,or if traffic appears threatening.For example,you can con- figure your IDS to log ICMP traffic into a special database or to inform you via e-mail about a specific login. File System Integrity Verification Host-based IDS applications such as Tripwire are able to take a snapshot of your file systems,then compare their later condition to that snapshot.You can then identify whether certain sensitive files have been altered.Such file system verifi- cation software is useful for guarding against Trojan horses,which are malicious applications designed to appear as legitimate applications,such as su,ls,and ps. If you have been able to protect your operating system with an application such as Tripwire,all but the most subtle and sophisticated attempts to substitute a Trojan horse for a legitimate application will fail. www.syngress.com
138_linux_04 6/20/01 9:38 AM Page 203 Implementing an Intrusion Detection System • Chapter 4 203 Which IDS Strategy Is Best? By now,you probably get the idea that no one IDS application or method is “the best.”Many different types of IDS applications exist,and as with any other task, you must use the right tool for the right job.Security professionals commonly say that,for example,PortSentry is a bit crude compared to Snort.This is not the case at all.PortSentry is a very useful tool,as long as you use it as intended:It is designed to identify traffic and log it to a central console.It can then send alerts and block traffic.However,it is not designed to detect attacks as they travel across your network.To detect traffic as it passes across your network,you will want a network-based IDS,such as Snort. Thus,arguing that one application is more useful or sophisticated than another is impractical.Rather,it is appropriate to say that PortSentry is useful when protecting a specific host,and that Snort is useful for detecting problems with network traffic.If you combine PortSentry with Tripwire,you will have a system that informs you of all port scans and file changes. Thus far,you have learned about the hardware and software necessary to implement an IDS.Don’t forget that the “wetware”—the people who implement the IDS—are an essential component to your success.In fact,you and your well- trained support staff are probably the most important part of an IDS.The IDS hardware and software are really nothing more than tools. Network-Based IDS Applications and Firewalls No IDS can act as a replacement for a firewall.A firewall is the primary means of establishing perimeter security,as you will see in Chapter 9.A firewall can block and allow traffic,depending upon your wishes.IDS technology is not at all suited for this.The primary function of an IDS is to monitor internal network traffic. An IDS can,however,act as a supplement to a firewall,because it can help you monitor traffic on the internal network.Sometimes,it may be useful to place an IDS application outside the firewall,or in the DMZ so that you can learn more about the attacks waged against the firewall itself.However,in this case,the IDS is not acting as a firewall in any way.In such cases,your IDS is acting as an attack detection device. One of the most common strategies is the practice of allowing your IDS application to reconfigure the firewall in case of an attack.For example,the IDS application can communicate with the firewall and ask it to automatically close a port or block a host.This functionality,however,is not readily available in open source firewalls.You will have to create custom scripts to do this,right now. www.syngress.com
138_linux_04 6/20/01 9:38 AM Page 204 204 Chapter 4 • Implementing an Intrusion Detection System IDS Applications Table 4.2 provides a list of common IDS applications:Some of these are not open source IDS applications,but they are listed to give you an idea of what you can choose. Table 4.2 Common IDS Applications IDS Product Name Description NetProwler (Symantec) A network-based IDS product designed www.Symantec.com to provide alerts and to work with additional Symantec offerings, such as Enterprise Security Manager (ESM). RealSecure (Internet Security Considered to be one of the first Systems) www.iss.net commercial network-based IDS applications. eTrust Intrusion Detection A popular network-based IDS applica- (Computer Associates) www.cai.com tion, due to its ease of use. Network Flight Recorder One of the more highly-regarded (NFR Security) www.nfr.com network-based IDS applications, mainly because its developers have written the code for specific hardware platforms. This IDS application has roots in the open source community. Snort (open source) www.snort.org Widely considered to be one of the more flexible and reliable lightweight network-based IDS applications. Shadow (open source) A collection of Perl scripts and Web www.nswc.navy.mil/ISSEC/CID pages that can help you log and analyze scanning attacks that have occurred over a long period of time (for example, port scans that have occurred over a period of days or weeks). Tripwire (Tripwire, Inc., open source) A host-based IDS designed to inform www.tripwire.com you concerning files that have changed. Ettercap (open source) A network-based sniffer designed to http://ettercap.sourceforge.net/ work in switched networks. PortSentry (Psion, Inc.) A host-based IDS application that www.psionic.com/abacus/portsentry listens to log files. It detects port scans and www.psionic.com/download and responds to them. Continued www.syngress.com
138_linux_04 6/20/01 9:38 AM Page 205 Implementing an Intrusion Detection System • Chapter 4 205 Table 4.2 Continued IDS Product Name Description Hostsentry (Psion, Inc.) Another host-based IDS application www.psionic.com/download that specifically searches log files for activity. If activity fits a signature, then Hostsentry will send an alert. Many more IDS applications exist.You can learn more about additional open source IDS applications at the following sites: (cid:2) www.securityfocus.com (cid:2) http://packetstorm.securify.com (cid:2) www.linuxsecurity.com. General Dependencies for Open Source IDS Applications Most open source IDS applications require several supporting applications.These often include: (cid:2) Tcpdump www.tcpdump.org (cid:2) Perl www.perl.com (cid:2) PreHypertext Processor, or PHP www.php.net (cid:2) Apache Server www.apache.org (cid:2) Databases, including PostgreSQL www.postgresql.org or www.pgsql.com and MySQL www.mysql.com (cid:2) Secure Shell www.openssh.org (cid:2) Supporting libraries, such as Libnet,Tcl/Tk, and pcap The IDS you choose will inform you concerning any additional applications or libraries you require.Now that you have received a rundown of the important IDS elements,you can begin implementing them on your Linux systems. www.syngress.com
138_linux_04 6/20/01 9:38 AM Page 206 206 Chapter 4 • Implementing an Intrusion Detection System NOTE One of the most important things to remember in regards to an IDS is that it should never affect system or network performance. Unless you have a compelling reason, you should not “double up” on a machine by making it, say, a firewall and an IDS application at the same time. An IDS can be an effective supplement to a firewall. Just make sure that the IDS resides on a separate system, and you will not encounter any performance problems. Installing Tripwire to Detect File Changes Tripwire is one of the most popular applications for determining when a file or directory has been altered.It scans your system’s hard drive and creates a database. After its database has been created,Tripwire can conduct regular scans of your hard drive and inform you (via e-mail or a log file) about any changes.Tripwire does not inform you concerning changes as soon as they occur.Rather,Tripwire can be placed into integrity checking mode and will then inform you of any changes to the file.After it is working properly,you can then be confident that you know about any and all changes that have occurred on your hard drive.To use Tripwire,you should follow this process (which is briefly illustrated in Figure 4.2):
- Install the binaries and configuration files.
- Edit the /etc/tripwire/twpol.txt file.
- Run the /etc/tripwire/twinstall.sh program,which creates a key pair and then allows you to secure all configuration files.
- Run Tripwire in database initialization mode.Tripwire will scan your system and use message digests to create signatures for the files you specify.Whenever Tripwire creates its database,it is said to enter database initialization mode.
- You can then set Tripwire to rescan these files and compare their signa- tures to the signatures stored in the database.This is called integrity checking mode. If a file has changed,Tripwire can inform you about the change.By default,you can check a text file.You can,of course,specify additional options,including having Tripwire send you an e-mail informing you of any changes. www.syngress.com
138_linux_04 6/20/01 9:38 AM Page 207 Implementing an Intrusion Detection System • Chapter 4 207 Figure 4.2 Using Tripwire Tripwire Database Compares Created Change Occurs Existing Drive Alert State to Its Database Network Host Protected by Tripwire SECURITY ALERT! Although Tripwire has a “file integrity mode,” Tripwire is not really an integrity checker in the classic sense. It does not, for example, test the file’s stability or inode number or any other aspect in regards to file storage. Tripwire simply compares a file’s new signature with that taken when the database was created. Other tools may be used to check the integrity of a file’s permissions and ownership information. Tripwire Dependencies Tripwire does not require any specialized daemons or applications.All of the following are standard to most Linux implementations: (cid:2) sed (cid:2) grep (cid:2) awk (cid:2) gzip version 2.3 or higher (cid:2) tar (cid:2) gawk www.syngress.com
138_linux_04 6/20/01 9:38 AM Page 208 208 Chapter 4 • Implementing an Intrusion Detection System Availability You can obtain Tripwire from the following sources: (cid:2) At www.tripwire.org (cid:2) At http://sourceforge.net/projects/tripwire (cid:2) On the accompanying CD (tripwire-2.3-47.i386.tar.gz) A commercial version is available at the www.tripwire.com site.This site also offers for-fee services for those who can afford to hire consultants to configure Tripwire.The developers of Tripwire wrote the application to work on many platforms,including most Linux flavors (Red Hat,SuSE,Slackware,Caldera,and so forth).You can download Tripwire as a tarball or in the RPM format.As of this writing,the Tripwire site recommends installing the RPM for Linux systems. Deploying Tripwire To properly configure Tripwire,you must take the following three steps:
- Install the Tripwire binaries and configuration files.
- Configure the Tripwire policy file.
- Create the database by conducting an initial run of the Tripwire binary. After you have taken these three steps,you can then run the tripwire binary from cron so that it conducts regular scans. Tripwire Files Here is a list of Tripwire files that you will become familiar with as you deploy them in your Linux/Unix systems: (cid:2) /usr/sbin/tripwire The tripwire binary responsible for reading, creating,and updating the database. (cid:2) /etc/tripwire/twpol.txt The Tripwire policy configuration file.This file is not the actual file Tripwire uses when it runs.Rather,it contains the instructions that determine what the /etc/tw.pol file will contain. (cid:2) /etc/tw.pol The signed Tripwire policy file.Tripwire reads this file to determine what it will place into its database. www.syngress.com
138_linux_04 6/20/01 9:38 AM Page 209 Implementing an Intrusion Detection System • Chapter 4 209 (cid:2) /etc/tripwire/twinstall.sh The file that signs the /etc/tripwire/ twpol.txt and /etc/tripwire/twcfg.txt files.It also configures password information for Tripwire. (cid:2) /etc/tripwire/twcfg.txt Configures the environment for the /usr/sbin/tripwire binary.You will usually not need to edit this file. (cid:2) /var/lib/tripwire/hostname.twd The default location of the Tripwire database file.You can change this location,if you wish.All you have to do is tell the Tripwire binary the location of the database.In fact,storing the database on a different device than the hard drive is a good idea.The first thing a reasonably talented hacker will do after obtaining root is find and erase the database.In the past,many systems administrators would place the database on a write-protected floppy disk.However,many Tripwire databases are very large (over 2 MB),so placing the database onto a more permanent read-only volume—such as a CD—is far more practical.A CD is also more appropriate,because a floppy disk is bound to fail more frequently than a CD. Tripwire Installation Steps Figure 4.3 shows the steps to take when installing the Tripwire binary.First,the rpm -qpil command lists the contents of the RPM package.Then,when you install Tripwire using the rpm -ivh command,you will be informed that you must edit the /etc/trwipwire/twpol.txt file.Then,run the /etc/tripwire/ twinstall.sh command to create a key pair and then sign all Tripwire files for the sake of security.Make sure that you do not forget the password you choose,or you will not be able to use Tripwire. Although installation seems straightforward,make sure to read the configura- tion information so that you can customize Tripwire to suit your own situation. Configuring the Tripwire Policy File The Tripwire policy file,/etc/tripwire.twpol.txt,is configured to read all files found in a Red Hat 7.x installation.You can use a simple text editor to customize the file.You have many options available to you.Table 4.3 shows the most important options. www.syngress.com
138_linux_04 6/20/01 9:38 AM Page 210 210 Chapter 4 • Implementing an Intrusion Detection System Figure 4.3 Installing Tripwire Table 4.3 Tripwire Configuration File Examples Option Description /etc/shadow -> $(IgnoreNone); Any file followed by the IgnoreNone argument will be checked by Tripwire’s “paranoid mode,” which means that any and all changes will be reported to you. You must place a semi- colon after any directory name. !/proc; Informs Tripwire to ignore the /proc directory. It is recom- mended that you not check the integrity of the /proc directory, because it is a virtual file system. Continued www.syngress.com
138_linux_04 6/20/01 9:38 AM Page 211 Implementing an Intrusion Detection System • Chapter 4 211 Table 4.3 Continued Option Description !/~james/Desktop; This particular setting shows how it is possible to ignore all con- tents of a subdirectory (in this case, the Desktop subdirectory of the james home directory. The Desktop directory is for the X Window environment, and will likely change often. It is also possible to specify a single file, as opposed to a single directory. “/home/fred/big file” -> +pingus; This syntax shows how it is pos- sible to specify a file that has spaces in it. /etc -> +ug (emailto=james@stanger.com, Allows you to have your system severity=50); send you an e-mail report in case anything in the /etc/ directory changes. Such options are useful only if you are reasonably sure that you do not want any changes to occur on the /etc/ directory (or whatever directory you wish to specify). /var/log/messages -> $(Growing); Tells Tripwire that the it is expected for the /var/log/ messages file to grow in size. However, Tripwire will still inform you if the file gets smaller or is erased. /etc -> +ug (rulename=etc); Tells Tripwire to check the /etc directory for basic changes in user and group settings and then organizes any output into a section named etc. The default file,/etc/tripwire/twpol.txt,contains a rather complex structure that has the following variables,among others: (cid:2) SEC_CRIT The same as $(IgnoreNone) -Sha; which is for files that cannot be changed. www.syngress.com
138_linux_04 6/20/01 9:38 AM Page 212 212 Chapter 4 • Implementing an Intrusion Detection System (cid:2) SIG_LOW The same as severity 33; which is for files of lesser importance. (cid:2) SIG_MED The same as severity 66; which is for files of moderate importance. (cid:2) SIG_HI The same as severity 100; which is for files of highest importance. You can change these values at will.For more specific information about the options,consult the Tripwire man page,or read the /usr/doc/tripwire/ policyguide.txt file. If,for example,you have just installed Cheops to monitor your network, include the path to the Cheops binary and databases.Then,after you run Tripwire,you can be reasonably sure that no one has replaced this file with a Trojan.Also,you may not want to scan the entire hard drive.Rather,you may want to concentrate only on certain commonly-used binaries. You should then use /usr/sbin/twadmin to sign the configuration file you are using.This way,you will be able to test it to see if someone has altered the file without your permission. Creating the Tripwire Policy File After you have installed Tripwire and edited the /etc/tripwire/twpol.txt,you are ready to begin the initial scan.Simply run the /etc/tripwire/twinstall.sh script, which should already be executable.It will then create the Tripwire configuration file.The twinstall.sh process will do the following: (cid:2) Create site and local host key pairs,which allow you to ensure that your Tripwire files are secure. (cid:2) Create the /etc/twpol file,which is what Tripwire will use when it enters database initialization mode. (cid:2) Create backup copies of the /etc/twpol.txt file,which you should secure so that no one can alter them. Database Initialization Mode After you have created a policy file,you can then enter database initialization mode by using the following command: tripwire --init www.syngress.com
138_linux_04 6/20/01 9:38 AM Page 213 Implementing an Intrusion Detection System • Chapter 4 213 This command creates the actual Tripwire database,as shown in Figure 4.4. Figure 4.4 Creating the Tripwire Database Tripwire Database The twadmin Command Network Host You will then be asked to enter your passphrases.It is possible to specify addi- tional options at the command line,but this is usually not necessary.Tripwire will then default to reading its configuration file (/etc/tripwire/tw.pol).If you wish to use an alternative policy file named altpolfile.pol,you can issue the following command: tripwire --init --polfile altpolfile.pol For additional information,you can read the tripwire man page,or you can issue the following command: tripwire --help init Depending upon the number of directories and files you specify,creating the database can take a significant period of time.For example,it took over an hour to create the database for an 18GB file on an 850Mhz Pentium III system using the default configuration file.After editing the policy configuration file to check only selected files in the /etc/ directory (such as /etc/passwd,/etc/shadow,and the cron directories),initializing the database took about a minute. www.syngress.com
138_linux_04 6/20/01 9:38 AM Page 214 214 Chapter 4 • Implementing an Intrusion Detection System Testing E-Mail Capability Earlier,you learned how to enter an emailto= entry into the policy configuration file.To ensure that your version of Tripwire can actually send e-mail,issue the following command,making sure to substitute your own e-mail address: tripwire -–test -–email youraccount@mailhost.com Tripwire will send a simple test message to the account you specify.If you receive the e-mail,you know Tripwire is working. Integrity Checking Mode After you have created the database,you can run Tripwire in integrity checking mode.You can either run the command manually or create a cron entry.To start Tripwire in integrity checking mode,issue the following command: tripwire --check It generally takes as much time to check the hard drive as it did to create the database.About the only significant difference between creating the database and checking integrity using the -check option is that you will not have to enter a password.If you have configured Tripwire to send an e-mail message by placing an emailto= entry into the /etc/tripwire/twpol.txt file,use the -M option: tripwire --check -M To automate the process,create a simple text file named tripwire and enter the following text: #!/bin/bash
Script to run Tripwire every week.
/usr/sbin/tripwire --check -s -M The added option,-s,has Tripwire forego sending a report to standard output.You will not need to see this output,because this script will likely be run when you are not logged on.Cron runs as root,so this command will run as long as you use chmod to make it executable,and you place the file into any of the following directories: (cid:2) /etc/cron.hourly/ (cid:2) /etc/cron.daily/ www.syngress.com
138_linux_04 6/20/01 9:38 AM Page 215 Implementing an Intrusion Detection System • Chapter 4 215 (cid:2) /etc/cron.weekly/ (cid:2) /etc/cron.monthly/ You can,of course,create a root-owned crontab file by using the crontab -e command as root,or you can create the appropriate file for the /etc/cron.d/ directory. Specifying a Different Database If you choose to burn the Tripwire database onto a CD,you will have to specify the location of the database: /usr/sbin/tripwire --check -d /dev/cdrom/hostname.twd -s -M Reading Reports If you choose not to mail reports to your e-mail account,you can check them by reading the report files Tripwire generates.Reports are stored in the /var/lib/ tripwire/ directory.If you have not activated e-mail,you can read the report by issuing the following command: /usr/sbin/twprint --print-report –r /var/lib/tripwire/report/filename.twr Tripwire will create a separate report for each scan.File names are a combi- nation of the host name and the time the report was generated. Updating Tripwire to Account for Legitimate Changes in the OS Eventually,legitimate changes will occur to your operating system.These changes will keep appearing in reports unless you update your database.Database update mode allows you to update the database so that it no longer recognizes any dif- ferences between itself and the operating system.Many systems administrators make the rookie mistake of completely rewriting the database by using the following command: twadmin -–create-polfile /etc/tripwire/twpol.txt www.syngress.com
138_linux_04 6/20/01 9:38 AM Page 216 216 Chapter 4 • Implementing an Intrusion Detection System This command is a mistake because it also requires you to re-initialize (in effect,rewrite) the entire database,which can result in lost information,especially if a security breach has occurred.The proper way to update the Tripwire database is to use the following command: tripwire -m u -r /var/lib/tripwire/reportyourreport.twr You will then be placed into “interactive mode,”which is where the report will be opened in the vi editor.You can then scroll through the report and deter- mine which events you wish to have Tripwire ignore.As you scroll down the text file,you will see that each change has a checkbox with an X in it.Tripwire,for some reason,calls this the ballot box. If you leave the X as is,the event will no longer be reported.If you enter edit mode in vi (just press ESC and then the letter I),you can erase the X,which means that Tripwire will still report the event. Updating the Policy Updating the policy is different than updating the database.sometimes,you may need to update your policy.If,for example,you install a new application,you may want to ensure that these files are protected by Tripwire.To update the policy,you would first edit the policy file (usually /etc/tripwire/twpol.txt) to suit your needs,then issue the following command: tripwire -m p /etc/tripwire/twpol.txt You must use this option to update the /etc/tripwire/twpol.txt file.If you change the policy file by manually editing the file and then use the twadmin --create-polfile command to update the file,you will cause inconsistencies in the database that can cause Tripwire to misreport information,even if you re-initialize the database. NOTE Skipping the scan of the /proc directory is generally a good idea. Also, because cron is such a powerful daemon, you should consider scanning the cron directories and files in the /etc/ directory. Directories include /etc/cron.d, /etc/cron.daily, /etc/cron.hourly, /etc/cron.monthly, and /etc/cron.weekly. Make sure that you also scan the crontab file. www.syngress.com
138_linux_04 6/20/01 9:38 AM Page 217 Implementing an Intrusion Detection System • Chapter 4 217 What Do I Do if I Find a Discrepancy? If you find that a file has been altered without your permission,you can do the following: (cid:2) Edit the file so that it is back to its original configuration. (cid:2) Replace the suspect file with a clean copy from a backup or installation media. (cid:2) Consider removing the altered system from the network. (cid:2) Conduct a full audit of the operating system to ensure that additional changes have not been made. (cid:2) Change your system password. Configuring Tripwire to Inform You Concerning Changes Now that you have an understanding of the moves required to make Tripwire effective for you,it is time to actually implement the application.As with any Linux/Unix application,you will have to do quite a bit of “tweaking”to make this application suit your needs. Exercise: Installing Tripwire
- Obtain the Tripwire RPM file either from the CD that accompanies this book (tripwire-2.3-47.i386.tar.gz—the file looks like a tarball,but it is actually a gzipped RPM),or from www.tripwire.org,or from the other sites discussed earlier in this chapter.
- Make a copy of the /etc/tripwire/twpol.txt file and call it /etc/ tripwire/twpol.orig.You are going to edit the original file,and you want to have the original handy in case something goes wrong.
- After you are finished installing,open the /etc/tripwire/twpol.txt file and edit it to your needs.We highly recommend that you eliminate all references to files that do not actually belong on your system.We also highly recommend that you use the ! sign to ensure that the /proc directory is not read.Finally,add the following line,which has Tripwire report any and all changes to the /etc/shadow file: www.syngress.com
138_linux_04 6/20/01 9:38 AM Page 218 218 Chapter 4 • Implementing an Intrusion Detection System /etc/shadow -> +pinusgamctdbCMSH (emailto=youraccount@youremailserver.com); Make sure that you enter this information all in one line,and that you substitute your own e-mail information. 4. Run the /etc/tripwire/twinstall.sh script and enter the site and local passwords.Write down the passwords here,in case you forget: Site password:______________________________________________ Local password:_____________________________________________ 5. When you are finished,initialize the database using the instructions given earlier in this chapter. 6. Test whether Tripwire can send e-mail using the instructions given earlier in this chapter. 7. After you know that Tripwire is able to send e-mail,test your configura- tion by adding a new user and changing the password.Unless you add an emailto= value to the /etc/passwd entry,you will have to change the password in order to alter the /etc/shadow file. 8. Issue the following command to have Tripwire perform an integrity check: tripwire --check -M 9. After some time,Tripwire will complete its integrity scan.Check your e-mail to view a report.Alternatively,use the twprint command: twprint -–print-report –r /var/lib/tripwire/report/reportfile.twr |less You will see that Tripwire will inform you about the change.Press q to quit the less command. 10. Run Tripwire again and perform an integrity check.You will see a very similar message. 11. You obviously know about this addition to the /etc/shadow file,and probably do not want to be informed about this change.Issue the following command to update the database: tripwire –m u –r /var/lib/tripwire/report/reportfile.twr www.syngress.com
138_linux_04 6/20/01 9:38 AM Page 219 Implementing an Intrusion Detection System • Chapter 4 219 Note that the file you specify should be the report from the latest integrity check. 12. You are now in vi,viewing the report.Deselect any file that you wish to continue hearing about.Otherwise,make no changes to the file.If you wish to make a change to the file,press ESC then I to enter insert mode.When you are finished,press CTRL,then ZZ to exit. 13. After you have exited,you will be asked for the password to the database.Enter it now. 14. Run Tripwire again in integrity check mode.You will see that any e- mail message you receive no longer contains a detailed reference to the /etc/shadow file.You will,however,see a message informing you about the fact that the file’s access time has changed.This is because Tripwire is reading its own scan of the file.The fact that you no longer see informa- tion about how the file has been changed means that the database has been updated. 15. If you wish,modify the /etc/tripwire/twpol.txt file and eliminate the access timestamp value (a) from the /etc/shadow entry.The newly edited entry should read as follows: +pinusgmctdbCMSH 16. Issue the following command to update the policy file: tripwire –m p /etc/tripwire/twpol.txt 17. Run Tripwire in integrity check mode again.You will receive a report that no files have changed. You now have configured,deployed and updated Tripwire. Exercise: Securing the Tripwire Database
- Burn the database to a CD.You can use a CD-RW disk,although this option is far less secure,because in theory someone could modify the data on the CD-RW disk,but in practice that is not easy to do via the network.
- Modify your tripwire --check -M command so that are now reading from the database on the CD. www.syngress.com
138_linux_04 6/20/01 9:38 AM Page 220 220 Chapter 4 • Implementing an Intrusion Detection System 3. You now can be reasonably sure that your sensitive files and directories are protected. Exercise: Using Cron to Run Tripwire Automatically
- As of this writing,Tripwire no longer runs automatically.Configure a cron job so that Tripwire runs every week.Use the simple script dis- cussed earlier in this lesson.If you wish,you can issue the crontab -e command and enter the following: 5 0 * * * root /usr/bin/tripwire --check –M This command will have Tripwire run daily at five minutes after midnight.
- Make sure that you specify the correct database file,if you have stored it onto a CD.
- You may not want Tripwire to send you any messages unless a problem occurs.To make Tripwire remain silent until a problem occurs,add or modify the MAILNOVIOLATIONS line to read as follows: MAILNOVIOLATIONS=false
- Issue the following command: twadmin --create-cfgfile -S /etc/tripwire/site.key /etc/tripwire/twcfg.txt Now,you will no longer be notified unless a problem occurs.
- When you are finished,removing all text-based configuration files is a good idea.Keep backup copies on a floppy disk for future use. You now have automated Tripwire to run every week.You can,of course, create a crontab that runs this job more often or less often. Deploying PortSentry to Act as a Host-Based IDS PortSentry is a host-based IDS application that monitors all open ports.It is an effective tool if you wish to detect TCP and/or UDP port scans,and if you wish www.syngress.com
138_linux_04 6/20/01 9:38 AM Page 221 Implementing an Intrusion Detection System • Chapter 4 221 to have your host reconfigure itself in case of a port scan.You can also configure PortSentry to do the following: (cid:2) Drop all packets returning to a host using the route command This is not the preferred option,but if you do not have Ipchains or Ipfwadm support,you will have to use it. (cid:2) Automatically update the /etc/hosts.deny file to block xinetd- based connections This is useful if all of your system’s daemons are started by xinetd. (cid:2) Automatically use Ipchains or ipfwadm to block connections This is the most comprehensive option,because it will block any and all connections from a host PortSentry has identified as an attacker.You should understand,however,that the 2.4 kernel does not support Ipchains. (cid:2) Log additional connection information By default,PortSentry logs all of its observations and actions to the /var/log/messages file,and it informs you concerning scans conducted by most popular applications, such as Nmap.This includes most “half-open”SYN scans,as well as the XMAS,NULL,and FIN scans.For more information,read the README files that ship with the product.Because PortSentry acts automatically,it is always revealing to check this file periodically to see what hosts have scanned your system.Of course,monitoring this file is wise,because PortSentry may generate false positives and block a host that you actually wish to allow full access. PortSentry is not distributed under the GNU General Public License (GPL). However,it is freeware,and you can modify the source code for your own pur- poses.However,you cannot give this modified source code to anyone else. PortSentry will compile on any standard Linux system that has TCPWrapper and Ipchains or Ipfw support.As mentioned earlier,you can obtain PortSentry from www.psionic.com/abacus/portsentry. Important PortSentry Files All of the PortSentry files are located off of the /usr/local/psionic/portsentry/ directory.These files include the following: (cid:2) portsentry The actual daemon responsible for detecting attacks. (cid:2) portsentry.conf The configuration file for the entire daemon. www.syngress.com
138_linux_04 6/20/01 9:38 AM Page 222 222 Chapter 4 • Implementing an Intrusion Detection System (cid:2) portsentry.blocked.stcp If you configure the portsentry.conf file to block stealth attacks,this file will log systems that have been blocked. (cid:2) portsentry.blocked.tcp A temporary file that informs you concerning the systems blocked since the last time PortSentry was activated. (cid:2) portsentry.history Contains detailed information concerning the hosts that have been blocked. (cid:2) portsentry.ignore Hosts that PortSentry will not respond to.This file is necessary so that you do not forbid access to your own system.Also, some default behavior from systems such as Microsoft Exchange boxes and DNS servers can be mistaken for scans.Cutting off all communica- tion to such systems would be a mistake if they are essential for your job or for normal operation of your operating system. Installing PortSentry All files are owned by root,and the program must be started as root,because it places your NIC into promiscuous mode.Generally,an application or daemon must be started as root in order to do this.The /usr/local/psionic/portsentry/ directory must be owned by root,and have “700”permissions.The portsentry.ignore and portsentry.conf files need only have 600 (read and write by owner) permissions. Configuring PortSentry to Block Users The /usr/local/psionic/portsentry/portsentry.conf file contains several fields. First,you will find that the default setting has PortSentry bind only to certain ports.Three predefined groups of ports are created for you.You can edit these at will.However,you must have only one pair uncommented at a time.The Advanced Stealth Scan Detection Options determine the port numbers that PortSentry will monitor when you use the -stcp option to start PortSentry.By default,PortSentry listens only to ports up to 1023.You can change this setting to read all ports,but vulnerable ports are usually those that reside below 1023,so you probably won’t need to alter these settings. The Dropping Routes section allows you to determine how PortSentry will deny connections.The KILL_ROUTE options allow you to configure various system tools to actually do the work of denying hosts.PortSentry allows you to use only one KILL_ROUTE option,so if you experience any troubles,check www.syngress.com
138_linux_04 6/20/01 9:38 AM Page 223
Implementing an Intrusion Detection System • Chapter 4 223
that you have not mistakenly uncommented multiple entries.The two most
useful KILL_ROUTE options are the following:
(cid:2) KILL_ROUTE="/sbin/ipchains -I input -s TARGET -j
DENY -l" Uses Ipchains to identify the attacker (the attacker’s host IP
address is stored in the TARGET value),then deny all incoming con-
nections from that host.This is the preferred option.
(cid:2) KILL_ROUTE="/sbin/route add -host TARGET reject" Uses
the route command to reject all packets emanating from the target host.
After you uncomment either of these entries,PortSentry will do the rest.The
KILL_HOSTS_DENY entry allows you to deny connections to any host con-
trolled by xinetd.Two entries exist.For Red Hat 7.0,select the second entry,
which appears as follows:
KILL_HOSTS_DENY="ALL: TARGET : DENY"
As with the KILL_ROUTE entries,after you uncomment these entries,
PortSentry will act automatically.
Optimizing PortSentry
to Sense Attack Types
There is more than one way to attack a system.Hackers can send UDP packets
to scan systems,or they can conduct full TCP scans or only “half-open”scans.As
a result,there is more than one way to start PortSentry.You can start PortSentry
in various ways,depending upon the types of attacks you wish to detect.For
example,if you note that many scanning attacks are being waged using half-open
scans,you can use the -stcp option,which is discussed shortly.The options that
you specify in the portsentry.conf file will also affect how you start PortSentry.
For example,if you wish to listen to UDP traffic,you would configure the port-
sentry.conf file to contain additional references to UDP ports.The startup com-
mands for PortSentry include the following:
(cid:2) portsentry -tcp Starts the program as a standard TCP host-based IDS.
PortSentry simply listens to the open TCP ports you specify.
(cid:2) portsentry -udp Starts the program as a standard UDP host-based
IDS.PortSentry simply listens to the open UDP ports you specify.
www.syngress.com
138_linux_04 6/20/01 9:38 AM Page 224 224 Chapter 4 • Implementing an Intrusion Detection System (cid:2) portsentry -stcp Allows PortSentry to listen for stealth TCP scans.The chief difference between this argument and the simple –tcp argument is that PortSentry opens up a socket to capture FIN,half-open-connection, and full-connection scans. (cid:2) portsentry -atcp Configures PortSentry to block all hosts connecting to the ports you specify in portsentry.conf.You must explicitly exclude any hosts that legitimately use the ports listed,or they will be blocked. As you might guess,this feature can result in false positives.One possible result is that you may block yourself from FTP,Web,and e-mail sites as you try to use them. (cid:2) portsentry -sudp Allows PortSentry to listen for stealth UDP scans, similar to the -stcp option. (cid:2) portsentry -audp Configures PortSentry to become ultra-sensitive to udp scans.Except for the fact that this option has PortSentry bind to UDP ports,it behaves exactly like the -atcp argument. Customize each system that you have depending upon its function and place in your network.For example,if you have any systems residing in a demilitarized zone (DMZ)—which is a special network that usually houses DNS,Web,and even e-mail servers—you may wish to use the -atcp option so that PortSentry can block scanning hosts. Exercise: Installing and Configuring PortSentry
- Obtain PortSentry from www.psionic.com.
- Place the tarball into the /root/ directory.
- Untar the file by using the following command: tar –zxvf portsentry-1.0.tar.gz
- Change to the portsentry-1.0 directory.
- The PortSentry installation process asks that you use the make com- mand with an option particular to your operating system.To install PortSentry on your Linux system,enter the following command: make linux www.syngress.com
138_linux_04 6/20/01 9:38 AM Page 225
Implementing an Intrusion Detection System • Chapter 4 225
6. Make will compile the binaries.Install these binaries into the /usr/
local/psionic/portsentry/ directory by issuing the following command:
make install
7. Change to the /usr/local/psionic/portsentry/ directory.
8. Open the portsentry.conf file in your favorite text editor,such as pico
or vi.
9. Scroll down to the Port Configuration section and notice that the inter-
mediate setting is not commented out.This means that the TCP and
UDP ports listed will be monitored.If you wish,you can add ports to
this list.Just make sure that you use a comma to separate ay ports you
wish to monitor and that you end the entire list with a quotation mark.
10. Scroll down to the Dropping Routes section.Review the default
settings as you pass by.
11. Find the Generic Linux entry,then scroll down to the packet filter
options.
12. Find the KILL_ROUTE="/sbin/ipchains -I input -s TARGET -j
DENY -l" line,then uncomment it.This entry uses the ipchains com-
mand to add the attacking host to the Ipchains table.If a host scans your
system or even connects to a listed port,PortSentry will cause Ipchains
to deny all connections between this host and yours.As a result,your
system will not respond to any packets originating from the attacking
host,and your system will become a “black hole,”as it were.Only
uncomment one KILL_ROUTE entry at a time,because PortSentry
does not support multiple entries and will crash.If you wish,edit this
entry so that it uses Iptables,instead.
13. Scroll down to the TCPWrappers section and comment the first
KILL_HOSTS_DENY entry and uncomment the second one that
purports to be for New Style systems.
14. Finally,scan down to the Port Banner Section and uncomment the
PORT_BANNER line.This entry has PortSentry automatically issue a
warning to anyone trying to listen in on your port.
15. After you have edited portsentry.conf,quit the file,making sure to save
your changes.
www.syngress.com
138_linux_04 6/20/01 9:38 AM Page 226 226 Chapter 4 • Implementing an Intrusion Detection System 16. Start PortSentry using the following command: portsentry -stcp 17. Use the ps command to see whether PortSentry has activated: ps aux | grep psioni root 787 0.0 0.0 1660 24 ? S Mar09 0:03 /usr/local/psioni Note that this command has the ps command search all processes, then use grep to search for the letters psioni in psionic. 18. Now that you have confirmed that PortSentry is running,use a remote host’s copy of Nmap to scan your host. 19. The Nmap scan may complete,or it may hang.On the host running PortSentry,test to see if your settings were effective.First,issue the fol- lowing command to see if the host running Nmap has been added to the /etc/hosts.deny file: cat /etc/hosts.deny 20. You should see that your scanning host has been added.However,the /etc/hosts.deny file protects only those daemons started by xinetd.The more comprehensive and powerful way to block remote hosts is the use of Ipchains.The ipchains command allows you to implement a packet filter on your Linux system.You will learn more about how to use Ipchains to create a firewall in future chapters.Note,however,that Ipchains is not supported by the 2.4 kernel.You will have to edit the portsentry.conf file to use Iptables.If your system does use Ipchains, PortSentry simply uses this application to automatically configure your host to drop any and all packets coming in from the attacking host.List the packet filtering table to see if your scanning host has been added to the ipchains filtering table: ipchains –L Chain input (policy ACCEPT): target prot opt source destination ports DENY all ----l- yourhost.yournetwork.com anywhere n/a Chain forward (policy ACCEPT): Chain output (policy ACCEPT): www.syngress.com
138_linux_04 6/20/01 9:38 AM Page 227 Implementing an Intrusion Detection System • Chapter 4 227 21. This output shows that all incoming traffic from your scanning is denied.Try to use any Web browser,FTP client,or Telnet to access this host.You will be denied.You won’t even be able to ping the host. Exercise: Clearing Ipchains Rules
- You may want to allow a blocked host to communicate with your system again.Do this by editing the /etc/hosts.deny file and eliminating any reference to the host you have just blocked.
- Use the following command to eliminate the first Ipchains input entry: ipchains –D input 1
- You may have to delete additional rules in the input chain.If so,you can specify additional rules: ipchains –D input 2
- You can then list all chains again to ensure that you have blocked all traffic.To eliminate any and all entries,use the flush command: ipchains –F Exercise: Running an External Command Using PortSentry Although not always appropriate in all instances,you can configure PortSentry to run an external command.In this example,you will run Nmap against the scan- ning host.Remember,this may not be the best option,because it is possible that the person who has scanned you has spoofed the connection,and you will be blocking the wrong IP address.The command shown in this exercise is an example of what you can do with PortSentry.
- Open the /usr/local/psionic/portsentry/portsentry.conf file.
- Scroll down to the External Command section,and enter the following all on one line: KILL_RUN_CMD="/usr/bin/nmap -O $TARGET$" >> /usr/local/psionic/portsentry/scan.txt www.syngress.com
138_linux_04 6/20/01 9:38 AM Page 228 228 Chapter 4 • Implementing an Intrusion Detection System 3. Exit the file and save your changes. 4. Completely kill PortSentry: ps aux | grep psion [pid info] kill PID 5. Restart PortSentry in standard tcp mode.This mode will generate fewer false positives when using an external command. portsentry -tcp 6. Make sure that all /etc/hosts.deny and Ipchains entries are eliminated. 7. Conduct a scan from a remote host. 8. After the scan is completed,check Ipchains and the /etc/hosts.deny file to see that PortSentry added the route.Now,check the /usr/local/ psionic/portsentry/scan.txt.You will see that your own system has con- ducted a reverse scan of the attacking host.This exercise has shown a simple Nmap scan,however.Consider what would happen if a malicious user used Nmap to spoof your default gateway.You would be denied access to the rest of your WAN. 9. Issue the following command to continuously read the /var/log/ messages file: tail -f /var/log/messages 10. Use your scanning host to scan the host with PortSentry enabled. 11. You will see messages from PortSentry informing you of the scan and the actions it has taken.If the scanning host is already added to the Ipchains forward chain and to /etc/hosts.deny,then PortSentry will inform you.If you have restarted PortSentry,then the program will add another entry using Ipchains and TCPWrappers. 12. You need to ensure that PortSentry will start at boot time.You can create your own custom script and place it in the /etc/rc.d/init.d/ directory,or you can simply place it at the bottom of the /etc/rc.d/ rc.local file.Now,each time your system boots,PortSentry will start. www.syngress.com
138_linux_04 6/20/01 9:38 AM Page 229 Implementing an Intrusion Detection System • Chapter 4 229 Installing and Configuring Snort Snort,available at www.snort.org,is best suited to detailed log analysis.Like PortSentry,it places your NIC into promiscuous mode.Unlike PortSentry,it cap- tures all traffic on your network segment,as opposed to traffic destined for just one host.Its method of capturing and logging packets is also much more sophis- ticated,because it can log its findings into remote or local databases.Snort’s anal- ysis feature is able to read the contents of the captured packets and then inform you about any attacks waged against your network. Availability You can download Snort in various forms,including the following: (cid:2) Binary RPM A version of Snort that is ready to operate.Generally, however,precompiled versions of Snort have certain features disabled. You also often have to edit various files before Snort will operate cor- rectly.This version is quite convenient,because it will automatically pro- vide startup scripts and plug-ins.However,this distribution format currently has some important limitations,including the fact that the Snort binary does not support database logging. (cid:2) Source RPM Installs all source files to the same locations as the binary RPM.You must then run make against the installation files in order to compile the Snort binary and the supporting files. (cid:2) Tarball The preferred format because you can specify compile-time options to enable specific database support. Supporting Libraries For full functionality,you will need the following libraries: (cid:2) Libpcap Usually installed by default,this is a library responsible for capturing network packets. (cid:2) A database In order to use Snort with a database,you will need a database such as PostgreSQL or MySQL.This chapter focuses on PostgreSQL. (cid:2) Libnet Snort has a feature called Flex Response,which enables it to issue third-party commands to help block network traffic after an alert occurs. www.syngress.com
138_linux_04 6/20/01 9:38 AM Page 230 230 Chapter 4 • Implementing an Intrusion Detection System In order to use the Flex Response feature,you must have Libnet installed.The Flex Response feature is still experimental,and its use is not recommended. Understanding Snort Rules Snort is able to automatically detect attacks based solely upon the rules it uses. Depending upon the rules you specify,Snort can identify various attacks, including the following: (cid:2) Port scans for all hosts, including stealth port scans This feature is useful even if you have PortSentry installed,because Snort will read the attacks as they come across the network wire before they reach the host. (cid:2) Attacks meant to exploit well-known buffer overflows, such as attacks against older versions of Sendmail that lead to a root compromise Snort is able to do this because the SMTP-specific rules are able to have Snort capture and then analyze all SMTP-based packets for typical text strings and packets used in such exploits. (cid:2) CGI attacks Snort can help protect your Web servers from the most commonly-known attacks. (cid:2) Server Message Block (SMB) probes You can protect your Windows servers by searching for typical attacks,such as brute force, scanning,and dictionary attacks. (cid:2) Operating system fingerprinting Snort can identify many of the most common tools such as Nmap and Queso. Snort Variables For the sake of logging accuracy,you can configure the snort.conf file to recog- nize the “home”(local) network,as well as any external networks,as well as the network’s DNS servers.Typical entries are as follows: (cid:2) var HOME_NET [192.168.1.0/24] Specifies the 192.168.1.0 net- work,with a standard class C subnet mask.Snort always uses Classless Internet Domain Routing (CIDR) notation,because it cannot simply assume that all IP addresses use standard Class A,B,and C subnet masks. www.syngress.com
138_linux_04 6/20/01 9:38 AM Page 231 Implementing an Intrusion Detection System • Chapter 4 231 You,of course,would substitute your own IP address.It is important that you follow the syntax of this variable exactly.You may have to edit the /etc/snort/snort.conf file so that it uses brackets instead of quotes.If you have many internal networks,you can enter multiple IP addresses:var HOME_NET [192.168.1.0/24, 10.100.100.1/24] to ensure that all systems on your network are logged when you place Snort into IDS mode. (cid:2) var EXTERNAL_NET any This particular example has Snort treat all IP addresses other than 192.168.1.0 as external to its interface.Instead of using the any keyword,you can enter specific network addresses (such as 192.168.2.0 and 192.168.3.0). (cid:2) var DNS_SERVERS [10.100.100.50/24,192.168.2.50/24] Allows you to determine the DNS servers Snort can use. Snort Files and Directories Here is a review of the files and directories used by Snort: (cid:2) /usr/local/snort The Snort binary,when installed from an RPM package.The binary RPM version is not configured for database support. (cid:2) /usr/local/bin/snort The binary,when installed from a tarball. (cid:2) /etc/snort/ A directory that contains the Snort configuration file,as well as all Snort rules. (cid:2) /etc/snort/snort.conf The Snort configuration file,which informs Snort about the nature of the network it is monitoring and which allows you to exclude certain hosts,determine the rules used,and set logging and alerting options. (cid:2) /usr/share/doc/snort-1.7 The documentation directory if you install Snort using the RPM.If you install using a tarball,the documentation will be in the subdirectory where you installed all of the source files. (cid:2) /etc/rc.d/init.d/snortd The initialization script for snortd.This script comes with the RPM package.You will be editing this script to customize how Snort initializes. www.syngress.com
138_linux_04 6/20/01 9:38 AM Page 232 232 Chapter 4 • Implementing an Intrusion Detection System Snort Plug-Ins It is possible to use several detection plug-ins.You specify the use of plug-ins in the snort.conf file by using preprocessor entries.They include the following: (cid:2) stream Called the TCP Stream Reassembly plug-in;is able to reconsti- tute TCP connections between network hosts.This ability is important, because most IDS applications have difficulty tracing extremely slow scans and attacks. (cid:2) defrag Allows Snort to search and reconstitute IP traffic. (cid:2) http_decode Tells Snort to listen for packets addressed to ports you specify. (cid:2) portscan Allows you to specify a separate logging location for port scans. (cid:2) portscan-ignorehosts Sometimes,you will want to specify hosts that are allowed to conduct scans,or which are allowed to send unusual packets.DNS servers,for example,can send replies that Snort can mis- understand.This plug-in allows you to list such hosts. (cid:2) minfrag Snort is able to reconstitute attacks that have been broken up into smaller bits using this plug-in. Sometimes,plug-ins do not require additional arguments.At other times,they require you to specify additional parameters.For example,the stream preprocessor requires that you give a timeout period,which ensures that Snort does not become bogged down.You can then specify the ports to monitor and then set a limit on the maximum number of bytes Snort will capture.Here is an example: preprocessor stream: timeout 4, ports 21 23 80 8080, maxbytes 17000 Here are additional entries: (cid:2) preprocessor defrag Enables the defrag value. (cid:2) preprocessor http_decode: 80 8080 Specifies monitoring of ports 80 and 8080 on the network. (cid:2) preprocessor portscan: $HOME_NET 4 3 /var/log/snort/ portscan.log Creates a log entry for port scans. (cid:2) preprocessor portscan-ignorehosts: $DNS_SERVERS Has Snort read the DNS_SERVERS variable entry. www.syngress.com
138_linux_04 6/20/01 9:38 AM Page 233 Implementing an Intrusion Detection System • Chapter 4 233 (cid:2) preprocessor minfrag: 128 Tells Snort to issue an alert if the value of a fragment is below 128. Some plug-ins,such as Spade,are also available.As of this writing,the Spade plug-in is still experimental.You can read more about the plug-ins by consulting the Snort documentation in the /usr/share/doc/snort-1.7/ directory. Starting Snort You can start Snort in three basic ways.To start Snort as a simple packet sniffer, issue the following command: snort -v This command will log traffic only at the network level.Figure 4.5 shows what Snort reports when it logs a simple ICMP packet sent between two other hosts on the network. Figure 4.5 Using Snort to View ICMP Packet Information Notice how you are able to read the source and destination information,as well as the nature of the packet (the TTL,the sequence (ID) number,and whether the ICMP packet is an ECHO or ECHO REPLY). After you end your session,you will receive a message informing you about the total number of packets Snort has been able to capture.See Figure 4.6. www.syngress.com
138_linux_04 6/20/01 9:38 AM Page 234 234 Chapter 4 • Implementing an Intrusion Detection System Figure 4.6 A Snort Summary Report If you use the -d option to have Snort capture application-layer data,you will capture additional information.Figure 4.7 shows the additional information Snort finds when it is started as follows: snort -vd Notice that you can now see the host names involved (james and jacob).You also see additional information concerning the exact nature of the ICMP packets being sent back and forth.Figure 4.8 shows Snort capturing a simple HTTP ses- sion.Notice how it is able to capture the text “This is james”from the HTML that creates the Web page. As you can see,Snort can report all information found in an unencrypted packet.Thus far,you have been using Snort as a glorified packet sniffer. www.syngress.com
138_linux_04 6/20/01 9:38 AM Page 235 Implementing an Intrusion Detection System • Chapter 4 235 Figure 4.7 Capturing Application-Layer Data with Snort Figure 4.8 Capturing an HTTP Session www.syngress.com
138_linux_04 6/20/01 9:38 AM Page 236 236 Chapter 4 • Implementing an Intrusion Detection System Logging Snort Entries The next way to use Snort is to have it store what it finds into log files.Issue the following command: /usr/sbin/snort -u snort -g snort -dev -l /var/log/snort -h 192.168.2.0/24 This command starts Snort under a user and group of Snort (the RPM file installation automatically creates these users),then logs all packets to the /var/log/snort directory.You can specify any directory you wish.The e option has Snort read data link layer headers,as well.The -h command tells Snort that the 192.168.2.0/24 network is the home network and to log all packets relative to the 192.168.2.0 system.You will have to ensure that the /var/log/snort direc- tory exists before you issue this command.All packets will be logged to this directory.Snort will create a directory for each host it detects.Each directory will contain a file that contains the messages specific to that host. Running Snort as a Network-Based IDS Thus far,you have seen how to run Snort from the command line so that it cap- tures all traffic.However,the snort.conf file gives you the ability to use Snort as a true IDS because it has Snort use rules and plug-ins.You can also specify more sophisticated home network and logging methods.After you begin using the rules and plug-ins found in snort.conf,it will begin selectively logging traffic. Specifically,it will log only suspicious activity for your home network.The fol- lowing line has Snort run using the /etc/snort/snort.conf file.The -D option has Snort run as a daemon: snort -u snort -g snort -dev -h 192.168.2.0/24 -d -D -i eth0 -c /etc/snort/snort.conf This command has snort run in daemon mode (-D) and specifies the eth0 interface.The last part of the command specifies the snort.conf file,which if properly configured will enable Snort to log traffic only as it violates the rules it contains.If you use this command,make sure that your snort.conf file is properly edited.For example,you will want to make sure that you specify all subnets for your home network. www.syngress.com
138_linux_04 6/20/01 9:38 AM Page 237 Implementing an Intrusion Detection System • Chapter 4 237 Ignoring Hosts You may want to tell Snort to ignore certain hosts on your network.The two easiest options for configuring Snort to ignore hosts are the following: (cid:2) Use Tcpdump-style filters on the command line (not in the /etc/snort/ snort.conf file). (cid:2) Use the portscan preprocessor entry in /etc/snort/snort.conf. When using Tcpdump-style filters,suppose that you wished to monitor all hosts on the network except for the host named james.You would specify the following at the command line: snort -u snort -g snort -dev -h 192.168.2.0/24 -d -D -i eth0 -c /etc/snort/snort.conf ip and not host james For more information,consult Chapter 5,or read the main page for Tcpdump. As far as using the portscan preprocessor is concerned,specify the hosts that you want to ignore by IP separated only by white space: preprocessor portscan-ignorehosts: $DNS_SERVERS 10.100.100.50/32 192.168.2.4/32 Make sure that you specify 32 for the subnet mask when you wish to block a specific host. Additional Logging Options:Text files,Tcpdump, and Databases If you wish to have Snort log all alert activity to a single log file,you can use the following option in the /etc/snort/snort.conf file: output alert_full: /snortlog/snort.log NOTE The output alert_full: /snortlog/snort.log option will not log port scans. The option for logging port scans is always specified by the “prepro- cessor portscan:” value. www.syngress.com
138_linux_04 6/20/01 9:38 AM Page 238 238 Chapter 4 • Implementing an Intrusion Detection System Many applications can read files that are created in Tcpdump format.Snort supports Tcpdump-compatible formats.Using the -b option allows you to use applications such as Tcdump and Ethereal to read them later on.To do enable Snort to do this,use the -b option to the command line (Make sure you enter this all on one line.): snort -u snort -g snort -dev -h 192.168.2.0/24 -d -D -i eth0 -c /etc/snort/snort.conf -b This command does not specify a directory.By default,Snort will place the Tcpdump-readable file into the /var/log/snort/ directory.The file will be named snort-*.log,where the * is the month,day,and time the capture was started.To read the file using Snort,issue the following command: snort -dv -r /var/log/snort/packet.log |less Configuring Snort to Log to a Database The most elegant way to log traffic is to place it into a database.To begin logging to a database,take the following steps:
- Install a database and ensure that it is running properly.In the upcoming exercise,you will configure PostgreSQL.
- Create a user,such as snort,on the database.Make sure that this user has privileges to insert rows and data into the database.
- Compile a version of Snort that supports logging to databases.The RPM binary currently does not support database logging.
- Create a database that will contain the log information.
- Edit the database so that it has the structure Snort expects.Snort con- tains files for the PostgreSQL and MySQL databases,as well as others.
- Edit the /etc/snort/snort.conf file so that Snort logs to your database. Here is an example of the entry to place into the snort.conf file: output database: log, postgresql, dbname=snort user=snort host=localhost password=password All of this information should all be on one line.This line tells Snort to send its data to a database with the log priority.You can also use the alert priority, which gathers all information concerning ping and port scans.The next entry www.syngress.com
138_linux_04 6/20/01 9:38 AM Page 239 Implementing an Intrusion Detection System • Chapter 4 239 gives the name of the database you have created.The user,host,and password entries tell Snort exactly which host to log to.This example has the database log to a local database,but it is possible to log to a remote database: output database: log, postgresql, dbname=snort user=snort host=localhost password=password The commas are extremely important.You place them after the log and database entries.You would,of course,enter your own information.If you were using MySQL,you would enter the following all on one line: output database: log, postgresql, dbname=snort user=snort host=databasehost.yournetwork.com password=password Controlling Logging and Alerts On busy networks,you need to configure Snort to log less information.The fol- lowing command-line options help you control how much your IDS will log: (cid:2) -A full The default setting,which issues all alerts found by the plug-ins. The alert contains detailed information about the nature of the per- ceived attack. (cid:2) -A fast This option has Snort write only a short description,complete with the source and destination IP addresses and ports and the time the alert occurred.All other information is left out. (cid:2) -A unsock This option has Snort send alerts to a local Unix socket where third-party applications can obtain the data.A Unix socket is much like a port,except that it is open only to the local host. (cid:2) -A none This option completely disables logging. Additional configuration options are available,including the ability to configure Snort to send alerts to Windows systems that have the Server service running.To enable SMB alerts,you will have to configure Snort with the `--enable- smbalerts' option (make sure to use the backtic character first—the key above the Tab key—and then the standard single-quote character).For more information, consult the USAGE and INSTALL files that ship with the application. www.syngress.com
138_linux_04 6/20/01 9:38 AM Page 240 240 Chapter 4 • Implementing an Intrusion Detection System Getting Information Snort is being developed quite rapidly.To learn more about the latest Snort developments,you can consult the following resources: (cid:2) The snort mailing list Go to www.snort.org and select the mailing list link.This link allows you to sign up for the Snort mailing list,which is very active and usually informative.Both novice and experienced users frequent the list,so chances are you will receive the help you need just by giving adequate information about your system and by asking spe- cific,well-worded questions. (cid:2) The snort user archives page Go to http://lists.sourceforge.net/ mailman/listinfo/snort-users.This archive contains past postings from the Snort mailing list. Exercise: Installing Snort
- To begin experimenting with Snort,install it from the RPM,which is on the CD that accompanies this book: rpm –ivh snort-1.7-1.i386.rpm Later,you will install the snort-1.7.tar.gz file,which has the ability to log to databases.The RPM version contains a binary that is not com- piled to work with databases. NOTE When you install Snort using the RPM, a user and group named Snort will automatically be generated. The /etc/rc.d/init.d/snortd script will also be created. However, you will first need to edit this script before you continue.
- After Snort is installed,run Snort as a simple sniffer: snort -vde
- If possible,have additional systems ping each other.If you are on a non- switched network,or if your switch is configured to report all traffic to your host,you will see the contents of the packets on your screen. www.syngress.com
138_linux_04 6/20/01 9:38 AM Page 241 Implementing an Intrusion Detection System • Chapter 4 241 4. Stop Snort by pressing CTRL+C.You will see a report summarizing all of the packets it has captured.Now,issue the following command,sub- stituting the proper values when necessary (Make sure you enter this all on one line.): snort -u snort -g snort -dev -l /var/log/snort -h your.ip.address.here /CIDR –i eth0 5. Snort will report the captures to both standard output (your screen) and also to the /var/log/snort/ directory.Make sure that you specify your IP address,complete with the proper CIDR notation for your subnet mask. If you are already using eth0,then you do not need to specify it. 6. Generate some traffic on the network.For example,ping several hosts on and off the network or open a Web browser or FTP client.Open a terminal and list the /var/log/snort/ directory.Snort will create a direc- tory for each system logged and will also log to the /var/log/snort/alert file.Change to one of the directories off of the /var/log/snortd/ direc- tory.Notice that this directory contains a message concerning an ICMP echo packet.Snort has logged this packet because it defaults to logging all ICMP traffic,which is a chief tool used in denial of service attacks. 7. Issue the same command again,except this time,log the information to a Tcpdump-readable file. snort -u snort -g snort -dev -h your.ip.address.here/ CIDR -d -D -i eth0 –b 8. After you have created this file,read it using the following command: snort –dv –r /var/log/snort/logfilename.log 9. After you learn more about Tcpdump and Ethereal in the next chapter, you will be able to read these files to gather more information about the traffic on your network. Exercise: Using Snort as an IDS Application
- Configure Snort to use the /etc/snort/snort.conf file.Doing so will make Snort become a true IDS application.First,edit snort.conf so that all variables match values for your specific network.The RPM process www.syngress.com
138_linux_04 6/20/01 9:38 AM Page 242 242 Chapter 4 • Implementing an Intrusion Detection System should accurately guess your system’s configuration,but check it to be sure.One problem Snort has is determining the correct CIDR value for the subnet mask.Don’t change this value right away,however.It is more likely that you have made some sort of mistake typing in information. Here is a list of values to customize or add (comments are entered to give you an idea of what each entry means): var HOME_NET [192.168.2.0/24,10.100.100.0/24]
Add all "home" network IP addresses.
var EXTERNAL_NET any # A standard entry. var DNS_SERVERS [10.100.100.50/24]
Make all of your DNS servers are listed here.
preprocessor defrag # A standard entry. preprocessor http_decode: 80 8080
Add the Web ports used on your network.
preprocessor portscan: $HOME_NET 4 3 /var/log/snort/portscan.log
A standard entry.
preprocessor portscan-ignorehosts: $DNS_SERVERS
A standard entry.
- Review the additional entries.You do not need to make any other changes,because the RPM file installs a default set of rules,which are all in the /etc/snort/ directory.
- Exit this file,making sure to save your changes.
- After you have ensured that all of your snort.conf entries are correct, issue the following command,all on one line: snort -u snort -g snort -dev -h your.ip.address.here/ CIDR -d -D -i eth0 -b -c /etc/snort/snort.conf
- Snort should have entered daemon mode.It should be logging informa- tion to all files in the /var/log/snort/ directory.Use the ps command to see if Snort is running properly: ps aux | grep snort www.syngress.com
138_linux_04 6/20/01 9:38 AM Page 243 Implementing an Intrusion Detection System • Chapter 4 243 If you do not see anything,or see only the grep command itself,a problem has occurred with either your command line or with the snort.conf file.Carefully review each.Also,consult the documentation that comes with the package to see what elements specific to your system may require changes to these steps. 6. After you have verified that Snort is running,generate some new traffic. For example,use Nmap to scan a system that is not your DNS server and ping a host that is not on your network.Notice that instead of log- ging all information about all hosts,Snort now logs information relevant to your home network. 7. Check the alert and portscan.log files by opening two terminals and using the tail -f command: tail -f /var/log/snort/alert tail -f /var/log/snort/portscan.log 8. Using a port scanner,scan a host on your network.You should see mes- sages to each of these files. Exercise: Configuring Snort to Log to a Database
- Stop Snort: killall snort
- Use the following command to make sure that Snort isn’t running: ps aux | grep snort
- Make sure that you have PostgreSQL installed on your system.Red Hat Linux,for example,ships with this database.Use the following command to query the RPM database: rpm –qa | grep postgres postgresql-server-7.0.2-17 postgresql-devel-7.0.2-17 postgresql-7.0.2-17 Your versions of Postgres may differ.This is not important.
- Although you have already installed a version of Snort using the RPM, this version does not support database logging.Obtain the tarball version www.syngress.com
138_linux_04 6/20/01 9:38 AM Page 244
244 Chapter 4 • Implementing an Intrusion Detection System
from the CD that accompanies this book (snort-1.7.tar.gz),then unzip
and untar it:
tar –zxvf snort-1.7.tar.gz
5. Change to the snort-1.7 directory.This directory contains all of the source
files necessary to compile Snort.Now,issue the following command:
./configure
This simple command will begin a process that automates the cre-
ation of configuration and make files for your specific system.This pro-
gram will automatically find installed database servers,such as Postgres
and MySQL.It will also automatically find the libpcap libraries.If the
configuration program fails,you will have to compile Snort using any of
the following options:
(cid:2) ./configure --with-libpq-libraries=DIR' If the configuration file can’t find the Postgres libraries,use this option.The libraries are often found in the /usr/include/ directory. (cid:2) ./configure --with-libpq-includes=DIR' The includes are
often found in the /usr/include/ directory.
(cid:2) ./configure --with-libpcap-includes=DIR' The libraries are often found in the /usr/lib/ directory. (cid:2) ./configure --with-libpcap-libraries=DIR' The libraries are
often found in the /usr/lib/ directory.
Additional options exist,but these are the ones relevant to database
connectivity.For more information,read the README.database and
INSTALL files.
6. As Snort configures itself,take note of the messages you see.You should
see messages informing you that it has found the database you are using.
NOTE
When using configure options, make sure that you use the backtic char-
acter at the beginning of the option and the standard apostrophe at the
end. Otherwise, compilation will fail. If you wish, you can combine
options: ./configure `--with-libpq-libraries=DIR--with-libpq-includes=DIR’:
www.syngress.com
138_linux_04 6/20/01 9:38 AM Page 245
Implementing an Intrusion Detection System • Chapter 4 245
7. Issue the following commands,one after the other:
make
make install
8. The tarball version of Snort 1.7 will install the Snort binary into the
/usr/local/bin/ directory.Because the /etc/rc.d/init.d/snortd script is
still very handy,open it in a text editor and edit the script.This script,
like all of the others in this directory,contains sections that start,stop,
and restart the daemon.Find the start section.Edit this section so that it
reads as follows:
daemon /usr/local/bin/snort -dev -D
-i $INTERFACE -l /var/log/snort -u snort -g snort -c
/etc/snort/snort.conf -b
9. Exit this file,making sure to save your changes.
10. It is time to configure the database.After you do this,you will edit the
/etc/snort/snort.conf file so that Snort logs to the database.
11. Start PostgreSQL:
/etc/rc.d/init.d/postgres start
12. After PostgreSQL has started,use the /usr/sbin/ntsysv command to
make sure that the database will begin each time you reboot.After in
ntsysv,place an asterisk next to the postgresql command.While you are
at it,check to see if snortd is also selected.
13. Exit ntsysv.
14. Become the postgres user:
su postgres
15. Create a user that can manipulate a database:
createuser snort
Make sure that you answer Yes to both questions:This user must be
able to create databases and create more new users.
16. Create another user,root.This user must also be able to create databases
and create more new users.
www.syngress.com
138_linux_04 6/20/01 9:38 AM Page 246 246 Chapter 4 • Implementing an Intrusion Detection System 17. As root,create a database: createdb -h 127.0.0.1 -U snort -W -e snort This command has createdb create a database on the local host and allows the user named snort to manipulate it.The -W command creates a password,and the -e option simply has createdb echo its processes to you.The last item,snort,is the name of the database. 18. Exit the postgres shell: exit 19. Change to the Snort source directory created when you unpacked the tarball. 20. Change to the contrib/ directory. 21. This directory contains several different applications and files that sup- plement Snort’s capabilities.Find the create_postgresql file and issue the following command: psql snort < ./create_postgresql 22. You will see this script create several tables in the database.You have now created a structure that Snort can log to. NOTE PostgreSQL stores its databases in the /var/lib/pgsql/data/base/ directory. 23. Edit the /etc/snort/snort.conf file and add the following command,all on one line: output database: log, postgresql, dbname=snort user=snort host=localhost password=yourpassword Make sure that this entry is all on one line.You will,of course,have to enter the appropriate password information.If you have altered any of the steps in this exercise,make sure that this line reflects your changes. 24. Exit this file,making sure to save your changes,then restart snortd: /etc/rc.d/init.d/snortd start www.syngress.com
138_linux_04 6/20/01 9:38 AM Page 247 Implementing an Intrusion Detection System • Chapter 4 247 25. Use the following command to verify that Snort has started successfully: /etc/rc.d/init.d/snortd status If you receive a message that the subsystem is locked,there is a problem with your syslog.conf configuration.Check the file and make any necessary changes.Remember,the RPM binary does not support logging to databases.Also,this exercise is specific to PostgreSQL.If you have not compiled in database support,or are using a different database, view the README.database file for more information. 26. After you have verified that Snort is operating properly,generate some traffic by using a port scanner.Also,ping several of the hosts. 27. The database you have created earlier is called snort.Use the psql com- mand to access the snort database: psql snort 28. Now,issue the following command to see the tables: \d You will see a list similar to that in Figure 4.9. Figure 4.9 Viewing the Snort Database 29. You can view the contents of these tables.For example,issue the following SQL command: SELECT* FROM event ; www.syngress.com
138_linux_04 6/20/01 9:38 AM Page 248 248 Chapter 4 • Implementing an Intrusion Detection System This command chooses all data (*) from the event table.As long as you have generated some traffic,you will see information similar to that shown in Figure 4.10. Figure 4.10 Viewing the Event Table 30. Query the iphdr table: SELECT * FROM iphdr ; This table gives you all IP information concerning your network hosts.See Figure 4.11. Each table column gives you the IP addresses of the hosts on your network,as well as the hosts that have made suspicious connections to your network.If you are in the X Window environment,resize your ter- minal so that you can see all of the information. If Snort has logged a large number of packets,they will go off the screen.Use the up and down arrow keys to scroll through the informa- tion.When you are finished viewing a particular table,press Q to exit. PostgreSQL also has a history feature,which allows you to scroll up to view previous commands. 31. Now,create SQL queries to obtain only the information you want.Issue the following commands: SELECT * FROM iphdr WHERE cid=1 ; SELECT * FROM iphdr WHERE cid>4 ; SELECT * FROM iphdr WHERE cid>=4 ; The first command obtains only the first row in the table.The cid value is the “connection id”value,and it is always in sequential order. www.syngress.com
138_linux_04 6/20/01 9:38 AM Page 249 Implementing an Intrusion Detection System • Chapter 4 249 Figure 4.11 The iphdr Table The second command obtains all rows after the fourth.The last com- mand obtains the fourth row,as well as all of the ones above 4. 32. Now,obtain only the IP address information for the sending and receiving host for the first three records: SELECT sid, cid, ip_src0, ip_src1, ip_src2, ip_src3, ip_dst0, ip_dst1, ip_dst2, ip_dst3 FROM iphdr WHERE cid<3 ; This command selects only certain columns from the iphdr table.If your table does not have the first three rows,then find the appropriate cid number and enter it here.Try the additional commands: SELECT sid, cid, ip_src0, ip_src1, ip_src2, ip_src3, ip_dst0, ip_dst1, ip_dst2, ip_dst3 FROM iphdr WHERE cid>30 ; www.syngress.com
138_linux_04 6/20/01 9:38 AM Page 250 250 Chapter 4 • Implementing an Intrusion Detection System SELECT cid, ip_dst1, ip_dst2, ip_dst3 FROM iphdr WHERE cid>40 ; SELECT sid, cid, ip_src0, ip_src1, ip_src2, ip_src3, ip_dst0, ip_dst1, ip_dst2, ip_dst3 FROM iphdr WHERE cid<32 ; SELECT cid, ip_dst0, ip_dst1, ip_dst2, ip_dst3 FROM iphdr WHERE ip_src0=FIRSTIPFIELD and ip_src1=SECONDIPFIELD and ip_src2=THIRDIPFIELD and ip_src3=FOURTHIPFIELD ; SELECT cid, ip_dst0, ip_dst1, ip_dst2, ip_dst3 FROM iphdr WHERE ip_src0= FIRSTIPFIELD and ip_src1= SECONDIPFIELD and ip_src2= THIRDIPFIELD and ip_src3<FOURTHIPFIELD ; 33. Eventually,you will want to clear your database or trim certain rows.To delete row 31,for example,from the iphdr table,issue the following command: DELETE FROM iphdr WHERE cid=31 ; 34. If you wish,issue the following command to delete all rows and column data from the iphdr table: DELETE FROM iphdr ; You now know how to log Snort output to a database,and you can manipulate the data. Exercise: Querying a Snort Database from a Remote Host One of the more useful elements of a database is that you can query it from a remote host.To do this,take the following steps: www.syngress.com
138_linux_04 6/20/01 9:38 AM Page 251 Implementing an Intrusion Detection System • Chapter 4 251
- On the system that has the Snort database,use a text editor to open the pg_hba.conf file.On many Red Hat systems,this file is in the /var/lib/pgsql/data/ directory.
- Once in the database,add the following line at the end of the file: host snort 192.168.2.10 255.255.255.255 trust This line allows the host with the IP address of 192.168.2.10 to access only the snort database from a remote connection.If,for example, you wished to allow all hosts on the 192.168.2.0 network to access this host,you would modify the line as shown: host snort 192.168.2.0 255.255.255.0 trust
- Now,from a remote Linux host,issue the following command: psql -h ids.yournetwork.com snort -U snort This command uses the psql client to connect to the remote host named ids to access the database named snort,using the database user name of snort.
- You will be logged into the remote database,and you can now issue queries just as if you were logged in at the console.This particular form of authentication is not as secure as others,because it relies upon authentication by IP address,and it also allows unencrypted transfer of information.Consult the PostgreSQL Web site (www.postgresql.org) for more information about securing communications.Options include using encrypted passwords and Secure Sockets Layer (SSL).Also,consider using IPsec between the hosts. Identifying Snort Add-Ons The following sections include a quick discussion of some applications written to help you read Snort log files.The first,called SnortSnarf,is a collection of Perl scripts designed to read the Snort alert file (/var/log/snort/alert) and then generate HTML output.The program is available either from www.silicondefense.com/ software/snortsnarf,or from the src/ directory if you have installed Snort from a tarball. www.syngress.com
138_linux_04 6/20/01 9:38 AM Page 252 252 Chapter 4 • Implementing an Intrusion Detection System SnortSnarf You can configure SnortSnarf in various ways,including the ability to automati- cally process Nmap log files into HTML.Consult the documentation for more information.In the following short exercise,you will use SnortSnarf to generate an HTML report based on the Snort alert file. Exercise: Using SnortSnarf to Read Snort Logs
- Obtain the SnortSnarf file from the CD that accompanies this book (SnortSnarf-041501.1.tar.gz),and unpack it using the tar -zxvf command.
- Change to the SnortSnarf-* directory,where * is the version of the program.
- Find the snortsnarf.pl file and then open it in a text editor.
- Some versions of SnortSnarf require that you make a minor change to the code.Find the text that reads snort.alert and change it to read as follows: snort/alert
- After you have edited the file,issue the following command,substituting information that is valid for your host and network: ./snortsnarf.pl –d /var/www/html -homenet x.x.x.x
- After some time,the command will complete.Open a browser and access the /var/www/html/index.html page.You will see a page similar to that shown in Figure 4.12. Analysis Console for Intrusion Databases Analysis Console for Intrusion Databases (ACID) is a more sophisticated version of SnortSnarf.It connects your PostgreSQL or MySQL database to your Web server,which allows you to conduct searches right from your Web browser.You can download ACID from the following sites: (cid:2) www.cert.org/kb/acid (cid:2) http://sourceforge.net/projects/acid-mysql (cid:2) www.andrew.cmu.edu/~rdanyliw/snort/snortacid.html www.syngress.com
138_linux_04 6/20/01 9:38 AM Page 253 Implementing an Intrusion Detection System • Chapter 4 253 Figure 4.12 Viewing SnortSnarf Output ACID requires the following items,in addition to Snort: (cid:2) Apache Server www.apache.org (cid:2) PHP version 4 www.php.net (cid:2) The Snort database plug-in www.incident.org For more information,consult any one of the ACID home pages. www.syngress.com
138_linux_04 6/20/01 9:38 AM Page 254 254 Chapter 4 • Implementing an Intrusion Detection System Summary In this chapter,you have implemented an IDS on your network.You have installed two host-based IDS applications (Tripwire and PortSentry),as well as a network-based IDS (Snort).Now,you can begin logging and analyzing connec- tions for attacks,and you can proceed with a bit more confidence now that you have implemented some safeguards.Additional IDS applications exist,of course. In time,the open source community will create and adopt even more sophisti- cated tools to help you make your network more secure. Several tasks lie ahead.You now get to:
- Read even more logs than before you read this chapter.
- Deploy the IDS applications you have read about on systems in your network.
- Secure your IDS application elements (such as your PostgreSQL database) so that none of these elements can be compromised.For example,if you are logging to a remote database or file,find a way to secure the connection between the two hosts.
- Monitor network and/or performance to make sure that your IDS is not significantly affecting performance. So,even though an IDS helps you do your job,it will never be able to do your job for you.The open source community has done a fairly good job keeping current with the latest IDS demands.As the Linux kernel and operating system stabilizes further,chances are that you will be able to implement even more sophisticated solutions. Solutions Fast Track Understanding IDS Strategies and Types (cid:59) An Intrusion Detection System (IDS) is any system or set of systems that has the ability to detect a change in the status of your system or net- work.Because an IDS can contain multiple hosts and applications,this chapter will often use the term IDS application to refer to a specific IDS element. www.syngress.com
138_linux_04 6/20/01 9:38 AM Page 255 Implementing an Intrusion Detection System • Chapter 4 255 (cid:59) Two general strategies are used when it comes to detecting intrusions, rule-based IDS applications (also called signature-based) and anomaly- based IDS applications. (cid:59) IDS applications do their work either continuously in real-time,or at certain intervals (interval-based intrusion detection). (cid:59) Two different types of IDS applications exist:host-based and network- based. (cid:59) In many cases,an effective IDS application requires a great deal of pro- cessor time in order to work well.Log files require a great deal of hard drive space,especially in busy networks.Thus,simply for the sake of per- formance,consider using multiple systems to gather,store,and analyze information. (cid:59) Most network-based IDS applications do not work properly in a switched network. (cid:59) An IDS stores its information in several places:System logs,simple text files and directories,and databases. (cid:59) An IDS can act as a supplement to a firewall,because it can help you monitor traffic on the internal network.Sometimes it may be useful to place an IDS application outside the firewall,or in the DMZ so that you can learn more about the attacks waged against the firewall itself. Installing Tripwire to Detect File Changes (cid:59) Tripwire is one of the most popular applications for determining when a file or directory has been altered.It scans your system’s hard drive and creates a database.After its database has been created,Tripwire can con- duct regular scans of your hard drive and inform you (via e-mail or a log file) about any changes. Updating Tripwire to Account for Legitimate Changes in the OS (cid:59) Eventually,legitimate changes will occur to your operating system.These changes will keep appearing in reports unless you update your database. Database update mode allows you to update the database so that it no www.syngress.com
138_linux_04 6/20/01 9:38 AM Page 256 256 Chapter 4 • Implementing an Intrusion Detection System longer recognizes any differences between itself and the operating system. (cid:59) Updating the policy is different than updating the database.It is some- times necessary to update your policy.If,for example,you install a new application,you may want to ensure that these files are protected by Tripwire. Configuring Tripwire to Inform You Concerning Changes (cid:59) As with any Linux/Unix application,you will have to do quite a bit of “tweaking”to make Tripwire suit your needs.Refer back to the Installing Tripwire,Securing the Tripwire Database,and Using Cron to Run Tripwire Automatically Exercises for more information on how to install and use Tripwire. Deploying PortSentry to Act as a Host-Based IDS (cid:59) PortSentry is a host-based IDS application that monitors all open ports.It is an effective tool if you wish to detect TCP and/or UDP port scans,and if you wish to have your host reconfigure itself in case of a port scan. (cid:59) PortSentry will compile on any standard Linux system that has TCPWrapper and Ipchains or Ipfw support. (cid:59) All of the PortSentry files are located off of the /usr/local/psionic/ portsentry/ directory.All files are owned by root,and the program must be started as root,because it places your NIC into promiscuous mode. Configuring PortSentry to Block Users (cid:59) The Advanced Stealth Scan Detection Options determine the port num- bers that PortSentry will monitor when you use the -stcp option to start PortSentry.By default,PortSentry listens only to ports up to 1023. (cid:59) The Dropping Routes section allows you to determine how PortSentry will deny connections.The KILL_ROUTE options allow you to con- figure various system tools to actually do the work of denying hosts. www.syngress.com
138_linux_04 6/20/01 9:38 AM Page 257 Implementing an Intrusion Detection System • Chapter 4 257 Optimizing PortSentry to Sense Attack Types (cid:59) You can start PortSentry in various ways,depending upon the types of attacks you wish to detect.Customize each system that you have depending upon its function and place in your network. Installing and Configuring Snort (cid:59) Snort,available at www.snort.org,is best-suited to detailed log analysis. Like PortSentry,it places your NIC into promiscuous mode.It captures all traffic on your network segment,as opposed to traffic destined for just one host. (cid:59) Snort can log its findings into remote or local databases.Snort’s analysis feature is able to read the contents of the captured packets and then inform you about any attacks waged against your network. (cid:59) Snort is able to automatically detect attacks based solely upon the rules it uses. (cid:59) You can use several detection plug-ins.Sometimes,plug-ins do not require additional arguments.At other times,they require you to specify additional parameters. Running Snort as a Network-Based IDS (cid:59) However,the snort.conf file gives you the ability to use Snort as a true IDS because it has Snort use rules and plug-ins.You can also specify more sophisticated home network and logging methods.After you begin using the rules and plug-ins found in snort.conf,it will begin selectively logging traffic. Configuring Snort to Log to a Database (cid:59) On busy networks,it is necessary to configure Snort to log less informa- tion.Certain command-line options help you control how much your IDS will log. www.syngress.com
138_linux_04 6/20/01 9:38 AM Page 258 258 Chapter 4 • Implementing an Intrusion Detection System (cid:59) Additional configuration options are available,including the ability to configure Snort to send alerts to Windows systems that have the Server service running. Identifying Snort Add-Ons (cid:59) SnortSnarf is a collection of Perl scripts designed to read the Snort alert file (/var/log/snort/alert) and then generate HTML output.The pro- gram is available from www.silicondefense.com/software/snortsnarf. Frequently Asked Questions The following Frequently Asked Questions, answered by the authors of this book, are designed to both measure your understanding of the concepts presented in this chapter and to assist you with real-life implementation of these concepts. To have your questions about this chapter answered by the author, browse to www.syngress.com/solutions and click on the “Ask the Author” form. Q: I am trying to configure PortSentry to use both the ipchains and route command to drop suspect connections.Why doesn’t the second command work? A: Currently,PortSentry allows only one KILL_ROUTE line.If possible,use the Ipchains options.If your kernel doesn’t support Ipchains (for example,if you are using the 2.4 kernel),then use the route option or work on using Iptables. Q: I want to use Snort to automatically respond to attacks.How do I do this? A: Compile Snort with the `--enable-flexresp' option.For more information on actually creating rules,consult the README.FLEXRESP file that comes with the RPM or source tarball. Q: I have configured Tripwire,but I would like to send e-mail using Qmail rather than Sendmail.What can I do? A: Open the /etc/tripwire/twcfg.txt and replace the MAILPROGRAM line with a reference to Qmail.You can also use Qmail-specific options to customize how Tripwire messages will be processed. www.syngress.com
138_linux_04 6/20/01 9:38 AM Page 259 Implementing an Intrusion Detection System • Chapter 4 259 Q: Why doesn’t my copy of Snort grab traffic to and from any other host than my own? A: Unless you have somehow misconfigured your HOME_NET value (or some other element of the snort.conf file or the command line),you are probably on a switched network.If this is the case,Snort will only be able to capture traffic between the local host and any other that connects with it.In other words,Snort will behave just like a fancy version of PortSentry. Q: I would rather use MySQL than PostgreSQL.What can I do? A: Other than some minor changes in the snort.conf file,you simply have to install MySQL and then connect the database.You are in luck when it comes to Snort add-ons,as well,because they all work with either MySQL or PostgreSQL. Q: What are some additional readings concerning how to implement an IDS? A: You can choose from quite a few.Here are some of the more popular titles: (cid:2) Network Intrusion Detection:An Analyst’s Handbook (2nd Edition),Stephen Northcutt,Donald McLachlan,and Judy Novak.Indianapolis:New Riders Publishing,2000.ISBN:0735710082. (cid:2) Intrusion Detection,Rebecca Bace.Indianapolis:MacMillan,2000.ISBN: 1578701856. (cid:2) Intrusion Detection:Network Security Beyond the Firewall,Terry Escamilla. New York:John Wiley & Sons,1998.ISBN:0471290009. www.syngress.com
138_linux_04 6/20/01 9:38 AM Page 260
138_linux_05 6/20/01 9:41 AM Page 261 Chapter 5 Troubleshooting the Network with Sniffers Solutions in this chapter: (cid:2) Understanding Packet Analysis and TCP Handshakes (cid:2) Creating Filters Using Tcpdump (cid:2) Configuring Ethereal to Capture Network Packets (cid:2) Viewing Network Traffic between Hosts Using EtherApe (cid:59) Summary (cid:59) Solutions Fast Track (cid:59) Frequently Asked Questions 261
138_linux_05 6/20/01 9:41 AM Page 262 262 Chapter 5 • Troubleshooting the Network with Sniffers Introduction A sniffer,or packet sniffer,is software or hardware that captures network traffic. This traffic can be analyzed to determine problems in a network,such as bottle- necks or performance degradation.It can also confirm hacker attacks against your network systems.If you suspect a system is under attack,you can capture the packets on its interface to identify what types of packets are hitting the system,as well as where the packets originated.Once a problem is determined,an adminis- trator can make network changes to ensure that the network operates efficiently and securely. Packet sniffers capture packets on a specific interface,or on all interfaces, depending on how you configure the sniffer.By default,they display all traffic captured on the network.However,this usually results in far too much traffic for an administrator to sort through.Therefore,sniffers offer filters that allow you to only capture and display packets that meet particular criteria.For instance,you may only be interested in capturing packets between one client and one server to determine the server’s response time,or to determine why a particular client cannot access a server.Sniffers allow you to enter the Internet Protocol (IP) addresses of the client and server,so that only the network traffic between the two IP addresses will be captured and displayed. This chapter introduces you to three popular open source Linux sniffers: (cid:2) Tcpdump A command-line network traffic monitoring tool.It has been around for a long time and most graphical sniffers depend on it. Visit the tcpdump public repository at www.tcpdump.org.Tcpdump is shown in Figure 5.1. (cid:2) Ethereal A graphical network traffic-monitoring tool that is more user friendly than tcpdump.It allows you to view real-time packet captures and uses many tcpdump commands and options for filtering.Once the data is captured,Ethereal allows you to interactively view each packet and its individual headers.Descriptions of the packet headers are sum- marized.It also allows you to view reconstructed TCP streams.It dis- plays real-time traffic,as well as traffic saved to a file.Visit the Ethereal home page at www.ethereal.com.Ethereal is shown in Figure 5.2. (cid:2) EtherApe A graphical network traffic monitoring tool.Unlike Ethereal, EtherApe displays networking activity graphically by identifying hosts and the links that exist between the hosts.The links are color coded and www.syngress.com
138_linux_05 6/20/01 9:41 AM Page 263 Troubleshooting the Network with Sniffers • Chapter 5 263 change constantly as the host connections change.It displays real-time traffic,as well as traffic saved to a file.Visit the EtherApe home page at http://etherape.sourceforge.net.EtherApe is shown in Figure 5.3. Figure 5.1 Tcpdump Figure 5.2 Ethereal When you complete this chapter,you will know how to configure a packet sniffer.These skills will be assumed throughout the rest of this book,as packet sniffing is used regularly to determine network problems and possible security violations.You will capture packets regularly as a security professional. www.syngress.com
138_linux_05 6/20/01 9:41 AM Page 264 264 Chapter 5 • Troubleshooting the Network with Sniffers Figure 5.3 EtherApe Before you use the individual open source sniffers,you must understand how to read a packet and be able to analyze a Transmission Control Protocol (TCP) connection.Without these skills,you will be unable to analyze the traffic cap- tured by the sniffers. Understanding Packet Analysis and TCP Handshakes As you would expect,packet analysis requires an understanding of network packets.This chapter requires you to already understand the seven layers of the Open System Interconnection Reference Model (OSI/RM) and the TCP/IP protocols within each layer.If you are not familiar with the seven layers and their respective TCP/IP protocols,visit the Cisco Press Internetworking Basics docu- ment at www.cisco.com/cpress/cc/td/cpress/fund/ith2nd/it2401.htm.For addi- tional Internetworking fundamentals documents,visit www.cisco.com/cpress/ cc/td/cpress/fund. One of the most important tasks for a security administrator is analyzing TCP traffic.It can tell us a great deal about our network connections.It can also identify many denial-of-service (DoS) attacks and man-in-the-middle,or hijacking,attacks. Because TCP is the protocol used for making a connection in TCP/IP,a careful analysis of the connection process can be extremely helpful for all packet analysis. www.syngress.com
138_linux_05 6/20/01 9:41 AM Page 265 Troubleshooting the Network with Sniffers • Chapter 5 265 TCP Handshakes Whenever two hosts establish a connection on a TCP/IP network,a TCP hand- shake must occur to establish the session.The handshake consists of rules that the two hosts must follow.All sniffers are capable of viewing any TCP connection establishment and termination,which includes the TCP handshake. TCP handshakes use special mechanisms,called flags,to establish and termi- nate a connection.Flags are included in the TCP header,and each flag completes a different function in the TCP connection process.The flags used in a TCP con- nection are listed in Table 5.1.The next section explains how the flags are used in a TCP handshake. Table 5.1 Flags Used in TCP Connections Flag Description SYN Synchronize sequence numbers. Used for connection establishment. FIN The sender is finished with the connection. Used for connection termination. RST Reset the connection. PSH Push the data. ACK Acknowledgment URG Urgent Establishing a TCP Connection To open a TCP connection,the TCP header includes different flags.The hosts exchange packets with these flags set to determine who opens the connection and who terminates the connection.The hosts must acknowledge each flag so that each host knows that the connection process is complete.If acknowledg- ments were not required,it would be much easier for hackers to hijack a TCP connection that was still active,even though the original host already thought it terminated the connection. There are three steps required to open a TCP connection.These steps are called the three-way handshake.This example will be the establishment of a TCP connection between a client and a server.
- Client Sends a SYN flag and the server port number with which it wants to communicate (such as port 80 for a Web server).It also includes the client’s Initial Sequence Number (ISN). www.syngress.com
138_linux_05 6/20/01 9:41 AM Page 266 266 Chapter 5 • Troubleshooting the Network with Sniffers 2. Server Responds with its own SYN flag and ISN to the client’s TCP port.It also responds with an ACK flag to acknowledge the client’s SYN flag. 3. Client Responds with an ACK flag to acknowledge the server’s SYN flag. Once the three-way handshake is complete,a TCP connection is established. The Application layer protocols,such as Hypertext Transfer Protocol (HTTP),can now send data through this TCP connection.The three-way handshake is shown in Figure 5.4. Figure 5.4 Three-Way Handshake Client Web Server
- SYN
- SYN ACK
- ACK Terminating a TCP Connection After the session is no longer required,or the data transfer between the hosts is complete,either host may terminate the TCP connection.There are four steps to terminate a TCP connection.Either host can terminate the connection (i.e.,the client or the server).In this example,the server will terminate the connection.
- Server Sends a FIN flag to the client.The FIN flag is usually sent in response to the client issuing a close command in an application on the server.This is often called an active close.
- Client Responds with an ACK flag to acknowledge that the connec- tion will be terminated.
- Client Sends a FIN flag to the server.This is often called a passive close.
- Server Responds with an ACK flag to acknowledge that the TCP connection is terminated. Once both hosts acknowledge the FIN flag from the other host,the TCP connection is terminated.It is possible for data to be sent one way if only one direction has been terminated.However,most applications do not take advantage of this TCP possibility. The TCP termination process is shown in Figure 5.5. www.syngress.com
138_linux_05 6/20/01 9:41 AM Page 267 Troubleshooting the Network with Sniffers • Chapter 5 267 Figure 5.5 Terminating a TCP Connection
- FIN Client Web Server
- ACK
- FIN
- ACK Tools & Traps… The TCP Flaw An inherent flaw in TCP was discovered in the mid-1980s that has recently received attention in the media and in security advisories. The problem centers on the Initial Sequence Numbers (ISNs), which are packet numbers used in TCP connections. These numbers are only known by the hosts that are making the connection. The sequence numbers are used to identify legitimate packets and determine which packets are part of a given transmission. The packets that follow contain a sequence number based on the INS. The sequence number changes each time by adding the number of bytes that are transmitted to the other host. The problem is that if the ISNs of a TCP connection are not random, or if they are not random in subsequent TCP sessions, a hacker can guess the ISN. If he or she guesses correctly, the hacker will be able to hijack the session. Hackers attempting to exploit this vulnerability will have an extremely difficult time. Not only will they need to guess the ISN, but they must identify the vulnerable systems. The actual attack is extremely difficult to implement. However, if a hacker develops tools for this hack and makes it available on the Internet, any person with a modem and not much experience will be able to implement it. The TCP flaw is 20 years old and is still a concern. As recently as 1996, researchers at AT&T proposed a solution to the Internet Engineering Task Force (IETF). To date, only OpenBSD is considered to have consistently random ISNs. Linux and Solaris would be considered average at per- forming this task. www.syngress.com
138_linux_05 6/20/01 9:41 AM Page 268 268 Chapter 5 • Troubleshooting the Network with Sniffers Creating Filters Using Tcpdump Tcpdump is a command-line network traffic-monitoring tool that can capture packets on a network interface and allows administrators to analyze the results.It is maintained by the TCPDUMP Group. Because tcpdump is a command-line tool,analyzing the results can be diffi- cult.Tcpdump allows you to capture all packets on a given interface,or all inter- faces on a system,for analysis.If the interface is not specified,it searches for the lowest interface number,excluding the loopback,and prints the packets for that interface.To filter the packets that tcpdump captures,you can add filters by using options and expressions,which you will learn about in this section. As stated earlier,tcpdump has been around for a long time,and most graphical sniffers use similar filter specifications.Tcpdump usually installs during standard Linux installations. The tcpdump public repository is located at www.tcpdump.org, and the Red Hat Linux tcpdump Red Hat Package Manager (RPM) can be downloaded at www.redhat.com/apps/download/ (keyword tcpdump).For Linux installation,the program must be installed as root,or setuid to root. Any version of tcpdump will work for the following examples.Version 3.6 and later has additional support for IPv6 and support for Solaris 8.If you require either feature,download version 3.6 or later. Tcpdump Options Options are used in tcpdump to filter the amount of packets your system cap- tures.Without them,administrators can be overwhelmed by the number of packets that tcpdump prints.Figure 5.6 displays the printout of 12 packets captured in just .3 milliseconds.All network packets were captured without any filters.Several Address Resolution Protocol (ARP) requests exist,and all packets were captured on the default eth0 interface,since no interface was specified. Table 5.2 lists many of the tcpdump options that assist in filtering tcpdump captures.For a complete listing,please access the tcpdump man page. www.syngress.com
138_linux_05 6/20/01 9:41 AM Page 269 Troubleshooting the Network with Sniffers • Chapter 5 269 Figure 5.6 Tcpdump Capture without Options or Expressions Table 5.2 Tcpdump Options Option Description -a Display data in ASCII. -b Capture packets using the Data Link layer specified. These include the following protocols (see RFC 1340 if you want to list these protocols as decimal values): ip ipv6 802.2 802.3 arp rarp dec lat atalk aarp x25 ipx -c Quit tcpdump after a specific number (count) of packets have been captured. -e List the link-level header for each packet that is captured. -F Instead of listing options and expressions, you can use a file as the input for your filter expression. If a file is used, any expressions you list on the command line will be ignored. Continued www.syngress.com
138_linux_05 6/20/01 9:41 AM Page 270 270 Chapter 5 • Troubleshooting the Network with Sniffers Table 5.2 Continued Option Description -i Specify the interface you want tcpdump to listen. If the interface is not specified, it searches for the lowest interface number, excluding the loopback, and prints the packets for that interface. -n Do not list host names, only list host addresses as numbers (such as IP addresses). This avoids Domain Name System (DNS) lookups. -nn Do not list port numbers as service names. The /etc/services file is used for the service names. -p Do not enable promiscuous mode for the interface. -q Quick output to reduce the amount of protocol information displayed by tcpdump on each line. -r Read packet data from a saved file instead of capturing data on an interface. -t Do not list the timestamp. -v Print out verbose output from the capture. Includes even more data, such as time-to-live (TTL) and type of service data. The –vv option will list additional data. -w Write the tcpdump packet capture to a file instead of displaying it. -x Display the packet information in hexadecimal format. You can use options to filter out all traffic except for ARP requests and replies.To do this,enter the following: tcpdump –b arp In Figure 5.7,notice that only ARP requests and replies appear.The requests are arp who-has entries,and the reply is listed as an arp reply entry.There is only one reply (entry number 10) in this capture,but many ARP requests. In the next example,you will use options to filter out host names,specify your interface,capture only 10 packets,and only capture ARP packets again.To do this,enter the following: tcpdump arp –n –i eth0 –c 10 In Figure 5.8,notice that host names no longer appear,and IP addresses and hardware addresses are captured.Notice that most of the ARP requests are broad- casts.Line 4 is an ARP request for the hardware address of 24.130.8.1,which happens to be the default gateway of that system.The ARP reply follows in line 5,which lists the hardware address as 0:10:f6:5:68:20. www.syngress.com
138_linux_05 6/20/01 9:41 AM Page 271 Troubleshooting the Network with Sniffers • Chapter 5 271 Figure 5.7 ARP Filter Figure 5.8 ARP Filter with No Host Names, a Specified Interface, and a 10 Count Tcpdump Expressions The tcpdump options listed in Table 5.2 are important in determining how the data will be printed.Tcpdump expressions can determine which network hosts you will capture data from.If you do not specify an expression,all packets on the network between all hosts will be printed.An expression will ensure that only the data you require,such as the IP traffic between your interface and a specific host,will be printed. Each expression is made up of at least one primitive.A primitive is an id fol- lowed by qualifiers.An id is a host name or number,and a qualifier can one of three types,as shown in Table 5.3. www.syngress.com
138_linux_05 6/20/01 9:41 AM Page 272 272 Chapter 5 • Troubleshooting the Network with Sniffers Table 5.3 Three Types of Qualifiers in an Expression Qualifier Description type Specifies the id as a host, network, or port. The syntax is host, net, or port. For example, you can enter host 24.130.10.35, net 192.168.60, or port 80. dir Specifies the direction of traffic you want to capture. By default, traffic in both directions will be captured, which is src or dst. The directions you can specify are dst, src, src and dst, and src or dst. For Data Link layer protocols, such as Serial Line Internet Protocol (SLIP) or Point-to-Point (PPP), use the inbound and outbound qualifiers to define your direction. proto Specifies a protocol to capture. The protocols you can choose from are the following: ether fddi ip arp rarp decnet lat sca moprc mopddl tcp udp You can combine qualifiers to include several different filters.For example, you can enter the tcpdump command followed by ether dst 24.130.10.35 or tcp port 80.It all depends on how specific you want your search to be.The fol- lowing examples in Table 5.4 are allowable primitives that you can use.Notice the repetition between the host,ether,net and port primitives.For more examples, see the tcpdump man page. Table 5.4 Allowable Primitives Primitive Description dst host host Captures all packets with the destination IP address (or name) of the specified host. src host host Captures all packets with the source IP address (or name) of the specified host. Continued www.syngress.com
138_linux_05 6/20/01 9:41 AM Page 273 Troubleshooting the Network with Sniffers • Chapter 5 273 Table 5.4 Continued Primitive Description host host Captures all packets with the source and destina- tion IP address (or name) of the specified host. ether dst ethernet_host Captures all packets with the destination Ethernet address (or name from /etc/ethers) of the specified Ethernet host. ether src ethernet_host Captures all packets with the source Ethernet address (or name from /etc/ethers) of the specified Ethernet host. ether host ethernet_host Captures all packets with the source and destina- tion Ethernet address (or name from /etc/ethers) of the specified Ethernet host. dst net network Captures all packets with the destination network address (or name from /etc/networks) of the speci- fied network. src net network Captures all packets with the source network address (or name from /etc/networks) of the specified network. net network Captures all packets with the source and destina- tion network address (or name from /etc/ networks) of the specified network. dst port port Captures all packets with the destination port number (or name from /etc/services) of the specified port. src port port Captures all packets with the source port number (or name from /etc/services) of the specified port. port port Captures all packets with the source and destina- tion port number (or name from /etc/services) of the specified port. In the following example,the host we-24-130-10-192.we.mediaone.net will be monitored for all packets with its host name in the source or destination fields.You need to select a host name that you can monitor on your local net- work.This will not work outside of your network. I used the hostname of a local workstation.To generate traffic,I pinged the host from my system.In Figure 5.10,you can see an ARP request and reply,the echo request and reply,and Windows Network Basic Input/Output System (NetBIOS) User Datagram Protocol (UDP) packets.As you can see,we are www.syngress.com
138_linux_05 6/20/01 9:41 AM Page 274 274 Chapter 5 • Troubleshooting the Network with Sniffers monitoring a Windows host from our Linux system. The tcpdump command entered on the Linux system is: tcpdump host we-24-130-10-192.we.mediaone.net The results are shown in Figure 5.9. Figure 5.9 Monitoring a Host on a Local Network The following primitives listed in Table 5.5 are extremely helpful for identi- fying specific protocols,broadcasts,and multicasts on a network. Table 5.5 Additional Primitives Primitive Description tcp Captures all packets that match the specified protocol. udp icmp ip arp rarp decnet ether broadcast Captures all Ethernet broadcast packets. ip broadcast Captures all IP broadcast packets. This includes all-one and all-zero broadcasts, as well as broadcasts based on the subnet-directed broadcasts. Helpful for determining Continued www.syngress.com
138_linux_05 6/20/01 9:41 AM Page 275 Troubleshooting the Network with Sniffers • Chapter 5 275 Table 5.5 Continued Primitive Description problems with automatic IP address allocations, such as Bootstrap Protocol (BOOTP) and Dynamic Host Configuration Protocol (DHCP). ether multicast Captures all Ethernet multicast packets. ip multicast Captures all IP multicast packets. For example,if you believe your system is experiencing a denial-of-service (DoS) attack,you can filter out Internet Control Message Protocol (ICMP) packets to determine if that system is the victim of a ping flood.To filter out ICMP packets that are destined to your system,enter the following command: tcpdump icmp –n –i eth0 The results are shown in Figure 5.10.As you can see,the host names are fil- tered out,as well as all protocols except for ICMP protocols.This can assist you in determining the source of the ping flood. In this case,the ICMP echo request packets are originating from a host at 24.130.10.192. Figure 5.10 Determining the Source of a Ping Flood Using Primitives Boolean Operators You can also use Boolean operators to further specify a filter.Boolean operators are the AND,OR,and NOT operators.For example,you can specify that you want to capture packets between 192.168.60.10 and 192.168.60.11.You can also www.syngress.com
138_linux_05 6/20/01 9:41 AM Page 276 276 Chapter 5 • Troubleshooting the Network with Sniffers capture packets between bob or susan.Finally,you can capture packets between susan and all hosts except for bob by using the not operator. In the next example,you will capture packets between a host and the Web server at www.tcpdump.org by using a Boolean operator.The command is as fol- lows (substitute your host name or IP address): tcpdump –i eth0 host we-24-130-10-35.we.mediaone.net and www.tcpdump.org Only the packets sent between the mediaone.net host and the www.tcpdump .org Web server appear,as shown in Figure 5.11. Figure 5.11 Capturing Packets between Two Specific Hosts NOTE The first three packets in Figure 5.12 comprise the TCP three-way hand- shake that establishes the TCP session. After the handshake, the Web page data is downloaded to the client, such as the images and text files that make up the Web page. To learn more about Boolean operators,please consult the tcpdump man page.You now have enough knowledge to create meaningful filters in tcpdump. Installing and Using Tcpdump Your system should already have a version of tcpdump installed.If you require the latest version of tcpdump (for instance,you need bug-free IPv6 support),you should visit the tcpdump repository at www.tcpdump.org and download the latest version.The tcpdump repository is shown in Figure 5.12. www.syngress.com
138_linux_05 6/20/01 9:41 AM Page 277 Troubleshooting the Network with Sniffers • Chapter 5 277 Figure 5.12 Tcpdump Repository If you are using Red Hat Linux,you can download the latest RPM at www.redhat.com/apps/download and perform a search for keyword tcpdump. The latest RPM is usually several versions behind the latest tcpdump repository version.Follow these steps to install tcpdump:
- Verify that the tcpdump RPM is installed on your system by entering: rpm –qa | grep tcpdump
- If you do not receive a reply,such as tcpdump-3.x-x,then you need to download and install tcpdump.
- Once you have verified tcpdump is installed,you are ready to capture packets.
- Capture all the packets on your network by entering: tcpdump
- Press CTRL+C and to stop the capture. NOTE If no packets appear after you stop the capture, you need to generate packets. For example, you can ping localhost or a server. www.syngress.com
138_linux_05 6/20/01 9:41 AM Page 278 278 Chapter 5 • Troubleshooting the Network with Sniffers 6. View the captured packets.It may resemble the following packet,which will be used to describe some of the important features of the packet. 23:20:26.356520 eth0 > we-24-130-10-35.we.mediaone.net.1047 > www.tcpdump.org.www: S 1722963211:1722963211(0) The first section is the timestamp (23:20:26) followed by milliseconds (.356520).The interface used to capture the packets is eth0.Next,the source host is the we-24-130-10-35.we.mediaone.net.It is sending the packet using its TCP port 1047.It is sending this packet to the destination host www.tcpdump.org.The destination port is port 80,which is identi- fied as www in the /etc/services file (the port number or port name can be used).The S is a synchronize flag used in a TCP handshake.In this case,it is the first SYN flag sent to the server.Therefore,the ISN for the TCP connection is 1722963211.All sequence numbers for this TCP con- nection will be based on this ISN.1722963211:1722953211 is also the starting sequence number and the ending sequence number for this packet.The (0) indicates that no data (in bytes) is sent with this packet.If data had been sent with this packet,the ending sequence number would have increased by the number of bytes sent. 7. Can you find any TCP handshakes in your packet capture? Identify the basic elements of the packets you have captured using the previous step as an example. 8. Next,capture only ARP packets on your network by entering the following: tcpdump –b arp 9. Capture ARP packets again,but specify the interface to use (eth0 is used as an example): tcpdump –i eth0 –b arp 10. Capture IP packets this time.Print the results with number only (no DNS lookups required) and only capture 12 packets.To accomplish this task,enter: tcpdump –n ip –c 12 Your screen may resemble Figure 5.13,depending on your network traffic. www.syngress.com
138_linux_05 6/20/01 9:41 AM Page 279 Troubleshooting the Network with Sniffers • Chapter 5 279 Figure 5.13 Tcpdump Command Using Filters 11. Capture source and destination packets to another host on your net- work.For example,enter: tcpdump host [hostname] 12. Capture a specific type of packet on your interface.For example,enter: tcpdump icmp –i eth0 13. Finally,capture packets between your system and another system,such as a Web server.For example,enter: tcpdump –i eth0 [your_hostname] and www.tcpdump.org You have learned the basics of tcpdump.You can apply this knowledge to all sniffer programs because tcpdump is the basis for all sniffers.Because tcpdump is difficult to analyze,and because the file size is flat,many network administrators use graphical sniffers to determine network problems and to troubleshoot pos- sible security threats.The remaining sniffers in this lesson are more user friendly than tcpdump and will simplify the packet analysis process. Configuring Ethereal to Capture Network Packets Ethereal is a graphical user interface (GUI) packet sniffer that is much easier to use than tcpdump.It performs the same tasks as tcpdump,but in a user-friendly format.Because Ethereal uses many of the same filters as tcpdump,it is essential www.syngress.com
138_linux_05 6/20/01 9:41 AM Page 280 280 Chapter 5 • Troubleshooting the Network with Sniffers that you fully understand the tcpdump commands and filters,as they will be used in Ethereal throughout this chapter and in your daily administrative work. Ethereal is very flexible because it allows you to read capture files from other programs,such as tcpdump,Network Associate Sniffer Basic and Sniffer Pro, NetXRay (now Sniffer Basic),snoop,atmsnoop,Microsoft Network Monitor,and Lucent/Ascend router debug output.When opening these files,Ethereal automat- ically determines the file type. Both Ethereal and tcpdump capture packets using the pcap library (libpcap). Since they both use the pcap library syntax,they can share many of the same commands,such as filtering options and primitives. Ethereal uses the same screen format as other packet sniffers—if you learn how to use Ethereal,you can apply your knowledge to any GUI sniffer.It divides the screen into three panes.The top pane is used for packet summary.It typically shows the summary of many different packets.The middle pane is a protocol tree, which displays the OSI/RM layers of the selected packet in the summary pane. The bottom pane is a hex dump.The hex dump displays the packet as it looks when traveling across the physical wire.Figure 5.14 displays a random packet capture of a network.Note that the pane sizes are adjustable. Figure 5.14 Ethereal Panes In Figure 5.15,an HTTP GET command is listed in the summary pane, which is the top pane.It displays the basic data regarding the packet.In this case, www.syngress.com
138_linux_05 6/20/01 9:41 AM Page 281 Troubleshooting the Network with Sniffers • Chapter 5 281 it states that the HTTP GET command will download the icann-logo.gif image to the client’s Web browser. Figure 5.15 Hex Code for an HTTP GET Command The second pane displays the protocol tree for the packet.Each packet can be expanded by selecting the + sign.You can discover a great deal about each packet using the protocol tree,such as the hardware address of your host (Ethernet II Source field) and your default gateway (Ethernet II Destination field),the TCP port number and sequence numbers,and all Application layer activity.Expand each protocol to learn more about the packet. The third pane displays the hexadecimal format of the packet,which is how it appears when traveling over the wire.If you highlight a line in the protocol tree, the corresponding hex code will appear in the hex pane,as shown in Figure 5.15. Ethereal Options Unlike tcpdump,Ethereal options are run before the packet capture occurs (in most cases).The options are run at the command line before the program runs. For example,at the command line you would enter: ethereal [options] The program will run using the options you specify.For example,if you wanted Ethereal to use numbers instead of host names to avoid DNS lookups, www.syngress.com
138_linux_05 6/20/01 9:41 AM Page 282 282 Chapter 5 • Troubleshooting the Network with Sniffers you would specify this as an option at the command line before the program runs. The Ethereal options are listed in Table 5.6. Table 5.6 Ethereal Options Option Description -c Defines the default number of packets to capture. -f Defines the filter expression to use for all captures. -h Displays the version number and available options. -i Defines the interface to use for all captures. -k Instructs Ethereal to start the packet capture immediately. If the interface is not defined, Ethereal (similar to tcpdump) uses the lowest number interface (excluding the loopback). -m Defines the font for Ethereal text. -n Disables names in Ethereal so only numbers will be used. This disables DNS lookups, as well as TCP and UDP port names. -r Instructs Ethereal to display a packet capture within a file. -R Allows you to apply a packet filter to a file. Any packet that does not apply to the filter is removed from the display. -s Defines the default length, in bytes, of each packet capture. -t Defines the timestamp format. There are three choices: Absolute ( a ) Actual time and date the packet is captured. Delta ( d ) The time since the last packet was captured. Relative ( r ) The time since the first packet was captured in the current packet capture. By default, the relative timestamp format is used. -w Defines the default packet capture filename. NOTE When determining the timestamp format to use, consider the purpose of your packet capture. If you are determining the performance response time of a server, the delta timestamp is ideal because it will indicate how long it takes a server to respond to a client request. If you are deter- mining a possible attack, you may want to use absolute timestamp to document the date and time an attack took place. www.syngress.com
138_linux_05 6/20/01 9:41 AM Page 283 Troubleshooting the Network with Sniffers • Chapter 5 283 Ethereal Filters Ethereal filters are similar to the filters in tcpdump.The easiest way to apply fil- ters is to open the program using the ethereal command at the command line, and then using the GUI to navigate to the filter configuration screen.You can then use the same filters used in tcpdump.The only difference is that you will not enter tcpdump before the filter specifications. Once benefit of Ethereal is that you can easily save your filters and access them as needed for each packet capture you make.You can have multiple filters from which to choose for different needs.For example,one filter might be used for capturing packets between two hosts,while another is used to capture ICMP packets on the network for troubleshooting purposes. To learn more about filter syntax,please consult the Ethereal and/or tcpdump man page. Configuring Ethereal and Capturing Packets The following steps will teach you how to configure Ethereal and capture packets on your network.Your system may already have a version of Ethereal installed.If you require the latest version of Ethereal,you should visit the Ethereal Web site at www.ethereal.com and download the latest version.(This RPM is also available on the CD accompanying this book (ethereal-0.8.9-4.i386.rpm).The Ethereal Web site is shown in Figure 5.16. Figure 5.16 The Ethereal Download Site www.syngress.com
138_linux_05 6/20/01 9:41 AM Page 284 284 Chapter 5 • Troubleshooting the Network with Sniffers If you are using Red Hat Linux,you can use the files on the CD or down- load the latest RPM at www.redhat.com/apps/download and perform a search for keyword ethereal.The latest RPM is usually several versions behind the latest Ethereal Web site version.To install Ethereal,complete the following steps:
- Verify that the Ethereal RPM is installed on your system by entering: rpm –qa | grep ethereal
- If you do not receive a reply,such as ethereal-8.x-x,you need to down- load and install Ethereal.
- Once you have verified that Ethereal is installed,you are ready to capture packets.
- To add filters to Ethereal,open a command interface and enter: ethereal
- Select the Edit menu,and choose Filters.The Ethereal:Filters screen appears,as shown in Figure 5.17.Since no filters have been configured, the configuration screen is blank. Figure 5.17 Ethereal Filter Configuration Screen
- To create a filter that allows only traffic between your host and another host,you must add a filter name and a filter string.For example,to create a filter between your host and the Web server at the ICANN (192.0.34.65),enter the filter name and filter string shown in Figure 5.18. Enter your IP address,not the 24.130.11.35 address listed in Figure 5.18. www.syngress.com
138_linux_05 6/20/01 9:41 AM Page 285 Troubleshooting the Network with Sniffers • Chapter 5 285 Figure 5.18 Creating a Filter between Two Hosts NOTE The filter string in Ethereal is the same primitive used in tcpdump. Both Ethereal and tcpdump use libpcap, which allows them to share many of the same filter configurations. 7. This filter will only capture packets with a source or destination address that matches 24.130.11.35 (the IP address of my system) and 192.0.34.65 (the IP address of the ICANN Web server).Please note that we could have also listed the host names (we-24-130-11-35.we.mediaone.net and www.icann.org). 8. After the two fields are complete,click Save,and then click New.Your filter will appear in the filter field,as shown in Figure 5.19. Figure 5.19 Completing the Filter Creation Process 9. Click OK to return to Ethereal.You can add additional filters,such as an ICMP filter,by repeating the process.Your new filter will appear in the www.syngress.com
138_linux_05 6/20/01 9:41 AM Page 286 286 Chapter 5 • Troubleshooting the Network with Sniffers Ethereal:Filter screen directly beneath the ICANN Web Server Filter. Each new filter will simply be added to the list,as shown in Figure 5.20. Figure 5.20 Adding Multiple Filters 10. To add the filter to a packet capture,you need to specify the filter.You can do this before or after the packet capture occurs.For example,to apply the filter before the capture,simply select the Capture menu and choose Start.The Capture Preference screen appears,as shown in Figure 5.21.Click Filter and choose the filter that you want to apply.In Figure 5.21,the ICMP filter was chosen. Figure 5.21 Ethereal Capture Preferences Notice that the Update list of packets in real time and Enable name resolution check boxes are selected.This ensures that packets are displayed as they are captured (i.e.,“live”),instead of displaying them only when the capture is complete.The Enable name resolution check box will display host names,as well as protocol names.You can also disable name resolution at the command line by entering ethereal –n when you run Ethereal,or by deselecting the Enable name resolution check box in the Capture Preferences screen. www.syngress.com
138_linux_05 6/20/01 9:41 AM Page 287 Troubleshooting the Network with Sniffers • Chapter 5 287 11. After you select the desired filter,click OK and the capture starts. Packets appear as they are captured so you can analyze the traffic on your network in real time.When you capture several packets,click Stop. 12. The packet capture appears in Ethereal.Your screen may resemble Figure 5.22,which shows Router solicitation packets and echo request and replies on the network. Figure 5.22 Ethereal Packet Capture with Filter Applied NOTE Ethereal can take a long time to process packets after you stop the cap- ture. Be patient. You may have to wait up to a minute for the captured packets to display properly. You may lose your capture if you interrupt Ethereal before it displays the packets. 13. Apply the host filter you created in Step 6 to filter only traffic between your host and another host (i.e.,a server). 14. Create your own filters and apply them to a packet capture.Use the filter techniques you learned in the tcpdump section,especially the primitives in Tables 5.4 and 5.5. www.syngress.com
138_linux_05 6/20/01 9:41 AM Page 288 288 Chapter 5 • Troubleshooting the Network with Sniffers As you can see,the GUI provided by Ethereal allows administrators to view detailed information about each packet.The protocol tree is especially helpful in determining the purpose of each protocol within the packet.The combination of Ethereal and tcpdump provides administrators with almost all of their sniffer needs on Linux systems. Viewing Network Traffic between Hosts Using EtherApe EtherApe is a graphical network traffic-monitoring tool.Unlike Ethereal, EtherApe displays networking activity graphically by identifying hosts and the links that exist between the hosts.The links are color coded and change constantly as the host connections change.It displays real -time traffic,as well as traffic saved to a file.Visit the EtherApe home page at http://etherape.sourceforge.net,shown in Figure 5.23. Figure 5.23 EtherApe Home Page As you can see,EtherApe supports Ethernet,Fiber Distributed Data Interface (FDDI),PPP,and SLIP devices,and is capable of reading network traffic live and from a file.It can also save network traffic and display it later.The program uses GNU Network Object Model Environment (GNOME) libraries for the inter- face.Similar to tcpdump and Ethereal,EtherApe uses libpcap,the library for packet capturing and filtering. www.syngress.com
138_linux_05 6/20/01 9:41 AM Page 289 Troubleshooting the Network with Sniffers • Chapter 5 289 EtherApe uses the command-line options listed in Table 5.7.Enter these options as needed when you run the program.Use the format: etherape [options] Table 5.7 EtherApe Options Option Name Description -d Diagram only Do not display diagram text. -f Filter Define a specific capture filter. -F No fade Do not allow old links to fade in diagram. -i Interface Define the interface for EtherApe to listen for network traffic. -L Link color Define the color of the diagram links. -m Mode Define the operation mode. You can choose from the following: ethernet fddi ip tcp By default, the lowest level is used for the device. -n Numeric Disables names so that only numbers will be used. This disables DNS lookups, as well as TCP and UDP port names. -n Text color Define the color of the diagram nodes. -r Infile Defines the input file. -T Text color Define the color of the diagram text. -? Help Display help message. Configuring EtherApe and Viewing Network Traffic The following steps will teach you how to configure EtherApe and view traffic on your network.Your system may already have a version of EtherApe installed.If you require the latest version of EtherApe,you should visit the EtherApe Web site at http://etherape.source-forge.net and download the latest version. www.syngress.com
138_linux_05 6/20/01 9:41 AM Page 290 290 Chapter 5 • Troubleshooting the Network with Sniffers If you are using Red Hat Linux,you can download the latest RPM at www.redhat.com/apps/download and perform a search for keyword EtherApe. (This RPM is also available on the CD accompanying this book:etherape-0.5.6- 4.i386.rpm.) To install EtherApe,complete the following steps:
- Verify that the EtherApe RPM is installed on your system by entering: rpm –qa | grep etherape
- If you do not receive a reply,such as etherape-0.5.x-x,you need to download and install EtherApe.
- Once you have verified EtherApe is installed,you are ready to capture packets.
- To open EtherApe,open a command interface and enter: etherape
- EtherApe opens and displays the network traffic diagram by default.If you are running Red Hat Linux 7,the diagram text is unreadable.You must select a font in order to read the text.To select a font,click Preferences on the EtherApe toolbar.The EtherApe Preference screen appears,as shown in Figure 5.24. Figure 5.24 EtherApe Preferences: Choosing a Readable Font (If Necessary)
- Click Font and choose a font;for example,Helvetica or Times New Roman.Click Save so you will not have to do this again,and then click OK. www.syngress.com
138_linux_05 6/20/01 9:41 AM Page 291 Troubleshooting the Network with Sniffers • Chapter 5 291 7. The network traffic diagram now appears with readable network addresses,as shown in Figure 5.25. Figure 5.25 Ethernet Traffic on EtherApe 8. By default,EtherApe diagrams the lowest-layer protocols,which are Ethernet protocols.If you are diagramming a busy network,ARP packets may quickly overrun your diagram.To diagram IP traffic instead, exit EtherApe.At the command line,enter: etherape –m ip This command opens EtherApe in IP mode,which will display the IP addresses and host names on your network,as shown in Figure 5.26. Figure 5.26 EtherApe in IP Mode www.syngress.com
138_linux_05 6/20/01 9:41 AM Page 292 292 Chapter 5 • Troubleshooting the Network with Sniffers 9. Experiment with the filter field by clicking Preferences and selecting the Capture tab.Using the Capture filter field,create an end-to-end IP filter or a port-to-port TCP filter. As you can see,EtherApe offers a graphical representation of your network traffic.Instead of displaying individual packets,it creates a diagram of network traffic links between hosts.EtherApe used in conjunction with tcpdump,and Ethereal provides a complete toolkit for a network administrator. www.syngress.com
138_linux_05 6/20/01 9:41 AM Page 293 Troubleshooting the Network with Sniffers • Chapter 5 293 Summary In this chapter,you learned that a sniffer,or packet sniffer,is software or hardware that captures network traffic.This traffic can be analyzed to determine problems in a network,such as bottlenecks or performance degradation.It can also confirm hacker attacks against your network systems.If you suspect a system is under attack,you can capture the packets on its interface to identify what types of packets are hitting the system,as well as where the packets originated.Once a problem is determined,an administrator can make network changes to ensure that the network operates efficiently and securely. You learned about three different programs that capture packets using the pcap library (libpcap),as well as the importance of identifying packet functions. For example,you learned about the function of a TCP handshake,how to identify one,and its importance on TCP/IP networks. Tcpdump is a command-line network traffic-monitoring tool that prints out packet headers on a network interface and allows administrators to analyze the results.Because tcpdump is a command-line tool,analyzing the results can be dif- ficult.Options are used in tcpdump to filter the amount of packets your system captures.Without them,administrators can be overwhelmed by the number of packets that tcpdump prints.An expression determines from which network hosts you will capture data.If you do not specify an expression,all packets on the net- work between all hosts will be printed.An expression will ensure that only the data you require,such as the IP traffic between your interface and a specific host, will be printed. Ethereal is a graphical user interface (GUI) packet sniffer that is much easier to use than tcpdump.It performs the same tasks as tcpdump,but in a user- friendly format.Ethereal uses the same screen format as other packet sniffers.If you learn how to use Ethereal,you can apply your knowledge to any GUI sniffer.It divides the screen into three panes.The top pane is used for packet summary,and typically shows the summary of many different packets.The middle pane is a protocol tree,which displays the OSI/RM layers of the selected packet in the summary pane.The bottom pane is a hex dump.The hex dump displays the packet as it looks when traveling across the physical wire. EtherApe is a graphical network traffic-monitoring tool.Unlike Ethereal, EtherApe displays networking activity graphically by identifying hosts and the links that exist between the hosts.The links are color coded and change con- stantly as the host connections change. www.syngress.com
138_linux_05 6/20/01 9:41 AM Page 294 294 Chapter 5 • Troubleshooting the Network with Sniffers EtherApe used in conjunction with tcpdump and Ethereal provides a com- plete toolkit for a network administrator.All three packet-capturing tools provide troubleshooting assistance for network problems,and can be used to identify potential security problems on your network.You will use these tools throughout this book,so it is important that you have an understanding of their functionality. Solutions Fast Track Understanding Packet Analysis and TCP Handshakes (cid:59) Analyzing TCP traffic is one of the most important tasks for a security administrator.It can tell you a great deal about your network connec- tions,as well as identify many denial-of-service (DoS) attacks and man- in-the-middle,or hijacking,attacks. (cid:59) A TCP handshake must occur whenever two hosts establish a connec- tion on a TCP/IP network.This handshake consists of rules that the two hosts must follow. (cid:59) Special mechanisms,called flags,are used to establish and terminate a TCP connection.Flags are included in the TCP header,and each flag completes a different function in the TCP handshake.The flags used are SYN,FIN,RST,PSH,ACK,and URG. Creating Filters Using Tcpdump (cid:59) Tcpdump captures packets on a given interface,or on all interfaces on a system,for analysis.It is a command-line tool,which can make it diffi- cult to read. (cid:59) Tcpdump options allow you to filter the packets that are captured.For example,you can limit the capture to ARP packets or display only IP addresses (not host names). (cid:59) Tcpdump expressions allow you to specify the hosts from which you will capture packets.For example,an expression will ensure that only the data you require,such as the traffic between your interface and a specific host,will be printed. www.syngress.com
138_linux_05 6/20/01 9:41 AM Page 295 Troubleshooting the Network with Sniffers • Chapter 5 295 Configuring Ethereal to Capture Network Packets (cid:59) Ethereal provides a GUI environment for capturing network packets, which makes it easier for many administrators to use. (cid:59) Ethereal and tcpdump capture packets using the pcap library (libpcap). Since they both use the pcap library (libpcap) syntax,they can share many of the same commands,such as filtering options and primitives. (cid:59) You can easily save Ethereal filters and access them as needed for each packet capture you make.You can have multiple filters from which to choose for different needs. Viewing Network Traffic between Hosts Using EtherApe (cid:59) EtherApe is a GUI that displays networking activity graphically by iden- tifying hosts and the links that exist between the hosts.It displays real- time traffic,as well as traffic saved to a file. (cid:59) EtherApe also uses the pcap library (libpcap),the library for packet cap- turing and filtering,which is similar to tcpdump and Ethereal. (cid:59) EtherApe uses options to specify the capture information,such as the interface,link colors,or whether names or numbers will be used. www.syngress.com
138_linux_05 6/20/01 9:41 AM Page 296 296 Chapter 5 • Troubleshooting the Network with Sniffers Frequently Asked Questions The following Frequently Asked Questions, answered by the authors of this book, are designed to both measure your understanding of the concepts presented in this chapter and to assist you with real-life implementation of these concepts. To have your questions about this chapter answered by the author, browse to www.syngress.com/solutions and click on the “Ask the Author” form. Q: How does a sniffer eavesdrop the traffic on a network? A: Ethernet was designed as a shared network since all systems share the same physical wire.It was designed so that systems would ignore all traffic that was not addressed to a particular system’s hardware address.Sniffer,or wiretap, programs turn off this filter,and switch a system’s interface into promiscuous mode,which then views all packets on the same physical wire. Q: Now that I can sniff network traffic,how can I stop people from sniffing my data? A:As you have learned,packet sniffing is a powerful tool.It allows malicious hackers to capture packets that contain passwords and usernames.The only way to protect yourself against hackers with packet sniffers is to encrypt your data.Even if hackers capture your encrypted data,they will be unable to decrypt it (unless they are extremely determined). Q:When I use Ethereal,the only TCP packets I can capture are those to and from my interface.Why? A:Your network interface card (NIC) probably has not switched to promiscuous mode for the packet capture.Promiscuous mode forces an interface to supply all network packets it sees to a host.Your operating system may be unable to switch your interface to promiscuous mode,or your interface may not sup- port promiscuous mode.If your interface cannot be put into promiscuous mode,you will only see TCP traffic addressed to your interface,link-layer addresses,broadcast and multicast packets.Try another interface for your packet captures. Q:When I perform a live capture in Linux,Ethereal freezes.Why? www.syngress.com
138_linux_05 6/20/01 9:41 AM Page 297 Troubleshooting the Network with Sniffers • Chapter 5 297 A:This problem was fixed in Ethereal 0.8.2 and later.Ethereal would freeze during a live capture because of the libpcap library.If the network was idle, libpcap was unable to return control to Ethereal,and Ethereal would freeze. Code was added to Ethereal to fix this issue. Q:When I use EtherApe,the hosts move before I can identify them.How can I keep them on my screen for analysis? A:You must set the node timeout to zero (0),or else the hosts will disappear after they are finished transmitting their data. Q: I installed EtherApe,but the diagram host names and addresses are a garbled mess.I can’t read anything. A:You must configure the font.When EtherApe is running,click Preferences. In the Diagram tab,click Font,and choose a font such as Helvetica or Times New Roman.Make sure you click Save so you avoid this problem in the future. www.syngress.com
138_linux_05 6/20/01 9:41 AM Page 298
138_linux_06 6/20/01 9:43 AM Page 299 Chapter 6 Network Authentication and Encryption Solutions in this chapter: (cid:2) Understanding Network Authentication (cid:2) Creating Authentication and Encryption Solutions (cid:2) Implementing One-Time Passwords (OTP and OPIE) (cid:2) Implementing Kerberos Version 5 (cid:2) Using kadmin and Creating Kerberos Client Passwords (cid:2) Establishing Kerberos Client Trust Relationships with kadmin (cid:2) Logging On to a Kerberos Host Daemon (cid:59) Summary (cid:59) Solutions Fast Track (cid:59) Frequently Asked Questions 299
138_linux_06 6/20/01 9:43 AM Page 300 300 Chapter 6 • Network Authentication and Encryption Introduction You have seen in previous chapters how the open source community has created powerful sniffing tools.You have seen how they can be used either to administer your network or to attack it.Because these sniffing tools are open source,and because it is relatively easy to place a Linux host on your company network,you need to consider ways to minimize improper use of packet capturing tools. Encryption solutions,such as Secure Shell (SSH) and enhanced authentication schemes such as one-time passwords (OTP) and Kerberos version 5 (v5),are common solutions to this problem.In this chapter,you will learn about how to implement one-time passwords,as well as how to implement Kerberos v5 realms. These will help you reduce sniffing attacks.In future chapters,you will then learn more about how to encrypt transmissions using SSH and IPSec.But,before you do this,it is important to review the concepts of network authentication and how many current implementations leave themselves open to attack. Understanding Network Authentication The traditional way to log on to servers is to provide a username and password pair as authentication tokens (credentials).The client first presents these creden- tials by sending them across the network to a server.The server then compares this information to its own database,then allows or denies access to system resources,depending upon the results of the comparison.Up until about the last ten years,this process had been considered quite effective and secure.Due to the increased sophistication of network tools (as well as hackers that may use them), this traditional practice has become less tenable. Still,users very commonly authenticate over the Internet using clear text passwords.Increasing amounts of people are working at home and logging on to remote e-mail and File Transfer Protocol (FTP) servers using passwords,all of which are sent in clear text.Such practices can only invite sniffing attacks that can lead to compromised user accounts and network servers. Even if employees remain behind the firewall,many system services allow clear text authentication,including the following: (cid:2) Telnet (cid:2) FTP (cid:2) Standard Network Information Service (NIS) www.syngress.com
138_linux_06 6/20/01 9:43 AM Page 301 Network Authentication and Encryption • Chapter 6 301 With relatively little expertise,an attacker can obtain authentication informa- tion quite simply.About ten years ago,most operating system vendors implemented encryption as a way to thwart sniffing attacks. Attacking Encrypted Protocols Encrypting the packets certainly seemed to be the answer to sniffing attacks.It stopped all but the most resourceful users from even trying to decrypt such proto- cols.Within the past five years,however,even encrypted transmissions such as Windows NT Server Message Blocks (SMBs,also known as the Common Internet File System [CIFS]),have become susceptible to attacks,because many versions of SMB/CIFS still send passwords.Although they are encrypted,the pass- words are still sent across the network,which is a problem because attacking encrypted protocols has become much easier.Many tools exist that help hackers wage a sniffing attack,which is a type of “man-in-the-middle”attack,where a “sniffing host”that resides in-between two systems captures the information.All the sniffing host operator has to do is place her Network Interface Card (NIC) into promiscuous mode to be able to capture encrypted information (such as pass- words and ensuing transmissions passing between hosts).Figure 6.1 shows how a “sniffing host”can sit in-between two systems and obtain encrypted information. Figure 6.1 Conducting a Man-in-the-Middle Attack System A #$@ Sniffing Host ##87 ( 5 En l5 c S ry ,k p r t & ed # 0 D 5 a 9 ta 1 ) -= 383.vzpodf9074& @
The Sniffing Host can obtain passwords as they cross over the network. In some cases, it does not matter if the passwords are encrypted or not. System B www.syngress.com
138_linux_06 6/20/01 9:43 AM Page 302 302 Chapter 6 • Network Authentication and Encryption After a hacker obtains encrypted data,he can still act on it.The hacker will need more than a simple packet sniffer,of course.Still,it is now possible to cull passwords and other information from these packets.The specific steps of a man- in-the-middle attack,described in Figure 6.2,apply to encrypted packets as much as they do packets sent in clear text. Figure 6.2 Steps for Obtaining Network Passwords 1: Grab the packets from the network. 2: Isolate the encrypted password. 3: Run a cracking application against it. After the packets containing the encrypted passwords are captured,hackers use cracking applications such as L0phtCrack (www.securitysoftwaretech .com/lc3),John the Ripper (http://packetstorm.securify.com),and others.All of these are designed to crack passwords after they are obtained.Some,such as L0phtCrack,are designed to both capture and crack sniffed encrypted passwords. Hackers create or find new resources and use more powerful computers all of the time.In order to secure your network more fully,you should consider finding a strategy that makes it even more difficult to capture and decrypt passwords. www.syngress.com
138_linux_06 6/20/01 9:43 AM Page 303 Network Authentication and Encryption • Chapter 6 303 Tools & Traps… Man-in-the-Middle Attacks Man-in-the-middle attacks come in several varieties. Sniffing attacks are simply the most popular form. Other man-in-the-middle attacks include the following: (cid:2) Replay Where the attacker captures network packets, stores them, then resends them out onto the network. Sometimes, an attacker can obtain a login sequence, which can then be used repeatedly to log in. (cid:2) Insertion When the attacker isolates a data stream and then injects arbitrary packets into it. Most of the time, such attacks are meant to annoy Internet Relay Chat (IRC) and Telnet users, but more sophisticated insertion attacks occur. Some programs are able to insert bogus packets into net- work transmissions to help evade network-based Intrusion Detection System (IDS) applications. Insertion attacks are not limited to just the network data stream, either. For example, versions of Microsoft Word are susceptible to an attack that allows a malicious user to insert information into a document that can cause Word to execute arbitrary code on the system. For more information, consult the following URL: http://packetstorm.securify.com/0001-exploits/mo2.htm. Creating Authentication and Encryption Solutions When it comes to authenticating safely,you have two options: (cid:2) Find a way to authenticate without sending passwords across the net- work.In modern networks,Kerberos is the best way to do this.Kerberos is a scheme that allows hosts to communicate using public keys.It ensures that no passwords whatsoever traverse the network. (cid:2) Find a way to discard any password that is sent across the network. The accepted phrase for this strategy is one-time passwords (OTP).This strategy www.syngress.com
138_linux_06 6/20/01 9:43 AM Page 304 304 Chapter 6 • Network Authentication and Encryption requires that the client and the server cooperate to ensure that once a password that traverses the network is used,it is never used again. You should also understand that it is important to encrypt the transmissions that occur after authentication.Kerberos has the added ability to encrypt trans- missions once authentication occurs.The use of OTP,however,does not encrypt subsequent transmissions.OTP is usually much easier to implement than Kerberos,however.Here are some additional ways to encrypt transmissions in addition to avoiding sending passwords across the Internet. (cid:2) Secure Sockets Layer (SSL) This protocol is designed to provide “on the fly”encryption by inserting a special layer on top of the transport layer of the Open System Interconnection Reference Model (OSI/RM).It uses public and private keys to establish a session that,the- oretically at least,is readable only between a client and a server. (cid:2) Secure Shell (SSH) This protocol encrypts the data stream,and it also allows for authentication using public keys.Using a server (SSHD) and a client (SSH),users can communicate with hosts much like using Telnet. Unlike Telnet,however,SSH is encrypted and allows users to authenti- cate without having passwords cross the Internet. (cid:2) IPSec (IP Security Architecture) An add-on to IP that provides encryption and authentication at the network layer of the OSI/RM.This encryption occurs “on the fly”between properly configured systems. Except for one-time passwords,all of these solutions use public key encryp- tion to try to create a secure data pipe in an open,insecure network. SECURITY ALERT! Even protocols such as SSH are not immune to attacks. For example, in 1998 the then-current version of SSH was vulnerable to an attack that allows a malicious user to forge and insert invalid packets into the data stream, resulting in decryption of the data stream. Although the problem was corrected, this example shows that even the most secure protocols can be attacked. Now that you understand some of the ways to secure network data,let’s take a closer look at one-time passwords and Kerberos,the two authentication options discussed earlier. www.syngress.com
138_linux_06 6/20/01 9:43 AM Page 305 Network Authentication and Encryption • Chapter 6 305 Implementing One-Time Passwords (OTP and OPIE) In the Linux world,the most universal way to implement OTP support in your Linux systems is to install the OPIE.For you Andy Griffith fans,OPIE doesn’t refer to Ronnie Howard’s character.It stands for “one-time passwords in every- thing.”It’s not a perfect acronym,but as far as OTP is concerned,OPIE is just about as perfect as you can get.OPIE is based on another,older OTP application named S/Key.What makes OPIE different is that it supports the Message Digest 5 (MD5) algorithm,which has become a de facto standard. What Files Does OPIE Replace? Once installed,OPIE automatically secures the use of the substitute user (su) application,as well as securing Telnet-based login.In order to do this,OPIE automatically replaces the following applications: (cid:2) /bin/su (cid:2) /bin/login By default,OPIE does not enforce OTP whenever you log in interactively. Any user is given the choice of using OTP or the standard login procedure.This is necessary,because the creators of OPIE realized that too many people were locking themselves out of their own systems.Thus,OPIE is not an ideal solution for securing interactive login.However,any Telnet-based connections that come from a remote host will be required to log in using OTP. OPIE does not currently support OTP for X Window sessions.Therefore,if you allow users to connect to your server through X,you must consider an alter- nate way to secure these connections (such as SSH or IPSec). How Does OPIE Work? OPIE works by generating a list of passwords that can (you guessed it!) be used only once.After a user logs in remotely,OPIE will issue a challenge.This chal- lenge will always contain two elements: (cid:2) Sequence number A number that begins by default at 499.Each time a user logs in,the count will decrement by one.After the count reaches 0,the systems administrator will have to regenerate the password infor- mation using opiepasswd. www.syngress.com
138_linux_06 6/20/01 9:43 AM Page 306 306 Chapter 6 • Network Authentication and Encryption (cid:2) Seed number A fixed number for each account.Each account gets a completely random number. After a user enters his name at a remote server’s login prompt,OPIE will send these two values over the network to the client’s terminal.The user will then enter these two numbers into an OTP generating program,such as opiepasswd (for Linux systems) or WinKey (for Windows 9x,Me,and 2000 systems). OPIE will issue a challenge in the following situations: (cid:2) Using Telnet The login program ensures that Telnet users are always challenged. (cid:2) Using su Any nonroot user who uses su will always be challenged. (cid:2) Using FTP If configured,OPIE supports FTP as well. OPIE Files and Applications Here is a list of the files that the systems administrator will use: (cid:2) /usr/local/bin/opiepasswd Used by the administrator to generate passwords for all users. (cid:2) /etc/opiekeys Contains the usernames and values used for the server’s request.The additional information is a hash value of the secret password and the date the password was created.It is vital that you secure this file from all users. (cid:2) /etc/opielocks/ Contains entries of the users who are locked out. (cid:2) */opieftpd Allows you to use OTP via FTP,and it is meant as a replacement for the in.ftpd daemon.The asterisk represents the OPIE source code directory,which will vary.You will learn more about opieftpd shortly. (cid:2) /etc/opieaccess Allows the systems administrator to specify certain hosts that do not have to use OTP.This,of course,means that usernames and passwords will traverse the network. Users can use the following applications to generate responses: (cid:2) /usr/local/bin/opiekey A command-line Linux utility.For security reasons,OPIE will not allow users to execute this application remotely. Otherwise,passwords will traverse the network. www.syngress.com
138_linux_06 6/20/01 9:43 AM Page 307 Network Authentication and Encryption • Chapter 6 307 (cid:2) /usr/local/bin/opieinfo A command-line Linux utility that informs users concerning the next sequence number and seed number they will use.As with opiekey,this application will not allow users to execute this application remotely. (cid:2) opie.tk An X Window application written in tcl/tk that does the same thing as opiekey. (cid:2) WinKey A Windows 2000/NT/Me/9x utility that does the same thing as opiekey. Generally,using these applications requires the use of two terminals or win- dows:one to begin the actual login session and the second to generate the response.Although safeguards are built into these applications,it is vital that you do not first establish an insecure connection,then use these applications. SECURITY ALERT! If you install OPIE and then do not run opiepasswd -c on each user, these users will not be able to log into your system remotely. You must use this command on the root account, as well. Otherwise, you will only be able to log in to your system interactively. If you try to log in remotely, all accounts will be forced to use OTP. Because you have not yet generated a password list, your OTP implementation will forever forbid you from remotely accessing the system. opiepasswd Although several options exist when using the opiepasswd command,the following is the most important: opiepasswd -c username Any user that you add must already belong to the /etc/passwd and /etc/shadow database.The opiepasswd command allows you to create OTP password lists for each user you specify.The -c option allows the systems adminis- trator (root) to simply enter the root password,as opposed to entering an OTP password.Then,opiepasswd will generate a key for each user.This process involves selecting a private key for each user.Consider using passwords of at least ten characters,although OPIE will use any length.After you have added the user, www.syngress.com
138_linux_06 6/20/01 9:43 AM Page 308 308 Chapter 6 • Network Authentication and Encryption OPIE will report information about the user.Those who are truly meticulous will write this key down for each user and store it in a safe place.You will have to use this command against every single user in your system,including the root user. When the count for a specific user reaches 0,you will have to run opiepasswd -c again on the account.Without the -c option,you will have to first use opiekey to generate a password,then enter the response when adding any user.For more information,consult the opiepasswd man page. SECURITY ALERT! Do not use the -c option remotely, because using it requires passwords to traverse the network. If you must use opiepasswd over a network, simply use the opiepasswd command. For example, if, as root, you want to change a password for the user named james, you would issue the following command: opiepasswd james However, you will have to train your users to never attempt this com- mand while they are using a remote connection. The opiepasswd com- mand will not allow it. Still, naïve users may still try to enter passwords. This results in passwords crossing the network, which can erode your network’s security. As soon as the opiepasswd command is used against a user,it is then possible for that user to use OTP to log in.However,make sure that you give all users their first passwords,as well as their secret passphrases.If you do not do this,users will not be able to use OPIE.In fact,it is wise to give users at least a small list of passwords so that they can get used to the concept. Password Format Each password that is generated will appear similar to the following: KING MORT GEM WASH STAR SING Although this text string appears to be six passwords,it is only one.Inform your users that they should enter these passwords in all caps,just to be consistent. Figure 6.3 shows the addition of a user named opieuser. www.syngress.com
138_linux_06 6/20/01 9:43 AM Page 309 Network Authentication and Encryption • Chapter 6 309 Figure 6.3 Using opiepasswd to Add a User Using opiekey Any user who receives a request will have to generate a response.The opiekey command generates responses.Users will have to find a way to transfer the server’s challenge into the opiekey command line.Figure 6.4 shows a use of opiekey where the challenge of 498 ke3468 has been entered.Opiekey then requires that you enter your secret passphrase,which the administrator must give to the user in a secure manner.The user must exercise extreme caution with this secret key,because if it is made public,anyone with an OTP application could log on to the server. Figure 6.4 Using opiekey to Compute a Response It is vital that you explain to all OPIE users that they cannot reveal their secret keys.If a user reveals his key,then the systems administrator will have to re-create the user’s OTP list using a different secret key. www.syngress.com
138_linux_06 6/20/01 9:43 AM Page 310 310 Chapter 6 • Network Authentication and Encryption Using opieinfo and opiekey to Generate a List When the systems administrator creates an OTP password list,the user can use the opieinfo command to generate a list of passwords for later use.This way,a user can still log in to a system if an OTP calculator is not available.The fol- lowing command creates a list of the next five passwords and stores it into a file named opiejames.txt: opiekey -n 5 ‘opieinfo‘ > opiejames.txt opiekey –n 5 496 ke 7116 492: AGEE NU ORR MIT SALE BOW 493: FUSS SONG MAIL STUB SOIL WARM 494: TENT SMUG JOT WEAN CLAW BIRD 495: BANG SAD OF TORE TALL DUNE 496: ROW PO SPA HEFT CUE QUIT This command works because it first has opiekey use the opieinfo com- mand to learn about the current sequence and seed number for the user,then print out the next five passwords.You can then e-mail this list to the user,who can then print it out and use it at any terminal.All the user has to do is pay attention to the sequence number given by the server,then enter his secret key and the password.It is really not a problem if a user loses this list,as long as the user does not reveal her secret key. Installing OPIE If you are using a mainstream system,such as Red Hat or SuSE,the installation process is simplicity itself.You just do the following in the source directory: ./configure make make install Configuration Options The configure script has several different options,although most people will not find them necessary.You can read about them all by issuing the ./configure --help command.Table 6.1 provides a list of the more important options. www.syngress.com
138_linux_06 6/20/01 9:43 AM Page 311 Network Authentication and Encryption • Chapter 6 311 Table 6.1 Configuration Options for OPIE Option Description --enable-access-file=FILENAME Allows you to create a file that allows hosts to bypass OTP. This file is not installed or supported by default, because it can defeat the purpose of installing OPIE in the first place. Although not necessarily a security hole, this option can cause problems, because once again, passwords will begin to pass over the network. --bindir=DIR This option allows you to determine where the OPIE binaries will be placed, if you do not want them in the /bin/ directory. --disable-user-locking By default, users will be kicked out after a number of failed logins unless you specify this feature. --enable-user-locking[=DIR] Allows you to specify the location of the user locking directory. --enable-retype Allows users to retype their secret pass phrases if they make a mistake. --enable-insecure-override Allows the use of opiepasswd and opiekey over a network. As with the --enable-access option, this option can cause security problems. Installation Options It is also possible to install only the OPIE clients.This option is useful,because you may want to disable all login options for a particular client system but still allow this system to log in to remote servers.If you wish to install only the client, you can issue the following command after issuing the ./configure command, complete with any options you desire: make client install This option installs only opiekey and opieinfo.Or,if you wish to install only the server,you can issue the following command: make server-install www.syngress.com
138_linux_06 6/20/01 9:43 AM Page 312 312 Chapter 6 • Network Authentication and Encryption You can learn more about configuration features by reading the README and INSTALL files that come with the distribution. NOTE The opiekey command requires a seed value that is over five digits. If the opiepasswd -c command generates a value that is too short, opiekey will fail. This often happens after you reinstall OPIE. If you encounter this problem, edit the /etc/opiekeys file and erase the entry of the account having this trouble. Uninstalling OPIE Upon installation,OPIE copies the existing /bin/su and /bin/login files su.opie.old and login.opie.old.After installing OPIE,you can use the make uninstall command to return the system back to its original state.The OTP ver- sions of su and login will be removed and replaced with the original versions. However,the make uninstall command will work only if the installation went well and if you are in the original directory from which you compiled OPIE.This means that you will have to keep the original installation directory handy in case a problem appears.Relying completely upon an uninstallation program to do the right thing every time is usually unwise,so remember the exact permissions of the original files.In Red Hat Linux,these permissions are as follows: (cid:2) /bin/su:-rwsr-xr-x (cid:2) /bin/login:-rwsr-xr-x Exercise: Installing OPIE
- Create a subdirectory off of your home directory named opie.
- Using a Web browser,download the OPIE 2.4 tarball source code from the CD accompanying this book,or from www.inner.net/opie.
- After you have obtained the file,place it in the opie directory.
- Issue the following command: tar -zxv www.syngress.com
138_linux_06 6/20/01 9:43 AM Page 313 Network Authentication and Encryption • Chapter 6 313 5. Change to the source directory (it should be named opie-2.4). 6. Issue the following commands,in order: ./configure make make install You can tell that things are going well when the ./configure script finishes in a way similar to that shown in Figure 6.5. Figure 6.5 Installing OPIE 7. After running make install,immediately issue the following command: /usr/local/bin/opiepasswd-c root Now,follow the instructions given by the opiepasswd command. 8. When opiepasswd completes,write down the resulting sequence number,seed number,and password here:
www.syngress.com
138_linux_06 6/20/01 9:43 AM Page 314
314 Chapter 6 • Network Authentication and Encryption
9. After you have added root,you can now access this account from a
remote server by using Telnet.But first,create two new users using the
useradd and passwd commands:
opieuser1
opieuser2
Make sure that you use the passwd command to give these users
standard passwords in the /etc/shadow directory.
10. Issue the following commands:
/usr/local/bin/opiepasswd-c opieuser1
/usr/local/bin/opiepasswd-c opieuser2
11. Now,issue the following command to generate OTP lists for root,
opieuser1,and opieuser2:
opiekey -n 5 opieinfo > otplistroot.txt
opiekey -n 5 opieinfo opieuser1 > otplistopieuser1.txt
opiekey -n 5 opieinfo opieuser2 > otplistopieuser2.txt
12. You now have a list of the next five challenges OPIE will issue for all of
the users you have added,in case they (and you) can’t get to an OTP
generator such as opiekey or WinKey.Test your OPIE installation
locally.Open another terminal and log in as a normal user.If you are
running X,just open another terminal screen and use su to become a
nonroot user (if you have a nonroot account named james,use the com-
mand su james).If you are at the command line,press CTRL+ALT+F2,
or CTRL+ALT+F3,then log in as the nonroot user.
13. Now,as a nonroot user in a new terminal,use the su command:
su
14. Notice that instead of the standard password,you are now given a chal-
lenge from OPIE.
15. To create a response,get to any terminal and use the opiekey command
as shown earlier in this chapter.That is,enter the following information,
substituting the sequence and seed numbers,as shown:
opiekey sequence# seed#
www.syngress.com
138_linux_06 6/20/01 9:43 AM Page 315 Network Authentication and Encryption • Chapter 6 315 16. The opiekey command will respond by asking you your secret pass- word.Enter this password correctly,because opiekey will use this secret password with the sequence and seed values to calculate the correct password.Remember,the sequence key will look something like “495,” and the seed value will look something like “bl13468.”Enter nothing else. 17. When you enter the correct sequence and seed numbers,opiekey will respond with a password consisting of several uppercase words.Go back to the terminal and carefully enter this password in all capital letters into the Response section in the other terminal,and you will be logged in. Congratulations.You have installed OPIE on your Linux system.Now,you can install the client portion on a remote server and test your work.See the next exercise for details. Exercise: Installing the OPIE Client on a Remote Server
- On another host than the one you used in the previous exercise,create a subdirectory named opie.This host will be called the OPIE client.
- Change to the opie subdirectory and obtain the OPIE tarball.
- Run the following commands: ./configure make make client install
- Telnet to access the original server that has the full OPIE installation. This server will be called the OPIE server.The copy of OPIE on this server will issue you a challenge (the sequence number and the seed number).
- Now,open another terminal on the OPIE client and run opiekey. Enter the challenge and seed numbers to log in.If you have any questions,follow the instructions given earlier in this chapter. www.syngress.com
138_linux_06 6/20/01 9:43 AM Page 316 316 Chapter 6 • Network Authentication and Encryption Exercise: Using opie-tk and Allowing Windows Users to Deploy OPIE
- It is very likely that you work with users who use the X Window envi- ronment,as well as Microsoft Windows systems.Several OTP generators exist that run right from any modern Windows systems.You can even find clients that run in DOS and Windows 3.11,if you want.Linux GUI clients exist,as well.Download the following files from www.inner.net/opie: (cid:2) winkey.exe A self-executable zip file,which contains the WinKey application for Windows 2000,NT,9x, and Me.This file is available on the CD that accompanies this book. (cid:2) opie.tk-v2.3.gz A tarball containing the opie.tk GUI for Linux. This file is also available on the accompanying CD. If you wish,you can also download additional clients,such as those for Macintosh or HP-UX machines.
- First,let’s start with using the opie.tk application.Unzip the application, then run it as follows: ./opie.tk-v2.3
- Begin a telnet session with the OPIE server and enter a login name so that you receive a challenge.
- Enter this challenge into the opie.tk-v2.3 screen and press Calculate. You will see a response similar to that shown in Figure 6.6. Figure 6.6 The opie.tk Interface after Calculating a Response
- Enter this response into the Telnet terminal and log in. www.syngress.com
138_linux_06 6/20/01 9:43 AM Page 317 Network Authentication and Encryption • Chapter 6 317 6. Now,unzip the WinKey binary,which is in a self-executing file. 7. Repeat the OPIE login procedure.See Figure 6.7,which shows a user receiving a challenge. Figure 6.7 Logging On to a Linux System from Windows 2000 Advanced Server 8. Enter the challenge values into the WinKey client and press Compute. You can copy and paste these values,if you wish.You will receive a response similar to that shown in Figure 6.8. Figure 6.8 Using WinKey to Generate a Response 9. Now,enter the response into the client.Sometimes,the Windows screen will allow you to paste the response right into the proper place.Just right- click on the screen.If this doesn’t work,just enter the values manually. 10. When you enter the response properly,you will be logged in. www.syngress.com
138_linux_06 6/20/01 9:43 AM Page 318 318 Chapter 6 • Network Authentication and Encryption Exercise: Installing opieftpd
- OPIE does not automatically place the compiled opieftpd file into a standard directory,nor does it program xinetd to recognize and use the binary.The compiled binary will be found in the OPIE source code directory of the OPIE server.Copy this file to the /usr/sbin/ directory.
- Now,create a simple text file named opieftpd in the /etc/xinetd.d/ direc- tory and enter the following into it: service ftp { disable = no socket_type = stream wait = no user = root server = /usr/sbin/opieftpd server_args = -l log_on_success += DURATION USERID log_on_failure += USERID nice = 10 }
- Now,disable the wu-ftpd daemon by editing its file (it should be in the /etc/xinetd.d/ directory) and change the disable = value to yes.If you have another FTP daemon configured to run from xinetd or any other daemon,disable it now.
- Restart xinetd: /etc/rc.d/init.d/xinetd restart
- Now,FTP to the OPIE server and enter your name to begin the OPIE login sequence.If you don’t see an OTP challenge,then recheck your work.
- Use any OTP client you wish to generate a response.Make sure that you enter your secret key (password) and sequence/seed numbers accurately. www.syngress.com
138_linux_06 6/20/01 9:43 AM Page 319 Network Authentication and Encryption • Chapter 6 319 7. The text you copy in from WinKey,for example,will not echo.Trust that it has been entered and press ENTER.You may have to repeat this process a few times in order to get it correct. 8. When you enter the information correctly,you will be logged in.You now have enabled OTP support for the su command,as well as for Telnet and FTP. Implementing Kerberos Version 5 Kerberos has become the premier way to allow network authentication.It pro- vides a central login point for a network that allows single sign-on for the net- work resources the user is allowed to access.Kerberos v5 is a revolutionary step in network authentication,because it allows you to establish a domain that authenticates not only individual hosts and users,but individual daemons,as well. Using Kerberos,it is possible to centrally control which hosts and users can access the daemons on your network.In this sense,Kerberos is revolutionary.It obviates the use of the Network Information Service (NIS),for example,and is a vast improvement upon it.Both NIS and Kerberos allow you to centrally manage users,but NIS does not encrypt transmissions,and it requires passwords to be given across the network.Microsoft now uses its proprietary version of Kerberos for its Windows 2000 products. After Kerberos is established on a network,passwords do not ever cross the network,not even in encrypted form.It is also possible to configure Kerberos to encrypt,ensuring communications between authenticated hosts.Kerberos is implemented by a Key Distribution Center (KDC),which holds all of the infor- mation that allows Kerberos clients to authenticate;the KDC contains the database that makes single sign-on possible.Whenever you have a system of Kerberos clients authenticating with a KDC,you are said to have a Kerberos “realm,”which is shown in Figure 6.9. Whenever you have a host that joins a Kerberos realm,it is often said to be “Kerberized.”Whenever an application is altered to participate in a Kerberos realm,it is also said to be Kerberized.This chapter discusses Kerberos version 5, which is the most current version as of this writing. www.syngress.com
138_linux_06 6/20/01 9:43 AM Page 320 320 Chapter 6 • Network Authentication and Encryption Figure 6.9 A Kerberos Realm Key Distribution Center (KDC) Kerberos Host A Kerberos Host B Kerberos Realm Kerberos Host C Kerberos Host D NOTE Usually, a Kerberos realm is given the same name as the Domain Name System (DNS) name for the company. Thus, a company with the DNS name of yourcompany.com will likely have the Kerberos realm name of YOURCOMPANY.COM. This practice is not absolutely necessary, however. You will see how you can edit a portion of the /etc/krb5.conf file to map dissimilar DNS domain and realm names to each other later in this chapter. Why Is Kerberos Such a Big Deal? The KDC’s database does not work in the traditional way.Traditionally,a standard user database waited for passwords to be sent across the network,and then the authentication mechanisms would present authentication information (a user- name and a password) to the database,make a comparison,and then access would be granted.In Kerberos,all network information (data about users,services,and hosts) is stored in the Kerberos database.This database contains the public keys of all principals.A principal is the name for any host,service,or user that is allowed to authenticate on a Kerberos network.Any sensitive information,such as pass- www.syngress.com
138_linux_06 6/20/01 9:43 AM Page 321 Network Authentication and Encryption • Chapter 6 321 words,always stays on the KDC and on the client.Using public key cryptog- raphy,the KDC and the client establish trust relationships that allow the KDC to then determine exactly which services a host and/or user can access. Kerberos Terms Table 6.2 provides the terms used when implementing Kerberos. Table 6.2 Common Kerberos Terms Kerberos Element Description Key Distribution Center (KDC) The system that authenticates principals. The KDC is responsible for the storage and transmission of principals on a Kerberized network. Most of the time, the KDC houses the Ticket Granting Server (TGS). The TGS provides a special token called a ticket granting ticket. The KDC also houses the Authentication Server (AS), which grants the actual tickets clients use when accessing hosts and daemons. Client A host that is part of a Kerberos realm. A client can house several daemons that can be accessed only if a user has properly authenticated with a KDC. Ticket Granting Ticket (TGT) A special access token obtained from the KDC that enables users to obtain additional tickets. Every user on a Kerberos realm must use the kinit program to obtain a TGT. Authentication Server A server that is responsible for granting tickets to users, hosts, and host daemons (principals). The Authentication Server first communicates with the TGT to ensure that the principal has been authenticated, and it then issues the ticket. In Linux systems, the Authentication Server is housed in the same system as the KDC. Ticket Temporary credentials generated when a properly authenticated client accesses network service, such as an FTP server, a printer, or a router. The ticket authenticates a client that wishes to use a remote service in a realm. If a client (Host A) wishes to access Continued www.syngress.com
138_linux_06 6/20/01 9:43 AM Page 322 322 Chapter 6 • Network Authentication and Encryption Table 6.2 Continued Kerberos Element Description a host in a Kerberos realm (Host B), the KDC will issue a ticket to Host A, which allows access to the service for a certain period of time (hours, by default). A ticket is not generated by kinit. Principal The equivalent of an entry in the /etc/passwd and /etc/shadow database in a standard Linux system. A principal can be defined as either a user, a host, or a host daemon that runs on hosts, and is comprised of three parts: The primary, the instance, and the realm. See Figure 6.10. Credential cache/ticket file Usually a file in the /tmp/ directory that contains your TGT, host, and host daemon keys. Service keys are generated when a client attaches to a Kerberized daemon that is able to authenticate with the KDC. Keytab (Key table) A file on a Kerberos client that includes the public keys of the hosts and host daemons that this server can access. Whenever a connection is made, Kerberos checks the contents of the keytab, then checks the current user’s credential cache. If these elements are approved, Kerberos will allow access to the remote server. It is vital that you update this file on each client. The file is usually named /etc/krb5.keytab. Policy A special limit placed upon a Kerberos principal that determines the amount of time a particular user, host, or host daemon ticket remains valid. Kerberos Principals You have already read that a principal consists of a primary (also known as a “root”),an instance,and a realm.Figure 6.10 shows an example of a host prin- cipal,which uses all of the three elements of a principal.A host principal always has the word “host”as the primary,then has the name of the host as the instance and the realm name in the realm section.A principal can exist for daemons run by hosts,as well. www.syngress.com
138_linux_06 6/20/01 9:43 AM Page 323 Network Authentication and Encryption • Chapter 6 323 Figure 6.10 A Kerberos Principal Principal Primary Instance Realm Host /www.yourcompany.com @YOURCOMPANY.COM The following is an example of a host daemon principal: ftp/www.yourcompany.com@YOURCOMPANY.COM This principal recognizes the FTP service for the www.yourcompany.com service.Any user who properly authenticates with the KDC and who is allowed access to this service will then be able to use the FTP service on the www.yourcompany.com host. Many times,however,a principal does not have an instance.For example, it is possible to create a user principal,which would appear as follows: james@YOURCOMPANY.COM.This principal would allow a user to log on to any host in a Kerberos realm.You can,of course,specify an instance for a user.For example,the following principal would allow login to only the system named www.yourcompany.com:james/www.yourcompany.com @YOURCOMPANY.COM The Kerberos Authentication Process The information in the next couple of paragraphs is greatly simplified,but it is more than enough from a system administrator’s point of view.When a Kerberos client first obtains a TGT from the KDC,this token does not actually provide access to any particular daemon or network service.It is simply a token that informs other hosts that the KDC has authenticated this host,and that this host and user can request services from other hosts.Because the TGT is signed by the user’s password and turned into a hash,the user can use the kinit command and his own password to generate the same hash and make a comparison between the two.If the TGT and password match,then a session key is established and a credential cache is created,usually in a file in the /tmp/ directory. www.syngress.com
138_linux_06 6/20/01 9:43 AM Page 324 324 Chapter 6 • Network Authentication and Encryption After the credential cache file is populated with the TGT,the host and user can then use this TGT to actually log on to hosts and request services.When it comes time for a user (a principal) to access a host’s daemon (such as Kerberos- FTP and rlogin),the user uses his TGT to contact the KDC and ask for an actual ticket,which is the access token for a specific service.If the KDC authenticates this request,the KDC will send a ticket and update the principal’s credential cache with information about the service he or she has requested.If the Kerberos database does not contain the service or host name,then access will be denied. How Information Traverses the Network When a ticket is transported across the network,it is signed by the user’s pass- word,which is entered whenever a Kerberos administrator uses the kadmin pro- gram to add a principal to the database.Note that the ticket does not actually contain the password.It is only signed by a password,which creates a hash.Not only that,but Kerberos places a time stamp on this ticket,so that even if someone with a supercomputer were to subject this ticket to a brute force attack and then generate a valid hash,the access token would no longer be valid.The Kerberos version in Red Hat Linux defaults to 8 hours.For this reason,time synchroniza- tion on networks and systems that use Kerberos is essential.NTP (Network Time Protocol) may be used for this purpose. NOTE For a more exhaustive discussion detailing how Kerberos works, go to http://web.mit.edu/kerberos/www/dialogue.html. This URL will take you to a document entitled “Designing an Authentication System: A Dialogue in Four Scenes.” Not only does it explain Kerberos quite well, it is also a well-written parody of a dialogue using the Socratic Method. I know that the document sounds pretty stuffy, but it’s an easy read and will help you learn more about exactly why Kerberos was developed and exactly what it does. However, understand that this document was originally written for Kerberos version 4. The current version of Kerberos is version 5. The chief alterations between Kerberos v4 and Kerberos v5 is that Kerberos v5 uses public key encryption. So, as clearly written as the dialog is, if you don’t understand public key cryptography well, then you probably won’t understand Kerberos very well. www.syngress.com
138_linux_06 6/20/01 9:43 AM Page 325 Network Authentication and Encryption • Chapter 6 325 Creating the Kerberos Database After installing Kerberos,you will have to create a database where all principals will be stored.You do this by issuing the following command: /usr/kerberos/sbin/kdb5_util create -s This command creates the necessary database files in the /var/kerberos/ krb5kdc/ directory.After you have created the database entries,you then edit the /etc/krb5.conf and /var/kerberos/krb5kdc/kdc.acl files to reflect your Kerberos realm and DNS domain names.You must then add an administrative user,as well as additional principals,to the database. Using kadmin.local Because you have a new Kerberos realm,you are presented with a logical conun- drum:You need to administer Kerberos,but the kadmin command requires that you present a username and a password.However,no administrative user or pass- word exists in the database yet.So,how do you get started? The answer is the /usr/kerberos/sbin/kadmin.local command.It does not require a user to first authenticate.As long as you have created the Kerberos database and edited the proper files,you will then be able to use kadmin.local to add an administrative user: /usr/kerberos/sbin/kadmin.local –q "addprinc james/admin" This command has kadmin.local run as a one-time command.You can also use kadmin.local interactively,which means that you begin a session where you get a special prompt that lets you enter Kerberos-specific commands.You can learn more about kadmin.local by reading its man page. After using kadmin.local,Kerberos will have an administrative user,and you can use the kadmin from any host on the network. SECURITY ALERT! Because kadmin.local does not require extensive authentication, con- sider the importance of making sure that this system runs no other dae- mons, and is accessible only via the most stringent security requirements. For example, consider allowing only interactive login and making sure that the computer itself is physically secure. www.syngress.com
138_linux_06 6/20/01 9:43 AM Page 326 326 Chapter 6 • Network Authentication and Encryption Using kadmin The kadmin application,also found in the /usr/kerberos/sbin/ directory,is designed to add principals to the Kerberos database.It is much like kadmin.local,except you can issue it from any Kerberos client on your realm. Kadmin is usually used as an interactive command,as shown in the following sequence: terminal# kadmin Authenticating as principal james/admin@ YOURNETWORK.COM with password. Enter password: kadmin: addprinc james WARNING: no policy specified for james@ YOURNETWORK.COM; defaulting to no policy Principal "james@YOURNETWORK.COM" created. kadmin: quit terminal# This example shows a kadmin session where the Kerberos administrator, james/admin,starts kadmin,enters the administrative password,then uses the addprinc command to add a user named james.This user will then be able to access network daemons and services,as long as the Kerberos administrator takes the additional steps shown in the upcoming example.Notice first that Kerberos automatically adds the realm name.Second,notice that the user james@yournetwork.com is different than the user james/admin@yournetwork .com.This is because the first principal (james@yournetwork.com) has an empty instance,whereas the second (james/admin@yournetwork.com),lists the admin instance,which makes the user an administrative user. Here is another example: terminal# kadmin Authenticating as principal root/admin@STANGERNET.COM with password. Enter password: kadmin: addprinc -randkey host/www.yournetwork.com WARNING: no policy specified for host/www.yournetwork.com@ YOURNETWORK.COM; defaulting to no policy Principal "host/www.yournetwork.com@YOURNETWORK.COM" created. kadmin: quit terminal# www.syngress.com
138_linux_06 6/20/01 9:43 AM Page 327 Network Authentication and Encryption • Chapter 6 327 This example shows a kadmin session where the Kerberos administrator james/admin starts kadmin,enters the administrative password,then uses the addprinc -randkey command to add a host principal named host/www. yournetwork.com.The -randkey option is unique to host and host daemon princi- pals,because after a principal is created,the password no longer needs to be remembered,because this password will be used to sign tickets for users who are already authenticated.This password is used only to sign tickets.No user will ever have to enter this password.In this case,it is best to let Kerberos create its own difficult password,rather than you taking the time to do so,because you will then have to verify it. To add a host daemon,you would simply issue the following command from within kadmin: addprinc -randkey ftp/www.yournetwork.com This command adds the ftp daemon for the www.yournetwork.com daemon. NOTE For the sake of convenience, you may want to make your administrative user the same name as your login name. Although not the most secure option, doing so means that you don’t have to use the following com- mand each time you start kadmin: /usr/kerberos/sbin/kadmin –p james/admin Still, it’s important that you know this command, because you will need to use it at least once on every host that belongs to your Kerberos network. This is because, as you will see, each client needs to have its keytab file updated by the systems administrator. Finally, if you are logged into one Kerberos realm named @othercompany.com, and you wish to use Kerberos to log into @yourcompany.com realm, you can issue the following command: /usr/kerberos/sbin/kadmin –p james/admin@YOURCOMPANY.COM This command will also work if you are logging in from the @yourcompany.com realm. Adding the @yourcompany.com is simply redundant in this case, however. www.syngress.com
138_linux_06 6/20/01 9:43 AM Page 328 328 Chapter 6 • Network Authentication and Encryption The kadmin command also lists,modifies,and deletes principals.To list pres- ent Kerberos users from within kadmin,enter the following command: kadmin:list_principals ftp/blake.yourcompany.com.YOURCOMPANY.COM rlogin/wordsworth.YOURCOMPANY.COM james.YOURCOMPANY.COM sandi.YOURCOMPANY.COM host/blake.yourcompany.com.YOURCOMPANY.COM kadmin: To delete any principal,you can issue the following command: kadmin: delete_principal user1 Are you sure you want to delete the principal "user1@YOURCOMPANY.COM"? (yes/no): yes Principal "user1@YOURCOMPANY.COM" deleted. Make sure that you have removed this principal from all ACL's before reusing. kadmin: For more information,use the ? command from within kadmin or consult the Kerberos documentation in the /usr/share/krb5*/ directory and the man pages.The asterisk represents the Kerberos version you are using. Using kadmin on the Client The kadmin command does not simply add and manage principals to the Kerberos realm.It is also used to populate and update the Key table files for each Kerberos host.It is vital that you understand this kadmin function,because most of the existing Kerberos documentation skims over this step.This is partially because most people who write about Kerberos do not have the knowledge to actually implement Kerberos,or because they know how to implement Kerberos so well that they just assume that you already know this step.Hopefully,the pres- ent discussion will bridge the gap between the overly theoretical and overly tech- nical writers and actually show you how to properly configure Kerberos clients. You will learn more about this shortly.Figure 6.11 shows the gkadmin interface. Although it is a nice interface,the command-line interface is ideal for updating the /etc/krb5.keytab files on clients. www.syngress.com
138_linux_06 6/20/01 9:43 AM Page 329 Network Authentication and Encryption • Chapter 6 329 Figure 6.11 The gkadmin Interface NOTE If you are running X, you can use the gkadmin GUI utility. Install the gnome-kerberos package for your particular distribution. You can obtain it from www.rpmfind.net, or other sites. It is also available on many distribution CDs, such as the Red Hat Power Tools disk. Using kadmin and Creating Kerberos Client Passwords As a Kerberos administrator,you will have to add user principals.The creators of Kerberos (researchers at the Massachusetts Institute of Technology) have recom- mended client passwords of at least six characters.Passwords should combine upper- and lower-case letters,and they should also include numbers and punctuation marks. www.syngress.com
138_linux_06 6/20/01 9:43 AM Page 330 330 Chapter 6 • Network Authentication and Encryption Setting Policies Kerberos policies are much like standard Unix password policies.They determine password length,whether or not a user’s principal will expire at a certain time, when the password will expire,and so forth.Standard principal policy settings include the following: (cid:2) Policy name When you create a policy,you can name it to help differ- entiate it from other policies. (cid:2) Minimum password life (in seconds) How long a user must keep a password before being allowed to change it. (cid:2) Maximum password life (in seconds) The longest amount of time a user can keep a password. (cid:2) Minimum password length Sets the number of characters a password must have. When you add a principal using kadmin and do not specify a policy,the default behavior is to establish no policy whatsoever.You can create a policy by using the addpol command from within kadmin: kadmin: addpol yourdomainpol kadmin: modpol -maxlife 2/02/2004 -minlength 6 domainpol This policy means that the principal will expire on the second day of February 2004,and that any subsequent password change must be at least six characters long.You can add this policy to a user named Jacob by using the modprinc command,as follows: modprinc –policy yourdomainpol Using Kinit The kinit command allows a user to obtain a TGT from the KDC.It does not allow a user to get a host or service ticket.A host or service ticket is obtained only when a user is successful logging into the service.Issuing the kinit com- mand has the Kerberos client contact the KDC and obtain a TGT,as shown in Figures 6.12 and 6.13. www.syngress.com
138_linux_06 6/20/01 9:43 AM Page 331 Network Authentication and Encryption • Chapter 6 331 Figure 6.12 Using the kinit Command KDC kinit Command Kerberos Client Figure 6.13 Receiving a TGT from the KDC KDC Ticket Granting Ticket (TGT) Kerberos Client www.syngress.com
138_linux_06 6/20/01 9:43 AM Page 332 332 Chapter 6 • Network Authentication and Encryption Here is an example of a simple kinit session: terminal# /usr/kerberos/bin/kinit Password for james@YOURDOMAIN.COM: terminal# This session has obtained a TGT from the KDC.This credential is usually stored on the local hard disk,usually in the /tmp/ directory.The file is usually in the following format: krb5cc_UID UID is the user identification number of the user who issued the kinit com- mand.For example,if you are root,the credential cache file would be krb5cc_0, whereas the user with the UID of 500 would have the credential file named krb5cc_500. Suppose,however,that your Kerberos name was james,and that you wished to obtain your credential,but only had access to a terminal owned by another user named sandi.The following command would get you your own TGT: terminal# /usr/kerberos/bin/kinit sandi Password for sandi@YOURDOMAIN.COM: Now,you have begun your own credential cache,which right now holds only your TGT.For more information about using kinit,consult its man page or the Kerberos workstation documentation in the /usr/share/doc/krb5*/ directory. The kinit Command and Time Limits Sometimes you may want to obtain a TGT that is valid for a period shorter than the default (eight hours).Suppose that you know you will use this TGT for only one hour.The following command would make the TGT valid for that period of time: terminal# /usr/kerberos/bin/kinit -l 1h terminal# Kinit and most Kerberized clients can also forward the tickets they obtain. This means that you can obtain tickets on one host,then have them sent to another.The following command obtains a ticket for the user named james in the YOURDOMAIN.COM realm for two hours,then allows you to forward them, as well: www.syngress.com
138_linux_06 6/20/01 9:43 AM Page 333 Network Authentication and Encryption • Chapter 6 333 terminal# /usr/kerberos/bin/kinit –f -l 1h @YOURDOMAIN.COM terminal# For additional details concerning how to customize the TGT and tickets obtained from the KDC,consult the man pages for kinit and additional clients. Managing Kerberos Client Credentials After you run kinit,the cache will contain only the TGT.Additional credentials, such as actual tickets to access a daemon such as FTP,will be added only after you access the remote host.This,in addition to properly updating the /etc/krb5.keytab file,is a little-understood part of Kerberos configuration.To list your current credentials,use the following command: terminal# /usr/kerberos/bin/klist 03/21/01 3:05:53 04/21/01 13:05:53 krbtgt/YOURNETWORK.COM@YOURNETWORK.COM terminal# This command shows that a TGT has been issued on March 21st for the YOURNEWORK.COM realm.Additional options exist.Consult the klist man page. The kdestroy Command When you log off of your system,you should use the kdestroy command to eliminate your credential cache.This command erases the /tmp/ krb5cc_UID file.You need to use this command when your TGT and other tickets expire. Many times,a seeming Kerberos problem can be solved by erasing this cache and using kinit over again. NOTE The gnome-kerberos package ships with the /usr/bin/krb5/krb5 applica- tion, shown in Figure 6.14. It is a combination of the kinit, klist, and kdestroy applications, because you can use it to view, delete, and obtain credentials. www.syngress.com
138_linux_06 6/20/01 9:43 AM Page 334 334 Chapter 6 • Network Authentication and Encryption Figure 6.14 The krb5 Interface WARNING Credential caches can grow quite large, and can remain valid long after a user walks away from the terminal. To ensure that your Kerberos realm remains secure, encourage and train users to use kdestroy whenever they have finished a session. Otherwise, another user can walk up to the terminal and access network resources. Exercise: Configuring a KDC You now have a basic understanding of Kerberos elements.Now,take the fol- lowing steps to configure a KDC on your Linux system.These steps will allow you to create a Kerberos database,configure the necessary files,and create user, host and host daemon principals.
- Take the time to plan your DNS domain and Kerberos realm names.If you do not have a proper DNS domain created,take the time to do this now.Enter the following information: Planned DNS domain name:__________________________________ Planned Kerberos realm name:_________________________________
- Obtain and install Kerberos using the available RPM files.You can download them from www.rpmfind.net.Make sure that you obtain the packages appropriate for your Linux host: www.syngress.com
138_linux_06 6/20/01 9:43 AM Page 335 Network Authentication and Encryption • Chapter 6 335 (cid:2) krb5-libs-* (cid:2) krb5-workstation-* (cid:2) krb5-server-* (cid:2) krb5-devel-* The * represents the version appropriate for your Linux host.Also, the krb5-devel package is necessary only if you plan to develop your own Kerberized applications.The 1.2.2-4 versions of these files are on the accompanying CD. 3. Install the packages in the following order: (cid:2) krb5-libs-* (cid:2) krb5-workstation-* (cid:2) krb5-server-* (cid:2) krb5-devel-* 4. Now,edit the /etc/krb5.conf and /var/kerberos/krb5kdc/kadm.acl files so that they reflect your planned Kerberos realm information.If you can, simply substitute your DNS domain and Kerberos realm information for all example.com/EXAMPLE.COM entries.Take special note of the [domain_realm] entries,which map DNS domains to Kerberos realms. This section helps you if your DNS domain is not the same as your Kerberos realm.Properly editing the /etc/krb5.conf file ensures that you will be able to use kadmin,kinit,and additional commands to access the database on the KDC.You will see how you will have to do much the same thing for each Kerberos client host. The /var/kerberos/krb5kdc/kadm5.acl file should appear as follows: */admin@YOURDOMAIN.COM * Now,anyone with the /admin instance has the power to administer all elements of your Kerberos realm. 5. Now that you have installed the correct Kerberos RPM packages and edited the configuration files,create the Kerberos database: /usr/kerberos/sbin/kdb5_util create -s You will be asked to create and confirm a password.Make sure that you save this password in a save place.The -s option creates what is www.syngress.com
138_linux_06 6/20/01 9:43 AM Page 336 336 Chapter 6 • Network Authentication and Encryption called a “stash file,”which contains the password for the Kerberos database.If you don’t create this stash file,Kerberos will ask you for the password each time you restart it. 6. Start the kadmin,krb5kdc,and krb24 daemons in the following order: /etc/rc.d/init.d/krb5kdc start /etc/rc.d/init.d/kadmin start /etc/rc.d/init.d/krb524 start 7. To ensure that these daemons will start at the next reboot,use ntsysv to mark the Kerberos services to start automatically. 8. Now,populate the database you have just created using the kadmin.local command: /usr/kerberos/sbin/kadmin.local –q "addprinc kerberosadministrator/admin" If you wish to use a name other than kerberosadministrator,substi- tute your own.However,you must use the /admin instance,because using this instance gives any user you specify the privileges to list,add, modify,and delete users. 9. Check the /var/kerberos/krb5kdc/kdc.conf file and ensure that it reflects the proper realm name. 10. Now that you have created an administrator account and verified all set- tings,log on using kadmin or gkadmin: terminal$ /usr/kerberos/sbin/kadmin –p kerberosadministrator/admin Authenticating as principal kerberosadministrator/admin@ YOURDOMAIN.COM with password kadmin: If this command fails,check your /var/kerberos/krb5kdc/kadm5.acl file and make sure that it reads as follows: */admin@YOURDOMAIN.COM * You will,of course,substitute your own realm information.Make sure that the /etc/krb5.conf file is also correct for your Kerberos realm and DNS information,that your system has proper DNS resolution (both forward and reverse),and that this system is a client to the proper DNS server. www.syngress.com
138_linux_06 6/20/01 9:43 AM Page 337 Network Authentication and Encryption • Chapter 6 337 11. After you have been able to obtain a kadmin prompt,enter the fol- lowing command: addprinc username Where username is the username you are currently logged in as. 12. When you have added the username user,type quit to exit kadmin. 13. Now,using the username you have just added,use kinit. 14. Use klist or krb5 to verify that you can get and list a TGT.Either client will show only the TGT,because you have not yet tried to authenticate with any of the network hosts.You will obtain actual ticket when you log on to remote hosts daemons.If you see a TGT,congratulations.If you need to troubleshoot Kerberos further,reread the rest of this chapter and consult the Kerberos documentation,which resides in various man pages (kerberos,kadmin,kinit,and so forth),as well as /usr/share/doc/ krb5-server-1.2.2/ and /usr/share/doc/krb5-workstation-1.2.2/ directories. Establishing Kerberos Client Trust Relationships with kadmin A trust relationship in public key cryptography allows two hosts to authenticate each other and to decrypt information.The only way to establish a trust relation- ship on the Kerberos client host is to use the kadmin command.The systems administrator must extract parts of the Kerberos database and insert them onto each client.Figure 6.15 shows the process of updating the /etc/krb5.keytab file for each client using kadmin ktadd. The administrator must use the kadmin -ktadd command on each Kerberos client that wishes to participate in the Kerberos realm.The process of extracting records populates the local host’s /etc/krb5.keytab file with the hosts and services that the Kerberos client is allowed to use.The KDC supplies these keys. The following example shows the kadmin ktadd -k command that gives each client the ability to prove that it has the public keys of the services used.The /etc/krb5.keytab file contains this information.To update the keytab file of a Kerberos client (in this example,a host named wordsworth),you would go through the following sequence on the client itself: www.syngress.com
138_linux_06 6/20/01 9:43 AM Page 338 338 Chapter 6 • Network Authentication and Encryption terminal# /usr/kerberos/sbin/kadmin Authenticating as principal james/admin@YOURCOMPANY.COM with password. Enter password: kadmin: ktadd -k /etc/krb5.keytab host/keats.yournetwork.com Entry for principal ftp/keats.yournetwork.com with kvno 6, encryption type DES cbc mode with CRC-32 added to keytab WRFILE:/etc/krb5.keytab. Entry for principal host/keats.yournetwork.com with kvno 6, encryption type Triple DES cbc mode raw added to keytab WRFILE:/etc/krb5.keytab. kadmin: quit terminal# Figure 6.15 Establishing Trust Relationships Using the kadmin ktadd Command Client B Administrator uses kadmin on Client A to update the local /etc/ krb5.keytab file. Public Keys Transferred from KDC KDC Public Keys Transferred from KDC Administrator uses kadmin on Client B to update the local /etc/krb5.keytab file. Client B www.syngress.com
138_linux_06 6/20/01 9:43 AM Page 339 Network Authentication and Encryption • Chapter 6 339 Now,this host has the public key of the keats system.It is vital that you give the host principal entry to this client.Otherwise,Kerberos will not be able to compare information to allow the wordsworth access to keats. Here is another example that adds the ftp/keats.yournetwork.com principal to the wordsworth keytab (/etc/krb5.keytab): terminal# /usr/kerberos/sbin/kadmin Authenticating as principal james/admin@YOURCOMPANY.COM with password. Enter password: kadmin: ktadd -k /etc/krb5.keytab ftp/keats.yournetwork.com Entry for principal ftp/keats.yournetwork.com with kvno 6, encryption type DES cbc mode with CRC-32 added to keytab WRFILE:/etc/krb5.keytab. Entry for principal ftp/keats.yournetwork.com with kvno 6, encryption type Triple DES cbc mode raw added to keytab WRFILE:/etc/krb5.keytab. kadmin: quit terminal# Assuming that the user has run kinit,this host can now properly authenticate with keats to access the FTP server.You will have to repeat this process to add the host/keats.yournetwork.com entry,as well.Unless you take these two steps,you will not be able to access any daemon on the host named keats. Additional Daemon Principal Names Generally,you must add a principal to the Kerberos database for each service.For example,to add smtp and pop3 principals for the host named blake,you would create the following principals: (cid:2) smtp/blake.yourdomain.com For a Kerberized SMTP service. (cid:2) pop3/blake.yourdomain.com For a Kerberized POP3 service. Remember,the text string “yourdomain”represents your DNS domain. Kerberos does not use the word “domain”to represent its authentication space— it uses the word “realm.”Additional Kerberized services exist.Check your xinetd directory (usually /etc/xinetd.d/) for additional service names to add. www.syngress.com
138_linux_06 6/20/01 9:43 AM Page 340 340 Chapter 6 • Network Authentication and Encryption Logging On to a Kerberos Host Daemon Figure 6.16 shows what occurs when a client with a TGT uses a Kerberized FTP client to log on to a Kerberized FTP daemon.Client A,the Kerberized client, first uses its TGT to request a session ticket.The Kerberos KDC checks to see if Client B has a host principal entry,then also checks to see if Client B has a host daemon entry for FTP.Then,the KDC determines that Client A has the proper host and host daemon keys for client B.If all of these credentials match,then client A can connect to client B’s FTP server. Figure 6.16 Accessing a Kerberized Network Daemon Client A Ticket Granting Ticket (TGT) Client A requests and recieves FTP session ticket, using TGT. FTP Session Allowed KDC Client B and KDC communicate to determine if access is allowed. Client B Common Kerberos Client Troubleshooting Issues and Solutions After you are reasonably sure that your Kerberos setup is correct,consider the following issues: www.syngress.com
138_linux_06 6/20/01 9:43 AM Page 341 Network Authentication and Encryption • Chapter 6 341 (cid:2) DNS You will not be able to use Kerberos unless you have a DNS server in place that has flawless forward and reverse zones.Simply having a forward zone or populated /etc/hosts files is not enough to run Kerberos properly. (cid:2) Time skew The tickets issued by Kerberos are time-sensitive.To help reduce authentication problems,Kerberos will not issue tickets to hosts whose clocks are more than five minutes apart from the KDC.The NTP is designed to ensure that all servers have the same time.The server at www.eecis.udel.edu has additional information about NTP,including network daemons you can install. (cid:2) Old credentials When you try to administer Kerberos using kadmin, it is important to realize that if you make significant changes to the database concerning a user,you will have to use kdestroy and then kinit to obtain new credentials. (cid:2) Unsupported client applications Make sure that the application you use actually supports the Kerberos protocol and that the versions match. (cid:2) Unstarted Kerberos client daemons Check your xinetd configura- tion on your destination server to ensure that this server has the proper Kerberized daemon started.For example,if you wish to test Kerberos by using your Kerberized FTP client to connect to the server named james, make sure that the Kerberized FTP server is started on james. (cid:2) Kerberos log files If you encounter problems,use the tail -f command to continuously read the /var/log/kadmind.log and krb5kdc.logfiles. (cid:2) Security concerns You must configure your Kerberos client hosts to use only Kerberized clients.In order to use Kerberos properly,no other client applications or server daemons should be used on the network, unless they use OTP,encryption,or a similarly secure protocol.For example,if you have just one Telnet daemon open and accepting con- nections,you still have passwords crossing the network. For more information about configuring Kerberos clients,consult the docu- mentation in the /usr/share/doc/krb5-workstation-1.2.2/ directory. Kerberos Client Applications The Kerberos clients installed with the workstation package are all in the /usr/ kerberos/bin/ directory.Here is a description of the more popular ones provided: www.syngress.com
138_linux_06 6/20/01 9:43 AM Page 342 342 Chapter 6 • Network Authentication and Encryption (cid:2) kpasswd Kerberos daemon clients can use the /usr/kerberos/bin/ kpasswd command to change passwords on the Kerberos KDC. (cid:2) ftp A Kerberized FTP client. (cid:2) krlogin A Kerberized rlogin client,which allows you to log in to a remote host without providing a password.This version is an improve- ment to the standard rlogin,because passwords are not sent in the clear. (cid:2) krsh A Kerberized rsh client,which allows commands to be executed on the remote host without a password. (cid:2) ksu Requires that users contact the KDC before being allowed to become root or any other user. Kerberos Authentication and klogin After you have created a principal for klogin (klogin/hostname.domainname.com@YOURREALM.COM) and updated the keytab files for all hosts involved,you can configure your host to allow others to access your home directory without divulging your account password.All you need to do is create a hidden file named .k5login in your home directory.The leading dot (.) makes the file hidden.You must then enter the principal of the user whom you wish to allow access.This user must,of course,be defined on the KDC,and the host from which the user is contacting you from must have an updated keytab file,which contains the host and host daemon name for krlogin. If you wish to add multiple principals to the .k5login file,you can do so by entering each principal on a separate line,as follows: patrick@YOURREALM.COM susan@MYREALM.ORG These two entries make it possible for patrick and susan to access only the home directory (the home directory of the system that contains the .k5login file),and no other area on your machine or any other area on the network. Should you then wish to revoke access to your home directory,simply edit the .k5login file and remove the relevant entry. Exercise: Configuring a Kerberos Client In this exercise,you will add user,host,and host daemon principals to your Kerberos realm.This exercise assumes three different systems in the following roles: www.syngress.com
138_linux_06 6/20/01 9:43 AM Page 343 Network Authentication and Encryption • Chapter 6 343 (cid:2) A KDC (host A) (cid:2) A Kerberos client running the Kerberized ftp daemon (host B). (cid:2) A Kerberos client accessing host B’s ftp daemon (host C). You can,of course,use fewer systems.For example,you can make the Kerberos KDC server offer up its own FTP service and use a remote client to access it.
- On the KDC (host A),run kadmin or gkadmin to add the following principals: kerberosuser1 kerberosuser2 host/hosta.yourdomain.com host/hostb.yourdomain.com host/hostc.yourdomain.com ftp/hostb.yourdomain.com ftp/hostc.yourdomain.com
- Install the krb-libs and krb5-workstation packages on hosts B and C.You do not need to install the server package on every host on the network.
- As root on hosts B and C,create two users named kerberosuser1 and kerberosuser2 using useradd,then use the passwd command to give each of these users a password: useradd kerberosuser1 useradd kerberosuser2 passwd kerberosuser1 passwd kerberosuser2 If you do not wish to create these local user accounts,you do not have to.However,when it comes time to use kinit,you will have to specify the user (such as kerberosuser1 or kerberosuser2) using the -p option.Read earlier in this chapter for more information on using kinit.
- Run kadmin on hosts B and C.Make sure that you specify the correct administrative user for your KDC.Issue the following commands on both hosts B and C to the local client (not on the Kerberos KDC) from within to populate the local /etc/krb5.keytab file with the principals of the network hosts and daemons you wish to use: www.syngress.com
138_linux_06 6/20/01 9:43 AM Page 344 344 Chapter 6 • Network Authentication and Encryption ktadd –k /etc/kb5.keytab kerberosuser1 ktadd –k /etc/kb5.keytab kerberosuser2 ktadd –k /etc/kb5.keytab host/hosta.yourdomain.com ktadd –k /etc/kb5.keytab host/hostb.yourdomain.com ktadd –k /etc/kb5.keytab host/hostc.yourdomain.com ktadd –k /etc/kb5.keytab ftp/hostb.yourdomain.com ktadd –k /etc/kb5.keytab ftp/hostc.yourdomain.com These commands will transfer information from the KDC to the /etc/krb5.keytab files on both hosts B and C. 5. Now,you need to activate the FTP daemons on the client hosts.This involves editing the /etc/xinetd.d/gssftp file for hosts B and C.Change the disabled = yes value to disabled = no. 6. Disable any other FTP daemons you may have active.For example,edit the /etc/xinetd.d/wu-ftpd or /etc/xinetd.d/opieftpd so that the disabled entry reads disabled = yes. 7. Restart xinetd: /etc/rc.d/init.d/xinetd restart 8. Use ping to verify that hosts B and C can access host A. 9. Now,on host B,log on as kerberosuser1 and use /usr/kerberos/bin/kinit to obtain a TGT.Alternatively,log on as any user and specify the Kerberos user (such as kerberosuser1 or kerberosuser2) using the -p option. 10. Use /usr/kerberos/bin/klist to view the TGT. 11. Now,use the /usr/kerberos/bin/ftp client to access host c. 12. You will be allowed access.If a problem occurs,open up two terminals on the KDC and use the tail -f commands to read the /var/log/ kadmind.log and /var/log/krb5kdc.log files to discover the problem. The most common problems are that the proper host and host daemon tickets have not been added either to the KDC,or to the keytabs of hosts B and C. 13. After you have logged on,use /usr/kerberos/bin/klist again to view your credential cache.You will see the host and ftp principal tickets have now been cached.Remember,you are using Kerberos v5,so ignore any Kerberos v4 messages. www.syngress.com
138_linux_06 6/20/01 9:43 AM Page 345 Network Authentication and Encryption • Chapter 6 345 Summary In this chapter,you have been introduced to ways that allow you to avoid sniffing attacks.Encrypting transmissions and ensuring that passwords do not cross the network in plain text are the two strategies.You learned how to implement OTP using OPIE,and then learned how Kerberos allows you to establish a more robust,though involved,authentication scheme.You now know the basic moves to take when implementing OPIE on clients and servers and have been armed with a method for implementing Kerberos.From principal creation to under- standing key exchange and credential confirmation,you now know what it takes to implement Kerberos on small networks,as well as enterprise networks that use multiple Kerberos realms. As you implement Kerberos,you will find that you will have to dedicate additional resources to manage Kerberos principals and secure network daemons. You will also find that it will be necessary to troubleshoot your client/server con- figuration.Nevertheless,these solutions will help you further secure your net- work.Now,it is time to learn how to use encryption techniques,such as Secure Shell,to stop sniffing attacks. Solutions Fast Track Understanding Network Authentication (cid:59) Even if employees remain behind the firewall,many system services allow clear text authentication,including Telnet,File Transfer Protocol (FTP),and standard Network Information Service (NIS).Even though transmissions can be encrypted,many tools exist that help hackers wage a sniffing attack to capture encrypted information. (cid:59) After the packets containing the encrypted passwords are captured, hackers use cracking applications such as L0phtCrack,which are designed to both capture and crack sniffed encrypted passwords. Creating Authentication and Encryption Solutions (cid:59) To authenticate safely,you have two options:Find a way to authenticate without sending passwords across the network,or find a way to discard www.syngress.com
138_linux_06 6/20/01 9:43 AM Page 346 346 Chapter 6 • Network Authentication and Encryption any password that is sent across the network. The accepted phrase for this strategy is one-time passwords (OTP). (cid:59) Kerberos has the added ability to encrypt transmissions after authentica- tion occurs.The use of OTP,however,does not encrypt subsequent transmissions.OTP is usually much easier to implement than Kerberos, however. (cid:59) Other encrypting solutions include Secure Sockets Layer (SSL),Secure Shell (SSH),and IPSec. Implementing One-Time Passwords (OTP and OPIE) (cid:59) In the Linux world,the most universal way to implement one-time pass- word (OTP) support in your Linux systems is to install the One-Time Passwords in Everything (OPIE) application.OPIE supports the Message Digest 5 (MD5) algorithm. (cid:59) By default,OPIE does not enforce OTP whenever you log in interac- tively.Any user is given the choice of using OTP or the standard login procedure. (cid:59) Using opiepasswd to create OPIE users.As soon as the opiepasswd command is used against a user,it is then possible for that user to use OTP to log in.The opiekey command generates responses. (cid:59) When the systems administrator creates an OTP password list,the user can use the opieinfo command to generate a list of passwords for later use. Implementing Kerberos Version 5 (cid:59) Kerberos v5 is a revolutionary step in network authentication,because it allows you to establish a domain that authenticates not only individual hosts and users,but individual daemons,as well.Using Kerberos,you can centrally control which hosts and users can access the daemons on your network. (cid:59) After Kerberos is established on a network,passwords do not ever cross the network,not even in encrypted form.You can configure Kerberos to encrypt ensuring communications between authenticated hosts. www.syngress.com
138_linux_06 6/20/01 9:43 AM Page 347 Network Authentication and Encryption • Chapter 6 347 (cid:59) A principal is the name for any host,service,or user that is allowed to authenticate on a Kerberos network.A principal consists of a primary (also known as a “root”),an instance,and a realm. (cid:59) The kadmin application,also found in the /usr/kerberos/sbin/ direc- tory,is designed to add principals to the Kerberos database.The kadmin command also lists,modifies,and deletes principals.It is also used to populate and update the Key table files for each Kerberos host. Using kadmin and Creating Kerberos Client Passwords (cid:59) Standard principal policy settings include policy name,minimum pass- word life (in seconds),maximum password life (in seconds),and min- imum password length. (cid:59) You can create a policy by using the addpol command from within kadmin. (cid:59) The kinit command allows a user to obtain a ticket granting ticket (TGT) from the Key Distribution Center (KDC).Issuing the kinit command has the Kerberos client contact the KDC and obtain a TGT. (cid:59) After you run kinit,the cache will contain only the TGT.Additional credentials,such as actual tickets to access a daemon such as FTP,will be added only after you access the remote host. Establishing Kerberos Client Trust Relationships with kadmin (cid:59) The only way to establish a trust relationship on the Kerberos client host is to use the kadmin command. (cid:59) The administrator must use the kadmin -ktadd command on each Kerberos client that wishes to participate in the Kerberos realm.The kadmin ktadd -k command gives each client the ability to prove that it has the public keys of the services used. www.syngress.com
138_linux_06 6/20/01 9:43 AM Page 348 348 Chapter 6 • Network Authentication and Encryption Logging On to a Kerberos Host Daemon (cid:59) Client A,the Kerberized client,first uses its TGT to request a session ticket.The Kerberos KDC checks to see if Client B has a host principal entry,then also checks to see if Client B has a host daemon entry for FTP.Then,the KDC determines that Client A has the proper host and host daemon keys for client B.If all of these credentials match,then client A can connect to client B’s FTP server. (cid:59) When you try to administer Kerberos using kadmin,it is important to realize that if you make significant changes to the database concerning a user,you will have to use kdestroy and then kinit to obtain new credentials. (cid:59) You must configure your Kerberos client hosts to use only Kerberized clients.In order to use Kerberos properly,no other client applications or server daemons should be used on the network,unless they use OTP, encryption,or a similarly secure protocol. Frequently Asked Questions The following Frequently Asked Questions, answered by the authors of this book, are designed to both measure your understanding of the concepts presented in this chapter and to assist you with real-life implementation of these concepts. To have your questions about this chapter answered by the author, browse to www.syngress.com/solutions and click on the “Ask the Author” form. Q:When using OPIE,don’t clients have to log on to the same machine in order to generate the response? A: No.You can use any OTP generator you wish,as long as you enter the sequence and seed numbers correctly. Q: If I implement OTP,don’t I have to generate a list of passwords and have carry them around with me? A: Well,yes and no.If users have access to a Linux or Windows computer,they can just use an application such as opiekey or WinKey.However,if no OTP generator is available,you will then have to find a way for users to access their sequence numbers and seed values.This is when a list becomes handy. www.syngress.com
138_linux_06 6/20/01 9:43 AM Page 349 Network Authentication and Encryption • Chapter 6 349 Q: Using OTP means that users don’t have to remember passwords,doesn’t it? A: No,not at all.Users still must remember their secret keys,because they use these keys and the server’s request to generate a response.The nice thing about OPIE is that passwords do not cross the network. Q: If I use OTP,usernames still cross the network unencrypted,don’t they? A: This is true unless you use IPsec or SSH.Still,the passwords do not cross the network. Q: I wish to remove a principal from the keytab of one of my Kerberos clients. How do I do this? A: Enter kadmin as an administrative user on the Kerberos client (not the KDC) and use the ketremove option.For example,if you wanted to remove the principal for the user named james,you would do the following: terminal$/usr/kerberos/sbin/kadmin kadmin: ktremove –p james kadmin: quit terminal$ Q: How do I create a backup of the Kerberos database? Also,is it possible to create a backup KDC? A: As for the first part of the question,you can create a backup of the KDC database as follows: /usr/kerberos/sbin/kdb5_util dump keatskerberos You can then read the database using any text editor.Figure 6.17 shows the backup database open in the pico text editor.As far as creating a backup KDC,this is indeed possible and is expected in large networks,or in net- works where timely authentication is vital.After all,consider the problems that would occur if users were not able to authenticate.Information for cre- ating a slave KDC is found in the /usr/share/doc/krb5-server*/ directory. www.syngress.com
138_linux_06 6/20/01 9:43 AM Page 350 350 Chapter 6 • Network Authentication and Encryption Figure 6.17 Viewing a Kerberos Backup Database Q: In this chapter,you have discussed both OPIE and Kerberos.I would like to access my Web server from home.Which should I use? A: If you only have to support one Web server,using Kerberos as a solution would be overkill.Use OPIE along with Secure Shell (SSH),and you will be in great shape. Q: Can Kerberos authentication cross through firewalls? A: Yes.As long as you allow your firewall to allow the Kerberos ports,you will have no problem.Table 6.3 provides the most often-used Kerberos ports. Table 6.3 Kerberos ports Kerberos Daemon Name Port Description krb5 88/tcp Used to send TGTs to clients krb5 88/udp Used to send TGTs to clients kerberos_master 751/udp The port Kerberos uses to issue authentication tickets kerberos_master 751/tcp Used to issue authentication tickets kpasswd 761/tcp For the Kerberos kpasswd command, used by clients to change their passwords on the KDC Continued www.syngress.com
138_linux_06 6/20/01 9:43 AM Page 351 Network Authentication and Encryption • Chapter 6 351 Table 6.3 Continued Kerberos Daemon Name Port Description kpop 1109/tcp The standard Pop Kerberos port krb5_prop 754/tcp Used by the primary KDC to update backup KDCs eklogin 2105/tcp The port for the Kerberos rlogin client that allows encryption klogin 543/tcp The standard Kerberized rlogin application for Kerberos version 5 kshell 544/tcp The port for the Kerberized rsh client kerberos-adm 749/tcp The kadmin port You may have to allow additional ports,depending upon the clients that you wish to support.Consult the /etc/services file for a more comprehensive list. Q: Does the Linux version of Kerberos support Microsoft’s implementation. A: In a word,no.Microsoft implemented several proprietary extensions to its implementation of the Kerberos protocol. Q:This chapter has focused on a single-realm implementation.Can you have multiple Kerberos realms? A:Yes.By editing the /etc/krb5.conf file,you can define multiple realms to further organize realms according to your business needs. www.syngress.com
138_linux_06 6/20/01 9:43 AM Page 352
138_linux_07 6/20/01 9:44 AM Page 353 Chapter 7 Avoiding Sniffing Attacks through Encryption Solutions in this chapter: (cid:2) Understanding Network Encryption (cid:2) Capturing and Analyzing Unencrypted Network Traffic (cid:2) Using OpenSSH to Encrypt Network Traffic between Two Hosts (cid:2) Installing OpenSSH (cid:2) Configuring SSH (cid:2) Implementing SSH to Secure Data Transmissions over an Insecure Network (cid:2) Capturing and Analyzing Encrypted Network Traffic (cid:59) Summary (cid:59) Solutions Fast Track (cid:59) Frequently Asked Questions 353
138_linux_07 6/20/01 9:44 AM Page 354 354 Chapter 7 • Avoiding Sniffing Attacks through Encryption Introduction You now understand how it is possible to enhance authentication using third- party open source software.You also understand some of the pitfalls involved in deploying such software in various systems.For example,in the last chapter you discovered how to deploy authentication using one-time passwords and Kerberos. These authentication implementations enable systems to verify the identity of a user logging on to them,and the integrity of data. In this chapter,you will learn about solutions to deploy strong encryption to enhance network security.Encryption ensures data confidentiality by using algo- rithms to encrypt data before it is sent over a network.The receiving host then decrypts the data to a readable format.The solutions in this chapter combine both authentication and encryption,and include a step-by-step guide to imple- menting encryption over an insecure network. Understanding Network Encryption Network encryption ensures that data sent across a network from one host to another is unreadable to a third party.If a sniffer intercepts the data,it finds the data unusable because the data is encrypted.Therefore,a hacker cannot view any usernames or passwords,and any information sent across the network is safe.The requirement is that all communicating systems must support the same network encryption technique,such as Secure Shell (SSH). Network encryption is used for any data transfer that requires confidentiality. Since the Internet is a public network,network encryption is essential.E-com- merce transactions must ensure confidentiality to protect credit card and personal information.Personal banking Web sites and investment companies often require extremely sensitive information to be sent,such as bank account numbers and tax identification numbers.If these usernames,passwords,and personal information fell into the wrong hands,the information could be used for a front-door attack, since the hacker could pose as a legitimate user. Rlogin,remote shell (rsh),and Telnet are three notoriously unsafe protocols. They do not use encryption for remote logins or any type of data transmission. For example,if you are an administrator and you want to log in to a system via Telnet,your username and login are sent in clear text.Rsh and rlogin send all data between two hosts in clear text as well (but a password is not required). www.syngress.com
138_linux_07 6/20/01 9:44 AM Page 355 Avoiding Sniffing Attacks through Encryption • Chapter 7 355 If a packet sniffer captured the packets destined for the administrator’s system, it would eventually capture the packets containing the username and password, and the attacker could then enter the system as a legitimate user. Capturing and Analyzing Unencrypted Network Traffic To view an unencrypted login session,you must capture packets during a login session.In the following steps,you will Telnet into a host and capture the unse- cured session with the open source packet sniffer Ethereal. Note that in order for the following example to work properly,you must have two systems:the Telnet client and the Telnet remote host.All Linux installa- tions include Telnet,so no additional program is required for this example.
- Verify that Ethereal is installed on your system by entering: rpm –qa | grep ethereal
- If you do not receive a reply,you need to download and install Ethereal. Ethereal (ethereal-0.8.9-4.i386.rpm) is included on the CD accompa- nying this book.
- Once you have verified that Ethereal is installed,you are ready to capture packets.
- To add filters to Ethereal without using host names,open a command interface and enter: ethereal -n
- Select the Edit menu and choose Filters.The Ethereal:Filters screen appears.Since no filters have been configured,the configuration screen is blank.
- To create a filter that allows only traffic between your host and another host,you must add a filter name and a filter string.For example,to create a filter between your host and a host at 24.130.10.35,enter the filter name and filter string shown in Figure 7.1.Please note that your IP addresses will not be the same.You need to select your system’s IP address and the IP address of the system you wish to log in to via Telnet. www.syngress.com
138_linux_07 6/20/01 9:44 AM Page 356 356 Chapter 7 • Avoiding Sniffing Attacks through Encryption Figure 7.1 Creating a Filter between Two Hosts 7. After the two fields are complete,you must click Save,and then click New.Click OK to exit the Filter screen. 8. To start a packet capture,simply select the Capture menu and choose Start.The Capture Preference screen appears.Click Filter and choose the “Telnet Login”filter that you created.Click OK twice and the capture starts. 9. To generate the Telnet login packets,Telnet into the Telnet host.For example,if you wanted to Telnet to a host at 24.130.10.35,you would enter: telnet 24.130.10.35 10. Enter a username and password to log in to the system.If you do not have a username and password on the Telnet host,create a user telnet with the password telnet on the Telnet host by entering: useradd telnet Create a password for user telnet by entering: passwd telnet Changing password for user telnet New UNIX password: Retype new UNIX password: passwd: all authentication tokens updated successfully 11. After you log in as user telnet on the Telnet host,exit the Telnet session. 12. Stop the Ethereal packet capture by clicking Stop. www.syngress.com
138_linux_07 6/20/01 9:44 AM Page 357 Avoiding Sniffing Attacks through Encryption • Chapter 7 357 13. The packet capture appears in Ethereal.Locate the Telnet data packet that includes the data:password field.Your screen will resemble Figure 7.2, which highlights the first password packet. Figure 7.2 Capturing a Telnet Login Session 14. Scroll to the second password packet.The password field contains the first character of the telnet password.In this case,the character is the letter “t,”as shown in Figure 7.3. Figure 7.3 Identifying the First Character in the Telnet Password www.syngress.com
138_linux_07 6/20/01 9:44 AM Page 358 358 Chapter 7 • Avoiding Sniffing Attacks through Encryption 15. Telnet sends each password character as a separate packet.If you con- tinue to scroll down the packet capture and view each Telnet data packet,you will discover the password. 16. An easier way to discover the Telnet password is to follow the TCP stream.To do this,simply select any packet involved in this Telnet con- nection.It can be a TCP or Telnet packet,as long as it is part of the Telnet session. 17. Once a corresponding packet is selected,select the Tools menu and select Follow TCP Stream. The contents of the TCP stream appear,as shown in Figure 7.4. Figure 7.4 Following a TCP Stream to Discover the Username and Password 18. The username and password are displayed in clear text.Please note the echo in the login name.By default,the system distinguishes client keystrokes with brown,and system text as blue.You can see the brown and blue text if you are reading the electronic file on this book’s accom- panying CD;even if you can’t see the brown client text on this printed page,you can see that the packet sniffer has discovered the username and password. 19. Save the packet capture as unsectel, and quit Ethereal. www.syngress.com
138_linux_07 6/20/01 9:44 AM Page 359 Avoiding Sniffing Attacks through Encryption • Chapter 7 359 As you can see,it is possible to intercept a login session and discover a user- name and password.In this case,a hacker could now log in to the Telnet host with the same privileges as user telnet.Telnet is a legitimate user,even though the impersonator is not.The Telnet host is now the victim of a front-door attack. If network encryption is implemented on the network,the login session will be encrypted.All of the information passed between the two hosts is rendered useless because no application data (such as a Telnet packet) is displayed because it is encrypted,as shown in Figure 7.5. If the hacker attempts to view the TCP stream to discover the username and password,it will also render useless information,as shown in Figure 7.6. Figure 7.5 Login Session with Network Encryption NOTE Hackers do not capture all Internet traffic in hopes that they will find sensitive information. There is simply too much traffic on the Internet, so this technique would be similar to finding the proverbial needle in a haystack. Instead, they either focus their packet sniffing on one server or client interface, or try to hack into a server that contains the sensitive information they seek. For example, they may attempt to hack into a bank’s database server that contains client credit card numbers and per- sonal information. In the steps described in this section, a packet filter was created on the sniffer to focus on the Telnet host. www.syngress.com
138_linux_07 6/20/01 9:44 AM Page 360 360 Chapter 7 • Avoiding Sniffing Attacks through Encryption Figure 7.6 Following a TCP Stream When Network Encryption Is Enabled Damage & Defense… Securing E-Commerce Transactions If hackers were alerted to an unsecure server, they could capture packets going in and out of the server to gain the data they sought. For example, if an e-commerce server does not use any type of network encryption for transactions, there is a great deal of data to be gained by a hacker. Unfortunately, many small companies or entrepreneurs set up their own Web servers, unaware of potential security problems, and set up simple scripts to process payment forms. Although the transaction takes place, it takes place in an unsecured manner. Every packet may contain valuable information that is very easy to observe over the wire. Secure Sockets Layer (SSL) is ideal for implementing secure e-commerce transactions. If a hacker intercepts a credit card number, the number may be used or sold. When the Web site customer backtracks to determine where his or her number was stolen, he or she may realize that it occurred shortly after an Internet transaction. This will tarnish the Web site’s reputation, since you have lost at least one customer, and eventu- ally put the site out of business. This is particularly troublesome if the Web server is under surveillance by a hacker. www.syngress.com
138_linux_07 6/20/01 9:44 AM Page 361 Avoiding Sniffing Attacks through Encryption • Chapter 7 361 The lesson demonstrated in the following sections demonstrates how to implement an important network encryption system:Open Secure Shell (OpenSSH).This system will ensure that all data transmitted between your hosts is secure,and is useless for hackers. Using OpenSSH to Encrypt Network Traffic between Two Hosts OpenSSH (www.openssh.org) is an open source program that encrypts all traffic between hosts using secure shell (SSH).It is a secure replacement for common Internet programs used for remote connectivity,such as Telnet,rlogin,and rsh. Because it encrypts all traffic,it always hides usernames and passwords used for remote logins.After the login occurs,it continues to encrypt all data traffic between the hosts.Open SSH is a free version of the SSH Communications Security Corporation’s SSH suite (www.ssh.org).As with most open source soft- ware,the tradeoff is that vendor support is not available.Do not confuse OpenSSH with the fee-based SSH suite.The OpenSSH home page is shown in Figure 7.7. Figure 7.7 OpenSSH Home Page The OpenBSD Project (www.openbsd.org) develops OpenSSH and the Unix operating system,OpenBSD.OpenBSD is a free 4.4BSD-based OS that is designed with security in mind.It uses strong encryption techniques to ward off www.syngress.com
138_linux_07 6/20/01 9:44 AM Page 362 362 Chapter 7 • Avoiding Sniffing Attacks through Encryption hackers.OpenBSD claims that the default installation has not experienced a remote hole in over three years.The OpenBSD Project has ported OpenSSH to other operating systems,including Linux,HP-UX,AIX,Irix,SCO,MacOS X, Cygwin,Digital Unix/Tru64/OSF,SNI/Reliant Unix,NeXT,and Solaris.The OpenBSD home page is shown in Figure 7.8. Figure 7.8 OpenBSD Home Page The OpenSSH Suite OpenSSH is a suite of secure networking connectivity programs.The OpenSSH suite includes the following programs: (cid:2) OpenSSH SSH client (SSH) Remote login program,used for secure remote logins and session encryption.Secure alternative for rlogin and Telnet. (cid:2) Secure copy program (SCP) Remote file copy program,used to securely copy files between network hosts.Supports usernames and passwords. (cid:2) Secure file transfer program (SFTP) Used for secure interactive file transfers.Secure alternative for FTP. (cid:2) OpenSSH SSH daemon (SSHD) The daemon for SSH. www.syngress.com
138_linux_07 6/20/01 9:44 AM Page 363 Avoiding Sniffing Attacks through Encryption • Chapter 7 363 Many features are included in the OpenSSH suite that ensure secure trans- missions across a network,and extend the usefulness of the program.Table 7.1 lists several of the OpenSSH features. Table 7.1 OpenSSH Features Feature Description Strong Encryption using The 3DES and Blowfish encryption algorithms Triple Data Encryption are patent free in all countries. 3DES is time Standard (3DES) and proven, and Blowfish provides faster encryption Blowfish by using fast block cipher. Either encryption algorithm can be used. They are applied before authentication to ensure that all usernames and passwords are encrypted, as well as the session data. Strong Authentication using Protects against authentication vulnerabilities Public Keys, One-Time Pass- such as IP and Domain Name System (DNS) words (OTPs) and Kerberos spoofing and fake routes. There are four types Authentication of authentication methods used with OpenSSH: (cid:2) Public key authentication only (cid:2) Public key-based host authentication along with .rhosts (cid:2) One-time passwords with s/key (cid:2) Kerberos authentication X11 Forwarding for Encrypts X Windows traffic between remote encrypting X Windows systems. Protects against remote xterm Traffic snooping and hijacking. Encrypted Port Forwarding Allows TCP/IP ports to be forwarded to another system over an encrypted channel. This is ideal for Internet protocols that do not inherently support encryption, such as POP or SMTP. Agent Forwarding for Single A user’s authentication keys can be stored on Network Login the user’s local machine, which becomes the authentication agent. When the user accesses the network from another system, the connec- tion is forwarded to this authentication agent. This prevents the authentication keys from being installed on any network system, and allows the user to securely access the network from any system. Interoperability Complies with multiple SSH protocol versions (SSH 1.3, 1.5 and 2.0). Continued www.syngress.com
138_linux_07 6/20/01 9:44 AM Page 364 364 Chapter 7 • Avoiding Sniffing Attacks through Encryption Table 7.1 Continued Feature Description Data Compression Allows data compression to occur before data encryption. This is important for networks with slow connections. Passes Kerberos and Andrew Allows users to access AFS and Kerberos File System (AFS) Tickets to services by entering their password only one Remote Systems time. NOTE OpenSSH 2.0 supports the SSH 1.3, 1.5, and 2.0 protocol. It is important to know that SSH 2.0 does not use the Rivest, Shamir, Adleman (RSA) algorithms, but does support it. Because RSA algorithms still had an effective patent, the SSH 2.0 developers decided to use the Diffie- Hellman (DH) and Digital Signature Algorithm (DSA) algorithms instead. Therefore, if your SSH client and servers use SSH 1.3, 1.5, or 2.0, they will be compatible. Most commercial implementations for Unix, Windows, and others use these versions. Installing OpenSSH OpenSSH implementations are significantly different between operating systems because of authentication.In fact,the developers split development into two categories: (cid:2) OpenBSD-based development Produces secure,clean,and simple OpenSSH code for the OpenBSD operating system. (cid:2) OpenSSH Portability Team Uses the OpenBSD OpenSSH code to develop portable versions for other operating systems.Each portable version is indicated with a “p”to differentiate it from the OpenBSD version.Portable versions are not released at the same time as the OpenBSD versions.They usually take longer to release,since more time is required for the additional code. www.syngress.com
138_linux_07 6/20/01 9:44 AM Page 365 Avoiding Sniffing Attacks through Encryption • Chapter 7 365 Make sure that you are downloading the specific version for your operating system.To determine if your operating system is supported,visit the Portable OpenSSH Web page at www.openssh.org/portable.html.The download links for each version are located at the bottom of the Web page.Simply scroll down to locate the download site nearest you,and then identify your particular operating system.The OpenSSH installation files required for Linux are included on the CD accompanying this book.The portable OpenSSH Web page is shown in Figure 7.9. Figure 7.9 Operating Systems Supported by Portable OpenSSH OpenSSH is becoming very popular,and operating systems are now released with OpenSSH installed by default.For example,Red Hat Linux 7 installs OpenSSH 2.1.1p7-1 during the installation process.The following operating sys- tems also include OpenSSH into the base system,as shown in Figure 7.10.These systems include Red Hat,SuSE,Mandrake Linux,FreeBSD,and others. From the preceding information,you can now determine whether you need to download and install OpenSSH.The examples in this chapter use Red Hat Linux 7.A portable version of OpenSSH has already been created.It is a Red Hat Package Manager (RPM) that is included into the base system of Red Hat Linux 7.These installation files are also located on the CD accompanying this book.Therefore,we are ready to begin configuring OpenSSH after we confirm that OpenSSH is installed. www.syngress.com
138_linux_07 6/20/01 9:44 AM Page 366 366 Chapter 7 • Avoiding Sniffing Attacks through Encryption Figure 7.10 Operating Systems That Incorporate OpenSSH
- To ensure that OpenSSH RPM is installed on your system,enter the following: rpm –qa | grep ssh
- You should receive the following response if SSH is installed: openssh-askpass-gnome-2.1.1p4-1 openssh-clients-2.1.1p4-1 openssh-2.1.1p4-1 openssh-server-2.1.1p4-1 openssh-askpass-2.1.1p4-1 If you receive this response,you are ready to configure OpenSSH.
- If you receive no response,install these files from the accompanying CD, or access www.openssh.org/portable.html to locate a download site nearest you,and download the portable version that matches your oper- ating system.For example,since I am located in Los Angeles,I would locate the Santa Barbara,CA,USA section,and select the “Linux RPMs”link.Then,choose the RH70/ directory (or equivalent),and download the corresponding RPMs from Step #2.The versions will be higher than the versions incorporated into the Red Hat Linux 7 release, as shown in Figure 7.11. www.syngress.com
138_linux_07 6/20/01 9:44 AM Page 367 Avoiding Sniffing Attacks through Encryption • Chapter 7 367 Figure 7.11 Downloading OpenSSH RPMs for Red Hat Linux 7 4. Multiple versions will exist for each RPM.Download the latest version of each. 5. Install the RPMs by using the rpm -i command.Once installed,you are ready to configure OpenSSH. Configuring SSH SSH is the OpenSSH SSH client,and works with the SSHD (SSH daemon). They work together to replace rlogin and rsh.SSH is also a replacement for Telnet.SSH is used to log in to a remote system and execute commands on the remote system.The difference between SSH and Telnet,rlogin,and rsh is that SSH is secure. At the beginning of this chapter,you used a Telnet connection to log in to a remote host.The entire session was unsecure because all data was sent in clear text,including the username and password.Using the packet sniffer Ethereal,you were able to capture the Telnet session packets and follow the Transmission Control Protocol (TCP) stream.You discovered the username and password used to establish the connection.Since you now have the username,password,and remote host Internet Protocol (IP) address (in this case),you can now log in as the user whose packets you captured. www.syngress.com
138_linux_07 6/20/01 9:44 AM Page 368 368 Chapter 7 • Avoiding Sniffing Attacks through Encryption Using a similar method,you can also capture rlogin and rsh sessions and determine the needed authentication data.For example,because rlogin and rsh use host authentication,you can determine the IP address or fully qualified domain name (FQDN),and the username required to log in to the host.Once the host name and username for authentication are determined,they can be used for IP and Domain Name System (DNS) spoofing. The SSH client is a replacement for Telnet,rlogin and rsh.It provides a secure data channel between two hosts on a network.These hosts can be untrusted and the network can be unsecured. In order to work,both hosts must support SSH. One host then connects to another host using an encrypted connection.Because the connection is encrypted,any hacker who captures the data will have an extremely difficult time decrypting it. How SSH Works The method for implementing SSH combines similar r-command concepts with a private and public key method.In order to understand how SSH works,it is a good idea to understand how the older r-commands work. Insecure r-command Authentication The following authentication method is used for r-commands,such as rlogin,rsh, or rcp,in Red Hat Linux 7.For the example,rlogin will be used.Any user log- ging on to a remote system must have a user account on the remote system.For this example,we will use the account susan.If Susan is logged on locally when she connects to a remote host,no password is needed to access the remote host. No password is needed because her account is authenticated by an entry in the .rhosts file located in the remote system’s $HOME/susan directory.The .rhosts file must be created in the susan home directory. The .rhosts file contains the host name and username required for Susan to log in to the system.The host name of Susan’s system is we-24-130-10-205.we .mediaone.net,and her username is susan.If her rlogin command matches the entry in the .rhosts file,she is allowed access to the system.No password is required.The .rhosts file is formatted as follows: hostname username The hostname should be the FQDN of the host,not the short host name. For example,use: we-24-130-10-205.we.mediaone.net www.syngress.com
138_linux_07 6/20/01 9:44 AM Page 369 Avoiding Sniffing Attacks through Encryption • Chapter 7 369 instead of: we-24-130-10-205 The username must be an account on the system.If a user account exists for this username on the system,the user can access all user accounts except root. As mentioned earlier,for Susan to log in remotely,the root user of the remote host must create a .rhosts file in the $HOME/susan directory with her host name and username.For example,if Susan’s machine were host name we-24-130-10-205.we.mediaone.net,the root user would enter the following: we-24-130-10-205.we.mediaone.net susan When Susan is ready to access the remote host,she would enter the following rlogin command: rlogin –l susan we-24-130-8-170.we.mediaone.net where we-24-130-8-170.we.mediaone.net is the remote host.The -l option indi- cates the account used for the login,which is susan. This method is not secure because the host name and username are sent to the remote host for authentication in clear text.This method opens the remote host to IP spoofing,DNS spoofing,and routing spoofing. Because of these security vulnerabilities,it is recommended that you disable the r-command utilities.This process was discussed in Chapter 2,“Hardening the Operating System,”using the /etc/xinetd.d directory and commenting out the associated text files.The /etc/xinetd.d directory makes it simple to disable ser- vices that your system is not using.For example,you can disable the rlogin and rsh services by commenting out the rlogin and rsh entries in the respective file and restarting the service.If the service is commented out,it will not restart. Once disabled,no one can access the machine via the r-command utilities.
- To disable rlogin,you must edit the /etc/xinetd.d/rlogin file.Open the rlogin file,as shown in Figure 7.12,using vi or an editor of your choice.
- Comment out the service login line by adding a number sign (#) before it: #service login
- Write and quit the file. www.syngress.com
138_linux_07 6/20/01 9:44 AM Page 370 370 Chapter 7 • Avoiding Sniffing Attacks through Encryption Figure 7.12 Disabling rlogin Using the /xinetd.d/rlogin File 4. Next,you must restart xinetd by entering: /etc/rc.d/init.d/xinetd restart Stopping xinetd: [ OK } Starting xinetd: [ OK } 5. Disable the rsh service using the same method (e.g.,edit the /etc/ xinetd.d/rsh and /etc/xinetd.d/rexec files by commenting out the service shell line). NOTE The rexec service is another r-command tool that provides authentication based on usernames and passwords for remote execution purposes. It is disabled by default. 6. To provide additional security,disable the Telnet service using the same method (e.g.,edit the /xinetd.d/telnet file by commenting out the ser- vice telnet line). 7. Restart xinetd. You have disabled the remote client programs that send information without encryption.Because these programs are vulnerable to attacks,they should be replaced entirely by SSH.The following sections demonstrate how SSH replaces these programs. www.syngress.com
138_linux_07 6/20/01 9:44 AM Page 371 Avoiding Sniffing Attacks through Encryption • Chapter 7 371 Secure SSH Authentication SSH is based on public-key cryptography.Versions before SSH 2.0 use RSA- based authentication.Version SSH 2.0 and later use the unpatented DSA instead. Public-key cryptography uses private and public keys to ensure authentication. The private key is only known by the user,and the public key is available to everyone else,such as the remote host. SSH can create a DSA private/public key pair for a user by using the ssh-keygen -d command.In SSH 2.0,the private DSA key is stored in the $HOME/.ssh/id_dsa file.The public key is placed in the $HOME/.ssh/id_dsa.pub file.The public key should be renamed and copied to the $HOME/.ssh/ authorized_keys2 file on the remote system.The authorized_keys2 file contains one public key per line. NOTE The $HOME/.ssh/authorized_keys2 file on the remote host is the SSH equivalent to the $HOME/.rhosts file used for the r-commands. Earlier in this chapter, you learned how the .rhosts file is configured to allow a user account to log in remotely using rlogin. In SSH version 1,RSA authentication is used.An RSA private/public key is created in either OpenSSH version by entering the ssh-keygen command without the -d option.The private key is stored in the $HOME/.ssh/identity file,and the public key is stored in the $HOME/.ssh/identity.pub file of the user’s home directory.The public key should be renamed and copied to the user’s home directory on the remote system,to the $HOME/.ssh/authorized_keys file. SSH offers password authentication if the public-key authentication fails.It also provides password authentication if public-key authentication is not available. This flexibility allows the password to be encrypted and transmitted over the network so that data integrity persists,even if the public-key authentication does not work.Table 7.2 summarizes the locations of the private and public keys used in SSH. www.syngress.com
138_linux_07 6/20/01 9:44 AM Page 372 372 Chapter 7 • Avoiding Sniffing Attacks through Encryption Table 7.2 Public-Key Authentication Locations for SSH SSH Version Local System Default 2 Key Location Remote Host Location Private key $HOME/.ssh/id_dsa Not applicable Public key $HOME/.ssh/id_dsa.pub $HOME/.ssh/authorized_keys2 SSH Version Local System Default 1 Key Location Remote Host Location Private key $HOME/.ssh/identity Not applicable Public key $HOME/.ssh/identity.pub $HOME/.ssh/authorized_keys Other important files used to identify public keys on a system are listed in Table 7.3. Table 7.3 Additional Files Used in SSH SSH File Description $HOME/.ssh/known_hosts Lists the public keys for all the hosts to which the user has logged in. The host public keys are listed here if they are not listed in /etc/ssh_known_hosts. /etc/ssh_known_hosts Lists the RSA-generated public keys for all the hosts that the system knows. For example, any host that logs in to the system should have its public key listed in this file. Your network admin- istrator should configure this file to list all the user public keys in your company. It should be a world-readable file, with one public key listed per line. /etc/ssh_known_hosts2 Same as the ssh_known_hosts file, except it lists the DSA-generated public keys for all hosts that the system knows. $HOME/.ssh/config Configuration file for each user. Each user can have a specific configuration file (if needed), which is used by the SSH client. /etc/ssh/ssh_config Configuration file for the entire system. It is world readable and provides values for users who do not have a configuration file. This file is required for SSHD to start, and is automatically generated upon OpenSSH installation. Continued www.syngress.com
138_linux_07 6/20/01 9:44 AM Page 373 Avoiding Sniffing Attacks through Encryption • Chapter 7 373 Table 7.3 Continued SSH File Description $HOME/.ssh/rc Lists commands that will be executed during user login. These commands are run immediately prior to the opening of the user’s shell. Used to run any required routines (if needed) before the home directory of the user is accessible. For example, AFS may be needed for the user. /etc/sshrc Similar to the $HOME/.ssh/rc file, except it specifies commands that must be run immediately prior to systemwide. It should be world readable. Implementing SSH to Secure Data Transmissions over an Insecure Network Before you implement SSH,you need to make sure both the local system and the remote system have SSH installed.It is also a good idea to use SSH 2.0 or later on each system.This ensures that the DSA algorithm is used instead of the RSA algorithm,which is patented in some countries.In the following examples, both systems are running Red Hat Linux 7 with SSH 2.1 installed.Therefore,the DSA algorithm will be used,and no SSH installation is necessary because SSH is built into the operating system. The ssh-keygen command is used to generate and manage SSH authentication keys.To implement SSH,you must first use ssh-keygen to create a private and public key on the client using either RSA or DSA authentication.The following steps demonstrate how to implement SSH to securely access a remote system.
- Create a user on the client system.For example,create the user dilbert. Enter: useradd dilbert
- Create a password for user dilbert by entering: passwd dilbert Changing password for user dilbert New UNIX password: Retype new UNIX password: passwd: all authentication tokens updated successfully www.syngress.com
138_linux_07 6/20/01 9:44 AM Page 374 374 Chapter 7 • Avoiding Sniffing Attacks through Encryption 3. Log on as user dilbert. 4. Generate a public and private key (key pair) for dilbert by entering the following command. ssh-keygen –d NOTE By default, SSH generates an RSA key for SSH 1.3 and 1.5. To generate a DSA key for SSH 2.0, you must specify the -d option when generating the key pair. 5. You will receive the following response: Generating DSA parameter and key. Enter file in which to save the key (/home/dilbert/.ssh/id_dsa): 6. Press ENTER to save the key to the default directory and filename (/home/dilbert/.ssh/id_dsa).You will then receive the following response: Created directory '/home/dilbert/.ssh'. Enter passphrase (empty for no passphrase): 7. The program requests a passphrase.For this example,do not enter a passphrase.The passphrase is used by 3DES to encrypt the private por- tion of the private key.A passphrase must be empty for host keys.If you enter a passphrase,do not use simple sentences.Instead,make it at least 10 to 30 characters with numbers,symbols,and letters.Passphrases can later be changed using the -p option.Press ENTER twice for no passphrase. SECURITY ALERT! Passphrases are not recoverable. If you forget your passphrase, a new key must be generated. You must then distribute the new public key to all required systems. www.syngress.com
138_linux_07 6/20/01 9:44 AM Page 375 Avoiding Sniffing Attacks through Encryption • Chapter 7 375 8. The key generator summary will appear: Your identification has been saved in /home/dilbert/.ssh/id_dsa. Your public key has been saved in /home/dilbert/.ssh/id_dsa.pub. The key fingerprint is: ca:3b:f9:80:5a:91:e5:c1:1e:5b:30:02:2f:d5:53:13 dilbert@we-24-130-10-205.we.mediaone.net 9. The entire key-generation process is shown in Figure 7.13. Figure 7.13 Generating a Private and Public Key Using the ssh-keygen Command 10. You have generated dilbert’s private and public keys.View dilbert’s pri- vate key by entering: cat /home/dilbert/.ssh/id_dsa The private key will resemble Figure 7.14.The private key must always remain secure on the local system. Figure 7.14 DSA Private Key for User Dilbert www.syngress.com
138_linux_07 6/20/01 9:44 AM Page 376 376 Chapter 7 • Avoiding Sniffing Attacks through Encryption 11. View dilbert’s public key by entering: cat /home/dilbert/.ssh/id_dsa.pub Dilbert’s public key can be distributed freely.Any system with which dilbert needs to communicate securely will need to obtain his public key.Dilbert’s public key will resemble Figure 7.15. Figure 7.15 DSA Public Key for User Dilbert NOTE You can rename the public key before you distribute it. For example, you can rename it “dilbert.pub.” This is much easier to remember, and will be different from other user public keys created with DSA. You should always rename the public key after you generate a public and private key. Distributing the Public Key You must now activate the keys by placing the public key in the proper location on the remote server.The public key can be distributed freely;therefore,you can send it any way you want to the remote host. For example,VeriSign offers digital ID services for e-mail clients to transmit e-mail securely.The digital ID is basically a public key with ID information embedded.VeriSign automatically posts the user’s public key on its Web site.Any user who needs to access a public key for a specific user can download the user’s digital ID from the VeriSign Web site at https://digitalid.verisign.com/services/ client/index.html. Figure 7.16 shows the information for downloading the public key (digital ID) for the user George Bush.It is doubtful that this George Bush is the www.syngress.com
138_linux_07 6/20/01 9:44 AM Page 377 Avoiding Sniffing Attacks through Encryption • Chapter 7 377 President of the United States.The U.S.Federal Bureau of Investigations (FBI) would most likely have the President’s public key unlisted,which is an option for all VeriSign users.If you needed to transmit e-mail securely with this user,you would download his public key.He would need to download your public key as well.When both of you had each other’s public keys,you could transmit data to one another securely. Figure 7.16 Downloading Pubic Keys from the VeriSign Web Site For this demonstration,you will upload dilbert’s private key to a Web server. The remote host will then download the public key and activate it.The public key is activated when placed into dilbert’s $HOME/.ssh/authorized_keys2 file on the remote system.The following steps demonstrate how to accomplish these tasks.
- You will upload dilbert’s public key to the Apache Web server on your system.Make sure that Apache is installed by entering: rpm –qa | grep apache
- You should receive a response similar to the following if Apache is installed: apache-manual-1.3.12-25 apache-1.3.12-25 apache-devel-1.3.12-25 www.syngress.com
138_linux_07 6/20/01 9:44 AM Page 378 378 Chapter 7 • Avoiding Sniffing Attacks through Encryption 3. If you do not receive a response,you need to download and install Apache. 4. Create a pubkeys directory in the default apache root directory by entering the following: mkdir /var/www/html/pubkeys 5. Copy and rename dilbert’s public key to this Web directory by entering: cp /home/dilbert/.ssh/id_dsa.pub /var/www/html/pubkeys/dilbert.pub 6. You have uploaded the public key to your local Apache server.Verify it is uploaded by opening a browser,such as lynx or Netscape Navigator,and entering: http://localhost/pubkeys/ The directory contents are listed by default.You should see dilbert.pub listed.If not,confirm the root Web directory in Apache and make sure you copied the public key to the correct directory. 7. Remote Host:You need a second system to be the remote host.We will refer to the first system (the one you just configured) as the client.The remote system in this demonstration is a Red Hat Linux 7 system located on the same network.Log in to the remote host as root. 8. Remote Host:You need to create a dilbert account.Use the same pass- word from the client system.Enter: useradd dilbert 9. Remote Host:Create a password for user dilbert by entering: passwd dilbert Changing password for user dilbert New UNIX password: Retype new UNIX password: passwd: all authentication tokens updated successfully 10. Remote Host:Create a .ssh directory in dilbert’s home directory by entering the following command: cd /home/dilbert mkdir .ssh www.syngress.com
138_linux_07 6/20/01 9:44 AM Page 379 Avoiding Sniffing Attacks through Encryption • Chapter 7 379 11. Remote Host:Open a Web browser and access dilbert’s public key from the client’s Apache server.Enter the URL of host and the pubkey directory.For example,if you configured Apache on we-24-130-10-205 .we.mediaone.net,you will enter: http://we-24-130-10-205.we.mediaone.net/pubkey Your browser window will resemble Figure 7.17 in Navigator. Figure 7.17 Accessing a Public Key from a Web Site 12. Remote Host:Download the public key to the remote host.For example,save it to the root user directory. 13. Remote Host:Next,you need to copy the contents of dilbert’s public key file to the /home/dilbert/.ssh/authorized_keys2 file.This file does not currently exist.The simplest way to transfer the public key to this file is to copy dilbert.pub and rename it as authorized_keys2.For example,if you downloaded dilbert’s public key to the root user direc- tory,you would enter (from the root user directory): cp dilbert.pub /home/dilbert/.ssh/authorized_keys2 The authorized_key2 file lists the public DSA keys that can be used for login by the user.Each public key must be listed as one line in the file.The id_dsa.pub file,when viewed in a text editor,is written as one line.Therefore,it is important that the key is copied as only one line when placed in the authorized_key2 file. www.syngress.com
138_linux_07 6/20/01 9:44 AM Page 380 380 Chapter 7 • Avoiding Sniffing Attacks through Encryption 14. Client Host:Physically access the client host. 15. Client Host:Log on as dilbert. 16. Client Host:Log in to the remote host using ssh.If the remote host were we-24-130-8-170.we.mediaone.net,you would enter: ssh we-24-130-8-170.we.mediaone.net 17. Client Host:You will receive a message similar to the following: The authenticity of host 'we-24-130-8-170.we.mediaone.net' can't be established. DSA key fingerprint is 9a:e6:64:34:d5:fa:f7:e4:e9:fd:b7:e5:95:b0:1e:40. Are you sure you want to continue connecting (yes/no)? The message stating “The authenticity of host ‘we-24-130-8- 170.we.mediaone.net’can’t be established”is a standard message that informs you that a trust relationship has not yet been established.This is standard for the first time a trust is established,and is seen on both the commercial and open versions of SSH. 18. Client Host:Enter Yes to continue connecting.The following warning message appears,indicating that the remote host’s public key is added to the client’s $HOME/.ssh/known_hosts file.You will not receive these warnings when you log in to the remote host in the future,as the trust relationship has been established.It is then followed by a prompt (no password is required due to the key pair): Warning: Permanently added 'we-24-130-8-170.we.mediaone .net,24.130.8.170' (DSA) to the list of known hosts. [dilbert@we-24-130-8-170 dilbert]$ 19. Client Host:You will receive a remote host command prompt for dil- bert.All data transmitted between your system and the remote host are encrypted. 20. Client Host:Quit the session by entering the exit command. www.syngress.com
138_linux_07 6/20/01 9:44 AM Page 381 Avoiding Sniffing Attacks through Encryption • Chapter 7 381 NOTE If public key authentication fails, or if you are logged on to the client system as a user other that dilbert, ssh will request a password: dilbert@we-24-130-8-170.we.mediaone.net's password: Dilbert can securely enter his password for the remote host, since he has an account. His username and password will be encrypted via SSH, so the transmission is still secure. If you are asked for a password, you need to retrace your steps. If public key authentication is set up properly, you will not be asked for a password. Capturing and Analyzing Encyrpted Network Traffic Now that we have created an SSH connection between two hosts,we need to prove that the session is actually encrypted.To prove this,you will capture packets between the hosts during the SSH session.You will attempt to locate any login data,as well as any session data,and then follow the TCP stream.
- Log in as root to the SSH remote host.
- Remote Host:To add filters to Ethereal without using host names,open a command interface and enter: ethereal -n
- Remote Host:Select the Edit menu and choose Filters.The Ethereal: Filters screen appears.
- Remote Host:To create a filter that allows only traffic between the SSH hosts,you must add a filter name and a filter string.For example,to create a filter between your remote host and a client host at 24.130.10.205,enter the filter name “SSH Login”and filter string shown in Figure 7.18.Please note that your IP addresses will not be the same.You need to select the IP address of your client and remote SSH hosts.After the two fields are complete,you must click Save,and then click New.Your screen will appear similar to Figure 7.18. www.syngress.com
138_linux_07 6/20/01 9:44 AM Page 382 382 Chapter 7 • Avoiding Sniffing Attacks through Encryption Figure 7.18 Creating a Filter between SSH Two Hosts 5. Remote Host:Click OK to exit the Filter screen. 6. Remote Host:To start a packet capture,simply select the Capture menu and choose Start.The Capture Preference screen appears.Click Filter and choose the “SSH Login”filter that you created.Click OK twice and the capture starts. 7. Client Host:Physically access the client host and log in as dilbert. 8. Client Host:To generate the SSH login packets,log in into the remote SSH host.For example,to log in to the SSH host at 24.130.8.170,you would enter: ssh 24.130.8.170 9. Client Host:After you log in as user dilbert (no password is required because of the public key cryptography) on the remote SSH host,enter a simple command to generate data through the connection.For example,enter: /sbin/ifconfig 10. Client Host:Exit the SSH session by entering the exit command. 11. Remote Host:Physically access the remote host.Stop the Ethereal packet capture by clicking Stop. 12. Remote Host:The packet capture appears in Ethereal.Attempt to locate the SSH data packet that includes the data:password field.Recall the easily identifiable data:password field in the Telnet packet from Figure 7.2.You should not be able to find any Application layer data in the capture.Your screen will appear similar to Figure 7.19. www.syngress.com
138_linux_07 6/20/01 9:44 AM Page 383 Avoiding Sniffing Attacks through Encryption • Chapter 7 383 Figure 7.19 Attempting to Locate the SSH Login Session 13. Scroll throughout the packet capture.The only information that can be analyzed is the Layer 1 (Physical) through Layer 4 (Transport) of the OSI reference model.We can discover that the SSH remote host is listening and transmitting on TCP port 22.The SSH client is using TCP port 1023.There are no passwords,usernames,or usable data.Figure 7.20 shows the vast array of worthless TCP packets. Figure 7.20 Packet Capture of SSH Session www.syngress.com
138_linux_07 6/20/01 9:44 AM Page 384 384 Chapter 7 • Avoiding Sniffing Attacks through Encryption 14. An easier way to discover useful data is to follow the TCP stream.To do this,simply select any packet involved in this SSH connection. 15. Once a packet is selected,select the Tools menu and select Follow TCP Stream. The contents of the TCP stream appear,as shown in Figure 7.21. Figure 7.21 Following a TCP Stream in SSH 16. The majority of data is encrypted using 3DES (the default symmetric encryption for the session data).The packet sniffer has discovered no useful or usable data by following the TCP stream. 17. Save the packet capture as secssh,and quit Ethereal. www.syngress.com
138_linux_07 6/20/01 9:44 AM Page 385 Avoiding Sniffing Attacks through Encryption • Chapter 7 385 Summary In this chapter,we discussed network encryption,and why it is essential to the security of your network.Network encryption ensures that data sent across a net- work from one host to another is secure.If a sniffer intercepts the data,it is unus- able because the data is encrypted.Therefore,a hacker cannot view any usernames or passwords,and any information sent across the network,such as confidential data,is safe. To display the problems associated with unencrypted data transmission,you captured unencrypted network traffic and analyzed it for security vulnerabilities. You learned that rlogin,rsh,and Telnet are three notoriously unsafe protocols. They do not use encryption for remote logins or any type of data transmission. You discovered that Telnet sends each password character as a separate packet.If you continue to scroll down the packet capture and view each Telnet data packet, you will discover the password.An easier way to discover the Telnet password is to follow the TCP stream.The username and password are displayed in clear text, as well as all of the data contained in the transmission. To solve this problem,you learned how to encrypt network traffic with OpenSSH.OpenSSH (www.openssh.org) is an open source program that encrypts all traffic between hosts.It is a secure replacement for common Internet programs used for remote connectivity,such as Telnet,rlogin,and FTP.Because it encrypts all traffic,it always hides usernames and passwords used for remote logins.After the login occurs,it continues to encrypt all data traffic between the hosts. You implemented secure data transmissions using OpenSSH over an unse- cured network.This required ensuring that OpenSSH was installed on two dif- ferent hosts.One system was the SSH remote host,and the other was the SSH client.SSH provides authentication by creating a private/public key pair for a user by using the ssh-keygen command.In SSH 2.0,the private DSA key is stored in the $HOME/.ssh/id_dsa file.The public key should be copied and stored in the $HOME/.ssh/authorized_keys2 file on the remote system.The authorized_keys2 file contains one public key per line.SSH 2.0 sessions are encrypted using ArcFour,CAST128,Blowfish,or 3DES.Data integrity is ensured using hmac-md5 and hmac-sha1.SSH 2.0 is superior and should be used when- ever possible. Last,you captured an SSH session and analyzed it for security vulnerabilities. The only information that could be analyzed was the Layer 1 (the Physical layer) through Layer 4 (the Transport layer) of the OSI reference model.The login data was unreadable,and the majority of data was encrypted using 3DES (the default www.syngress.com
138_linux_07 6/20/01 9:44 AM Page 386 386 Chapter 7 • Avoiding Sniffing Attacks through Encryption symmetric encryption for the session data).The packet sniffer discovered no useful or usable data by following the TCP stream.As you can see,OpenSSH is essential and should be a permanent replacement for Telnet,rsh,and rlogin. Solutions Fast Track Understanding Network Encryption (cid:59) Network encryption is used for any data transfer that requires confiden- tiality.Encryption ensures that data sent across a network from one host to another is unreadable to a third party. (cid:59) Rlogin,remote shell (rsh),and Telnet are three notoriously unsafe proto- cols.They do not use encryption for remote logins or any type of data transmission.If a malicious hacker captured this traffic,it would display the data,such as usernames or any passwords,in clear text. Capturing and Analyzing Unencrypted Network Traffic (cid:59) You can capture packets during a Telnet login session using the open source packet sniffer Ethereal.Once the session is captured,you can locate the Telnet data packet that includes the data:password field. (cid:59) Another way to discover the Telnet password is to follow the TCP stream.To do this,simply select any packet involved in this Telnet con- nection,then select the Tools menu,and select Follow TCP Stream in Ethereal.The username and password are displayed in clear text. Using OpenSSH to Encrypt Network Traffic between Two Hosts (cid:59) OpenSSH encrypts all traffic between two hosts using Secure Shell (SSH).It is a secure replacement for common Internet programs used for remote connectivity,such as Telnet,rlogin,and rsh. (cid:59) It features strong encryption using Triple Data Encryption Standard (3DES) and Blowfish,as well as strong authentication using public keys, one-time passwords (OTPs),and Kerberos Authentication. www.syngress.com
138_linux_07 6/20/01 9:44 AM Page 387 Avoiding Sniffing Attacks through Encryption • Chapter 7 387 Installing and Configuring Secure Shell on Two Network Hosts (cid:59) OpenSSH implementations are significantly different between operating systems.The OpenSSH Portability Team uses the OpenBSD OpenSSH code to develop portable versions for other operating systems.You must make sure a specific version exists for your operating system at www.openssh.org. (cid:59) The method for implementing SSH combines similar r-command con- cepts with a private and public key method. (cid:59) SSH can create a DSA private/public key pair for a user by using the ssh-keygen -d command.In SSH 2.0,the private DSA key is placed in the $HOME/.ssh/id_dsa file.The public key is placed in the $HOME/.ssh/id_dsa.pub file.The public key should be renamed and copied to the $HOME/.ssh/authorized_keys2 file on the remote system. Implementing SSH to Secure Data Transmissions over an Insecure Network (cid:59) Both hosts must have SSH installed to transmit data securely,such as the SSH implementation. (cid:59) You must first use ssh-keygen to create a private and public key on each host using either RSA or DSA authentication.Then,distribute the public key to the host with which you wish to communicate,and vice versa. (cid:59) To establish the connection using SSH,the ssh command is used in the format ssh remotehost.Remotehost is the name of the host you will con- nect to using SSH. Capturing and Analyzing Encrypted Network Traffic (cid:59) You can capture packets between two hosts using an SSH session to determine if the data is secure.For example,you can attempt to identify any login data,as well as any session data. (cid:59) Using Ethereal,or any packet-capturing program,you will find that all Application layer data is encrypted.No passwords,usernames,or usable data is displayed.Following a TCP stream is fruitless.Only the TCP ports are displayed in the capture. www.syngress.com
138_linux_07 6/20/01 9:44 AM Page 388 388 Chapter 7 • Avoiding Sniffing Attacks through Encryption Frequently Asked Questions The following Frequently Asked Questions, answered by the authors of this book, are designed to both measure your understanding of the concepts presented in this chapter and to assist you with real-life implementation of these concepts. To have your questions about this chapter answered by the author, browse to www.syngress.com/solutions and click on the “Ask the Author” form. Q: I am receiving warning messages regarding key lengths.What do these mes- sages mean,and how can I prevent them? A:The key-length warning messages you see are sent by OpenSSH when it encounters certain defective RSA or DSA keys that are sometimes generated by a bug in the ssh-keygen program (in commercial SSH).These defective keys are Pubkey Authentication keys whose Most Significant Bit (MSB) is not set.Thus,these keys are frequently half as long as advertised (they adver- tise as full length).The warning messages alert you that OpenSSH has detected this type of defective key. You can prevent this type of warning message by editing the known_hosts file.Find the entry listing the incorrect key length value (often 1024),and change the entry to list the correct key length value (generally 1023). Another solution is to simply create new keys.This approach is preferable because even after correction,the modified keys are generally less secure. Q:Why did I lose support for SSH2 after I upgraded to OpenSSH 2.5.1? A:When you upgrade OpenSSH versions,your sshd_config or ssh_config programs may incur some modifications.It is advisable to verify the settings in these files whenever you upgrade OpenSSH.If you are upgrading from OpenSSH 2.3.0 to 2.5.1,you can add: HostKey /etc/ssh_host_dsa_key to your sshd_config file.This modification will retain your SSH2 support. Q:Why does it take so long for SSH to connect with Linux glibc 2.1? A:The Red Hat Linux 6.1 implementation of glibc offers a universal “IPv6 or IPv4”resolution capability.Although this feature can be convenient,it www.syngress.com
138_linux_07 6/20/01 9:44 AM Page 389 Avoiding Sniffing Attacks through Encryption • Chapter 7 389 requires more time to resolve IP addresses from domain names because it must make the IP version determination on a case-by-case basis. To speed up resolution,you can use the --with-ipv4-default configure option.When you enter this option,OpenSSH will resolve only IPv4 addresses.Similarly,you can use the -6 option to instruct OpenSSH to resolve only IPv6 addresses. Q:Why does SSHD or “configure”sometimes state they do not have support for RSA or DSA? A:Your OpenSSH libraries must be constructed to include this support.You can verify that RSA and DSA are supported in your program files by checking internally or by using the RSAref. Q:The configure file is missing from my distribution,and the make command fails when executed.Why? A: If you receive a missing separator error when the make command fails,or you are missing the configure file in your downloaded tar.gz,you probably have the same problem:You may be trying to compile the OpenBSD distri- bution of OpenSSH on a platform other than the one you used to download it.You must use a portable version of OpenSSH in order to do this without error. Q: OpenSSH hangs when I exit SSH.Why? A: Linux and HP-UX systems have been noted to hang when exiting OpenSSH.This bug appears in current OpenSSH versions,and occurs pri- marily when a background process is active.You can enter sleep 20&exit to test for this problem.The man page for your shell should list an option you can use to send a HUP signal to active processes upon exit.Bash users can use the following entry in either /etc/bashrc or ~/.bashrc: shopt -s huponexit www.syngress.com
138_linux_07 6/20/01 9:44 AM Page 390
138_linux_08 6/20/01 9:46 AM Page 391 Chapter 8 Creating Virtual Private Networks Solutions in this chapter: (cid:2) Secure Tunneling with VPNs (cid:2) Explaining the IP Security Architecture (cid:2) Creating a VPN by Using FreeS/WAN (cid:59) Summary (cid:59) Solutions Fast Track (cid:59) Frequently Asked Questions 391
138_linux_08 6/20/01 9:46 AM Page 392 392 Chapter 8 • Creating Virtual Private Networks Introduction In previous chapters,you have discovered how you can enhance authentication by using third-party open source software,such as Kerberos,“one-time passwords in everything”(OPIE),and the public-key cryptography methods of Open Secure Shell (OpenSSH).You also learned how to employ encryption between hosts by using the application-layer security methods of OpenSSH.In this chapter,you will go a step further to deploy secure authentication and strong encryption at the network layer to establish network security by using virtual pri- vate networks (VPNs).VPNs offer certain advantages over other network security protocols,as you will find in this chapter.You will learn about the many solutions provided by VPNs in today’s Internet workplace,such as providing secure trans- missions between two hosts,routers,or both.We explain the Internet Protocol Security Architecture (IPSec),which is quickly becoming the standard protocol for VPNs.You will finish up the chapter by creating your own VPN by using Free Secure Wide Area Network (FreeS/WAN). Secure Tunneling with VPNs A VPN provides a private data network over public telecommunication infrastruc- tures,such as the Internet.It provides both secure authentication and encryption.It creates a data “tunnel”between devices so that all data transmitted between the devices is secure,regardless of what programs the devices are running.After a secure tunnel is established,data can be transmitted securely between the hosts. Three basic types of VPN solutions exist:telecommuter,router-to-router,and host-to-host.A telecommuter VPN can be used to securely connect a host to a network from any Internet connection and is ideal for traveling workers.A router-to-router VPN is used to create a secure transmission tunnel between two networks,such as two company sites in different locations.A host-to-host VPN creates a secure transmission tunnel between any two hosts.A VPN implementa- tion named FreeS/WAN,which you will implement in this chapter,can provide all three solutions. Telecommuter VPN Solution Telecommuters can use VPNs to log in to their company network from home or from the road.Any location with Internet access can be used.The telecommuter must ensure that the laptop,desktop,or handheld system contains VPN client software and the address of the company’s VPN server.The telecommuter then www.syngress.com
138_linux_08 6/20/01 9:46 AM Page 393 Creating Virtual Private Networks • Chapter 8 393 accesses the Internet through normal access methods,such as a dial-up,a Digital Subscriber Line (DSL),or a cable network connection.After access to the Internet is achieved,the telecommuter opens a VPN client to log on to the com- pany VPN server—once logged on,the telecommuter has access to the company network.She receives the same user rights and privileges on the company net- work as if she were physically logged in at a company workstation.If the telecommuter has a fast Internet connection,she will be unable to tell the differ- ence between physically working at the company location and working through the VPN.The VPN concept is shown in Figure 8.1. Figure 8.1 Telecommuting Using a VPN File Server Workstation Internet Company Ethernet Laptop Computer Company VPN Server (VPN Client) Customer Database After the VPN tunnel has been established,the telecommuter can run any application as if he were at a company workstation,provided he has the appro- priate client.All of these applications will run over the tunnel,and the applica- tions themselves are not required to be secure,because they are transmitted through the VPN tunnel.The VPN tunnel encrypts the data,so any captured data (regardless of the program that generated that data) will be useless.The tunnel concept is displayed in Figure 8.2. Figure 8.2 Secure Transmission of Data across the Internet Using a VPN Tunnel Internet Secure VPN Tunnel Laptop Computer Company VPN Server (VPN Client) www.syngress.com
138_linux_08 6/20/01 9:46 AM Page 394 394 Chapter 8 • Creating Virtual Private Networks VPNs can also be used by corporate partners.For instance,the customer database displayed in Figure 8.1 could be available for a sales team at another company.The sales team could receive accounts on your network with access to the customer database only. Router-to-Router VPN Solution VPNs are a cost-effective way to create a wide area network (WAN) for con- necting company satellite offices and corporate offices.In the past,a company leased expensive dedicated lines from phone companies to connect each location. VPNs allow companies to create a router-to-router VPN over the Internet instead. In order to implement a VPN,you must ensure that each gateway router to your network supports the VPN implementation you choose at each location. These routers are located on the edge of your network and are the end-to-end points for your VPN tunnel.They are responsible for encapsulating the traffic as it leaves the network and removing the capsule as it arrives between your satellite and corporate offices.All router vendors offer VPN functionality.For instance, Cisco offers the Cisco 1600 series of routers that offer a VPN option. VPNs can connect your corporate networks for a fraction of the cost of leasing dedicated lines.A corporate WAN using VPN-enabled routers is displayed in Figure 8.3. Figure 8.3 Creating a Corporate Router-to-Router VPN File Server Workstation File Server Workstation Internet New York Ethernet Secure VPN Tunnel Tokyo Ethernet VPN-Enabled Router VPN-Enabled Router (Tunnel Endpoint) (Tunnel Endpoint) Accounting Database Customer Database www.syngress.com
138_linux_08 6/20/01 9:46 AM Page 395 Creating Virtual Private Networks • Chapter 8 395 Host-to-Host VPN Solution VPNs can also securely connect two hosts over the Internet or any unsecured network.Each host is the tunnel endpoint.The only difference is that a separate network does not exist on the other side of the hosts,so no gateway is required with IP forwarding enabled.If you can create a tunnel between two hosts,you can expand your knowledge in an enterprise environment to accommodate both telecommuter and router-to-router VPN solutions.The host-to-host VPN solu- tion is shown in Figure 8.4. Figure 8.4 Creating a Host-to-Host VPN Internet/ VPN Host VPN Host Unsecured Network Secure VPN Tunnel Tunneling Protocols As mentioned previously,a “tunnel”is created between VPN hosts to ensure that all traffic between them is secure.The tunnel is created with a tunneling pro- tocol.These protocols are responsible for encapsulating a data packet before a host transmits it.After the data is encapsulated,it is sent over the Internet until it arrives at its destination.When it arrives,the capsule is removed,and the data is processed by the destination host. IP tunneling protocols are particularly powerful because they can transmit foreign protocols over the Internet.For instance,a Novell NetWare host can send an Internetwork Packet Exchange/Sequenced Packet Exchange (IPX/SPX) packet over the Internet by encapsulating it in an IP packet,then transmitting it using Transmission Control Protocol/IP (TCP/IP).When it arrives at its destina- tion,the IP packet is stripped off,and the IPX/SPX packet is processed. The next generation protocol,IPv6,has a test bed called the 6bone (www.6bone.net).The 6bone is a virtual network that uses IPv6-over-IPv4 tun- neling.The IPv6 networks,called islands, are connected over the Internet using IPv4 tunnels.The IPv6 packets are encapsulated by an IPv4 packet and sent over the Internet.When they arrive at the destination,the IPv4 packet is removed,and www.syngress.com
138_linux_08 6/20/01 9:46 AM Page 396 396 Chapter 8 • Creating Virtual Private Networks the IPv6 packet is processed on the IPv6 network.The leading VPN tunneling protocols are listed in Table 8.1. Table 8.1 The Leading VPN Tunneling Protocols Tunneling Protocol Description Point-to-Point Tunneling Tunneling protocol developed by Microsoft that Protocol (PPTP) is built into the Windows operating system. It is an extension of the Point-to-Point Protocol (PPP) and uses PPP mechanisms for authentication, encryption, and compression. PPTP uses Microsoft Point-to-Point Encryption (MPPE) for encrypting the PPP frames. Layer 2 Forwarding (L2F) Tunneling protocol developed by Cisco that is similar to PPTP. Layer 2 Tunneling Protocol Tunneling protocol that combines PPTP and L2F. (L2TP) L2TP uses the best mechanisms of each. L2TP is already built into Microsoft Windows 2000 Server and Cisco Internet Operating System (IOS) software for networking and end-to-end hard- ware products. Like PPTP, L2TP requires that ISPs support it so that it can be used for router-to- router VPNs. This protocol is used in Cisco’s “Access VPN” service. L2TP uses IPSec for encryption. L2TP will eventually become the industry standard for VPNs. Explaining the IP Security Architecture IP has been a low-cost,efficient protocol for several decades.However,it has always suffered from security vulnerabilities that have required users and busi- nesses to use other methods to ensure data confidentiality across the Internet.A new protocol,IP Security Architecture (IPSec),is designed to add authentication and encryption to IP when needed. IPSec is an Internet Engineering Task Force (IETF) security protocol that is becoming a standard component of VPN tunneling protocols.As the name sug- gests,it was designed for IP,and IPSec has gained wide industry support.For instance,Cisco already supports IPSec in its routers and is one of the leading sup- porters for IPSec standardization.IPSec is currently a proposed standard (Request www.syngress.com
138_linux_08 6/20/01 9:46 AM Page 397 Creating Virtual Private Networks • Chapter 8 397 for Comments [RFC] 2401) within the IETF.The IPSec charter Web page, shown in Figure 8.5,is maintained by the IETF IPSec working group.The URL is www.ietf.org/html.charters/ipsec-charter.html.This site is ideal for monitoring the progress of IPSec and the numerous implementations for the IPSec standard. Figure 8.5 IETF IPSec Charter IPSec provides secure authentication and encryption over a network by securing all packets at Layer 3,the network layer,of the Open System Interconnection (OSI) reference model.Layer 3 security is significant because Layer 3 is responsible for IP addressing and routing over the Internet.Security at this layer ensures that everything on the network is secure. NOTE Another benefit of IPSec is that it already supports the next generation Internet Protocol, IP version 6 (IPv6). IPSec will be a requirement for IPv6 implementation. Layer 3 security is in contrast to methods that provide only encryption and authentication to higher-level protocols,such as SSH (you learned about SSH in the last chapter). www.syngress.com
138_linux_08 6/20/01 9:46 AM Page 398 398 Chapter 8 • Creating Virtual Private Networks Programs such as SSH for remote login,Secure Hypertext Transfer Protocol (SHTTP) and Secure Socket Layer (SSL) for Web applications,and Pretty Good Privacy (PGP) for e-mail secure data between two applications using Layer 4 mechanisms.This method works extremely well but is limited because only the data between the program’s associated ports is encrypted.IPSec secures all data, regardless of the program running between the hosts.To demonstrate the limita- tions of security protocols such as SSH,SHTTP,and SSL,recall the implementa- tion of SSH in the last chapter.First,you captured packets that were unencrypted,shown in Figure 8.6. Figure 8.6 Unencrypted Packets Next,you captured packets between two SSH hosts that used encryption.The application layer data was encrypted,but the Layer 4 (the transport layer) port numbers could be viewed,so you could easily determine the service running.You discovered that the SSH remote host listens and transmits on TCP port 22.The SSH client used TCP port 1023.Figure 8.7 shows the captured SSH traffic. SHTTP and SSL traffic displays in a similar manner when captured,except dif- ferent port numbers are displayed. IPSec is different from SSH and other application-based encryption protocols because an IPsec tunnel encrypts data at the Layer 3 (the network layer) so that no transport layer (Layer 4) data is displayed,which reduces security vulnerabilities. Figure 8.8 displays a packet capture of IPSec packets transmitted through a tunnel. Note that the amount of useful information is significantly reduced.For instance, www.syngress.com
138_linux_08 6/20/01 9:46 AM Page 399 Creating Virtual Private Networks • Chapter 8 399 Figure 8.7 Packet Capture of SSH Session Displaying TCP Port Data Figure 8.8 Packet Capture of IPSec Session all transport layer data in the figure is encrypted by an Encapsulating Security Payload (ESP) header,which renders the packet and its contents useless if captured by a hacker.ESP encrypts the packet at the network layer,so even the port infor- mation is encrypted.So as you can see,this is an improvement over application- based encryption protocols,such as SSH,which display the transport-layer data. www.syngress.com
138_linux_08 6/20/01 9:46 AM Page 400 400 Chapter 8 • Creating Virtual Private Networks The packets captured in Figure 8.8 are from a VPN tunnel using IPsec.This tunnel was set up between two hosts (a host-to-host solution),and the tunnel endpoints encrypted all traffic between the two hosts,regardless of the applications running between them.IPsec is used by many VPN implementations.You will learn about these implementations and how they use IPsec in the next section. Using IPSec with a VPN Tunneling Protocol IPSec is used as an authentication and encryption standard for VPNs.As you learned in Table 8.1,several tunneling protocols exist,such as PPTP and L2TP. You learned that both PPTP and L2TP are extensions of PPP.One of IPSec’s functions within L2TP is to encapsulate the PPP data and encrypt the data at the network layer (Layer 3) of the OSI model.Figures 8.9 through 8.11 display a graphic that displays how IPSec encapsulation works with one type of L2TP implementation. First of all,a PPP frame is created.This frame contains the IP packet created from the TCP/IP stack on your system with a PPP header attached.It contains data from your system that would normally be sent across the wire.The PPP frame is displayed in Figure 8.9. Figure 8.9 Starting Out with a PPP Frame PPP PPP Payload Header (IP Packet) Next,the L2TP and User Datagram Protocol (UDP) headers are added to the PPP frame,as shown in Figure 8.10. Figure 8.10 Adding an L2TP and UDP Header to a PPP Frame UDP L2TP PPP PPP Payload Header Header Header (IP Packet) Last,the IPSec encapsulation is implemented.IPSec adds an IPSec ESP header and trailer.It also adds an IPSec Authentication trailer for message authen- tication and integrity.The L2TP packet is encrypted by IPSec,which uses the encryption keys that were generated form the authentication process. www.syngress.com
138_linux_08 6/20/01 9:46 AM Page 401 Creating Virtual Private Networks • Chapter 8 401 During this process,the standard IP header is added to the packet.The IP source address is the VPN client (which is sending this packet).The IP destination address is the VPN server that will receive this packet.The IPSec packet is dis- played in Figure 8.11. Figure 8.11 Adding IPSec Mechanisms to an L2TP Packet IPSec Encrypted IPSec IPSec IPSec IP UDP L2TP PPP PPP Payload ESP ESP Auth Header Header Header Header (IP Packet) Header Trailer Trailer When the packet arrives at the VPN server,the VPN server will strip the IP, IPSec,UDP,L2TP,and PPP headers from the packet to discover the original data sent from the VPN client. Internet Key Exchange Protocol IPSec is often used in conjunction with the Internet Key Exchange (IKE) pro- tocol.IKE is a key management protocol standard that enhances IPSec,such as providing a simpler IPSec configuration,flexibility,and more features.IKE is not required to run IPSec,but it enhances the standard. IKE is a hybrid protocol.It implements three security protocols: (cid:2) Internet Security Association and Key Management Protocol (ISAKMP) (cid:2) Oakley key exchange (cid:2) Skeme key exchange IKE uses the ISAKMP framework to run the Oakley and Skeme key exchange mechanisms.The combination of these three security protocols pro- vides authentication using digital signature and public key encryption. IKE allows dynamic authentication of hosts,provides anti-replay services,and can change encryption keys during an IPSec session.It allows IPSec to operate without requiring an administrator to manually configure all of the IPSec secu- rity parameters between two hosts,and it negotiates IPSec security associations (SAs) automatically.IKE also allows Certification Authority (CA) support and permits lifetime specifications from IPSec security associations. www.syngress.com
138_linux_08 6/20/01 9:46 AM Page 402 402 Chapter 8 • Creating Virtual Private Networks To learn more about IKE,read the RFC 2409 proposed standard on the Internet at www.ietf.org/rfc/rfc2409.txt. Creating a VPN by Using FreeS/WAN Free Secure WAN (FreeS/WAN) is a Linux VPN implementation that uses IPSec and IKE.IPSec and IKE were discussed in the previous sections and are used to provide secure authentication and encryption of data between two hosts at Layer 3 (network layer) of the OSI model.FreeS/WAN creates a secure VPN tunnel between the hosts.The FreeS/WAN project goal is to provide freely available source code to promote IPSec and allow it to run on many different machines.It also avoids export restrictions and attempts to interoperate with all VPNs that use IPSec.The FreeS/WAN project is based at www.freeswan.org/intro.html (shown in Figure 8.12). Figure 8.12 Home of the FreeS/WAN Project Because FreeS/WAN uses IPSec,it can be implemented on any system that performs IP networking.This includes routers,PCs,laptops,firewalls,and applica- tion servers such as Web,mail,and database servers.FreeS/WAN uses three IPSec protocols,shown in Table 8.2. www.syngress.com
138_linux_08 6/20/01 9:46 AM Page 403 Creating Virtual Private Networks • Chapter 8 403 Table 8.2 IPSec Protocols Used in FreeS/WAN Protocol Description Authentication Header (AH) Performs authentication at the packet level. Encapsulating Security Performs encryption as well as authentication. Payload (ESP) Internet Key Exchange (IKE) Performs key exchanges and connection parameter negotiation. Damage & Defense… The Need for VPN Interoperability Interoperability is a major concern with S/WAN and VPNs in general. Currently, almost all firewalls and security software available today offers IPSec support. It is the goal of S/WAN developers for all S/WAN implementations to interoperate, no matter what device they are installed on. This goal is shared by many manufacturers and is spear- headed by the VPN Consortium (VPNC). The VPNC is an international trade association for manufacturers in the VPN market. The VPNC goal is to show manufacturers where their VPN products interoperate, so that the manufacturers can more easily provide inter- operability with other VPN implementations. They also publicize and provide support for testing events for VPN interoperability. By providing a forum for all VPN manufacturers to communicate, the Internet may eventually use one VPN standard, and all vendor VPN products may be able to communicate with one another. To learn more about VPN interoperability efforts, visit the VPNC Web site at www.vpnc.org. These IPSec protocols are implemented in FreeS/WAN by using two programs and a variety of scripts,as shown in Table 8.3. www.syngress.com
138_linux_08 6/20/01 9:46 AM Page 404 404 Chapter 8 • Creating Virtual Private Networks Table 8.3 FreeS/WAN Implementation of IPSec Protocols FreeS/WAN Implementation Description Kernel IPSec (KLIPS) Performs AH and ESP functions. It also handles packets within the Linux kernel. Pluto Performs IKE. Pluto is an IKE daemon. Variety of scripts Offers a FreeS/WAN interface for the administrator. NOTE In order to add IPSec to the system, FreeS/WAN installs IPSec into the Linux IPv4 TCP/IP stack. This step is necessary because IPSec is not required for IPv4. However, it is required for IPv6. In the following sections,you will download,install,and configure FreeS/WAN.After you install it,you will capture a variety of unencrypted application packets,then implement FreeS/WAN and ensure that all packets transmitted through the VPN are secure. Downloading and Unpacking FreeS/WAN FreeS/WAN is not included with all Red Hat Linux distributions.Many coun- tries have restriction laws that forbid the export or import of strong encryption. Therefore,your version of Red Hat Linux most likely does not include FreeS/WAN. These installation instructions are written for freeswan-1.9 (this tarball is available on the CD accompanying this book [freeswan-1.9.tar.gz ]) and Red Hat Linux 7.0 using the linux-2.2.16 kernel,which will be upgraded to the linux- 2.4.3 kernel (this kernel is also included on the CD [linux-2.4.3.tar.gz]).A custom installation of Linux with “everything”was installed. The program is downloaded as a TAR file that contains the source code and documentation,as well as any patches.To download and install FreeS/WAN complete the following steps:
- Log in as root. www.syngress.com
138_linux_08 6/20/01 9:46 AM Page 405 Creating Virtual Private Networks • Chapter 8 405 2. Access the FreeS/WAN download site at www.freeswan.org/ download.html.You can also obtain the necessary files from the CD accompanying this book. 3. Scroll down to the Latest Release section,as shown in Figure 8.13. Figure 8.13 Accessing the Latest Release of FreeS/WAN SECURITY ALERT! Do not download the installation files from the “Today’s Snapshot” sec- tion. The snapshots are experimental versions, and you may have diffi- culty implementing them. The “Latest Release” versions have been tested on Red Hat Linux and have a better change of working correctly on your system. 4. In this example,the latest release can be downloaded from Europe via FTP by selecting the ftp.xs4all.nl link.Select the corresponding link in your browser. 5. At the FTP site,view the FreeS/WAN files that are listed.For instance, the Europe FTP site is shown in Figure 8.14.You would need to down- load at least the freeswan-1.9.tar.gz file (your version may differ) to your system.Although not all the files are required to run FreeS/WAN,you www.syngress.com
138_linux_08 6/20/01 9:46 AM Page 406 406 Chapter 8 • Creating Virtual Private Networks may find them useful.For instance,the RFCs that FreeS/WAN is based are included in the RFCs.tar.gz file.The files you can download are as follows (these files are also located on the CD accompanying this book): (cid:2) RFCs.tar.gz (cid:2) freeswan-1.9.tar.gz (cid:2) freeswan-1.9.tar.gz.sig (cid:2) freeswan-sigkey.asc Figure 8.14 Downloading the FreeS/WAN TAR File(s) NOTE You can also access the freeswan-1.9.tar.gz tarball from the supple- mental CD included with this book and copy it to your /root directory. This lab is written for version 1.9, which is the version on the CD. 6. Download the FreeS/WAN file(s) to your /root directory. 7. Access the download directory by entering. cd /root www.syngress.com
138_linux_08 6/20/01 9:46 AM Page 407 Creating Virtual Private Networks • Chapter 8 407 NOTE If you have already compiled your kernel in the past (you have a .config file in your /usr/src/linux directory), then download and unpack the files in your /usr/src/ directory (but not in the linux directory). 8. The filename will look like this:freeswan-1.9.tar.gz. 9. In the /root directory,unpack the image by entering: tar -zxvf freeswan-1.9.tar.gz This will create a /root/freeswan-1.9 directory. Compiling the Kernel to Run FreeS/WAN Now you need to configure the Linux kernel to run FreeS/WAN.The FreeS/WAN code must be added to the kernel.Before you configure FreeS/WAN,you must configure,build,and test a system kernel.This must be done before installing FreeS/WAN because the program uses the results of com- piled kernel to make the necessary modifications. The following tools must be installed before you begin the kernel configura- tion for FreeS/WAN.If you completed a “Custom”Red Hat Linux installation with “everything”installed,you can skip this warning—all of the required Red Hat Package Manager (RPM) packages are already installed (you may need to update them later in this section). To check if an RPM is installed,enter rpm -qa | grep rpm_name. To install an RPM,enter rpm -i rpm_name_version.Access the RPMs from the Red Hat installation CD /RedHat/RPMS directory,as shown in the following Kernel source code item:
- Kernel source code The Linux kernel source RPM must be installed to configure the kernel.To find out if it is installed,enter rpm -qa | grep kernel-source.If you do not receive a reply,access your Red Hat installation CD and install the kernel-source and kernel-headers RPMs (your versions may vary) from the /RedHat/RPMS directory.
- Tools A GNU C compiler RPM must be installed—either gcc or egcs works.Development tools,including make and patch must be installed. www.syngress.com
138_linux_08 6/20/01 9:46 AM Page 408 408 Chapter 8 • Creating Virtual Private Networks 3. Libraries The glibc,GMP (required for Pluto’s public key calculations), and ncurses (if you use menuconfig) RPMs must be installed. NOTE The following demonstration is safe and will upgrade your Linux kernel. You will always have the old kernel on your system, so you can switch back if a problem arises. Recompiling the kernel is required to support many new devices in Linux. If you have already compiled your kernel in the past (you have a .config file in your /usr/src/linux directory), then you can skip this section. Go to the “Configuring FreeS/WAN” section. Please note that you will NOT have to reconfigure the FreeS/WAN Makefile. 4. Revisit www.freeswan.org/download.html (shown in Figure 8.13) to determine if your system’s Red Hat Linux version and kernel are supported. 5. For this demonstration,the Linux kernel will be upgraded to linux- 2.4.3,and then FreeS/WAN will be compiled. 6. Access the kernel source code from the anonymous FTP site located at ftp://ftp.kernel.org/pub/linux/kernel/. 7. Open the v2.4 directory (or the latest supported by FreeS/WAN) to access the Linux 2.4 kernel versions.Locate the linux-2.4.3.tar.gz file.It is located in the middle of the screen,shown in Figure 8.15. NOTE You can also access the linux-2.4.3.tar.gz tarball from the CD included with this book and copy it to your /root directory. This lab is written for Linux 2.4.3, which is the version on the CD. 8. Download the kernel to your home directory,such as /root as shown in Figure 8.16.You can download and unpack the kernel in any directory in which you have permissions,such as your home directory.In this demonstration,the /root directory is used. www.syngress.com
138_linux_08 6/20/01 9:46 AM Page 409 Creating Virtual Private Networks • Chapter 8 409 Figure 8.15 Locating the linux-2.4.3.tar.gz Kernel Figure 8.16 Downloading Kernel to Your Home (/root) Directory 9. On your system,access the /root directory by entering the following: cd /root 10. Unpack the downloaded kernel by entering the following: gzip –cd linux-2.4.3.tar.gz | tar xvf - A /root/linux/ directory is created. 11. To remove stale .o files and dependencies,access the new linux directory and run the make mrproper command.Enter the following commands: cd /root/linux make mrproper www.syngress.com
138_linux_08 6/20/01 9:46 AM Page 410 410 Chapter 8 • Creating Virtual Private Networks NOTE View the README file included with the unpacked kernel. The file explains in detail the processes for installing the 2.4 kernel, which are slightly different from previous releases. For instance, the Linux kernel was unpacked in your home directory, not the /usr/src/ directory. In this example, read the /root/linux/README file. This process will also ensure that you do not overwrite your current system kernel. 12. Open the /root/linux/documentation/changes file and see which updated packages are required to run the linux-2.4.3 kernel.For instance,if you are upgrading from linux-2.2.16-22,you will need to upgrade the following packages to these minimum versions: (cid:2) util-linux 2.10o (cid:2) modutils 2.4.2 (cid:2) e2fsprogs 1.19 (cid:2) pppd 2.4.0 (cid:2) reiserfsprogs 3.x.0j-1 13. Download the required RPMs at the RPM repository (http://rpmfind .net/linux/RPM).These RPMs are also available on the CD accompa- nying this book. 14. The RPM repository is shown in Figure 8.17.Search for the required RPM by entering its name in the Search field,and clicking the Search button. 15. For instance,if you are upgrading from linux-2.2.16.22,you need to download the following RPMs,which are also available on the CD accompanying this book: (cid:2) util-linux-2.10s-12.i386.rpm (cid:2) modutils-2.4.2-5.i386.rpm (cid:2) e2fsprogs-1.19-4.i386.rpm (cid:2) ppp-2.4.0-2.i386.rpm www.syngress.com
138_linux_08 6/20/01 9:46 AM Page 411 Creating Virtual Private Networks • Chapter 8 411 Figure 8.17 Searching for RPMs at the RPM Repository on rpmfind.net 16. Install each RPM using the rpm -U command.For instance,to install the RPMs listed in the previous step,you would enter the following: rpm –U util-linux-2.10s-12.i386.rpm rpm –U modutils-2.4.2-5.i386.rpm rpm –U e2fsprogs-1.19-4.i386.rpm rpm –U ppp-2.4.0-2.i386.rpm 17. After updating the required RPMs,you are ready to compile the kernel. The easiest way to configure the kernel is to enter X Windows.If you are not already in X Windows,enter the following: startx 18. Access the new linux directory,which is the required location for this kernel configuration.Enter the following: cd /root/linux www.syngress.com
138_linux_08 6/20/01 9:46 AM Page 412 412 Chapter 8 • Creating Virtual Private Networks 19. Open the Linux Kernel Configuration GUI.This program allows you to choose kernel options for your system.Open it by entering the following: make xconfig The Linux Kernel Configuration GUI appears,as shown in Figure 8.18. Figure 8.18 Configuring the Linux Kernel by Using xconfig 20. Click the Loadable module support button. 21. The Loadable module support configuration screen appears.Select Y for all three options,as shown in Figure 8.19.If they are already selected, then you do not have to change the configuration options. Figure 8.19 Configuring Loadable Module Support in the Linux Kernel 22. Click the Main Menu button to return to the Linux Kernel Configuration screen. 23. Select the Processor type and features button.In the Processor family drop-down menu,select the process type running on your system.For the first time,modern PC processors are listed,such as the Pentium III and IV,as well as the AMD Athlon/K7.Many times, Linux installs using the i386 processor,even though your system may be www.syngress.com
138_linux_08 6/20/01 9:46 AM Page 413 Creating Virtual Private Networks • Chapter 8 413 running a more modern processor.Selecting the correct processor type will increase system performance.The Processor type and features screen is shown in Figure 8.20. Figure 8.20 Configuring Processor Type 24. Click the Main Menu button to return to the Linux Kernel Configuration screen. 25. Click the Network device support button and select the Ethernet (10 or 100Mbit) option.Select your NIC from the list of available options.The PCI NE2000 and clones support usually works for PCI cards that are not specifically listed.If this is what you require,select Y, as shown in Figure 8.21. Figure 8.21 Selecting the PCI NE2000 and Clones NIC www.syngress.com
138_linux_08 6/20/01 9:46 AM Page 414 414 Chapter 8 • Creating Virtual Private Networks 26. Click the OK button and then the Main Menu button. 27. Make any additional changes required for your system.For instance,if you want printer support,you must activate Parallel port support from the Main Menu and select the Y option. 28. Click the Save and Exit button.You will receive a message stating “End of Linux kernel configuration.”Click the OK button. 29. The kernel configurations are saved in the file /root/linux/.config. 30. Continue to run commands from the /root/linux directory. 31. Run the make dep command,which finds dependencies between the files.Enter the following: make dep 32. Run the make bzImage command,which builds a loadable image of the kernel.It compresses the image with bzip.Enter the following: make bzImage 33. The bzImage file is created and placed in /linux/arch/i386/boot/ bzImage. NOTE At the end of the make bzImage process, you may receive a warning (especially if you have installed a large number of kernel options) stating “warning: kernel is too big for standalone boot from floppy.” If you receive this warning, you need to copy the image to the hard drive and boot up with lilo. 34. Continue to run commands from the /root/linux directory. 35. Run the command make install by entering the following: make install 36. Now that you have made a kernel,create the modules by entering the following: make modules www.syngress.com
138_linux_08 6/20/01 9:46 AM Page 415 Creating Virtual Private Networks • Chapter 8 415 37. To install the modules in the proper subdirectories,enter the following: make modules_install 38. To boot into the new kernel,you must copy the kernel image to either a floppy disk or to your hard drive.This depends on how you usually boot up Linux. 39. If you use a boot disk,then copy the image to a new floppy disk.The floppy disk must be high density.Then create a boot disk,insert a new HD floppy disk,and enter the following: cp /root/linux/arch/i386/boot/bzImage /dev/fd0 Leave the floppy boot disk in your system and reboot the system from the floppy boot disk. 40. If you boot from your hard drive,your system uses lilo.The lilo configura- tions are specified in /etc/lilo.conf.The lilo.conf file specifies kernel images that are located in the /boot directory.During the installation pro- cess,the bzImage file was copied to the /boot directory and renamed vmlinuz-2.4.3.It can be named anything you want,as long as you specify the name and location in the lilo.conf file (which you will do in Step 42). 41. To specify your new image in the /etc/lilo.conf file,enter the following: vi /etc/lilo.conf 42. Press I to insert text.Insert the following text at the end of the file to identify the new kernel image (your entry may vary due to different partitions): image=/boot/vmlinuz-2.4.3 label=linux-2.4.3 read-only root=/dev/hda5 Your lilo.conf file should resemble Figure 8.22. 43. Press ESC to exit insert mode.Write and quit the file by entering the following: :wq www.syngress.com
138_linux_08 6/20/01 9:46 AM Page 416 416 Chapter 8 • Creating Virtual Private Networks Figure 8.22 Configuring /etc/lilo.conf to Access the New Kernel Image 44. To load your lilo.conf changes,enter the following command: lilo You should receive the following response: Added linux * Added linux-2.4.3 45. You are ready to reboot the system and test to see if the new kernel works. 46. Reboot the system. 47. At the lilo prompt,the kernel image labels are presented.If not,select the TAB key.Two options will be available to you:the original linux kernel and the new linux-2.4.3 kernel you just configured.Select the linux-2.4.3 kernel. 48. The system should boot properly.If you receive errors when booting the new kernel,reboot using the old kernel image and access the /root/ linux/README file.To find out more about kernel configuration com- mands and troubleshooting problems,visit www.linuxdoc.org/ HOWTO/Kernel-HOWTO.html (be aware,however,that the HOWTO documents are not always up-to-date). 49. Log in as root.You should be successful. www.syngress.com
138_linux_08 6/20/01 9:46 AM Page 417 Creating Virtual Private Networks • Chapter 8 417 Recompiling FreeS/WAN into the New Kernel Congratulations! You have successfully created and tested a new kernel image for your system.This will make any troubleshooting of FreeS/WAN much easier, because you know that the compiled kernel works.If you skipped the last section because you compiled your kernel in the past (you have a .config file in your /usr/src/linux directory),then you do not have to reconfigure the FreeS/WAN Makefile.Skip to Step 7 in the following demonstration and use /usr/src/ freeswan-1.9 instead of the /root/freeswan-1.9 directory for the remainder of the section.
- Reboot the system and log in to the original kernel as root.Do not use the new kernel for the following steps.
- Access the freeswan directory by entering the following (your version may vary): cd root/freeswan-1.9
- Open the /root/freeswan/Makefile by entering the following: vi Makefile
- You need to change the kernel source location where FreeS/WAN looks for the kernel.By default,FreeS/WAN looks in the /usr/src/linux directory.However,you compiled your new kernel in /root/linux. Therefore,you need to change the Makefile to reflect your kernel source location.To change the kernel source location,scroll down the file and locate the following comment:
kernel location, and location of kernel patches in the
distribution KERNELSRC=/usr/src/linux 5. Change the kernel source location by pressing I to enter vi’s insert mode,then change the location to the following: KERNELSRC=/root/linux Your file should resemble Figure 8.23. 6. To save and exit the file,press ESC and enter the following: :wq www.syngress.com
138_linux_08 6/20/01 9:46 AM Page 418 418 Chapter 8 • Creating Virtual Private Networks Figure 8.23 Changing the FreeS/WAN Makefile Kernel Source Location 7. To add the FreeS/WAN default settings into your Linux kernel’s .config file,enter the following command in the /root/freeswan-1.9 directory: cd /root/freeswan-1.9 make oldgo This command installs default FreeS/WAN configurations to the linux-2.4.3 kernel you created.To complete the FreeS/WAN kernel configuration,enter the following in the /root/freeswan-1.9 directory: make kinstall NOTE When the make kinstall command is run from the freeswan directory, it performs the same make commands that you usually run from the /linux directory to configure and install your kernel. It runs the equivalent make commands: make make install make modules make modules_install www.syngress.com
138_linux_08 6/20/01 9:46 AM Page 419 Creating Virtual Private Networks • Chapter 8 419 8. The lilo.conf file already specifies the new kernel image location. However,you can enter the lilo command to ensure that it is up-to-date by entering the following: lilo You should receive the following response: Added linux * Added linux-2.4.3 9. You are ready to reboot the system and test whether the new kernel works. 10. Reboot the system into the new linux-2.4.3 kernel image. 11. During the reboot,check the messages during boot.You can also check them using dmesg.Look for the following: (cid:2) Make sure that you are booting into the new kernel. (cid:2) Make sure that a message appears for KLIPS initialization. (cid:2) Make sure that a start report appears for Pluto. (cid:2) Make sure that “ipsec_setup – Starting FreeS/WAN IPsec 1.9” appears. 12. Log in as root. 13. Test the IPSec commands shown in Table 8.4 (just make sure that you get a response). Table 8.4 Commands to Test if IPSec Is Working Command Description ipsec -version Shows the FreeS/WAN version, which tests the /usr/local/bin path for IPSec admin commands. ipsec whac --kstatus Command used for status information for Pluto. 14. If the FreeS/WAN kernel implementation is successful,you are ready to continue.Please note that you need a second system setup with FreeS/WAN to create a VPN. 15. If you are not successful,please view the Linux FreeS/WAN online doc- umentation at www.freeswan.org/doc.html.It provides a documentation www.syngress.com
138_linux_08 6/20/01 9:46 AM Page 420 420 Chapter 8 • Creating Virtual Private Networks tree with a troubleshooting section,as shown in Figure 8.24.The specific address is:www.freeswan.org/freeswan_trees/freeswan-1.9/doc/ trouble.html Figure 8.24 Troubleshooting Tips for Linux FreeS/WAN Configuring FreeS/WAN After you have compiled FreeS/WAN into your Linux kernel and confirmed that IPSec,KLIPS,and Pluto are running,you are ready to configure the pro- gram.Any IPSec implementation requires that you first test IP networking on the gateways,or hosts,at each tunnel endpoint.The reason is because IPSec does not work unless a functional IP network is working underneath it. In this section,you will configure FreeS/WAN between two hosts,which is a host-to-host VPN solution.In an enterprise environment,these hosts would be the VPN gateways into the network.In a telecommuter environment,one host would be the telecommuter,and the other would be the VPN gateway to the company network. Testing IP Networking To create a host-to-host VPN solution,both systems must have FreeS/WAN properly installed and tested.Next,you must ensure that IP networking is www.syngress.com
138_linux_08 6/20/01 9:46 AM Page 421 Creating Virtual Private Networks • Chapter 8 421 functioning.For this demonstration,you will also capture HTTP packets between the hosts.This capture will allow you to compare and prove that IPSec is func- tioning after the tunnel is created between the hosts. To test IP networking,make sure that each host can ping the others.If suc- cessful,access the default Apache Web page on one of the hosts and capture the transmission.View the packet capture to confirm that the packets are not encrypted.This process is documented in the following steps:
- For this demonstration,we must define our VPN host1 and host2.Write your host1 and host2 in the space provided.From this point forward,the hosts will be referred to as host1 and host2. host1 = we-24-130-8-170.we.mediaone.net ______________________ host2 = we-24-130-10-205.we.mediaone.net _____________________
- Confirm that host1 and host2 are booted into the new kernel that is configured with FreeS/WAN.
- Confirm that host1 and host2 have FreeS/WAN properly installed and tested.
- Test connectivity between host1 and host2 using ping.For instance, enter the following from host1: ping host2 From host2,enter: ping host1 You should be successful.If not,troubleshoot your network until you gain connectivity between the two hosts.
- Host2:Make sure that Apache is installed by entering the following: rpm –qa | grep apache
- Host2:You should receive a response similar to the following if Apache is installed: apache-manual-1.3.12-25 apache-1.3.12-25 apache-devel-1.3.12-25 www.syngress.com
138_linux_08 6/20/01 9:46 AM Page 422 422 Chapter 8 • Creating Virtual Private Networks 7. Host2:If you do not receive a response,then you need to download and install Apache. 8. Host2:After you confirm that Apache is installed and running,you have completed Apache configuration.This is because host1 will access the default Web site that Apache configures automatically upon installation. 9. Host1:Capture HTTP packets between your Web browser and the Apache Web server on Host2.To accomplish this task,you must first set up a packet capture filter between host1 and host2 using Ethereal.To set up the filter,complete the following steps: 10. Host1:Verify that the Ethereal RPM is installed on the system by entering the following: rpm –qa | grep ethereal 11. Host1:If you do not receive a reply,then you need to download and install Ethereal (www.rpmfind.net).You can also install it from your PowerTools CD that is distributed with Red Hat Linux. 12. Host1:After you have verified that Ethereal is installed,you are ready to capture packets. 13. Host1:To add filters to Ethereal without using host names,open a com- mand interface and enter the following: ethereal -n 14. Host1:From the Edit menu,choose Filters.The Ethereal:Filters screen appears.Because no filters have been configured,the configuration screen is blank. 15. Host1:To create a filter that allows only traffic between your host and another host,you must add a filter name and a filter string.For instance, to create a filter between two hosts (host1 and host2),enter the filter name HTTP Capture and filter string shown in Figure 8.25.Please note that your IP addresses will not be the same. 16. Host1:After the two fields are complete,you must click the Save button and then click the New button.Click the OK button to exit. 17. Host1:To start a packet capture,simply choose Start from the Capture menu.The Capture Preference screen appears.Click the Filter button and choose the HTTP Capture filter that you created.Click the OK button twice,and the capture starts. www.syngress.com
138_linux_08 6/20/01 9:46 AM Page 423 Creating Virtual Private Networks • Chapter 8 423 Figure 8.25 Creating a Filter between Two Hosts 18. Host1:To generate the HTTP packets,open the browser and access the default Web page on the host2 Web server.For instance,enter the following:http://we-24-130-10-205.we.mediaone.net. 19. Host1:The default Web page on the host2 Web server appears,as shown in Figure 8.26. Figure 8.26 Accessing the Default Web Page on the host2 Web Server 20. Host1:Close the browser. 21. Host1:Stop the Ethereal packet capture by clicking the Stop button. www.syngress.com
138_linux_08 6/20/01 9:46 AM Page 424 424 Chapter 8 • Creating Virtual Private Networks 22. Host1:The packet capture appears in Ethereal.The transmission is not encrypted.All application data is displayed,as well as the port numbers. Your screen will resemble Figure 8.27,which highlights the first HTTP packet. 23. Host1:Save the packet capture as unsecHTTP and quit Ethereal.A sample unsecHTTP file is included on the CD accompanying this book. Figure 8.27 Capturing an HTTP Session without FreeS/WAN You have successfully tested IP networking between the two VPN hosts.You also captured HTTP packets between the two hosts to prove that a VPN tunnel has not yet been configured.When the VPN tunnel is configured,all traffic between the two hosts will be encrypted,regardless of the applications running between the hosts. Configuring Public Key Encryption for Secure Authentication of VPN Endpoints You have tested and confirmed that an HTTP daemon and browser can commu- nication between host1 and host2.Do not proceed in this chapter until this works. This proves that the hosts can communicate without IPSec and will make trou- bleshooting any problems far easier.The next goal will be to have host1 and host2 communicate with the FreeS/WAN IPSec implementation. www.syngress.com
138_linux_08 6/20/01 9:46 AM Page 425 Creating Virtual Private Networks • Chapter 8 425 For IPSec to work,you have to set up public key encryption.As you learned in Chapter 7,public key encryption uses private and public keys to ensure authen- tication.The private key is known only by the host,and the public key is available to everyone else,such as all hosts that the system will communicate with. NOTE The U.S. patent on the RSA algorithm expired on September 20, 2000. Therefore, RSA is used for the public key encryption in FreeS/WAN and will be incorporated into many additional open source programs as they are developed and new versions are released. An RSA key pair was created during the FreeS/WAN installation process. The key pair is placed in the /etc/ipsec.secrets file.This file must be kept secure because your private key is listed within it.Only you,the superuser,should have access to this /etc/ipsec.secrets file. The public key should be placed in the /etc/ipsec.conf file.Because the public key is available to anyone with whom you communicate,security is not as important for the /etc/ipsec.conf file.The private and public key locations for FreeS/WAN are summarized in Table 8.5. Table 8.5 Location of RSA Key Pair for FreeS/WAN Key File Name Location on Host Private key ipsec.secrets /etc/ipsec.secrets Public key Public key ipsec.conf /etc/ipsec.conf You will configure these files in the following steps on host1 and host2 so that you can start the tunnel.Complete the following steps to configure your systems for FreeS/WAN.FreeS/WAN and IPSec refer to the VPN endpoints as the “left” and “right”hosts.In this section’s demonstration,host1 is left,and host2 is right.
- Host1:First,you will configure the /etc/ipsec.secrets file,which lists your system’s public and private keys.Open the file by entering the following: vi /etc/ipsec.secrets www.syngress.com
138_linux_08 6/20/01 9:46 AM Page 426 426 Chapter 8 • Creating Virtual Private Networks Your file will resemble the one shown in Figure 8.28. Figure 8.28 Configuring the /etc/ipsec.secrets File 2. Host1:You are using public key authentication,so you need to comment out (#) the line indicating the “Shared secret.”To do this,press I and comment out the last line in the second paragraph of the file,as follows (your arbitrary character string may vary):
Shared secret (an arbitrary character string, which should be
both long and hard to guess, enclosed in quotes) for a pair
of negotiating hosts.
Must be same on both; generate on one and copy to the other.
10.0.0.1 10.12.12.1 : PSK
"jxmWkkWmm4uV1m4SW3SuUWU1233Wu5S5U3S…"
- Host1:Notice the public and private key listed in the file.Pluto,which is the IKE implementation on FreeS/WAN,uses these keys to authenti- cate hosts with your system.
- Host1:Press ESC,then write and quit the file by entering the following: :wq www.syngress.com
138_linux_08 6/20/01 9:46 AM Page 427 Creating Virtual Private Networks • Chapter 8 427 NOTE IPSec (and FreeS/WAN) use RSA keys by default for authentication between the VPN hosts. Encryption is accomplished by default through 3DES. 5. Host1:Next,you will configure the /etc/ipsec.conf file,which lists the configuration and connection information for IPSec. 6. Host1:Make a backup copy of the /etc/ipsec.conf file and name it ipsec.conf-backup.The ipsec.conf file is actually a sample file that you must configure.Enter the following: cp /etc/ipsec.conf /etc/ipsec.conf-backup 7. Open the /etc/ipsec.conf file by entering the following: vi /etc/ipsec.conf 8. Host1:Your file will resemble the file shown in Figure 8.29 (Figure 8.30, displayed later in this section,displays the remainder of the file,which has three main sections). Figure 8.29 Configuring the /etc/ipsec.conf File www.syngress.com
138_linux_08 6/20/01 9:46 AM Page 428 428 Chapter 8 • Creating Virtual Private Networks 9. Host1:As you can see in Figure 8.29,/etc/ipsec.conf is the main FreeS/WAN IPSec configuration file,which has three parts.The “basic configuration”and “defaults for subsequent connection descriptions” sections are shown in the figure.The “connection”section is discussed after these two sections are completed. NOTE For more information on the configuration options for ipsec.conf, see the following documents: (cid:2) www.freeswan.org/freeswan_trees/freeswan-1.9/doc/manpage.d/ ipsec.conf.5.html (cid:2) man ipsec.conf (cid:2) /root/freeswan-1.9/doc/examples 10. Host1:Read the “basic configuration”section as follows.You do not need to make any changes to this section of the file.Additional com- ments are here for your understanding:
basic configuration
config setup
THIS SETTING MUST BE CORRECT or almost nothing will work.
%defaultroute is okay for most simple cases. This defines the
interfaces that IPsec uses. For instance, you could add
"ipsec0=eth0" for the interfaces value as well.
interfaces=%defaultroute
Debug-logging controls: Specifies how much KLIPS and Pluto
debugging output will be logged. Defaults to "none".
Enter "none" for (almost) none, "all" for lots.
klipsdebug=none plutodebug=none
Plutoload specifies a connection name (identified in the third
section of this file) that will be loaded into the internal
database at startup. It does not attempt to start the
connection until summoned.
plutoload=host-to-host www.syngress.com
138_linux_08 6/20/01 9:46 AM Page 429 Creating Virtual Private Networks • Chapter 8 429
Close down old connection when new one using same
ID showns up.
uniqueids=yes 11. Host1:You must modify the “defaults for subsequent connection descriptions”section.The configurations you enable here will determine how the following “connections”section will behave.Because you are using public key cryptography,you do not require the manual-key testing entries.The section should read as follows (you do not need to enter the comments):
defaults for subsequent connection descriptions
conn %default
How persistent to be in (re)keying negotiations (0 means
very).
Keying tries=0
Indicates that RSA authentication will be used for the VPN
connection. To generate your public key, open a terminal and
enter 'ipsec showhostkey'. Copy your public key to the
leftrsasigkey value. Copy the public key of host2 to the
rightrsasigkey.
authby=rsasig leftrsasigkey= rightrsasigkey= NOTE The host1 public key is also listed in the /etc/ipsec.secrets file and begins with #pubkey=0x” (see Figure 8.28). Only the hexadecimal portion is required, not the #pubkey=” portion. You can copy the public key from host1 from this file and paste it into the leftrsasigkey= value. You may want to use a text editor other than vi to copy and paste the public key. 12. Host1:You must modify the “sample connection”section so that it applies to a host-to-host connection.The connection section is shown in Figure 8.30. www.syngress.com
138_linux_08 6/20/01 9:46 AM Page 430 430 Chapter 8 • Creating Virtual Private Networks Figure 8.30 Configuring the Connection Section of the /etc/ipsec.conf File NOTE If you were configuring VPN gateways for a network, you would enter the “leftsubnet” and “rightsubnet” options (shown in Figure 8.30). These options identify the LAN network address that the gateway is attached to. If you were configuring a VPN involving a telecommuter, you would identify the subnet on only one side, because the telecommuter has no gateway, it is a host. 13. Host1:Modify the connection section for a host-to-host VPN solution. Modify the section as follows (you do not need to enter the comments):
host-to-host tunnel (no subnets)
In this demonstration, the hosts talk directly to each other,
so next-hop settings are not required. The name of this
connection is "host-to-host."
conn host-to-host
The left host is the IP address of host1.
left=24.130.8.170
Next hop to reach the right host — no value required because
hosts are on the same network.
leftnexthop=
The right host is the IP address of host2
right=24.130.10.205
Next hop to reach the left host — no value required because
www.syngress.com
138_linux_08 6/20/01 9:46 AM Page 431 Creating Virtual Private Networks • Chapter 8 431
hosts are on the same network.
rightnexthop= 14. Host1:Press ESC,then write and quit the file by entering the following: :wq 15. Host1:Copy the /etc/ipsec.conf file from host1 and transfer it to host2. Doing so will save you a lot of time and effort. NOTE If you have security concerns, you can configure the /etc/ipsec.conf file separately on host2. Then, copy the public key of host1 to a text file and name it host1.pub. (A sample host1.pub file is included on the CD accompanying this book). The public key is the line in the output of the /etc/ipsec.secrets file that begins with #pubkey=0x” (see Figure 8.28). Only the hexadecimal portion is required, not the #pubkey=” portion. Then transfer the host1.pub file to host2 and place it in the /etc/ipsec.conf file. As usual, authentication of public keys is essential to ensure that you are not tricked into accepting a public key from a hacker. Make sure that you are certain the public key is from host1. 16. Host2:Log in to host2 as root using the FreeS/WAN-enabled kernel. 17. Host2:Make a backup copy of the /etc/ipsec.conf file and name it ipsec.conf-backup.The ipsec.conf file is actually a sample file that you must configure.Enter the following: cp /etc/ipsec.conf /etc/ipsec.conf-backup 18. Host2:Replace the host2 /etc/ipsec.conf file with the host1 ipsec.conf file.You need to add only the host2 public key to the rightrsasigkey= value,which you will do in the following steps. 19. Host2:Open the /etc/ipsec.secrets file by entering the following: vi /etc/ipsec.secrets www.syngress.com
138_linux_08 6/20/01 9:46 AM Page 432 432 Chapter 8 • Creating Virtual Private Networks 20. Host2:Similar to host1,comment out (#) the line indicating the “Shared secret”.To do this,press I and comment out the last line in the second paragraph of the file,as shown (your arbitrary character string may vary):
Shared secret (an arbitrary character string, which should be
both long and hard to guess, enclosed in quotes) for a pair
of negotiating hosts.
Must be same on both; generate on one and copy to the other.
10.0.0.1 10.12.12.1 : PSK
"jxmWkkWmm4uV1m4SW3SuUWU1233Wu5S5U3S…"
- Host2:Copy the public key of host2.The public key is the line in the output of the /etc/ipsec.secrets file that begins with #pubkey=0x”.Only the hexadecimal portion is required,not the #pubkey=” portion.
- Host2:Paste the public key of host2 to the /etc/ipsec.conf rightrsasigkey= value.You may want to use a text editor other than vi to copy and paste the public key.Both public keys for host1 and host2 should now be listed in the file.
- Host2:Write and quit both the /etc/ipsec.secrets and the /etc/ipsec.conf file.
- Host2:Transfer the host2 public key to host1.For instance,copy the public key of host2 to a text file and name it host1.pub,(a sample host1.pub file is included on the CD accompanying this book),or copy the /etc/ipsec.conf file to host1.The file will be exactly the same on both hosts,so this method is possible.
- Host1:Copy the public key of host2 to the /etc/ipsec.conf rightrsasigkey= value.
- Host1 and Host2:The ipsec.conf file on both host1 and host2 should be identical.Figures 8.31 through 8.33 display the completed ipsec.conf file for the host-to-host tunnel for two mediaone.net endpoints.A sample ipsec.conf file is included on the CD accompanying this book. www.syngress.com
138_linux_08 6/20/01 9:46 AM Page 433 Creating Virtual Private Networks • Chapter 8 433 Figure 8.31 Final Configurations for the “Basic Configuration” Section of the /etc/ipsec.secrets File Figure 8.32 Final Configurations for the “Defaults for Subsequent Connection Descriptions” Section of the /etc/ipsec.conf File Figure 8.33 Final Configurations for the “Connection (Host-to-Host Tunnel)” Section of the /etc/ipsec.conf File www.syngress.com
138_linux_08 6/20/01 9:46 AM Page 434 434 Chapter 8 • Creating Virtual Private Networks Starting the Tunnel Congratulations.Both /etc/ipsec.conf and /etc/ipsec.secret files on host1 and host2 are configured with each other’s public keys.Now you must create the tunnel.The commands used to start,stop,and maintain the tunnel are IPSec commands.Table 8.6 displays common IPSec commands. Table 8.6 Common IPSec Commands Command Description ipsec auto --up Requests Pluto to establish a connection (tunnel) using data stored in its internal database. ipsec auto --down Requests Pluto to close a connection (tunnel). ipsec auto --rereadsecrets Request Pluto to reread the /etc/ipsec.secrets file. ipsec look Lists a minimal amount of debugging informa- tion. Main use is to provide a quick look at current connections. ipsec barf Lists all debugging information related to IPSec, including encryption and authentication data. ipsec pluto The IPSec Key Exchange (IKE) daemon command. The IPSec auto commands are more convenient for establishing and closing IKE connections. ipsec whack Provides a control interface for IPSec keying daemons, which is Pluto in FreeS/WAN. The IPSec auto commands are more convenient for establishing and closing IKE connections. ipsec --help Most IPSec commands have their own man pages. The --help option lists all the IPSec commands. ipsec --version Lists the FreeS/WAN version number. ipsec --copyright Lists the copyright information. Most IPSec commands have their own man pages.For a listing,visit www.freeswan.org/freeswan_trees/freeswan-1.9/doc/manpages.html.You can also view the IPSec man page.It lists the associated IPSec commands that have their own man pages. www.syngress.com
138_linux_08 6/20/01 9:46 AM Page 435 Creating Virtual Private Networks • Chapter 8 435 The following steps will demonstrate how to start the tunnel using IPSec commands:
- Host1 and Host2:Reboot the systems and make sure that you load the FreeS/WAN-enabled kernel.The reboot loads your “host-to-host”con- nection that you specified in the /etc/ipsec.conf file into Pluto’s internal database at startup.Recall the plutoload=host-to-host line.
- Host1 and Host2:Examine /var/log/messages for any IPSec errors.
- Host1 and Host2:Check that the following entries exist in /proc/net/ directory: ipsec_version ipsec_tncfg ipsec_eroute ipsec_spi ipsec_spigrp
- Host1 and Host2:Check for the IPSec virtual interface on the host. Enter the following: cat /proc/net/ipsec_tncfg
- Host1 and Host2:ipsec0 should be listed.It will point to your physical interface,such as eth0.For instance,it will read as follows: ipsec0 -> eth0 mtu=16260 -> 0 ipsec1 -> NULL mtu=0 -> 0 ipsec2 -> NULL mtu=0 -> 0 ipsec3 -> NULL mtu=0 -> 0 The ipsec0 pseudo-device uses the FreeS/WAN eroute utility.This routes all connections through this device and encrypts it before sending it to the underlying physical interface.
- Host1:On one of the hosts,start the tunnel by entering the following: ipsec auto –-up host-to-host where host-to-host is the name of the connection you created in the ipsec.conf file. www.syngress.com
138_linux_08 6/20/01 9:46 AM Page 436 436 Chapter 8 • Creating Virtual Private Networks 7. Host1:If no errors are supported,the VPN tunnel should be established. Enter the following command to observe the connection configuration: ipsec look 8. The response from both ipsec commands should resemble Figure 8.34.If you receive a similar response,your VPN tunnel is established between the hosts. Figure 8.34 Starting and Confirming the Establishment of a Host-to-Host VPN Tunnel Capturing VPN Tunnel Traffic To ensure that your VPN is actually encrypting traffic between the hosts,you need to capture packets using the HTTP Capture filter you created in the “Testing IP Networking”section of this chapter.Complete the following steps to prove that the VPN is indeed functioning.Any traffic you send between the hosts will be encrypted.
- Host1:Open Ethereal without using host names,open a command interface,and enter the following: ethereal -n
- Host1:To start a packet capture,simply choose Start from the Capture menu.The Capture Preference screen appears.Click the Filter button www.syngress.com
138_linux_08 6/20/01 9:46 AM Page 437 Creating Virtual Private Networks • Chapter 8 437 and choose the “HTTP Capture”filter that you created.Click the OK button twice,and the capture starts. 3. Host1:To generate the HTTP packets,open the browser and access the default Web page on the host2 Web server.For instance,enter the following: http://we-24-130-10-205.we.mediaone.net 4. Host1:The default Web page on the host2 Web server appears. 5. Host1:Close the browser. 6. Host1:Stop the Ethereal packet capture by clicking the Stop button. 7. Host1:The packet capture appears in Ethereal.The transmission is encrypted.No application data or port numbers are displayed.Your screen will resemble Figure 8.35,which highlights the first encrypted packet.In this case,ESP uses 3DES for packet encryption and MD5 for packet authentication. Figure 8.35 Capturing an HTTP Session with a FreeS/WAN Host-to-Host VPN 8. Host1:Save the packet capture as tunntraf and quit Ethereal.A sample tunntraf file is included on the CD accompanying this book. www.syngress.com
138_linux_08 6/20/01 9:46 AM Page 438 438 Chapter 8 • Creating Virtual Private Networks You have successfully implemented a VPN host-to-host solution over an unsecured network.You captured HTTP packets between the two hosts to prove that a VPN tunnel has not only been configured,but that it works.When the VPN tunnel is configured,all traffic between the two hosts is encrypted,regard- less of the applications running between the hosts. Closing the VPN Tunnel To close the VPN tunnel,you must close the connection from both endpoints of the tunnel.Even though you started the VPN tunnel from one endpoint,both endpoints must terminate the connection.It can be terminated by completing the following steps:
- Host1:To close the VPN tunnel from host1,enter the following: ipsec auto --down host-to-host
- Host2:To close the VPN tunnel from host2,enter the same command: ipsec auto --down host-to-host www.syngress.com
138_linux_08 6/20/01 9:46 AM Page 439 Creating Virtual Private Networks • Chapter 8 439 Summary In this chapter,you learned how it is possible to deploy secure authentication and strong encryption to establish network security using virtual private networks (VPNs).A VPN provides a private data network over public telecommunication infrastructures,such as the Internet.It provides both secure authentication and encryption.It creates a data tunnel between devices so that all data transmitted between the devices is secure,regardless of what programs the devices are run- ning.There are three basic types of VPN solutions:telecommuter,router-to- router,and host-to-host. A tunnel is created between VPN hosts to ensure that all traffic between them is secure.The tunnel is created with a tunneling protocol.These protocols are responsible for encapsulating a data packet before a host transmits it.After the data is encapsulated,it is sent over the Internet until it arrives at its destination.When it arrives,the capsule is removed and the destination host processes the data. IPSec is an Internet Engineering Task Force (IETF) security protocol that is becoming a standard component of VPN tunneling protocols.As the name sug- gests,it was designed for IP,and it has gained wide industry support.IPSec pro- vides secure authentication and encryption over a network by securing all packets at Layer 3—the network layer—of the Open System Interconnection (OSI) model.Layer 3 security is significant because Layer 3 is responsible for IP addressing and routing over the Internet.Security at this layer ensures that every- thing on the network is secure. IPSec is often used in conjunction with the Internet Key Exchange (IKE) protocol.IKE is a key management protocol standard that enhances IPSec,such as providing a simpler IPSec configuration,flexibility,and more features.IKE is not required to run IPSec,but it enhances the standard. Free Secure Wide Area Network (FreeS/WAN) is a Linux VPN implementa- tion that uses IPSec and IKE.IPSec and IKE are used to provide secure authenti- cation and encryption of data between two hosts at Layer 3 (the network layer) of the OSI model.FreeS/WAN creates a secure VPN tunnel between the hosts.It is the goal of S/WAN developers for all S/WAN implementations to interop- erate,no matter what device they are installed on.The FreeS/WAN project goal is to provide freely available source code to promote IPSec and allow it to run on many different machines.It also avoids export restrictions. Last,you learned how to compile FreeS/WAN into a Linux kernel and dis- covered how to configure and test a host-to-host VPN.You captured the traffic transmitted in the VPN tunnel and realized that it would be useless to a hacker www.syngress.com
138_linux_08 6/20/01 9:46 AM Page 440 440 Chapter 8 • Creating Virtual Private Networks because it is encrypted.When the VPN tunnel is configured,all traffic between the two hosts is encrypted,regardless of the applications running between the hosts. Solutions Fast Track Secure Tunneling with VPNs (cid:59) VPNs provide a private data network over public telecommunication infrastructures,such as the Internet,by providing authentication and encryption through a data “tunnel”between devices.All data transmitted between the devices through the tunnel is secure,regardless of what pro- grams the devices are running. (cid:59) Telecommuter,router-to-router,and host-to-host are three the basic types of VPN solutions.The solution you choose will depend on your specific needs. (cid:59) Tunneling protocols are responsible for encapsulating a data packet before a host transmits it.The data is encapsulated and sent over the net- work to its destination.Upon arrival,the capsule is removed and the data is processed by the destination host.IP tunneling protocols are powerful because they can transmit foreign protocols over the Internet. Explaining the IP Security Architecture (cid:59) IPSec is an Internet Engineering Task Force (IETF) security protocol that is becoming a standard component of VPN tunneling protocols. (cid:59) IPSec secures all packets at Layer 3 (the network layer) of the OSI model by providing secure authentication and encryption over a network.Layer 3 security ensures that everything on the network is secure,such as IP addressing and routing over the Internet,as well as all application data. Creating a VPN by Using FreeS/WAN (cid:59) FreeS/WAN is a Linux VPN implementation that uses IPSec and IKE. (cid:59) IKE is a key management protocol standard that enhances IPSec.It pro- vides enhancements such as simplifying IPSec configuration and adding www.syngress.com
138_linux_08 6/20/01 9:46 AM Page 441 Creating Virtual Private Networks • Chapter 8 441 flexibility and more features.It is not required for IPSec,but is often used in conjunction with it.FreeS/WAN uses Pluto,which is an IKE daemon. (cid:59) The Authentication Header (AH) performs authentication at the packet level in IPSec.The Encapsulating Security Payload (ESP) performs encryption as well as authentication.FreeS/WAN uses the Kernel IPSec (KLIPS) to perform AH and ESP functions. Frequently Asked Questions The following Frequently Asked Questions, answered by the authors of this book, are designed to both measure your understanding of the concepts presented in this chapter and to assist you with real-life implementation of these concepts. To have your questions about this chapter answered by the author, browse to www.syngress.com/solutions and click on the “Ask the Author” form. Q: I had great difficulty installing FreeS/WAN.Does a simpler solution exist for an IPSec gateway? A: The FreeS/WAN program is included in several Linux distributions and var- ious firewall packages.Installation procedures for these products would incor- porate FreeS/WAN functionality in your system.Depending on your needs and budget,you may save yourself time and trouble by acquiring FreeS/WAN through one of these alternate sources. Some available script sets are designed to allow you to manage firewalls that also serve as FreeS/WAN IPSec gateways.You can implement FreeS/WAN through these programs. Some countries other than the United States have more reasonable encryption laws and thus offer some general-purpose Linux distributions that include FreeS/WAN as well,such as the following: (cid:2) Corel Linux (the server edition from Canada) (cid:2) Conectiva (from Brazil) (cid:2) Polish(ed) Linux Distribution (from Poland) (cid:2) SuSE Linux (European versions from Germany) (cid:2) Trustix Secure Linux (from Norway) www.syngress.com
138_linux_08 6/20/01 9:46 AM Page 442 442 Chapter 8 • Creating Virtual Private Networks You can also use one of the specialized distributions for firewall or router applications.These products offer various alternatives that include FreeS/ WAN.Here are a few: (cid:2) Astaro Security Linux This freeS/WAN configuration is included among the Web-based firewall management tools. (cid:2) Gibraltar This Debian GNU/Linux-based distribution can be booted from a CD-ROM and can be used without a hard disk. (cid:2) Linux Router Project This freeS/WAN packaged for LRP is available from the LRP site hosted by Charles Steinkuehler.This distribution can be booted from a floppy disk. Q: Can FreeS/WAN interoperate with other versions of IPSec? A: Any IPSec implementations should be able to communicate with others, because the protocols that support IPSec are designed to allow interoperation. However,IPSec protocols are very complex,and therefore difficulties can arise whenever you attempt interoperation with other programs. Many IPSec implementations can interoperate with Linux FreeS/WAN; FreeS/WAN can even interoperate with previous versions of itself.You can use existing configuration files for newer FreeS/WAN versions in the same series (for example,all versions 1.x).With the impending release of FreeS/WAN 2.0,you will need to use the new configuration files.Table 8.7 lists IPSec implementations that interoperate well with Linux FreeS/WAN. Table 8.7 IPSec Implementations that Interoperate with FreeS/WAN Older Versions of FreeS/WAN PGP Mac and Windows IPSEC Client OpenBSD IRE Safenet/SoftPK FreeBSD Borderware NetBSD Freegate Cisco Routers Timestep Nortel (Bay Networks) Contivity Switch Shiva/Intel LANrover Raptor Firewall Sun Solaris Gauntlet Firewall GVPN Sonicwall Checkpoint Firewall-1 Radguard Continued www.syngress.com
138_linux_08 6/20/01 9:46 AM Page 443 Creating Virtual Private Networks • Chapter 8 443 Table 8.7 Continued Older Versions of FreeS/WAN PGP Mac and Windows IPSEC Client F-Secure VPN for Windows Windows Clients Watchguard Windows 2000 Xedia Access Point/QVPN Q:When I compile FreeS/WAN,I get the error gmp.h:No such file or directory. Why? A: The gmp.h error occurs if Pluto cannot locate the GNU Multi-Precision (GMP) library.The GMP library enables Pluto to calculate large numbers for public-key encryption operations.Pluto will not compile until the GMP library is installed. Two RPMs are usually required for GMP installation:libgmp and libgmp-devel.Most distributions provide the GMP library.You can obtain the RPM files from the vendor’s site if they are not included on your distribution CD-ROMs. The GMP home page (www.swox.com/gmp) offers the latest version and information regarding the GMP library. Q: What type of DES encryption does FreeS/WAN offer? A: The IPSec standard includes DES support,however DES is not considered adequately secure by the developers of the FreeS/WAN program.Because DES methods are not reliable,FreeS/WAN does not use DES to build con- nections (at the IPSec level) or to negotiate connections (at the IKE level). FreeS/WAN delivers a higher level of security by using the Triple DES (3DES) algorithm instead. Q: Which versions of Linux are compatible with FreeS/WAN? A: FreeS/WAN is designed to run on any CPU that Linux supports.Although most distributions will require some minor adjustments for the specific envi- ronment,the program is widely adaptable beyond the Red Hat versions (on which FreeS/WAN is created and tested).As previously discussed in this section,some applications and packages include FreeS/WAN in their distributions.You can visit www.freeswan.org/freeswan_trees/freeswan-1.9/ doc/otherdist to consult the FreeS/WAN compatibility document for more information. www.syngress.com
138_linux_08 6/20/01 9:46 AM Page 444
138_linux_09 6/20/01 9:48 AM Page 445 Chapter 9 Implementing a Firewall with Ipchains and Iptables Solutions in this chapter: (cid:2) Understanding the Need for a Firewall (cid:2) Deploying IP Forwarding and Masquerading (cid:2) Configuring Your Firewall to Filter Network Packets (cid:2) Understanding Tables and Chains in a Linux Firewall (cid:2) Logging Packets at the Firewall (cid:2) Configuring a Firewall (cid:2) Counting Bandwidth Usage (cid:2) Using and Obtaining Automated Firewall Scripts and Graphical Firewall Utilities (cid:59) Summary (cid:59) Solutions Fast Track (cid:59) Frequently Asked Questions 445
138_linux_09 6/20/01 9:48 AM Page 446 446 Chapter 9 • Implementing a Firewall with Ipchains and Iptables Introduction Thus far,you have seen how to further secure your network by enhancing net- work authentication and encrypting transmissions.However,even the best authentication and encryption schemes in the world cannot protect a system from scanning attacks,or from applications designed to flood hosts with bogus network packets.Distributed denial-of-service (DDoS) attacks such as those waged by Tribe Flood Network 2000 (TFN2K) and others can instantly flood a network with Internet Control Message Protocol (ICMP),Transmission Control Protocol (TCP),and User Datagram Protocol (UDP) packets,effectively disabling all network hosts.You still need to establish a network perimeter,which means that you need a firewall. Fortunately,the open source community has excelled in creating firewall soft- ware that is ideally suited for networks of any size.Linux natively supports the ability to route and/or filter packets.Modern Linux systems use either Ipchains or Iptables to do this.Ipchains supports Linux kernel versions up to 2.2.If you are using any kernel newer than 2.2 (i.e.,the experimental 2.3 kernel,or the stable 2.4 kernel),you must use Iptables.The Iptables package supports packet masquerading and filtering functionality as found in the 2.3 kernel and later.This functionality is known as netfilter.Therefore,in order to use Iptables,you must recompile the kernel so that netfilter is installed,and you must also install the Iptables package.RPMs for Ipchains and Iptables can be found on the that accompanies this book.The file names are ipchains-1.3.9-17.i386.rpm and iptables-1.2.1a-1.i386.rpm.You can obtain newer versions from www.rpmfind.net. NOTE Ipfwadm is the precursor to both Ipchains and Iptables. Because it is used in older Linux kernels, this chapter does not consider it. Depending on your kernel version,you can use these applications to con- figure your Linux system to act as a router,which means that it ensures packets get sent from one network to another.At this level,a Linux router does not examine or filter any traffic.It simply ensures that all traffic addressed to a remote network gets sent to it. Ipchains and Iptables also allow you to configure your Linux router to mas- querade traffic (i.e.,to rewrite IP headers so that a packet appears to originate www.syngress.com
138_linux_09 6/20/01 9:48 AM Page 447 Implementing a Firewall with Ipchains and Iptables • Chapter 9 447 from a certain host),or to examine and block traffic.It is even possible to con- figure your Linux router to do both.The practice of examining and blocking traffic is often called packet filtering.In this chapter,you will learn how to invoke packet filtering on your Linux system. A packet filter works at the Network layer of the Open System Interconnection Reference Model (OSI/RM).Daemons such as Squid (www.squid-cache.org) also allow you to examine and block traffic.However, Squid is not a packet filter;it is a proxy server,which is designed to operate at the Application layer of the OSI/RM.The primary difference between a packet filtering router (e.g.,one created by using Ipchains or Iptables) and a proxy server (e.g.,one enabled by Squid) is that a packet filtering router does not inspect net- work packets as deeply as a proxy server does.However,proxy servers require more system resources in order to process network packets.As a result,a proxy server can sometimes be slow when honoring requests,especially if the machine is not powerful enough.This is why packet filters and proxy servers are both nec- essary in a network:one (the packet filter) blocks and filters the majority of net- work traffic,and the proxy server inspects only certain traffic types.You will learn more about Squid in Chapter 10. In this chapter,you will learn how to configure a system as a simple router and how to implement complex packet filtering so that you can protect your network from various attacks. Understanding the Need for a Firewall Regardless of whether you are implementing a packet filter or a proxy server,a firewall provides several services.The most essential Linux firewall functions include: (cid:2) IP address conservation and traffic forwarding Many firewalls first act as routers so that different networks (i.e.,the 192.168.1.1/24 and 10.100.100.0/24 networks) can communicate with each other.Many network administrators use only this function to help create additional subnets.This feature is included as a firewall element simply because it is accomplished using either Ipchains or Iptables.Thus,anyone with only one IP address can create a local area network (LAN) or wide area net- work (WAN) that has full access to the Internet.You should understand, however,that a firewall does not necessarily have to provide Network Address Translation (NAT).Still,many firewalls (including those pro- vided by Linux and Ipchains/Iptables) allow you to choose this feature. www.syngress.com
138_linux_09 6/20/01 9:48 AM Page 448 448 Chapter 9 • Implementing a Firewall with Ipchains and Iptables (cid:2) Network differentiation A firewall is the primary means of creating a boundary between your network and any other network.Because it cre- ates a clear distinction between networks,a firewall helps you manage traffic.A firewall does not necessarily need to be deployed between a trusted,private network and the Internet.Many times,a firewall is deployed within a company network to further differentiate certain company divisions (such as research and development or accounting) from the rest of the network. (cid:2) Protection against denial-of-service (DoS), scanning, and sniffing attacks A firewall acts as a single point that monitors incoming and outgoing traffic.It is possible for this firewall to limit any traffic that you choose. (cid:2) IP and port filtering The ability to allow or reject a connection based on IP address and port.Such filtering is likely the most understood function of a firewall.Generally,this type of filtering is usually accom- plished by packet filters (i.e.,Linux systems that use either Ipchains or Iptables).Packet filtering can become quite complex,because you must always consider that traffic can be filtered according to the source of the packet,as well as the packet’s destination.For example,a packet filter can block traffic to your network if it originates from a particular IP address and port. (cid:2) Content filtering Proxy servers are generally the only types of firewall that manages and controls traffic by inspecting URL and page content.If configured properly,a proxy-oriented firewall can identify and block content that you consider objectionable. (cid:2) Packet redirection Sometimes,it is necessary for a firewall to send traffic to another port or another host altogether.For example,suppose that you have installed Squid proxy server on a separate host than your firewall.It is likely that you will want to have your firewall automatically forward all traffic sent to ports 80 and 443 (the standard HTTP and HTTPS ports) to your proxy server for additional processing. (cid:2) Enhanced authentication and encryption A firewall has the ability to authenticate users,and encrypt transmissions between itself and the firewall of another network. (cid:2) Supplemented logging One of the most important—though com- monly ignored—benefits of a firewall is that it allows you to examine all www.syngress.com
138_linux_09 6/20/01 9:48 AM Page 449 Implementing a Firewall with Ipchains and Iptables • Chapter 9 449 details about network packets that pass through it.You can learn,for example,about port scans and various connections to your system. A firewall is the most efficient means of reducing scanning threats.In Chapter 4 you learned how network and host-based IDS applications help detect and thwart host scanning.However,an IDS is primarily meant to monitor internal network transmissions,and cannot protect the network as a firewall.This is because a firewall acts as a centralized point that can block or allow incoming and outgoing traffic. With a firewall in place,you can effectively use one system to protect hun- dreds of other systems from scanning,sniffing,and DoS attacks.Of course,it is possible to use multiple firewalls in a network,but in general,as soon as you place your network hosts behind an adequately configured firewall,a hacker on the other side of the firewall will have to resort to alternative strategies in order to manipulate internal network hosts. Building a Personal Firewall It is possible to use Ipchains or Iptables on a standard client system.You have already seen an example of this in Chapter 4,where PortSentry used Ipchains to block all connections to a host that had illicitly scanned the system.A personal firewall can be helpful in the following situations: (cid:2) You have only one system directly connected to the Internet,and don’t want to create a router or a firewall as an intervening host. (cid:2) You want to log all blocked (or even allowed) traffic,and then read the entries in the /var/log/messages file. (cid:2) You want to block certain ports,such as those belonging to X (177 tcp and 177 udp,and tcp ports 6000 and 7100). (cid:2) You want to disable all pinging on the host.If you don’t want to use Ipchains,you can change the value of /proc/sys/net/ipv4/ icmp_echo_ignore_all to 1 using: echo "1" > /proc/sys/net/ipv4/icmp_echo_ignore_all. When it comes to building any type of firewall,it is important to consider your own situation.The commands you learn in the next section will help you implement the proper solution. www.syngress.com
138_linux_09 6/20/01 9:48 AM Page 450 450 Chapter 9 • Implementing a Firewall with Ipchains and Iptables Understanding Packet Filtering Terminology Table 9.1 provides a list of common terms used when configuring a Linux firewall. Table 9.1 Common Firewall Terminology Term Description Operating system Locking down all unnecessary ports and services so hardening that the firewall is as impregnable as possible. Interface A network interface card (NIC). Most firewalls have multiple NICs, which you must properly configure in order to filter traffic. Linux refers to the first interface as eth0, the second as eth1, the third as eth2, and so forth. Multihomed A host that has at least two interfaces. Generally, one interface is exposed to a public network, and one interface is open only to the trusted network. This way, the router or firewall is able to forward packets on the Internet. Ingress Traffic coming into a network host or interface. Egress Traffic coming out of a network host or interface. Rule An entry in the firewall database that determines how an IP packet will be handled. If an IP packet matches a particular rule, then the packet can, for example, be dropped. However, a firewall can do more than simply drop a packet. A firewall can also forward a packet to another host or port, or it can forward a packet to another rule for processing. Source IP address The IP address where a packet was created. A firewall reads this address in a packet to help determine which of its rules apply. Source port The port where a packet was created. The source port is almost always associated with the source IP address. Destination IP address The IP address of the host to which a packet is addressed. As with the source IP address, a firewall reads this address in a packet to help determine how to apply a rule. Destination port The port where the IP packet is supposed to be delivered. The destination port is almost always associated with the destination IP address. Continued www.syngress.com
138_linux_09 6/20/01 9:48 AM Page 451 Implementing a Firewall with Ipchains and Iptables • Chapter 9 451 Table 9.1 Continued Term Description Private IP addresses In order to conserve IP addresses, the Internet Engineering Task Force (IETF) has established the following IP network addresses as “private.” This means that the following networks are meant to be used behind firewalls and routers: 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 Although it is possible to route these protocols using a Linux router, Internet routers will not forward packets marked with these IP addresses. You will need to masquerade these connections or use NAT/Port Address Translation (NAT/PAT) if you want to forward traffic from private networks to the Internet. Masquerading The ability to change a packet’s source or destination IP address so that it can be routed to the Internet. Generally,whenever a packet passes through a firewall,it is compared to its rules.If a packet matches a rule,then the firewall processes the packet.Ipchains gets its name from the fact that it connects each of its rules in an order,much like connecting links in a chain.Whenever a packet enters a chain in Ipchains,it must pass all the way through before the kernel allows it to pass on to the oper- ating system,or pass through to another host.Iptables uses a similar principle, except that it allows you to create specific tables that can be either processed or ignored,making the packet-filtering process quicker and more efficient.Iptables will likely become the standard for some time.Now that you understand some of the basic firewall terms,it is time to learn more about the most common uses of a Linux system in regard to routing and firewalling. NOTE Many times, a router can be a completely separate host from the fire- wall. This is especially the case in medium to large networks, where it is necessary to balance the load between the two. However, routers com- monly have features that allow you to program them as a packet filter. Linux is a particularly handy tool because it allows you to do both simple routing and packet filtering. www.syngress.com
138_linux_09 6/20/01 9:48 AM Page 452 452 Chapter 9 • Implementing a Firewall with Ipchains and Iptables Choosing a Linux Firewall Machine Contrary to what you may think,a firewall does not necessarily have to be the most powerful system on your network.It should,however,be a dedicated host, which means that you should not run any other services.The last thing you want to do is configure your firewall to also be a Samba server or print server. Additional services may cause a performance drain,and may open up vulnerabili- ties as well. Ideally,a small network would be well served by a typical Pentium III or Pentium IV system with 128MB of RAM and a 500MHz processor.Depending on the amount of traffic the network generates,however,you could get by with a much less powerful system.It is not uncommon to see a network with 25 systems accessing the Internet using a Linux router that is no more powerful than a low- end 300MHz system.A good NIC is vital for firewalls and routers. Larger businesses,say,those with demands for Web surfing,e-mail retrieval, and additional protocols,may require a more powerful system.Considerations for more powerful systems might include: (cid:2) A 1GHZ processor. (cid:2) At least 256MB of RAM (512MB of RAM or more may be preferable). (cid:2) Quality network interfaces and I/O cards,and possibly RAID 0 for faster data processing.RAID 0 does not provide data redundancy.It does,however,provide you with faster read/write time,which is helpful in regard to a firewall.Although a firewall does not store data as would a database application server,fast I/O is important,because you want the machine to process data as quickly as possible.Fast I/O is especially important if you plan to log extensive amounts of data. (cid:2) SCSI hard drives.SCSI systems tend to be faster and longer lasting than their IDE counterparts,thus allowing you a more powerful firewall. Protecting the Firewall One of the benefits of having a firewall is that it provides a single point that pro- cesses incoming and outgoing traffic.However,consider that a firewall can also provide a central point of attack or failure.A firewall does inform a hacker that a series of networks does exist behind it.If a hacker is able to defeat this one fire- wall,the entire network would be open to attack.Furthermore,if a hacker were able to somehow disable this host,the entire network would be denied all www.syngress.com
138_linux_09 6/20/01 9:48 AM Page 453 Implementing a Firewall with Ipchains and Iptables • Chapter 9 453 Internet services.It is important,therefore,that you take measures to protect your firewall.Consider the following options: (cid:2) Limit router and firewall access to interactive login only,and physically secure the system.This way,your firewall is much less susceptible to remote attack.It is still possible,however,that problems in the kernel (e.g.,buffer overflows and other programming problems) may occur. Such problems can lead to compromise of the system,even if you have no other services running. (cid:2) If remote access is necessary,consider using access only via Secure Shell (SSH),properly configured to use public keys to authenticate.Although SSH is not immune to security threats,it is one of the most popular and secure remote administration tools for Linux firewalls. (cid:2) Create a backup host:If your host crashes due to an attack,or simply because of a hard drive failure,you should have an identical system avail- able as a replacement. (cid:2) Monitor the host:Use an IDS application to listen in on connections made to your router.Usually,installing an IDS application on a separate host on the network is best.This is called passive monitoring,because the remote host does not consume the system resources of the firewall.The IDS application can,for example,send a random ping to the firewall to test whether it is up,and can then inform you if the host is down. Consider using an application such as Cheops,for example. (cid:2) Watch for bug reports concerning Ipchains,Iptables,and the Linux kernel.Keeping current about such changes can help you quickly upgrade your system in case a problem is discovered. Deploying IP Forwarding and Masquerading IP forwarding is the ability for a Linux system to act as a router.Packets enter the Linux kernel,and are then processed by the operating system.Follow these steps to make your Linux operating system act as a simple IP forwarder:
- Install at least two NICs into your system.This is necessary,because your Linux system will then be able to service two different networks.You www.syngress.com
138_linux_09 6/20/01 9:48 AM Page 454 454 Chapter 9 • Implementing a Firewall with Ipchains and Iptables must,of course,have all of the required cables and hubs to allow systems to use all of the available network hosts. 2. Issue the following command at a terminal: echo "1" > /proc/sys/net/ipv4/ip_forward This command enables IP forwarding on your Linux router. Entering the preceding command into some sort of file that runs when- ever the system boots up.This way,if you restart your system,IP for- warding will be enabled by default.You can create your own file,or you can enter it at the bottom of the /etc/rc.d/rc.local file. 3. You can verify whether your system is acting as a router (i.e.,IP for- warder) by issuing the following command: cat /proc/sys/net/ipv4/ip_forward 1 host # If it reads 1,then your system is now acting as a router.A value of 0 means that your Linux system is not routing. The main thing to remember is that a Linux system with simple IP forwarding enabled can route any network address to another.If you are allotted a range of IP addresses from a local or regional Internet registry,you can use a multihomed Linux system to route this set of addresses to another network.For example,if you are allotted the 128.187.22.0/24 block of IP addresses,you can use a Linux router to route this network to the 221.9.3.0 network,or to any other. NOTE An Internet registry is the local distribution point for IP addresses. Operating on the authority of the Internet Corporation for Assigned Numbers (ICANN, at www.icann.org), these bodies ensure that IP addresses are meted out properly. If you live in the United States, the American Registry for Internet Numbers (ARIN, at www.arin.net) is the body to contact. European countries obtain IP addresses from the Réseaux IP Européens (RIPE, at www.ripe.net/ripe), and the Asia Pacific region uses the Asia Pacific Network Information Center (APNIC, at www.apnic.net). www.syngress.com
138_linux_09 6/20/01 9:48 AM Page 455 Implementing a Firewall with Ipchains and Iptables • Chapter 9 455 However,Internet routers will not forward traffic from private IP addresses (i.e.,any network address of 10.0.0.0/8,172.16.0.0/12,or 192.168.0.0/16). Figure 9.1,for example,shows how traffic from the 10.1.2.0 network and the 192.168.1.0 network can reach all networks,including the 128.187.22.0 network. However,only traffic from the 128.187.22.0 can reach the Internet. Figure 9.1 A Linux System Configured as a Forwarding Router Client Host Although all the networks in the LAN can access each other only the 128.187.22.0 can access the Internet. The 10.1.2.0 Network Linux Router with Only IP Forwarding Enabled Client Host Client Host The 128.187.22.0 Network The 192.168.1.0 Network Client Host Client Host Client Host Client Host Client Host Client Host Internet Figure 9.1 shows that traffic from the 10.1.2.0 and 192.168.1.0 networks cannot reach hosts across the Internet,only because the Internet routers will simply drop the traffic.To allow private network addresses to reach the Internet, you need to invoke Ipchains/Iptables-based IP masquerading.However,you have at least two solutions available to you: (cid:2) Place a proxy server on the network that has at least two NICs This proxy server can be configured to accept requests from the internal network and forward them to the outside network.The first NIC must be internal,because it will receive traffic passing from inside the net- work.The second NIC must be external,and will pass internal traffic to the outside world,and will also receive outside traffic so that it can be routed to the internal network.Another way of explaining this concept www.syngress.com
138_linux_09 6/20/01 9:48 AM Page 456 456 Chapter 9 • Implementing a Firewall with Ipchains and Iptables is that the proxy server receives egress traffic (i.e.,traffic passing outside of the private IP address networks) and uses an Internet-routable IP address to forward the packets.The proxy server can also receive ingress traffic and translate it so that internal systems can receive it.This option requires the use of an additional software daemon,such as Squid. (cid:2) Enable IP masquerading In a Linux router,you can use either Ipchains or Iptables to forward and/or alter the IP headers of packets originating from private IP address networks to pass through Internet routers.Both Ipchains and Iptables do this by processing IP packets through the Linux kernel.As long as the client hosts are configured to use your Linux router as their default gateway,the clients will be able to access any and all Internet services,including ping,traceroute,Telnet, FTP,e-mail (SMTP and POP3),and Web client traffic (ports 80 and 443).This is because the Linux system “mangles”the packets to make them appear as if they originated from a legitimate IP address,and then sends them on their way.You should note that this option is not neces- sarily secure—IP masquerading leaves all client hosts wide open to attack.If a hacker can attach to your Linux router using Telnet,for example,he or she can then directly access your systems.You will learn about how you can use Ipchains and Iptables to create firewall rules shortly. We will focus on the second option:Enable IP masquerading. Masquerading Masquerading is when your Linux system rewrites the IP headers of a network packet so that the packet appears to originate from a different host.Once the IP header has been rewritten to a nonprivate IP address,it can then be rerouted over the Internet.The practice of rewriting IP packets is colloquially known as packet mangling,because it alters the contents of the packet.Masquerading is useful because you can use it to invoke NAT,where one IP address can stand in for several. As shown in Figure 9.2,masquerading allows the Linux-based system to translate the 10.1.2.0 network in to the Internet-addressable IP address of 66.1.5.0. Once the private network of 10.1.2.0 is masqueraded as the IP address of 66.1.5.1,all hosts on this network can access the Internet.Depending on the subnet mask used for the 10.1.2.0 network,this means that hundreds and perhaps even thousands of client hosts can be masqueraded under this one IP address. www.syngress.com
138_linux_09 6/20/01 9:48 AM Page 457 Implementing a Firewall with Ipchains and Iptables • Chapter 9 457 Figure 9.2 Masquerading the 10.1.2.0 Network as the 66.1.5.1 IP Address Client Host Linux-Based Router with Masquerading Enabled The 10.1.2.0 Network 10.1.2.0 66.1.5.1 Client Host Client Host All private-IP client hosts can access the Internet, due to IP masquerading. Internet Translating the private to routable Internet address is accomplished by a database stored on the Ipchains/Iptables-based Linux router.The Linux mas- querading router keeps this database so that it knows how to “untranslate,”as it were,the packets that have been mangled so that they can then be addressed to the local,private network.This process occurs very quickly,although it is impor- tant that you have the proper amount of system power to enable the translation database to do its jobs. NOTE Ipchains-based NAT is not compatible with Microsoft Point-to-Point Tunneling Protocol (PPTP) VPN clients. Not surprisingly, Microsoft did not follow RFC-defined standards. Not only did they not follow RFCs, but their PPTP is also plagued by a number of design vulnerabilities that affect security. You can, if you want, find workarounds to provide IPSec and VPN support between your Linux system and Microsoft VPN-enabled systems at www.impsec.org/linux/masquerade/ip_masq_vpn.html. www.syngress.com
138_linux_09 6/20/01 9:48 AM Page 458 458 Chapter 9 • Implementing a Firewall with Ipchains and Iptables Simple masquerading leaves the network “wide open,”meaning that anyone who enters your firewall or router as a default gateway can have full access to all attached networks.Packet filtering is the answer to locking down access to your network.You can learn more about masquerading by reading the NAT-HOWTO file,which can be found on the accompanying CD. Configuring Your Firewall to Filter Network Packets Creating packet-filtering rules can become somewhat involved,mainly because you have to spend a great deal of time determining the source and destination IP addresses and ports.You also need to be familiar with how connections are made, managed,and ended.However,there are some simple rules that can help you create a packet filter as soon as possible.As far as outgoing traffic is concerned, you should take the following steps:
- Configure your Linux firewall to deny all outgoing traffic unless explicitly allowed.This means that your firewall will deny all services to your end users,unless you allow it by creating a rule allowing a specific traffic type.
- Configure your firewall to allow your internal network to use ports over 1023.Most network clients use these ports to establish connections to network services.
- Identify the ports of your services to which you want to allow access.If, for example,you want to allow end users to access the Web,you must create a rule allowing all local network hosts to access all remote systems at ports 80 and 443.Likewise,if you want your local clients to use remote POP3 servers,you will have to allow local hosts to use access remote systems at port 110. As far as incoming traffic is concerned,you have many options.Many systems administrators want to create a firewall that forbids all incoming traffic,except for the TCP and UDP packets necessary when building up and tearing down a net- work connection.For example,if you want to allow internal clients to allow access to the Web,you will need to allow remote hosts to make connections to your firewall.This involves allowing remote hosts to open up their local ports above 1023 to access your systems at ports above 1023.Therefore,you should take the following steps: www.syngress.com
138_linux_09 6/20/01 9:48 AM Page 459 Implementing a Firewall with Ipchains and Iptables • Chapter 9 459
- Configure your firewall to prohibit all incoming traffic from accessing any services below port 1023.The most secure firewall will not allow any connections to these ports.
- Forbid all incoming traffic unless it is part of an already established ses- sion.In Ipchains,the -y option will do this.In Iptables,you would use the --SYN option.Each of these options will have the firewall match and discard any incoming packet with the SYN bit set.All other packets with the FIN or ACK bit set will be allowed,because the firewall assumes that these packets are part of an already established session (e.g., an internal user is closing an SMTP or POP3 session with a remote host on the Internet).If you do not add this rule,then it is easier for mali- cious users to get around your firewall.
- Disable all incoming ICMP traffic to protect yourself against DoS attacks.This step is optional,of course,because disabling this feature often makes network troubleshooting quite difficult.
- Disable all forwarding except for networks that require it.The Ipchains and Iptables commands allow you to masquerade private IP networks. You want to,however,masquerade only certain networks.
- To enable logging,use the -l option in Ipchains,or the -j LOG target in Iptables. Damage & Defense… Customized Packet Filtering Your firewall configuration needs will be specific to your situation. You need to consider the design of your network, and the services you need to provide. If, for example, you want to allow remote clients to access certain internal hosts, such as a Web server, you can place the Web server outside of the firewall, or you can allow incoming traffic to access port 80. Consider, however, that if you place your Web server behind your firewall, you will have to ensure that this request is then forwarded to a specific internal host. Later in this chapter, you will see how you can manipulate the default INPUT, FORWARD, and OUTPUT chains using Ipchains and Iptables. Continued www.syngress.com
138_linux_09 6/20/01 9:48 AM Page 460 460 Chapter 9 • Implementing a Firewall with Ipchains and Iptables It is common practice to use packet filtering to block the following: (cid:2) Incoming and outgoing ICMP packets (cid:2) Access to remote POP3 servers (cid:2) Access to remote SMTP servers (cid:2) Access to the Web, or to certain sites (unproductive or offen- sive sites) (cid:2) Access to additional remote TCP/IP services, such as Telnet, FTP, finger, and so forth Configuring the Kernel Most Linux operating systems,such as Red Hat,Slackware,SuSE,and Caldera, support IP forwarding,masquerading,and firewalling by default.However,you may have to reconfigure your kernel in order to provide full functionality.When recompiling the kernel,choose the following option in the Networking section: Network packet filtering (replaces Ipchains).In the 2.2 and earlier kernels, check the following Networking options: (cid:2) Network firewalls (cid:2) TCP/IP networking (cid:2) IP accounting Packet Accounting Packet accounting is the ability to summarize protocol usage on an IP network. For example,you can use this feature to list the amount of TCP,ICMP,and IP traffic that passes through your interfaces.Once you have recompiled the kernel and restarted your system,find out if the following file is present in the /proc virtual file system: /proc/net/ip_acct If the file exists,then your kernel supports IP accounting,in addition to all other features.Of course,you may want to check to see if this file exists before taking the time to recompile the kernel. www.syngress.com
138_linux_09 6/20/01 9:48 AM Page 461 Implementing a Firewall with Ipchains and Iptables • Chapter 9 461 Understanding Tables and Chains in a Linux Firewall Iptables derives its name from the three default tables it uses,which are listed in Table 9.2.Each interface on your system can have its packets managed and modi- fied by the chains contained in each of these tables. Table 9.2 Default Tables and Chains Table Name Default Chains Description Filter INPUT Enables you to filter out packets. FORWARD OUTPUT Nat PREROUTING Enables masquerading. OUTPUT POSTROUTING Mangle PREROUTING Allows you to further “mangle” packets OUTPUT by changing their contents. This feature, for example, allows you to shape packets so that they are ready for certain VPN clients, such as Microsoft PPTP. Iptables is an extension of Ipchains,because Iptables adds the nat and mangle tables.Ipchains uses only the three chains listed in the filter table in Table 9.2. Thus,with Ipchains,you have access to only the INPUT,FORWARD,and OUTPUT options.If you want to masquerade using Ipchains,you will use the --masquerading option for the FORWARD chain.In Iptables,if you want to filter out packets using,you will use the filter table,and if you want to mas- querade packets,you will use the nat table.In Iptables,if you do not specify a table,it will default to the filter table.Now that you understand tables,it is important to understand the specific chains. A chain is a series of actions to take on a packet.Whenever you use Ipchains or Iptables to configure a firewall,the proper perspective to adopt is to view all packets from the firewall itself.Even more specifically,you should consider all packets from the perspective of the network interface,the table used,and the spe- cific chains.For example,if you are using the filter table,each interface on your network has three different default chains: www.syngress.com
138_linux_09 6/20/01 9:48 AM Page 462 462 Chapter 9 • Implementing a Firewall with Ipchains and Iptables (cid:2) INPUT Contains rules that determine what will be done with all packets that enter this specific interface (i.e.,eth0). (cid:2) FORWARD For the purposes of this chapter,contains rules that deter- mine if a packet will be masqueraded. (cid:2) OUTPUT Contains rules that determine filtering for packets leaving the interface. The nat and mangle tables contain two additional chain types.The PREROUTING chain alters packets when they enter the interface.The POSTROUTING chain is used for altering packets when they are ready to leave the host.The POSTROUTING chain is essential to masquerading connections. Built-In Targets and User-Defined Chains Ipchains and Iptables use built-in targets to specify the destination of a packet.By far,the most common built-in targets are DROP and ACCEPT.Table 9.3 describes each of these in detail.(Additional targets exist.You can read about them by consulting the Ipchains or Iptables man page.) Table 9.3 Common Ipchains and Iptables Targets Target Description DROP The packet is immediately discarded. The target of REJECT is also used. ACCEPT Allows the packet to pass through the rest of the chain. By default, all default chains are configured to allow any and all connections. User-defined chains are often useful if you want to create a large number of rule entries,but do not want a chain to become too long.Chains that become too long can slow down the packet,and are also difficult to read and organize. The following is a sequence where a user defined chain is created,modified,and then invoked: ipchains -N custom ipchains -A custom -s 0/0 -d 0/0 -p icmp -j REJECT ipchains -A input -s 0/0 -d 0/0 -j custom This is a trivial example,of course.The -A option “appends”a rule,meaning that it is placed at the beginning of a chain.The -I option adds the rule to the www.syngress.com
138_linux_09 6/20/01 9:48 AM Page 463 Implementing a Firewall with Ipchains and Iptables • Chapter 9 463 end of a chain.The user-defined rule of james is created,and then a rule drop- ping all ICMP packets is added to this custom chain.Then,a rule is added to the default input chain that all packets are processed by the custom chain.As a result, any and all ICMP packets will be dropped.If you were to make the mistake of forgetting to have the input chain refer to the chain named custom,then the custom chain would never be read. In Iptables,the equivalent of the preceding command sequence would be very similar (it is possible,of course,to create user-defined chains that are much more ambitious). ipchains -N custom ipchains -A custom -s 0/0 -d 0/0 -p icmp -j DROP ipchains -A input -s 0/0 -d 0/0 -j custom Specifying Interfaces If no interface is specified,the first interface (usually eth0) is assumed.If you have multiple interfaces,you must specify the interface you want to be added to the chain.Thus,in a multiple-NIC system,when you use the INPUT chain to deny all ICMP traffic,you must specify the interface.If,for example,you have a system with two interfaces that allowed all traffic,you would have to issue the following commands: ipchains -A input -i eth0 -s 0/0 -d 0/0 –p icmp –j REJECT ipchains -A input -i eth1 -s 0/0 -d 0/0 –p icmp –j REJECT Now,this system will not forward ICMP packets on either the eth0 or the eth1 interface.For Iptables,the commands would be as follows: iptables -A INPUT -i eth0 -s 0/0 -d 0/0 --protocol icmp --icmp-type echo-reply –j REJECT iptables -A INPUT -i eth1 -s 0/0 -d 0/0 --protocol icmp --icmp-type echo-reply –j REJECT In both Iptables and Ipchains,the FORWARD chain allows you to specify a source and destination interface.This is because the FORWARD chain is used to masquerade connections.Thus,the -i and -o options allow you mark packets passing between interfaces. www.syngress.com
138_linux_09 6/20/01 9:48 AM Page 464 464 Chapter 9 • Implementing a Firewall with Ipchains and Iptables Setting Policies Both Ipchains and Iptables default to accepting all connections.The safest option is to set the default policy to first deny all traffic.You can then create rules to explicitly allow certain traffic types.You can change this default stance using the -P option.For example,the following Ipchains command changes the default policy of the INPUT chain to deny: ipchains –P input DENY The following command does the same thing in Iptables: iptables –P input DROP To reset the policy to accept,you simply use the ACCEPT target. Listing Tables and Chains Once you generate Ipchains or Iptables rules,you can then list them.For example,the following Ipchains command would list all chains and rules: ipchains -L Iptables uses the same command: iptables -L You can,if you want,list specific chains: ipchains -L output Because Iptables allows you to modify three different tables,you can also list specific tables.To list all nat chains,you would issue the following command: iptables -t nat -L The following command would view only the POSTROUTING chain in the nat table: iptables -t nat -L POSTROUTING Consider the following output from the -L option in Iptables: iptables -L Chain INPUT (policy ACCEPT) target prot opt source destination custom icmp -- anywhere anywhere www.syngress.com
138_linux_09 6/20/01 9:48 AM Page 465 Implementing a Firewall with Ipchains and Iptables • Chapter 9 465 Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination Chain LD (0 references) target prot opt source destination Chain custom (1 references) target prot opt source destination DROP icmp -- anywhere anywhere This output shows that the INPUT chain of the filter table contains one rule. This rule does not block ICMP traffic.Rather,it specifies that all ICMP traffic will be handled by the custom chain.The custom chain,listed last,does the actual dropping of all ICMP packets sent to this host. The following commands allow you to list all of the rules by number: ipchains --line-numbers -L iptables --line-numbers -L Saving, Flushing, and Restoring Rules Once you have created rules in Ipchains or Iptables,you can save them using the following commands: /sbin/ipchains-save /sbin/iptables-save These commands are helpful for two reasons.First,you can save the tables and rules to a text file in order to study them.Second,backing up your rules is important,as it generally takes considerable time to create the “perfect”firewall for your situation,and you should keep a backup in case your firewall configura- tion somehow gets lost.To save your Iptables information to a text file,for example,you would issue the following command: /sbin/iptables-save > iptables.txt www.syngress.com
138_linux_09 6/20/01 9:48 AM Page 466 466 Chapter 9 • Implementing a Firewall with Ipchains and Iptables NOTE You should use a package later than Iptables 1.2.1a or later, because it allows you to use the ipchains-save option. Earlier packages did not have it. Red Hat 7.1 and later have a compatible version installed. To install the RPM package on older systems, you need to use the --nodeps option: rpm -ivh --nodeps iptables-1.2.1a-1.i386.rpm To flush any existing rules,you can use the -F option: ipchains -F iptables -F Used without arguments,this command will erase the contents of all rules in Ipchains,and all rules in the filter table of Iptables.To flush a specific chain,you would issue the following command(s): ipchains -F input iptables -F INPUT SECURITY ALERT! Many times, the -F option is used as a safety measure in firewall scripts. When used at the beginning of a script, it can ensure that the firewall begins its configuration from “ground zero,” rather than being appended to an existing firewall configuration. When creating a firewall script, make sure that you flush all of the necessary chains and tables. Otherwise, you may end up combining your configuration with an existing one, which could lead to connectivity or security problems. The -F option does not delete rules from either the nat or mangle tables in Ipchains,however.To delete information from a specific table,you have to specify the table as follows: iptables -t nat -F www.syngress.com
138_linux_09 6/20/01 9:48 AM Page 467 Implementing a Firewall with Ipchains and Iptables • Chapter 9 467 The -F function does not change a policy from DROP to ACCEPT,either. You must use the -P option,discussed earlier. In case you need to restore your backup information,you can use the following commands: ipchains-restore iptables-restore For example,to restore the Iptables rules database using the iptables.txt file created earlier,you would issue the following command: /sbin/iptables-restore iptables.txt By default,Ipchains-restore will append any restore information to any existing rules.You can use the -f option to flush out any existing rules,if you want. However,the Iptables-restore command automatically erases any existing Iptables rules whenever it is used.However,you can use the -n option,which appends the contents of the restore file to any existing rules. Using Ipchains to Masquerade Connections The Ipchains command has only one table,and three chains (INPUT, FORWARD,and OUTPUT).Using the FORWARD chain and the MASQ target,you can masquerade any IP address you wish.Suppose,for example,that you have a router that connects the 192.168.1.0/24 network and the 10.100.100.0/24 network.Suppose further that this firewall’s eth0 interface con- tains the internet-addressable IP address of 66.1.5.1/8.The following Ipchains command issued on the router would enable both private-IP networks to com- municate via the Internet: ipchains –A forward –I eth0 –s 192.168.1.0/24 –j MASQUERADE ipchains –A forward –I eth0 –s 10.100.100.0/24 –j MASQUERADE This rule specifies that any connection from the 192.168.1.0/24 and 10.100.100.0/24 networks will be masqueraded as 66.1.5.1/8 on eth0.The -A option adds the rule to the forward chain,and the -I option specifies the eth0 interface.The -s option specifies the networks in question. This particular configuration actually exposes the network.Any remote host would be able to use your masquerading firewall to access your host.The fol- lowing additions to the FORWARD chain of the filter table ensures that your masquerading router masquerades only for your internal network: www.syngress.com
138_linux_09 6/20/01 9:48 AM Page 468 468 Chapter 9 • Implementing a Firewall with Ipchains and Iptables ipchains –A forward –s 192.168.1.0/24 –j ACCEPT ipchains –A forward –d 192.168.1.0/24 –j ACCEPT ipchains –A forward –s 10.100.100.0/24 –j ACCEPT ipchains –A forward –d 10.100.100.0/24 –j ACCEPT ipchains –A forward –j DROP Iptables Masquerading Modules Many of the protocols you want to use on the Internet,such as FTP or RealAudio,require additional support.Iptables provides several modules that allow masqueraded clients to access these resources.Some of these are described in Table 9.4. Table 9.4 Ipchains Masquerading Modules Module Description ip_masq_ftp Module for masquerading FTP connections ip_masq_raudio RealAudio ip_masq_irc IRC ip_masq_vdolive For VDO Live ip_masq_cuseeme CU-See-Me Enabling these options requires that you use the /sbin/insmod command. For example,to enable the ip_masq_ftp and ip_masq_raudio modules,you would issue the following command: /sbin/insmod ip_masq_ftp /sbin/insmod ip_masq_raudio To automate this process,you can place these entries into a script,or into /etc/rc.local. Using Iptables to Masquerade Connections Using the same example of the 192.168.1.0/24 network and the 10.100.100.0/24 network connected by the firewall with the IP address of 66.1.5.1/8,you would use the following command: iptables –t nat –A POSTROUTING –d ! 192.168.1.0/22 –j MASQUERADE iptables –t nat –A POSTROUTING –d ! 10.100.100.0/24 –j MASQUERADE www.syngress.com
138_linux_09 6/20/01 9:48 AM Page 469 Implementing a Firewall with Ipchains and Iptables • Chapter 9 469 This rule is added to the nat table (-t),and is added to the POSTROUTING chain (-a).The ! mark tells netfilter/Iptables to masquerade all packets not des- tined for the internal networks.Specifically,it stipulates that if the packet is not sent to either the 192.168.1.0/22 or 10.100.100.0/24 network,then the packet needs to be modified so that it masquerades as the 66.1.5.1/8 IP address. Consequently,any packet that leaves the interface will be rewritten with the 66.1.5.1/8 address,but packets that stay on the internal network will not be rewritten.The eth0 interface is assumed by default.If,for some reason,you had to specify a different interface that has the Internet-routable address,you would use the -o option: iptables –t nat –o eth1 –A POSTROUTING –d ! 192.168.1.0/22 –j MASQUERADE iptables –t nat –o eth1 –A POSTROUTING –d ! 10.100.100.0/24 –j MASQUERADE As with Ipchains,this particular configuration leaves the network wide open. The following additions to the FORWARD chain of the filter table ensure that your masquerading router masquerades only for your internal network: iptables –A FORWARD –s 192.168.1.0/24 –j ACCEPT iptables –A FORWARD –d 192.168.1.0/24 –j ACCEPT iptables –A FORWARD –s 10.100.100.0/24 –j ACCEPT iptables –A FORWARD –d 10.100.100.0/24 –j ACCEPT iptables –A FORWARD –j DROP Notice the order of these entries.Both Ipchains and Iptables consider rules in strict order,which is why the preceding rules first accept certain packets and then drop all of the rest.If the final entry (iptables -A FORWARD -j DROP) were listed first,then all packets would be denied. NOTE Because both Ipchains and Iptables default to allowing any and all input, it is quite easy to create rules that inadvertently allow unwanted traffic to pass through. Some systems administrators prefer to first change the policy of all rules in all tables to deny. Doing so, however, will require you to add explicit rules to all affected chains so that your masquerading will work properly. www.syngress.com
138_linux_09 6/20/01 9:48 AM Page 470 470 Chapter 9 • Implementing a Firewall with Ipchains and Iptables Tools & Traps… Modem Banks: One Way Around Your Firewall One of the easiest ways to avoid a firewall is to find and exploit improp- erly configured modem banks. Many times, modems are configured to allow access to all areas of the network, and are often not protected or monitored very closely. As you establish your firewall, consider inspecting any and all systems for modems. You should approach your modem bank with the same care and consideration as you would your firewall. Even modems not configured to receive incoming calls can be a danger. Consider also that an end user who connects to another net- work through a modem may be opening up a security breach. For example, suppose that a user has mapped several drives mapped to a file server that contains sensitive information. If an end user connects regularly to a remote dial-up server, it is possible for a malicious user to discover this connection and gain access to the mapped drives, and hence to the sensitive information. Iptables Modules Table 9.5 lists some of the most commonly used modules for Iptables. Table 9.5 Iptables Masquerading Modules Module Description ipt_tables The module for Iptables support. As with all of these modules, it is possible to compile the kernel so that all of these modules are included. ipt_LOG Support for advanced logging, which includes the ability to log only initial bursts of traffic, and capture an certain amount of traffic over a period of time. ipt_mangle The IP masquerading module. ipt_nat The NAT module. You can load these modules using insmod.Iptables masquerades the FTP, RealAudio,and IRC protocols by default. www.syngress.com
138_linux_09 6/20/01 9:48 AM Page 471 Implementing a Firewall with Ipchains and Iptables • Chapter 9 471 Exercise: Masquerading Connections Using Ipchains or Iptables
- Configure your Linux system with at least two NICs.
- Enable IP forwarding using the instructions given earlier in this chapter.
- Using either Ipchains or Iptables,invoke masquerading for your IP addresses using the instructions given earlier in this chapter.
- Now,configure the FORWARD chain in the filter table (or just the FORWARD chain in Ipchains) so that it will masquerade only your internal hosts.
- If necessary,load the modules necessary to support FTP,IRC,and additional protocols.
- You will likely have to adjust your masquerading settings.Make sure that you save your settings using the /sbin/ipchains-save command. Logging Packets at the Firewall As discussed earlier,the Iptables -l option allows you to log matching packets.You can insert -l into any rule,as long as you do not interrupt a particular option.For example,the following command logs all matching TCP packets that are rejected: ipchains –I input –i eth0 –p tcp –s 0.0.0.0/0 –y –l –j REJECT However,the following command would be a mistake,because Ipchains would think that -l is an argument for the source of a packet: ipchains –I input –i eth0 –p tcp –s –l 0.0.0.0/0 –y –j REJECT Once you establish logging,you can view Ipchains output in the /var/log/ messages file. Iptables allows you to log packets,as well,but in a much more sophisticated way.This is because Iptables uses the LOG target,which you specify just like DROP or ACCEPT.For example,to reject and also log all initial TCP traffic,you would issue the following two commands: iptables –A INPUT –i eth0 –p tcp –s 0.0.0.0/0 –syn –j LOG iptables –A INPUT –i eth0 –p tcp –s 0.0.0.0/0 –syn –j DROP As with Iptables,you can view the results of your logging in the /var/log/ messages file. www.syngress.com
138_linux_09 6/20/01 9:48 AM Page 472 472 Chapter 9 • Implementing a Firewall with Ipchains and Iptables Setting Log Limits By default,Iptables will limit logging of packets.The default limit rate is three logging instances an hour.Each time a logging instance starts,only the first five packets will be logged by default.This behavior is meant to ensure that log files do not get too large.You can change the default logging rate by specifying the --limit and --limit-burst flags.The --limit flag allows you to determine the limit rate by second,minute,hour,or day.The --limit-burst figure allows you to deter- mine how many initial packets will be logged.For example,to log ICMP packets at a rate of two per minute,you would issue the following command: iptables –A INPUT –i eth0 –p icmp –s 0.0.0.0/0 –-limit 2/min –-limit-burst 2 –j LOG Notice also that the limit-burst value is set to 2. SECURITY ALERT! Be careful not to log too many packets. You will quickly consume hard drive space if you log all packets passing through your firewall interfaces. Adding and Removing Packet Filtering Rules Thus far,you have created a masquerading router.However,you have not yet invoked any packet filtering.Following are some examples of packet-filtering rules you may want to create on your system.First,consider the following Ipchains and Iptables commands: ipchains –P input DENY ipchains –A input –I eth0 –p tcp -s 0/0 –d 0/0 22 –j ACCEPT Now,consider the equivalent series of Iptables commands: iptables –P INPUT DROP iptables –P FORWARD DROP iptables –A FORWARD –i eth0 –p tcp –-dport 22 –j ACCEPT These commands effectively prohibit every service from entering your fire- wall,except for SSH,which uses port 22.No other service can access your net- work.Notice that Ipchains refers to the input chain in lowercase,whereas Iptables www.syngress.com
138_linux_09 6/20/01 9:48 AM Page 473 Implementing a Firewall with Ipchains and Iptables • Chapter 9 473 uses the FORWARD chain in uppercase.Iptables always refers to chains in uppercase.In addition,Iptables does not use the INPUT chain for packets des- tined for the internal network.In Iptables,the INPUT chain refers only to packets destined for the local system.Thus,in Iptables,you should explicitly drop all packets to the INPUT interface,unless you want to allow access to your fire- wall,say by SSH or another relatively secure administration method.Your firewall will still forward packets on the nat table using the FORWARD, POSTROUTING,and PREROUTING chains. Notice also that Ipchains uses DENY as a target name,whereas Iptables uses DROP.The difference is in the way source and destination are specified.This dif- ference is actually not necessary;both Ipchains and Iptables can use -s and -d,or the --dport option.When using --dport or --sport,if you do not specify a source or destination,both Iptables and Ipchains assume the first local interface. The -I option in Ipchains specifies a particular interface (in this case,the eth0 interface),whereas in Iptables,the -I option specifies the incoming interface. The preceding configuration is both extremely simple and restrictive.It allows outside hosts to access SSH users to access only SSH,and will not allow any user interactively logged in to the system to check e-mail or any other Internet-based service.This is because the rule is designed to lock down the fire- wall as much as possible. ICMP Types Notice that with Iptables,you can reject specific ICMP types.Table 9.6 explains some of the additional types,including the numbers assigned in RFC 792,which is the document that defines the parameters for all ICMP messages. Table 9.6 Common ICMP Names and Numbers Iptables/Ipchains RFC Name and ICMP Message Name Number Description echo-request 8 Echo The packet sent out by the common ping command. echo-reply 0 Echo Reply The reply a host gives to the ping command. destination- 3 Destination Informs an echo request unreachable Unreachable packet that there is a problem reaching the intended host. Continued www.syngress.com
138_linux_09 6/20/01 9:48 AM Page 474 474 Chapter 9 • Implementing a Firewall with Ipchains and Iptables Table 9.6 Continued Iptables/Ipchains RFC Name and ICMP Message Name Number Description source-quence 4 Source Quench If a router is too busy and cannot fulfill a client request, it will send back this message to a client. Redirect 5 Redirect Sent by a router that has, essentially, discovered a more direct route to the destination than originally found in the network packet sent by the network host. time-exceeded 11 Time Exceeded If a datagram is held too long by a router, its time-to-live (TTL) field expires. When this occurs, the router is supposed to send a message back to the host informing it of the drop. parameter-problem 12 Parameter Problem Sent by either standard hosts or routers, this message informs other hosts that a packet cannot be processed. You can learn about additional arguments by typing iptables -p icmp -h at any terminal. A Personal Firewall Example Suppose that you want to create a personal firewall for a system that you use as a desktop.You would modify the previous Ipchains commands as follows: ipchains –P input DENY ipchains –A input –I eth0 –p tcp -s 0/0 –d 0/0 22 –j ACCEPT To create a personal firewall system using Iptables,you would issue the following commands: iptables –P INPUT DROP iptables –A INPUT –I eth0 –p tcp –-dport 22 –j ACCEPT iptables –A INPUT –I eth0 –p tcp –-dport 1023 –j ACCEPT iptables –A INPUT –I eth0 –p udp –-dport 1023 –j ACCEPT www.syngress.com
138_linux_09 6/20/01 9:48 AM Page 475 Implementing a Firewall with Ipchains and Iptables • Chapter 9 475 The preceding commands allow SSH,but no other service.However,now a user can browse the Web,contact DNS servers,and so forth,and use the system with a reasonable degree of security.This system now cannot even be pinged, which helps to protect it against distributed DoS and ping scanning attacks. Exercise: Creating a Personal Firewall and Creating a User-Defined Chain
- Using either Ipchains or Iptables,add the following rules to your INPUT table to create a personal firewall: (cid:2) Deny all incoming ICMP traffic,and make sure the denial is logged (cid:2) Deny all incoming FTP traffic (cid:2) Deny all incoming DNS traffic (cid:2) Deny Telnet (cid:2) Deny SMTP and POP3
- If you are using Iptables on a standard system with one interface,you would issue the following commands: iptables –A INPUT –s 0/0 –d 0/0 –p icmp –j DROP iptables –A INPUT –s 0/0 –d 0/0 –p icmp –j LOG iptables –A INPUT –s 0/0 –d 0/0 –p tcp –-dport 20 –j DROP iptables –A INPUT –s 0/0 –d 0/0 –p tcp –-dport 21 –j DROP iptables –A INPUT –s 0/0 –d 0/0 –p tcp –-dport 53 –j DROP iptables –A INPUT –s 0/0 –d 0/0 –p udp –-dport 53 –j DROP iptables –A INPUT –s 0/0 –d 0/0 –p tcp –-dport 21 –j DROP iptables –A INPUT –s 0/0 –d 0/0 –p tcp –-dport 25 –j DROP iptables –A INPUT –s 0/0 –d 0/0 –p tcp –-dport 110 –j DROP Of course,there is more than one way to do this.For example,you could create a user-defined chain and handle all SMTP and POP3 there: iptables –N icmptraffic iptables –A icmptraffic –s 0/0 –d 0/0 –p icmp –j DROP iptables –A icmptraffic –s 0/0 –d 0/0 –p icmp –j LOG iptables –A INPUT –s 0/0 –d 0/0 –p icmp –j icmp www.syngress.com
138_linux_09 6/20/01 9:48 AM Page 476 476 Chapter 9 • Implementing a Firewall with Ipchains and Iptables 3. List the INPUT chain.If you created a user-defined chain,list this as well. 4. Save your configuration for the sake of backup.If you are using Iptables, use the following command: iptables-save > iptables.txt 5. Flush all of the rules you created.If you are using Iptables,issue the fol- lowing command: iptables –F 6. List the INPUT chain (and any other) to verify that you have in fact flushed this chain. 7. Use the iptables-restore (or ipchains-restore) command along with the text file you created to restore your Iptables chains: iptables-restore iptables.txt 8. List your tables and chains again to verify that your rules have been restored. 9. Thus far,you have created a personal firewall that starts with a “wide open”policy,and then proceeds to lock down ports.Now,use the -P option to block all traffic,and then allow only SSH,or any other pro- tocol(s) of your choice.If,for example,you are using Iptables,issue the following commands: iptables –P INPUT DROP iptables –A INPUT–p tcp --dport 22 –j ACCEPT iptables –A INPUT–p tcp --dport 1023: –j ACCEPT iptables –A INPUT–p udp --dport 1023: –j ACCEPT You can specify –i eth0,if you wish.However,if you only have one interface,both Ipchains and Iptables will default to using this interface. Remember,you should open up the ephemeral TCP and UDP ports so that you can still do things like checking your e-mail,and so forth.If,of course,you do not want any services open on your network,you could omit the --dport 22 line altogether. 10. Now,log all traffic that attempts to connect to your system.If you are using Iptables,issue the following command: www.syngress.com
138_linux_09 6/20/01 9:48 AM Page 477 Implementing a Firewall with Ipchains and Iptables • Chapter 9 477 iptables –A INPUT–p udp --dport 1023: –j LOG iptables –A INPUT–p tcp --dport 1023: –j LOG This feature may log too much information for your server, depending on your system’s activity.Make sure you check your log files regularly. 11. Log all attempts to scan the standard ports for Microsoft networking.If you are using Iptables,issue the following command: iptables –A INPUT–p tcp --multiport --destination-port 135,137,138,139 –j LOG iptables –A INPUT–p udp --multiport --destination-port 137,138,139 –j LOG The --multiport --destination-port option allows you to specify a range of ports.You can read more about these options in the Iptables man page. 12. If your server needs to support additional protocols,experiment with adding them. Redirecting Ports in Ipchains and Iptables Port redirection is where a packet destined for a certain port (say,port 80) is received by an interface,and is then sent to another port.Redirecting ports is common in networks that use proxy servers.To redirect a port in Ipchains to the local system’s eth0 interface,you could issue the following command: ipchains –A input –i eth1 –s 0/0 –d 0/0 –p tcp 80 –j REDIRECT 8080 ipchains –A input –i eth1 –s 0/0 –d 0/0 –p tcp 443 –j REDIRECT 8080 In Iptables,you must use the REDIRECT target from the nat table: iptables –t nat -A PREROUTING -i eth1 -s 0/0 -d 0/0 –p tcp 80 –j REDIRECT / --to-ports 8080 iptables –t nat -A PREROUTING -i eth1 -s 0/0 -d 0/0 –p tcp 443 –j REDIRECT / --to-ports 8080 www.syngress.com
138_linux_09 6/20/01 9:48 AM Page 478 478 Chapter 9 • Implementing a Firewall with Ipchains and Iptables These rules ensure that any hosts that try to bypass your proxy server by specifying your firewall are redirected to a proxy server on the firewall.Another strategy is to deny all requests to ports 80 and 443,and then make sure that all Web clients are configured to access your proxy server. Configuring a Firewall Because your situation will be unique,it is impossible to provide a “cookbook” firewall for you.However,the following is a beginning firewall for a system with three NICs.The NICs have the following IP addresses: (cid:2) Eth0 207.1.2.3/24 (cid:2) Eth1 192.168.1.1/24 (cid:2) Eth2 10.100.100.1/24 Thus,Eth0 represents the 207.1.2.0/24 network,Eth1 represents the 192.168.1.0/24 network,and Eth2 represents the 10.100.100.0/24 network.The intention is to create a firewall that allows the Eth1 and Eth2 networks to com- municate freely with each other,as well as get on to the Internet and use any ser- vices (Web,e-mail,FTP,and so forth).However,no one from the Internet should be able to access internal ports below port 1023.Again,this configuration does not spend much time limiting egress (i.e.,outbound) traffic.Rather,it focuses on trying to limit ingress (inbound) traffic.Any of the Ipchains or Iptables com- mands given in the following sections can be entered into any script,or into a directory or file such as /etc/rc.d/init.d/ or /etc/rc.d/rc.local.This way,your rules will be loaded automatically when you reboot your system. Setting a Proper Foundation Regardless of whether you are using Ipchains or Iptables,the first thing you will have to do for your firewall is to flush all existing rules using the -F option. Then,you need to use the -P option to set the firewall policies to deny all con- nections by default.The subsequent rules you create will then allow the protocols you really want.Then,use the necessary commands to enable forwarding and masquerading,as shown earlier in this chapter.Without this foundation,you will not be able to forward packets at all,and thus firewalling them would be rather superfluous. www.syngress.com
138_linux_09 6/20/01 9:48 AM Page 479 Implementing a Firewall with Ipchains and Iptables • Chapter 9 479 Creating Anti-Spoofing Rules Many times,a hacker will try to use your firewall as a default gateway and try to spoof internal packets.If a firewall’s “Internet interface”(i.e.,the one that is responsible for addressing packets to the Internet) is not configured to explicitly deny packets from the network,then you are susceptible to this attack.To deny spoofing,you would issue the following commands,depending on what kernel you are using: ipchains -A input -s 192.168.1.0/24 -i eth0 -j deny ipchains -A input -s 10.100.100.0/24 -i eth0 -j deny iptables -A FORWARD -s 192.168.1.0/24 -i eth0 -j DROP iptables -A FORWARD -s 10.100.100.0/24 -i eth0 -j DROP You may want to log all of the attempts,just so you know how often you are attacked: ipchains -A input -s 192.168.1.0/24 -i eth0 -l -j deny ipchains -A input -s 10.100.100.0/24 -i eth0 -l -j deny The preceding rules are different only in that they specify the -l option.In Iptables,create two additional entries to log the traffic: iptables -A FORWARD -s 192.168.1.0/24 -i eth0 -j LOG iptables -A FORWARD -s 10.100.100.0/24 -i eth0 -j LOG Remember,if you have additional interfaces,you have to add a rule for each. Do not leave one interface open to a spoofing attack.You will be surprised how quickly a hacker can discover this vulnerability. Allowing TCP The following is an example of what you can do with your network when it comes to allowing inbound and outbound TCP connections.If you are using Ipchains,issue the following commands to allow TCP connections: ipchains–A input –p tcp -d 192.16.1.0/24 ! 80 -y –b -j ACCEPT ipchains–A input –p tcp -d 10.100.100.0/24 ! 80 -y -b -j ACCEPT The -y option prohibits remote hosts from initiating a connection to any port except port 80.This is because the “!”character reverses the meaning of anything that is immediately in front of it.In this case,only connections meant www.syngress.com
138_linux_09 6/20/01 9:48 AM Page 480 480 Chapter 9 • Implementing a Firewall with Ipchains and Iptables for port 80 will be allowed;all others will be denied.This may seem strange,but remember,this rule is for the input chain,and many times these rules seem to be the reverse of common sense.The -b option “mirrors”the rule,which means that the rule applies to packets going in both directions.This rule allows one rule to do the same thing as repeating the command and reversing the source and desti- nation flags (-s and -d). If you are using Iptables,issue the following commands: iptables –A FORWARD –m multiport –p tcp –d 192.168.1.0\24 --dport 25,110, 80, 443, 53 / ! –tcp flags SYN, ACK ACK -j ACCEPT iptables –A FORWARD –m multiport –p tcp –s 192.168. 1.0\24 --sport 25,110, 80, 443,53 / ! –tcp flags SYN, ACK ACK -j ACCEPT iptables –A FORWARD –m multiport –p tcp –d 10.100.100.0\24 --dport 25,110, 80, 443, 53 ! / –tcp flags SYN, ACK ACK -j ACCEPT iptables –A FORWARD –m multiport –p tcp –s 10.100.100.0\24 --sport 25,110, 80, 443, 53 ! / –tcp flags SYN, ACK ACK -j ACCEPT The preceding rules allow ports to be opened above 1023,as long as they are continuing a connection that has first been established by a host inside of the firewall.You can,of course,add additional ports,according to your needs.The / character is a simple line continuation character that you may have to specify in a script.As with Ipchains,the ! character reverses the meaning of anything that is in front of it.In this case,it means that any packet that does not have the SYN, SYN ACK,or ACK bit set is accepted. TCP Connections Initiated from Outside the Firewall You may want to allow certain outside hosts to initiate a connection to your fire- wall.If you do,you can issue the following commands: For Ipchains,you would issue the following: ipchains –A input –p tcp –I eth0 –d 192.168.1.0/24 80 –y –j ACCEPT www.syngress.com
138_linux_09 6/20/01 9:48 AM Page 481 Implementing a Firewall with Ipchains and Iptables • Chapter 9 481 The difference between this command and those given previously is that this one specifies the interface,as opposed to the IP address. For outgoing connections,you would issue the following: ipchains –A input –p tcp –i eth0 –d 0/0 –j ACCEPT For Iptables,you would do the following for standard TCP connections: iptables -A FORWARD -m multiport -p tcp -i eth0 -d 192.168. 1.0/24 80 --syn / --syn -j ACCEPT iptables -A FORWARD -m multiport -p tcp -i eth0 -d 10.100.100.0/24 80--syn / --syn -j ACCEPT To allow for outgoing connections,you would issue the following: iptables -A FORWARD -m multiport -p tcp -i eth0 -d 0/0 --syn -j ACCEPT iptables -A FORWARD -m multiport -p tcp -i eth1 -d 0/0 --syn -j ACCEPT iptables -A FORWARD -m multiport -p tcp -i eth2 -d 0/0 --syn -j ACCEPT All other TCP traffic will be locked out. Firewalling UDP To filter incoming and outgoing UDP,you would follow many of the same pro- cedures as outlined earlier.However,you should allow both TCP port 53 and UDP port 53,at least at first.Most of the time,DNS uses UDP port 53. However,DNS can use TCP when a request grows too large,so you should account for this by creating explicit rules.For Ipchains,you would do the fol- lowing to allow incoming connections: ipchains–A input –p udp –i eth0 –d 192.168.1.0/24 53 –j ACCEPT ipchains–A input –p udp –i eth0 –d 10.100.100.0/24 –j ACCEPT The preceding rule is necessary only if you plan to allow outside users to access your DNS server. ipchains–A input –p udp –i eth0 –d 0/0 –j ACCEPT www.syngress.com
138_linux_09 6/20/01 9:48 AM Page 482 482 Chapter 9 • Implementing a Firewall with Ipchains and Iptables For Iptables,you would issue the following commands: iptables –A FORWARD –m multiport –p udp –i eth0 –d 192.168.1.0/24 / --dport 53 –j ACCEPT iptables –A FORWARD –m multiport –p udp –i eth0 –s 192.168.1.0/24 / --dport 53 –j ACCEPT Outgoing UDP usually requires that you enable DNS lookups,which are usually at UDP port 53: iptables –A FORWARD –m multiport –p udp –i eth0 –d 0/0 --dport 53 –j ACCEPT iptables –A FORWARD –m multiport –p udp –i eth0 –s 0/0 --dport 53 –j ACCEPT It is possible that your network requires additional ports.For example,if you are running SNMP,you would have to open up ports 160 and 161. Enhancing Firewall Logs If you want to log these connections,do the following using Ipchains: ipchains –A input –p tcp –l –j REJECT ipchains –A input –p udp –l –j REJECT ipchains –A input –p icmp –l –j REJECT The preceding commands will log any packet that is matched.If you are using Iptables,the equivalent commands are: iptables –A FORWARD –m tcp –p tcp –j LOG iptables –A FORWARD –m udp –p udp –j LOG iptables –A FORWARD –m udp –p icmp –j LOG Usually,creating the ideal packet-filtering rules requires some trial and error, as well as research specific to your own situation.For more information about using Ipchains,consult the Ipchains man page,and the Ipchains-HOWTO avail- able at www.linuxdoc.org/HOWTO/IPCHAINS-HOWTO.html#toc1. For more information about using Iptables,consult the Iptables man page, and the Iptables-HOWTO available at various sites,including www.guenthers.net/doc/howto/en/html/IP-Masquerade-HOWTO.html#toc2. Using the information in this chapter and additional resources,you will be able to create a firewall that blocks known attacks. www.syngress.com
138_linux_09 6/20/01 9:48 AM Page 483 Implementing a Firewall with Ipchains and Iptables • Chapter 9 483 Counting Bandwidth Usage A Linux firewall can inform you about the number of packets it has processed,in addition to blocking and logging attacks.The process of counting packets is often called packet accounting.Many companies are very interested in determining how much traffic a department or network has generated.This can help them deter- mine the type of equipment necessary to support the department further.Such information can also help a company determine how much it can bill a client or department.In many situations,the firewall is an ideal place to gather such statis- tics.If you have the following two networks,these rules will count packets that pass between the two: ipchains -A forward -p icmp -s 192.168.1.0/24 -d 10.100.100.0/24 The preceding rule will identify all of the traffic passing from the 192.168.1.0/24 network to the 10.100.100.0/24 network. If you are using Iptables,you have many additional options.For example,you can identify specific ICMP packets that are forwarded by the firewall: iptables -A FORWARD -m icmp -p icmp –f -j LOG To gather information about a more specific element of ICMP,you could issue the following command: iptables -A FORWARD -m icmp -p icmp --sport echo-request -j LOG This rule will count all icmp echo-request packets (icmp 0).The following command discovers all of the icmp-reply packets that have been forwarded: iptables -A FORWARD -m icmp -p icmp --sport echo-reply -j LOG You are not limited to ICMP packets.If,for example,you wanted to gather information about the HTTP packets being forwarded,you would enter the following: iptables -A FORWARD -p tcp --sport 80,443 -j LOG To determine the amount of HTTP traffic passing between two networks, you would issue the following command: iptables -A FORWARD -s 192.168.1.0/24 -d 10.100.100.0/24 -p tcp --sport 80,443 -j LOG www.syngress.com
138_linux_09 6/20/01 9:48 AM Page 484 484 Chapter 9 • Implementing a Firewall with Ipchains and Iptables Listing and Resetting Counters To list the counter information,you can issue either of the following commands from a terminal: ipchains -L -v iptables -L -v You can save this information using the ipchains-save and iptables-save commands.The following commands reset the counters: ipchains -L -Z iptables -L -Z Setting Type of Service in a Linux Router Many routers,including Linux routers using Ipchains or Iptables,are capable of shaping traffic as it passes through.The IP header for all packets has a special field called the Type of Service (ToS) field,which allows you to prioritize traffic as it passes through the router.Using the ToS field,you can make certain types of traffic (e.g.,SMTP and POP3) take precedence over others (e.g.,SSH and Telnet).Packets that are marked will be treated differently at the router.Setting the ToS field occurs at the Network layer (Layer 3 of the OSI/RM).You can learn more about how ToS works by consulting RFC 1349. Usually,assigning priority for packets is a secondary concern when config- uring a firewall.In some situations,however,you will find it useful for a firewall to “double up”and offer both services.The main reason why you would set the ToS field in network traffic is to cut down on network congestion,especially in networks that have high amounts of traffic. NOTE Do not confuse Type of Service (ToS) with Quality of Service (QoS). QoS refers to the ability of physical devices (i.e., switches, routers) to transmit packets according to ToS values found in IP packets. QoS concerns might include whether the packet is delivered via Frame Relay, Asynchronous Transfer Mode (ATM), Ethernet, Synchronous Optical Network (SONET), and so forth. Because ToS refers to the ability to mark certain packets so that they have a higher priority than others do, these markings deter- mine whether they are available for QoS routing. www.syngress.com
138_linux_09 6/20/01 9:48 AM Page 485 Implementing a Firewall with Ipchains and Iptables • Chapter 9 485 Service Values The normal-service value is 0 (or,0x00 in the actual packet).Table 9.7 lists the four different options available to you when marking a packet. Table 9.7 ToS Field Options Service Value Description Minimum delay The minimum delay field reduces the time a datagram takes to get from the router to the host. The minimum delay option is ideal for protocols that require speed when building initial connections, or when transferring control data. Traffic such as the ftp-control port (20), Telnet, and SSH benefits from this setting. Marking this traffic will reduce latency (i.e., the time interval between a request and a reply) at the router. The ToS field bit is 10 (0x10 in the actual packet). Maximum throughput This value is appropriate for the ftp-data port (20) and for large file transfers via HTTP. Networks that use the X Windows system to export displays between systems should consider using this bit as well. The ToS field bit is 8 (0x08 in the actual packet). If you anticipate large volume transfers via POP3, you could consider this option as well. Maximum reliability Used in an attempt to reduce retransmissions. Sometimes, UDP protocols such as DNS (port 53) and SNMP (ports 161 and 162) are receive this option. However, TCP-based protocols such as SMTP also benefit from this ToS option, because systems can waste bandwidth to keep retransmitting this protocol. The ToS bit value is 4 (0x04 in the actual packet). Minimum cost This option is often only implemented by commercial products. The ToS field bit is 2 (0x02 in the actual packet). It may be useful to consider these four options in terms of common network tasks.Client hosts (i.e.,hosts that use X,SSH,FTP,HTTP,and other protocols) may benefit from either maximum throughput or minimum delay settings. Servers generally benefit from maximum throughput,depending on the traffic that they generate. www.syngress.com
138_linux_09 6/20/01 9:48 AM Page 486 486 Chapter 9 • Implementing a Firewall with Ipchains and Iptables Setting ToS Values in Ipchains and Iptables To set ToS values in Ipchains,add the following values to the end of any rule: -t andmask xormask The andmask value is usually 01,because this value compares,or “ands”the original TOS value,and then allows you to make a change to the packet.The xormask value can be any of the service values found in Table 9.7 (e.g.,08 for maximizing throughput).This second field is evaluated as an “or”value,meaning that if the value you specify is different from the original value,the one you specify will be set. For example,to mark the ToS field for maximum throughput for HTTP (port 80) for all packets being sent out to all remote systems,you would do the following: ipchains -A output -s 0.0.0.0/0.0.0.0 -d 0.0.0.0/0.0.0.0 80 -p 6 -t 01 08 The -p 6 option specifies TCP as the protocol.You would never set a ToS value on a packet that will eventually be dropped.Following are some additional examples of the ToS value being set on additional protocols: ipchains -A output -s 0.0.0.0/0.0.0.0 -d 0.0.0.0/0.0.0.0 21 -p 6 -t 01 04 ipchains -A output -s 0.0.0.0/0.0.0.0 -d 0.0.0.0/0.0.0.0 20 -p 6 -t 01 08 ipchains -A output -s 0.0.0.0/0.0.0.0 -d 0.0.0.0/0.0.0.0 22:22 -p 6 -t 01 10 ipchains -A output -s 0.0.0.0/0.0.0.0 -d 0.0.0.0/0.0.0.0 25:25 -p 6 -t 01 04 ipchains -A output -s 0.0.0.0/0.0.0.0 -d 0.0.0.0/0.0.0.0 53:53 -p 6 -t 01 04 ipchains -A output -s 0.0.0.0/0.0.0.0 -d 0.0.0.0/0.0.0.0 80:80 -p 6 -t 01 08 ipchains -A output -s0.0.0.0/0.0.0.0 -d 0.0.0.0/0.0.0.0 110:110 -p 6 -t 01 08 ipchains -A output -s0.0.0.0/0.0.0.0 -d 0.0.0.0/0.0.0.0 143:143 -p 6 -t 01 04 ipchains -A output -s0.0.0.0/0.0.0.0 -d 0.0.0.0/0.0.0.0 443:443 -p 6 -t 01 04 Additional ToS Options in Iptables Iptables,as you might suspect,adds several options and uses some different termi- nology.First,you can set your router to either match packets with certain ToS options set,or you can have the router set the actual ToS options.These are two very different things.One allows the router to handle packets with the ToS value www.syngress.com
138_linux_09 6/20/01 9:48 AM Page 487 Implementing a Firewall with Ipchains and Iptables • Chapter 9 487 already set,whereas the other actually sets the values.To create a rule that matches a ToS field,you would use the -m option,complete with its arguments: -m tos --TOS tos_value -j TARGET In the preceding syntax,the tos_value number is any ToS bit found in Table 9.7 (e.g.,08 for maximum throughput).As far as target value is concerned,you can specify any target you wish (ACCEPT,a user-defined chain,and so forth). For example,the following rule accepts packets from port 80 with the ToS value set to 08: iptables -A INPUT -p tcp -m tos 0x08 -j ACCEPT As far as setting ToS values is concerned,you can only set them in the FOR- WARD and OUTPUT chains.The syntax is as follows: -j TOS --set-tos tos_value For example,to set the ToS value to maximum throughput for all outgoing Web traffic,you would do the following: iptables -A OUTPUT -p tcp -m tcp --dport 80 -j TOS --set-tos 0x08 Following are some additional examples where Iptables has been used to set ToS fields for various traffic: iptables -A OUTPUT -p tcp -m tcp --dport 21 -j TOS --set-tos 0x04 iptables -A OUTPUT -p tcp -m tcp --dport 20 -j TOS --set-tos 0x08 iptables -A OUTPUT -p tcp -m tcp --dport 22 -j TOS --set-tos 0x010 iptables -A OUTPUT -p tcp -m tcp --dport 25 -j TOS --set-tos 0x04 iptables -A OUTPUT -p tcp -m tcp --dport 53 -j TOS --set-tos 0x04 iptables -A OUTPUT -p tcp -m tcp --dport 80 -j TOS --set-tos 0x08 iptables -A OUTPUT -p tcp -m tcp --dport 110 -j TOS --set-tos 0x08 iptables -A OUTPUT -p tcp -m tcp --dport 143 -j TOS --set-tos 0x04 iptables -A OUTPUT -p tcp -m tcp --dport 443 -j TOS --set-tos 0x04 www.syngress.com
138_linux_09 6/20/01 9:48 AM Page 488 488 Chapter 9 • Implementing a Firewall with Ipchains and Iptables Using and Obtaining Automated Firewall Scripts and Graphical Firewall Utilities Several attempts have been made to automate the process of creating a firewall in Linux.Similarly,developers are also busy creating GUI applications that make the job easier.Many of these utilities are quite useful,although they are mostly effec- tive in beginning your firewall configuration;you will likely have to customize the rules these applications generate. The more effective firewall scripts and GUI tools include the following (cid:2) Firestarter A fairly sophisticated graphical tool that supports both Ipchains and Iptables.It can be used to create a personal firewall,but also supports multihomed systems.Like many automated firewalls,it creates multiple rules to filter out known and expected attacks.You may need to adjust some of these automatic settings.Although Firestarter does sup- port multiple interfaces,it,like most of the open source GUI firewall applications,is best used only as a beginning to a firewall on a multi- homed system.You can obtain Firestarter at http://sourceforge.net/ projects/firestarter. (cid:2) Mason A unique product,Mason is designed to first listen in on traffic passing through your firewall,and then generate Ipchains or ipfwadm (the precursor to ipchains and Iptables) rules.As of this writing,Mason does not support Iptables.In spite of this,Mason’s approach to rules cre- ation is both unique and sound,as it attempts to create rules based on your network traffic about your firewall needs.You can download this binary at http://users.dhp.com/~whisper/mason.Do not confuse this product with the HTML Mason utilities meant to dynamically generate HTML for Apache Server. (cid:2) Knetfilter A GUI firewall designed to work with the KDE desktop environment.Although it purports to be stable,it appears to have prob- lems working with common versions of KDE.You can learn more about Knetfilter at http://expansa.sns.it:8080/knetfilter. (cid:2) MonMotha’s IPTables Firewall This is a firewall script,not a GUI interface.It is designed to give you a chance to specify the traffic you want to allow and deny.You must first edit the script and then run it www.syngress.com
138_linux_09 6/20/01 9:48 AM Page 489 Implementing a Firewall with Ipchains and Iptables • Chapter 9 489 from a command prompt.You can obtain this script at http://mirkk.kurd.nu/~monmotha/firewall/index.php. (cid:2) Firewall Builder Firewall Builder is in many ways the most ambitious open source GUI tool.It allows you to create rules for multiple inter- faces,networks,and hosts.It is also quite unstable on most versions of Red Hat Linux through version 7.1.Learn more about Firewall Builder at http://sourceforge.net/projects/fwbuilder. (cid:2) EasyChains As of this writing,EasyChains has a ncurses-based GUI,and supports only Ipchains.You can download it at http://sourceforge.net/projects/easychains. Tools & Traps… Weighing the Benefits of a Graphical Firewall Utility As you consider using any of the GUI applications covered in this section, keep is mind the following issues: (cid:2) Often, these downloads do not provide public keys or hash values for their code; therefore, before using any of the applications, make sure that you review the source code. If you cannot review the source code yourself, then employ someone to check it, especially if you plan to use it in an enterprise environment. (cid:2) Most of these applications are still in beta form, so remember that they often provide limited functionality. Although some, such as Mason, are quite impressive, limita- tions still persist: As of this writing, Mason does not support Iptables. (cid:2) The more advanced GUI applications often require you to upgrade to either the very latest version of a particular window manager, such as KDE or Gnome, or to use an idiosyncratic version or configuration. Consequently, you may have to spend a great deal of time configuring your window manager. Generally, this time could be better spent learning how to use Iptables or Ipchains commands. www.syngress.com
138_linux_09 6/20/01 9:48 AM Page 490 490 Chapter 9 • Implementing a Firewall with Ipchains and Iptables Firewall Works in Progress The following is a partial list of applications being developed at the current time: (cid:2) jb dynFW (http://sourceforge.net/projects/jbdfw) This project appears to be interested in creating a personal firewall product,as opposed to a multihomed firewall. (cid:2) Heimdall Linuxconf Firewall (http://sourceforge.net/projects/ heimdall) A promising effort,mainly because it proposes to be an add- on to the Linuxconf application. (cid:2) NetFilter-1 (http://sourceforge.net/projects/netfilter-1) If it lives up to its promise,this particular project could produce a truly useful piece of software,because it is trying to mimic the CheckPoint Firewall-1 product.Its “secure logging”feature will employ encryption so that the firewall can log to remote systems without the fear of sniffing attacks. (cid:2) PHP Ipchains project (http://sourceforge.net/projects/phpchains) The primary strength of this product is that it is based on PHP,which is a truly portable language,and is well supported by Apache Server. Because many other security applications use PHP,this product may allow you to apply skills you have already learned. (cid:2) Positive Control (http://sourceforge.net/projects/positivecontrol) Not only does this project plan on releasing a GUI,but it also plans on cre- ating a firewall that can detect port scans through stateful inspection, which is basically a way for the firewall to maintain and scan its own dynamic database.If this database senses a number of ports that have been scanned in a row,the firewall can take action.Some actions the firewall can take may include automatic firewall reconfiguration and automatic alerts. Exercise: Using Firestarter to Create a Personal Firewall
- Make the necessary preparations for your firewall.If you are creating a personal firewall,then you can simply move on to step 2.If you want to use your firewall to masquerade connections,you should understand that Firestarter may not do the best job creating forwarding and nat/ masquerading rules,so you may want to create them first.You will see www.syngress.com
138_linux_09 6/20/01 9:48 AM Page 491 Implementing a Firewall with Ipchains and Iptables • Chapter 9 491 later in this exercise how you can configure Firestarter to enable masquerading for you. 2. Once you have verified and tested your masquerading (if necessary) copy firestarter-0.7.0-1.i386.rpm from the CD that accompanies this book,or download the latest Firestarter RPM or tarball from http://sourceforge.net/projects/firestarter.The RPM and tarball pack- ages are equivalent.They do not require any special libraries;if you have installed either the Gnome or KDE window managers,you will have no problem. 3. Install Firestarter.If you are using the RPM,you would issue the following command: rpm –ivh firestarter-0.7.0-1.i386.rpm 4. Now,start X and enter the following in a terminal: firestarter 5. If an existing Ipchains or Iptables configuration exists,you may see the warning shown in Figure 9.3. If necessary,click Yes.You should note that this warning will also appear if you restart Firestarter.If you are using this wizard on a system that already has masquerading configured,you would click No to save this configuration.Firestarter will simply append its configuration to yours. Figure 9.3 Firestarter Warning 6. When you first launch Firestarter,the configuration wizard,shown in Figure 9.4,should appear automatically. If the wizard does not appear,maximize the main interface and go to Firewall | Run firewall wizard. 7. Once the wizard begins,click Next. www.syngress.com
138_linux_09 6/20/01 9:48 AM Page 492 492 Chapter 9 • Implementing a Firewall with Ipchains and Iptables Figure 9.4 The Firestarter Configuration Wizard Initial Screen 8. The Network Device Configuration screen will appear,as shown in Figure 9.5.Select the interface you want to protect,and click Next. You will notice that in this particular example,the eth0 interface is selected.Firestarter is written well enough so that it will automatically detect all of your interfaces. Figure 9.5 The Network Device Configuration Screen 9. The Services Configuration window,shown in Figure 9.6,will appear. www.syngress.com
138_linux_09 6/20/01 9:48 AM Page 493 Implementing a Firewall with Ipchains and Iptables • Chapter 9 493 Figure 9.6 The Services Configuration Window 10. Configure the services that you desire.Figure 9.6 shows that only SSH will be allowed to connect to the firewall.Your settings will differ according to your needs.When you are finished selecting the services you want to provide on this interface,click Next. 11. The ICMP Configuration screen will appear,as shown in Figure 9.7.By default,Firestarter disables all ICMP filtering,which means that all ICMP packets will be allowed to pass through the firewall.Select Figure 9.7 The ICMP Configuration Screen www.syngress.com
138_linux_09 6/20/01 9:49 AM Page 494 494 Chapter 9 • Implementing a Firewall with Ipchains and Iptables Enable ICMP Filtering,and then select the ICMP packet types that you want to filter.You will notice that in this particular example,no ICMP packets will be allowed to traverse the firewall. 12. When you have selected the ICMP packets you want to block,click Next.Firestarter will inform you that it is ready to generate the firewall, as shown in Figure 9.8.Click Finish to do so. Figure 9.8 Completing the Firewall Generation Process in Firestarter 13. The wizard will disappear,and you will see the Firestarter main inter- face,shown in Figure 9.9. 14. The main interface defaults to the Firewall hits tab,which is a graph- ical logging device.If a packet matches the rules you have generated,it will be instantaneously logged here.From a remote system,generate some traffic that you have blocked.For example,if you have not enabled Telnet support,try to telnet to this system.After enough traffic is gener- ated,you will see the logging screen fill up,as shown in Figure 9.10. 15. Now,select the Dynamic Rules tab.From here,you can add rules to those that Firestarter has automatically generated.It is important to understand that Firestarter imposes a fairly strict series of rules.You may need to open up some ports to suit your needs.Following is a brief overview of your options: (cid:2) Deny all connections from Allows you to block a specific host. If,for example,you have left the SSH port open to all systems,you www.syngress.com
138_linux_09 6/20/01 9:49 AM Page 495 Implementing a Firewall with Ipchains and Iptables • Chapter 9 495 Figure 9.9 The Firestarter Main Interface Figure 9.10 Viewing Logged Packet Matches in Firestarter can specify a host or range of IP addresses here.As with any of the dynamic options,the rules you enter here will override any settings established by either Firestarter or the Firestarter wizard. (cid:2) Allow all connections from Enables you to allow a host or range of IP addresses full access to your system.Be careful when using this option,because it can expose your firewall to IP spoofing. Remember,it opens all ports on your interface to a remote system. www.syngress.com
138_linux_09 6/20/01 9:49 AM Page 496 496 Chapter 9 • Implementing a Firewall with Ipchains and Iptables (cid:2) Open service to machine Allows you to open a specific port or range of ports to a specific host or range of IP addresses. (cid:2) Open service to anyone Opens a port to all hosts on the net- work,and any other network.Like the Allow all connections from setting,this option is quite powerful,and can reduce your fire- wall’s security.Specifying this option allows any host on your net- work or on any other to access the port you specify. You can also add and remove all rules in a particular group,or you can remove all of the dynamic rules you have created. 16. Right-click in the Allow all connections from field,and then select Add new rule.You will see a dialog box,shown in Figure 9.11,where you can enter either an IP address or a host name.Enter the IP address of a remote host here.Although you can enter a DNS name,it is best if you use an IP address.When you are finished,click OK. Figure 9.11 The Add New Rule Dialog Box 17. You will see that the IP address or host name (if this is what you entered) is entered in the Allow all connections from dialog box (Figure 9.12). Test this setting by using the remote client you have specified. 18. Experiment with the additional settings to see how well Firestarter is able to configure the interface to suit your needs. www.syngress.com
138_linux_09 6/20/01 9:49 AM Page 497 Implementing a Firewall with Ipchains and Iptables • Chapter 9 497 Figure 9.12 Allowing SSH and Telnet Service to a System Named “keats” When you have configured Firestarter,open a second terminal and list the chains.If,for example,you are using Iptables,issue the following command: iptables -L 19. You will see a list of many different rules,most of which have been added by Firestarter.Consider that some of these rules may not be nec- essary for your particular situation.Use the -D option to delete the rules you do not need.Make sure you test your firewall each time you delete a rule. 20. When you are finished,use the iptables-save or ipchains-save command to save your rules: ipchains-save > firestarter.chains iptables-save > firestarter.chains You can then restore your firewall by using the ipchains-restore or iptables-restore command. www.syngress.com
138_linux_09 6/20/01 9:49 AM Page 498 498 Chapter 9 • Implementing a Firewall with Ipchains and Iptables 21. It is also possible to save the logs generated by Firestarter.In the main interface,go to Hit List | Save firewall hit list to file.You will be asked to enter the name of the text file where the logs will be stored. Do so,and then press OK.When you have saved the log file,open it in a text editor.You will see a report that details the connection,including the source IP address,the time of the attempted connection,and the protocol used. 22. When you are finished saving your log,you can clear the log screen and begin logging again. Exercise: Using Advanced Firestarter Features
- Go to Firewall | Preferences and examine the additional options offered by Firestarter.These include the ability for Firestarter to play a sound whenever a packet matches a rule,starting Firestarter “hidden,”so that you do not see the interface,and,the most interesting feature,the one that shows every page in the configuration wizard.You can access this feature by selecting the Advanced icon,and then clicking Show every page in wizard.
- When you have done this,restart the wizard.You will then be given additional options,including the ability to create masquerading rules,as shown in Figure 9.13,and the ability to create ToS associations,shown in Figure 9.14. This particular page allows you to have Firestarter automatically dis- cover the internal network IP range,which works rather sporadically.In addition,notice that you can also enable specific port forwarding rules.If you do not want to rely on the Autodetect feature,you can specify your own range. The ToS configuration feature is effective if you want to give certain services,such as e-mail or the X Windows system,more priority than others have.In this particular example,the choice was made to give pri- ority to server applications,such as FTP,Squid,SSH,SMTP,and POP3. You will,of course,choose the option that best suits you. You can choose these settings according to your needs.
- When you are finished using the wizard,you can then re-edit your settings to create the best firewall for your situation. www.syngress.com
138_linux_09 6/20/01 9:49 AM Page 499 Implementing a Firewall with Ipchains and Iptables • Chapter 9 499 Figure 9.13 The IP Masquerade Configuration Screen Figure 9.14 The ToS Configuration Screen www.syngress.com
138_linux_09 6/20/01 9:49 AM Page 500 500 Chapter 9 • Implementing a Firewall with Ipchains and Iptables Summary A firewall is the chief means of establishing a network perimeter.It is vital to sep- arate your own network from all others,as doing so helps you to manage and secure your network hosts.In this chapter,you reviewed concepts essential to firewalling.You have learned about IP forwarding,as well as masquerading and packet filtering.You then used Ipchains and Iptables to create firewall rules. This chapter also showed you how to enable logging and ToS bits on network traffic,ands how to save,edit,and restore Ipchains and Iptables entries.You were provided with practical advice concerning commands to take,and saw how GUI and automated applications have been created to help build firewalls. With this information ,you now have all of the tools necessary to begin cre- ating your own firewall using either Ipchains or Iptables. Solutions Fast Track Understanding the Need for a Firewall (cid:59) Linux natively supports the ability to route and/or filter packets. Modern Linux systems use either Ipchains or Iptables to do this.Ipchains supports Linux kernel versions up to 2.2.If you are using any kernel newer than 2.2,you must use Iptables.The Iptables package supports packet masquerading and filtering functionality as found in the 2.3 kernel and later.This functionality is known as netfilter.Therefore,in order to use Iptables,you must recompile the kernel so that netfilter is installed,and you must install the Iptables package. (cid:59) Ipchains and Iptables also allow you to configure your Linux router to masquerade traffic (i.e.,to rewrite IP headers so that a packet appears to originate from a certain host),and/or to examine and block traffic.The practice of examining and blocking traffic is often called packet filtering. (cid:59) The primary difference between a packet-filtering router (e.g.,one cre- ated by using Ipchains or Iptables) and a proxy server (e.g.,one enabled by Squid) is that a packet-filtering router does not inspect network packets as deeply as a proxy server does.However,proxy servers require more system resources in order to process network packets. www.syngress.com
138_linux_09 6/20/01 9:49 AM Page 501 Implementing a Firewall with Ipchains and Iptables • Chapter 9 501 (cid:59) Watch for bug reports concerning Ipchains,Iptables,and the Linux kernel.Keeping current about such changes can help you quickly upgrade your system in case a problem is discovered. Deploying IP Forwarding and Masquerading (cid:59) IP forwarding is the ability for a Linux system to act as a router. (cid:59) A Linux system with simple IP forwarding enabled can route any net- work address to another.If you are allotted a range of IP addresses from a local or regional Internet registry,you can use a multihomed Linux system to route this set of addresses to another network. (cid:59) In order to allow private network addresses to reach the Internet,you need to invoke Ipchains/Iptables-based IP masquerading. (cid:59) In a Linux router,you can use either Ipchains or Iptables to forward and/or alter the IP headers of packets originating from private-IP address networks to pass through Internet routers.Both Ipchains and Iptables do this by processing IP packets through the Linux kernel.You should note that this option is not necessarily secure—IP masquerading leaves all client hosts wide open to attack. (cid:59) Masquerading is when your Linux system rewrites the IP headers of a network packet so that the packet appears to originate from a different host.The practice of rewriting IP packets is colloquially known as packet mangling.Masquerading is useful because you can use it to invoke network address translation (NAT),where one IP address can stand in for several. (cid:59) Translating the private to routable Internet address is accomplished by a database stored on the Ipchains/Iptables-based Linux router.The Linux masquerading router keeps this database so that it knows how to “untranslate,”as it were,the packets that have been mangled so that they can then be addressed to the local,private network. Configuring Your Firewall to Filter Network Packets (cid:59) To create packet-filtering rules for outgoing traffic,configure your Linux firewall to deny all outgoing traffic unless explicitly allowed.Where incoming traffic is concerned,you have many options,including to www.syngress.com
138_linux_09 6/20/01 9:49 AM Page 502 502 Chapter 9 • Implementing a Firewall with Ipchains and Iptables forbid all incoming traffic unless it is part of an already established ses- sion,and to disable all forwarding except for networks that require it. (cid:59) Most Linux operating systems,such as Red Hat,Slackware,SuSE,and Caldera,support IP forwarding,masquerading,and firewalling by default. However,you may have to reconfigure your kernel in order to provide full functionality. Understanding Tables and Chains in a Linux Firewall (cid:59) Iptables derives its name from the three default tables it uses:filter,nat, and mangle.Each interface on your system can have its packets managed and modified by the chains contained in each of these tables. (cid:59) A chain is a series of actions to take on a packet.Whenever you use Ipchains or Iptables to configure a firewall,the proper perspective to adopt is to view all packets from the firewall itself. (cid:59) If you are using the filter table,each interface on your network has three different default chains:INPUT,FORWARD,and OUTPUT. (cid:59) Ipchains and Iptables use built-in targets to specify the destination of a packet.By far,the common most built-in targets are DROP and ACCEPT. Logging Packets at the Firewall (cid:59) The Iptables -l option allows you to log matching packets.You can insert -l into any rule,as long as you do not interrupt a particular option. Iptables allows you to log packets in a more sophisticated way because it uses the LOG target,which you specify just like DROP or ACCEPT. (cid:59) By default,Iptables will limit logging of packets.The default limit rate is three logging instances an hour.This behavior is meant to ensure that log files do not get too large. (cid:59) An example used in this section uses Ipchains and Iptables commands to add and remove packet-filtering rules,prohibiting every service from entering your firewall,except for Secure Shell (SSH),which uses port 22. This would not allow any user interactively logged in to the system to check e-mail or any other Internet-based service—the rule is restrictive, but is designed to lock down the firewall as much as possible. www.syngress.com
138_linux_09 6/20/01 9:49 AM Page 503 Implementing a Firewall with Ipchains and Iptables • Chapter 9 503 (cid:59) With Iptables,you can reject specific ICMP types. (cid:59) Port redirection in Ipchains and Iptables is where a packet destined for a certain port (say,port 80) is received by an interface,and is then sent to another port,using the REDIRECT target.Redirecting ports is common in networks that use proxy servers. Configuring a Firewall (cid:59) Regardless of whether you are using Ipchains or Iptables,the first thing you will have to do for your firewall is to flush all existing rules using the -F option.Then,you need to use the -P option to set the firewall policies to deny all connections by default.The subsequent rules you create will then allow the protocols you really want.Then,use the neces- sary commands to enable forwarding and masquerading.Without this foundation,you will not be able to forward packets at all,and thus fire- walling them would be superfluous. (cid:59) Many times,a hacker will try to use your firewall as a default gateway and try to spoof internal packets.If a firewall’s “Internet interface”(i.e., the one that is responsible for addressing packets to the Internet) is not configured to explicitly deny packets from the network,then you are susceptible to this attack. (cid:59) The example describing allowing inbound and outbound TCP connec- tions illustrates that with Ipchains and Iptables,the ! character reverses the meaning of anything that is in front of it. (cid:59) Creating the ideal packet-filtering rules requires some trial and error,as well as research specific to your own situation. Counting Bandwidth Usage (cid:59) A Linux firewall can inform you about the number of packets it has processed,in addition to blocking and logging attacks.The process of counting packets is often called packet accounting. (cid:59) Many routers,including Linux routers using Ipchains or Iptables,are capable of shaping traffic as it passes through.The IP header for all packets has a special field called the Type of Service (ToS) field,which allows you to prioritize traffic as it passes through the router. www.syngress.com
138_linux_09 6/20/01 9:49 AM Page 504 504 Chapter 9 • Implementing a Firewall with Ipchains and Iptables (cid:59) The main reason why you would set the ToS field in network traffic is to cut down on network congestion,especially in networks that have high amounts of traffic. Using and Obtaining Automated Firewall Scripts and Graphical Firewall Utilities (cid:59) Several attempts have been made to automate the process of creating a firewall in Linux.Many of these utilities are quite useful,although they are mostly effective in beginning your firewall configuration;you will likely have to customize the rules these applications generate. (cid:59) Most of these applications are still in beta form,so remember that they often provide limited functionality. (cid:59) Firestarter is a fairly sophisticated graphical tool that supports both Ipchains and Iptables.It can be used to create a personal firewall,but also supports multihomed systems. (cid:59) Mason is designed to first listen in on traffic passing through your fire- wall,and then generate Ipchains or ipfwadm (the precursor to ipchains and Iptables) rules. (cid:59) Firewall Builder is in many ways the most ambitious open source GUI tool.It allows you to create rules for multiple interfaces,networks, and hosts. www.syngress.com
138_linux_09 6/20/01 9:49 AM Page 505 Implementing a Firewall with Ipchains and Iptables • Chapter 9 505 Frequently Asked Questions The following Frequently Asked Questions, answered by the authors of this book, are designed to both measure your understanding of the concepts presented in this chapter and to assist you with real-life implementation of these concepts. To have your questions about this chapter answered by the author, browse to www.syngress.com/solutions and click on the “Ask the Author” form. Q: I am using Iptables.Why can’t I use the –MASQ target for the INPUT chain? A: Because Iptables uses a completely different table to do masquerading.In Iptables,the INPUT chain is used for packets that are destined to the firewall system.You must create a rule that specifies the nat table. Q: I just got used to Ipchains rather than using ipfwadm.Now,I have to get used to using Iptables.Will this ever end? A: Welcome to the world of the open source community,my friend.It is hoped that Iptables will undergo evolutionary rather than revolutionary changes from now on.Because it is much more sophisticated than Ipchains,and because it will take some time for the 2.5 kernel to become stable enough to become 2.6, it is likely that we will not have to learn a new application any time soon. Q: I am using Firestarter.It has automatically discovered my interface.However, it seems to block all traffic,even if I specify that I am using SSH and other protocols.What do I do? A: Manually edit the Iptables chains and remote any offending entries.You can also access the Dynamic rules tab and open up services to specific hosts there. Because Firestarter uses the -A option to add a rule,any addition you specify will become an exception to the restrictive rule set created by Firestarter. Q: Do I have to keep Firestarter running in order for the firewall to be in place? A: No.However,the Firestarter “Firewall hits”list will not be updated,nor will Firestarter inform you of hits using the sound option.If you establish logging by issuing manual Ipchains or Iptables commands,you can check hits by viewing the /var/log/messages file using the tail -f command. Q: When I use Iptables to list my rules,the listing just hangs,or is very slow. What is going on? www.syngress.com
138_linux_09 6/20/01 9:49 AM Page 506 506 Chapter 9 • Implementing a Firewall with Ipchains and Iptables A: One of your rules has disabled DNS lookup.You will find that the same problem will arise if you try to use netstat.Either delete the offending rule,or append a rule that opens up ports above 1023 to access your DNS server at both UDP and TCP port 53. Q: I am still using a dial-up connection (ppp0).Can I use this dial-up modem to provide access to the rest of my network? A: Certainly.Just substitute the ppp0 interface for eth0 in many of the examples in this chapter,and you will be up and running in no time. Q: I have set my default policy to DROP,and now I can’t access anything on the network.I have flushed all of the rules,but the policy is still at DROP.What do I do now? A: Use the –P option to change the default policy to ACCEPT. Q: I am using Ipchains,yet I can’t seem to add anything to the INPUT, FORWARD,or OUTPUT chains.Why not? A: Because Ipchains is case sensitive,and does not use the INPUT,FORWARD, or OUTPUT chains.Specify the input,forward,or output chains,and you will be in good shape.This can be rather confusing,because Iptables is also case specific,and uses the INPUT,FORWARD,and OUTPUT chains. Q: I have configured masquerading,and have also created several rules that seem to protect my network.However,I used commands different from yours. How come? A: In Linux,as with all of the Unix community,there is always more than one way to accomplish your goals.This can be liberating,but also rather frus- trating.If you are able to get a secure firewall going,congratulations.Now, just remember that you need to test and log your firewall so that you verify that it is helping to protect your network. Q: Is a Linux firewall ideal for a corporate environment? A: The answer for this question lies with management,really.Many busy,large environments use Linux routers and firewalls.However,you should ensure that your company’s IT and security policies allow the use of Linux systems. You should also test your implementation in an isolated subnet before bringing it into production. www.syngress.com
138_linux_10 6/20/01 9:50 AM Page 507 Chapter 10 Deploying the Squid Web Proxy Cache Server Solutions in this chapter: (cid:2) Benefits of Proxy Server Implementation (cid:2) Differentiating between a Packet Filter and a Proxy Server (cid:2) Implementing the Squid Web Proxy Cache Server (cid:2) Configuring Proxy Clients (cid:59) Summary (cid:59) Solutions Fast Track (cid:59) Frequently Asked Questions 507
138_linux_10 6/20/01 9:50 AM Page 508 508 Chapter 10 • Deploying the Squid Web Proxy Cache Server Introduction In Chapter 9,“Implementing a Firewall with Ipchains and Iptables,”you learned about packet filtering.However,packet filtering is only one way to create a net- work perimeter.Using proxy cache services,it is possible to filter traffic in a more specific way.In this chapter,you will learn the advantages of using proxy caching on your network,and understand the differences between a packet filter and a proxy server.You will also configure a proxy caching server and a proxy client,and test and troubleshoot a proxy cache server.The proxy cache you will implement in this chapter is called the Squid Web Proxy Cache server. Benefits of Proxy Server Implementation A proxy server is an intermediary between hosts on different or separate net- works,such as a local area network (LAN) and the Internet.It is used to imple- ment caching for certain services,and for security and administrative control. Proxy servers can implement different functions,such as proxy caching and Network Address Translation (NAT).NAT is technically the function of a network-level gateway,but some vendors include this functionality in their proxy server products as well. Proxy Caching Proxy cache servers are implemented at the Application layer and process specific Internet protocols,such as Hypertext Transfer Protocol (HTTP) and File Transfer Protocol (FTP).Rules are set up on the proxy server to determine how a work- station request should be processed. One of the main tasks of a proxy server is to cache Web pages and FTP files for proxy clients.These types of proxy servers are called proxy cache servers. Caching increases the performance of the network by decreasing the amount of data transferred from outside of a local network. To implement proxy caching,each workstation on the network is configured as a proxy client for a specific service.For example,a Web proxy client would configure his or her browser to acknowledge the proxy server.When the client makes a Web browser request to download a certain Web page,the client’s browser makes the request to the proxy server.The proxy server has a cache of recently visited Web pages.This cache contains Web pages that workstations throughout the network have recently downloaded. www.syngress.com
138_linux_10 6/20/01 9:50 AM Page 509 Deploying the Squid Web Proxy Cache Server • Chapter 10 509 The proxy server checks its cache to see if the Web page exists.If the page exists in the cache,then the cached page is sent to the client.If the page does not exist in the cache,the proxy server downloads the client’s Web page from the specific Web site,enters it into the cache,and sends the page to the workstation. To ensure that the Web pages in the proxy cache are not out of date,proxy cache data expires after a preset time.In the Squid program,this setting is called the object refresh time.The refresh time ensures that old data is not transferred to the proxy clients. This process increases network performance because the Web page is imme- diately downloaded to the client from the proxy server without having to down- load the Web page from the Internet each time.This speeds up Internet access on the network and saves bandwidth.This seemingly simple operation of adding a small amount of data to a Web cache has a significant impact on browsing speed and bandwidth usage over the network.The Web proxy concept is shown in Figure 10.1. Figure 10.1 Demonstrating a Proxy Server’s Web Caching Function Send Web Page to Yes Workstation Web Is Web Page in No Download Web Page Page to Internet Request Proxy Cache? from Proxy Cache Workstation Proxy Server Web Browser NOTE One benefit of proxy servers is that the proxy administrator can add rules to filter content. For example, you can filter out Web page requests that contain certain words in the address. If a supervisor from marketing complains that his marketing personnel are spending all of their time looking for other jobs, he could have the administrator create proxy rules to filter out the addresses of popular job search sites, denying all requests for, say, www.needajobfast.com! www.syngress.com
138_linux_10 6/20/01 9:50 AM Page 510 510 Chapter 10 • Deploying the Squid Web Proxy Cache Server NOTE The correct term for cached content, such as text files, sound files, video clips, etc., is object. Table 10.1 lists the advantages of using a proxy-caching server. Table 10.1 Benefits of Proxy Caching Benefit Description Reduced bandwidth costs Internet infrastructure costs are reduced significantly because proxy caching reduces bandwidth usage. Increased network The network runs faster because less bandwidth performance is used to access the Internet. Increased network Even networks that have a great deal of band- performance during traffic width can experience traffic spikes during major spikes events, such as a popular video-streamed broad- cast. Caching can help prevent these slow response periods. Load balancing Caching servers can cache Web site objects to balance the original Web server’s load. Cache aborted requests If a user aborts a download, proxy caches can continue to download the object so it will be available to the next user. Functions when Internet If your Internet connection fails, the proxy cache connection is down will log the error and send the requested objects (if available, including out-of-date objects) from the cache. The impact of a large-scale Internet outage is reduced. Network Address Translation The proxy cache is only one mechanism of a proxy server.Many proxy servers are distributed with the ability to support Network Address Translation (NAT). NAT allows a company’s internal network address to be hidden from the Internet.The company is represented on the Internet as one IP address that is not related to the company’s internal IP addresses. www.syngress.com
138_linux_10 6/20/01 9:50 AM Page 511 Deploying the Squid Web Proxy Cache Server • Chapter 10 511 NOTE NAT is technically the function of a network-level gateway, but many vendors, such as Microsoft, include this functionality in their proxy server products. Using a proxy server,all Internet-bound traffic within the company is sent to the proxy server.The proxy gives each packet another IP address before transmit- ting it across the Internet.When the response packet arrives,the proxy server sends it to the appropriate company host who made the initial request.This pro- cedure protects the actual addresses of the internal network from the Internet. Therefore,it is much more difficult for a hacker to attack a system,since the address of the protected system is unknown and is not accessible directly from the Internet.Figure 10.2 shows the NAT process using a proxy server. Figure 10.2 Demonstrating the Network Address Translation (NAT) Function 192.168.10.20 All Company Hosts are represented by the Proxy Server address of 24.130.10.205 on the Internet. 192.168.10.10 24.130.10.205 Company Ethernet Internet Proxy Server with NAT 192.168.10.30 192.168.10.22 This chapter focuses on the caching services of a proxy server by implementing the Squid Web Proxy Cache service.NAT is presented so you will understand this network-level gateway service that is often added to proxy servers. www.syngress.com
138_linux_10 6/20/01 9:50 AM Page 512 512 Chapter 10 • Deploying the Squid Web Proxy Cache Server Differentiating between a Packet Filter and a Proxy Server It is common to confuse a packet filter with a proxy server.Both services are placed on the network edge.Both serve as an intermediary between a LAN and the Internet.Both have the capability to filter traffic transmitted in to and out of the network.Both use rules to determine whether certain traffic is allowed to pass through the server or be discarded.So,you may ask,what is the difference? Basically,a packet filter does not go as deep into a packet as a proxy server.A packet filter analyzes traffic at the Network (Layer 3) and Transport layers (Layer 4) of the Open Systems Interconnection (OSI) reference model.For example,a packet filter determines whether it will allow a certain IP address or IP address range to pass through.If your network is attacked from a consistent range of source IP addresses,you can create a rule to discard all packets that originate from that IP address range.You can also filter traffic by service,or port number.For example,you could create a rule to discard all traffic directed at certain listening ports,such as FTP,rlogin and Telnet traffic,or within a port number range.You can also filter ICMP packets by type/code,which allows you to discard only cer- tain types of ICMP traffic.This is helpful in protecting yourself from common distributed denial-of-service (DDoS) attacks.Because packet filters work at these layers,they are often implemented on routers at the network edge. A proxy server is capable of analyzing packets at the Application layer (Layer 7) of the OSI model.This allows much more flexibility,because the traffic within one service,such as port 80 (HTTP) traffic,can be filtered.As mentioned earlier, this allows proxy servers to analyze HTTP or FTP traffic,and determine whether the traffic will pass through.If a rule exists that prevents any Web address with “jobs”in it,then any HTTP URL request with “jobs”in it will be discarded.You will implement a Web proxy cache server in the next section.A proxy server is usually installed on an application server at the network edge.Figure 10.3 shows one of the differences between a packet filter and a proxy server. In this chapter,you will implement a proxy server with Web caching services. The proxy server you will install,configure,and run is the Squid Web Proxy Cache,which is a Unix full-featured Web proxy cache. www.syngress.com
138_linux_10 6/20/01 9:50 AM Page 513 Deploying the Squid Web Proxy Cache Server • Chapter 10 513 Figure 10.3 One of the Differences between a Packet Filter and a Proxy Server Workstation Caches HTTP and FTP traffic, other URLs, and DNS lookups. Also filters URLs based on content. Company Ethernet Internet IP Packet Filter Web Proxy Cache Server and Router Printer Filter packets based on IP addresses, IP Workstation address ranges, and TCP/UDP port numbers and ranges. Implementing the Squid Web Proxy Cache Server The Squid Web Proxy Cache server is a free,Unix open source Web proxy cache. It allows administrators to set up a Web proxy caching service,add access controls (rules),and even cache DNS lookups.The Squid home page is located at www.squid-cache.org,as shown in Figure 10.4. Figure 10.4 Squid Web Proxy Cache Home Page www.syngress.com
138_linux_10 6/20/01 9:50 AM Page 514 514 Chapter 10 • Deploying the Squid Web Proxy Cache Server NOTE It is important to point out that Squid is a Web proxy-caching server only. It does not support other proxy functions, such as NAT or firewall functions. Squid originated from a program developed by the Harvest project called cached (Cache Daemon).The National Science Foundation (NSF) funds Squid development through the National Laboratory of Network Research (NLANR). Squid is a Web proxy cache that conforms to the HTTP 1.1 specification.It is used only by proxy clients,such as Web browsers,that access the Internet using HTTP,Gopher,and FTP.Furthermore,it does not handle the majority of Internet protocols.That means that it cannot be used for protocols that support applications such as videoconferencing,newsgroups,RealAudio,or video games such as Quake. The main reason for this limitation is that Squid does not support client programs that use UDP.Squid uses UDP for inter-cache communication only. Any client protocol supported by Squid must be sent as a proxy request in HTTP format.Most browsers support this function,so the following client pro- tocols are supported on most networks that implement Squid: (cid:2) FTP (cid:2) HTTP (cid:2) Secure Sockets Layer (SSL) (cid:2) Wide Area Information Server (WAIS) (cid:2) Gopher The protocols will work if you request them using your browser,and if your browser is configured as a proxy client to the Web proxy-cache server.You will accomplish this task later in the chapter. Squid also supports internal and management protocols.These protocols are used between caches that might exist on different (or the same) proxy-caching servers,or for managing a proxy cache.The supported inter-cache and manage- ment protocols are: (cid:2) Internet Cache Protocol (ICP) Queries other caches for a specific object. www.syngress.com
138_linux_10 6/20/01 9:50 AM Page 515 Deploying the Squid Web Proxy Cache Server • Chapter 10 515 (cid:2) Cache Digest Retrieves an object index from other caches. (cid:2) HTTP Retrieves objects from other caches. (cid:2) Hypertext Caching Protocol (HTCP) Currently being added to Squid (not implemented on a wide scale yet). (cid:2) Simple Network Management Protocol (SNMP) Retrieves infor- mation about the proxy cache and sends it to a Network Management Station (NMS) for analysis. Despite these limitations,Squid is very popular because the Web proxy-cache services are integral to almost all networks connected to the Internet.For example,the products listed in Table 10.2 are based on Squid. Table 10.2 List of Commercial Products Based on Squid Product Description CacheRaq4 Squid-based proxy cache designed for Linux with a MIPS CPU. Sun Microsystems acquired Cobalt, the creator of this product. Tsunami Squid-based proxy cache that runs on Linux. Swell Technologies is the creator of this product. CacheXpress Squid-based proxy cache created by Industrial Code and Logic (INDCL). Includes a version for Windows. Netfilter4.1 A monitoring and traffic management program based on Squid and developed by nXp Technologies. N2H2 Provides products for filtering solutions. For example, their N2H2 for Microsoft Proxy 2.0 and N2H2 for ISA add enhanced content filtering to these products, and are based on Squid. These commercial products are supported by their various vendors.Therefore, technical support is available in case you run into any problems.Squid is supported by Visolve.com,which provides free basic support for open source products.These products include Squid,Apache,and Linux itself.Their Web site is located at www.visolve.com.The Squid site contains links to Visolve.com—use their free services at your own risk.The Visolve.com Web site is shown in Figure 10.5. www.syngress.com
138_linux_10 6/20/01 9:50 AM Page 516 516 Chapter 10 • Deploying the Squid Web Proxy Cache Server Figure 10.5 Free Basic Support for Squid and Other Open Source Products at Visolve.com System Requirements Specific to Proxy Caching By nature,Squid uses certain system resources more than others do.The two main hardware subsystems that Squid (or any other proxy cache) uses heavily and must therefore perform well are the disk random seek time and the amount of system memory. (cid:2) Disk random seek time When you purchase a disk,the documenta- tion should include a random seek time number.For a proxy cache, make sure this number is as low as possible.The problem is that oper- ating systems try to speed up disk access times using various methods that usually slow the system’s performance. (cid:2) Amount of system memory RAM is also extremely important when using a proxy cache.Squid keeps an in-memory table of its objects in RAM,which should always remain in RAM.If part of the table goes to swap,the performance of Squid is greatly degraded.Squid is one pro- cess,so any swapping will slow the program.To give you an idea of the object index size,if you have 16GB of objects stored in your cache,you will require approximately 96MB of RAM for the object index.Ensure you have as much RAM as possible in the system. www.syngress.com
138_linux_10 6/20/01 9:50 AM Page 517 Deploying the Squid Web Proxy Cache Server • Chapter 10 517 Other system requirements,such as CPU speed,are not as important. Processor speed will be noticed during startup when the system must determine the contents of its cache and create the object index.Other than that,a single CPU system usually performs well.A multiprocessor system does not usually make a difference in the proxy cache performance because Squid contains a small portion of threaded code. Installing Squid Squid is provided as an RPM package in Red Hat Linux.If you completed a custom installation and installed everything on your Red Hat Linux system,then Squid is already installed.If not,you need to download it at a trusted site,or install it from your Red Hat CD.We have provided version 2.3 on the com- panion CD (squid2.3.STABLE4-1.i386.rpm).You can also download the source files and compile it.The source code is beneficial because it allows you to turn on some compile-time options that are not included in the binary version.For example,SNMP support is not included in the binary version.If SNMP support is required,you must download and compile the source version of Squid. The Squid developers only create the source code,but they concentrate on making it as portable as possible.Therefore,other developers are responsible for porting to the different operating systems.The following operating systems have Squid available: (cid:2) Linux (cid:2) SCO Unix (cid:2) BSD/OS (cid:2) NetBSD (cid:2) MkLinux (cid:2) Solaris (cid:2) NeXTStep (cid:2) OS/2 Warp (cid:2) AIX The location of each of these download sites is available at www.squid-cache .org/platforms.html.This Web site changes as Squid is ported to new operating systems.If your operating system is different from Linux,then download the corresponding version from the site,as shown in Figure 10.6. www.syngress.com
138_linux_10 6/20/01 9:50 AM Page 518 518 Chapter 10 • Deploying the Squid Web Proxy Cache Server Figure 10.6 Downloading Ported Versions of Squid for Multiple Platforms WARNING When you download binary RPMs, always make sure that you are down- loading them from a trusted source. RPMs are installed as root, which means they can do anything to your system. They can add new users, reconfigure settings, install new files, and overwrite existing ones. It is possible that an unscrupulous programmer could purposely distribute RPMs meant to exploit and install vulnerabilities into systems. To avoid any security threats, always download your binary RPMs from a trusted source. Most vendor and open source project download sites can be trusted. You can download binary versions of squid at the Red Hat Web site at www.redhat.com.You can download the Squid development team source code from the Squid site at www.squid-cache.org/Versions/v2/,as shown in Figure 10.7.Make sure you download a stable version of Squid.Any Squid 2.x stable version will perform well on your system.Both of the Squid download sites mentioned are trusted. www.syngress.com
138_linux_10 6/20/01 9:50 AM Page 519 Deploying the Squid Web Proxy Cache Server • Chapter 10 519 Figure 10.7 Downloading the Squid Source Version from the Trusted Squid Site For the following demonstration,we’ll use the Red Hat Linux binary RPM included with the Red Hat Linux 7.x distribution.For instructions on compiling the Squid source version,visit http://squid-docs.sourceforge.net/latest/html/ x366.htm.Complete the following steps to make sure that Squid is installed on your Red Hat Linux system.
- To ensure the Squid RPM is installed on your system,enter the following: rpm –qa | grep squid
- You should receive the following response if Squid is installed: squid-2.3.STABLE4-1 If you receive this response,you are ready to configure Squid.
- If you receive no response,access www.redhat.com to click the Download link.Perform an RPM search by entering squid into the Find Latest RPMs By Keyword field.Click Search.The latest Squid version provided as an RPM will appear;in this case,it is squid- 2.3.STABLE4-1,as shown in Figure 10.8.This RPM is also located on the accompanying CD. www.syngress.com
138_linux_10 6/20/01 9:50 AM Page 520 520 Chapter 10 • Deploying the Squid Web Proxy Cache Server Figure 10.8 Downloading a Squid RPM for Red Hat Linux 7 4. Download the latest stable version of Squid. 5. Install the RPM by using the rpm –i command.Once installed,you are ready to configure Squid. Configuring Squid Once Squid is installed,you must configure it using the /etc/squid/squid.conf file.This file defines the Squid configurations,such as the HTTP port number on which Squid listens for HTTP requests,incoming and outgoing requests,timeout information,and firewall access data.During Squid installation,a /etc/squid/ squid.conf file was created. The squid.conf file is configured for the Squid configuration default settings and can be used after several changes.You must make changes because squid.conf denies access to all browsers by default.Squid is completely useless until you make changes to the squid.conf. As it states in the default Squid configuration file,if you do not need to change a default setting,then you do not need to uncomment the setting.The default Squid configuration file,/etc/squid/squid.conf,is shown in Figure 10.9. www.syngress.com
138_linux_10 6/20/01 9:50 AM Page 521 Deploying the Squid Web Proxy Cache Server • Chapter 10 521 Figure 10.9 Configuring Squid with the /etc/squid/squid.conf File Each configuration option in squid.conf is identified as a tag.Each tag is a Squid configuration.For example,the HTTP client request port setting is identi- fied as the http_port tag.We will refer to the squid.conf settings as tags. In Figure 10.9,the squid.conf file displays the Network Options section.It shows the configuration for the socket address on which Squid will listen for HTTP client requests.The default port number specified,TCP port 3128,is also the default port used by proxy clients to send requests to the proxy cache server. If you change this port on the proxy cache server,you will need to change it on the proxy clients as well. NOTE Notice that all of the tags in the squid.conf file are commented out. This means that Squid will use the default settings when no tags are speci- fied. In theory, this file could be empty, and Squid will run the defaults settings just the same. If you specify a tag, then Squid will use that tag instead of the default setting. Also note that a file containing the orig- inal default settings of /etc/squid/squid.conf is listed in /etc/squid/ squid.conf.default. www.syngress.com
138_linux_10 6/20/01 9:50 AM Page 522 522 Chapter 10 • Deploying the Squid Web Proxy Cache Server The Squid “accelerator mode”mentioned in the http_port description allows Squid to act as a Web server.Squid basically translates client Web requests by changing the destination server and port,and sends the request to a Web server. The response is cached,and Squid sends it to the client.This reduces traffic to the Web server (it “accelerates”the slow Web server) and can protect the Web server through filtering.This chapter will not demonstrate accelerator mode,but you should be aware of it. The http_port Tag The http_port tag configures the HTTP port on which Squid listens for proxy clients.By default,Squid does not listen for proxy clients on any ports.Therefore, you have to open at least one port for Squid to work using the http_port tag. The default port is 3128,as shown in Figure 10.9.Port 8080 is also often used for this service.You can configure Squid to listen on both ports by including each number in the http_port tag.In the following steps,you will configure Squid to listen on ports 3128 and 8080 for proxy clients.
- Open the /etc/squid/squid.conf file by entering: vi /etc/squid/squid.conf
- Press i to enter Insert mode.Locate the http_port setting:
http_port 3128
- Remove the comment (#) and add port 8080 to the setting by entering: http_port 3128 8080
- Your http_port tag should resemble Figure 10.10. Figure 10.10 Configuring the http_port tag to Listen on Ports 3128 and 8080 www.syngress.com
138_linux_10 6/20/01 9:50 AM Page 523 Deploying the Squid Web Proxy Cache Server • Chapter 10 523 5. Click ESC to exit Insert mode.Enter the following to write the file: :w You will configure the squid.conf file further in the next section. The Cache_dir Tag The cache_dir tag specifies where the cached data is stored.You can specify dif- ferent directories for your cache directory by using more than one cache_dir tag in squid.conf.For this demonstration,you will only use one cache directory. Figure 10.11 shows the default settings for the cache_dir tag. Figure 10.11 Configuring the cache_dir Tag in the squid.conf File By default,the following cache_dir tag value is presented: cache_dir ufs /var/spool/squid 100 16 256 The default cach_dir tag is broken down and defined in Table 10.3. www.syngress.com
138_linux_10 6/20/01 9:50 AM Page 524 524 Chapter 10 • Deploying the Squid Web Proxy Cache Server Table 10.3 Defining the Default cache_dir tag in the squid.conf File Tag Value Description cache_dir Defines the values of the cache directory used for Squid. ufs Squid assumes that a Unix file system (ufs) is used for the cache’s storage system. /var/spool/squid The directory for all cached objects will be /var/spool/squid. 100 The amount of cached data that Squid will store in the caching directory. The default cache size is 100MB. 16 Sets the number of subdirectories to create in the cache. Squid then divides the cached objects into these sub- directories to speed up disk access. For example, Squid will find an object much faster by searching several smaller directories of files, instead of one directory with several hundred thousand objects. 256 Sets the number of second-tier subdirectories to create in the cache. If your cache is extremely large, you may want to increase these values. For this demonstration, and for most implementations, these subdirectory values are sufficient. You can change these values to meet your particular needs.If you do, remember to remove the comment (#) in front of the tag to activate your changes.If you do not remove the comment,the default values will be used. For this demonstration,you will use the cache_dir tag default values.The /var/spool/squid caching directory was automatically created when Squid was installed.Verify that the default cache directory exists by completing the following steps:
- Access the spool directory by entering the following command: cd /var/spool
- List the directory contents to confirm your caching directory exists. Enter: ls
- You should receive a response similar to the following,depending on your system configuration.The squid directory is included. Anacron cron lpd mqueue rwho slrnpull up2date uucppublic voice at fax mail news samba squid ucp vbox www.syngress.com
138_linux_10 6/20/01 9:50 AM Page 525 Deploying the Squid Web Proxy Cache Server • Chapter 10 525 The acl Tag The acl tag allows you to define an access list.The access list can include client IP addresses,a range of IP addresses,a URL host’s IP address,a local socket IP address,or domains.Any access list you define using the acl tag can later be used to allow or deny requests to the cache server.For example,if you define a range of addresses using the acl tag,you can allow any system using an address from this range of IP addresses to use the proxy cache.The acl tag section of the squid.conf file is shown in Figure 10.12. Figure 10.12 Configuring the acl Tag to Define Access Lists It is important for you to define access control lists.If you do not,you will not have any definitions to create customized rules.When Squid finds a rule, such as “deny all systems from the IP address range of 192.168.3.1 through 192.168.3.254,”it will check that a corresponding acl is created that defines this IP address range. In this demonstration,you will create an access list that includes the proxy clients that will access your proxy cache server.You will define them by IP address.
- Open the /etc/squid/squid.conf file by entering (if not already opened): vi /etc/squid/squid.conf
- Locate the acl tags defaults section.Press i to enter Insert mode. www.syngress.com
138_linux_10 6/20/01 9:50 AM Page 526 526 Chapter 10 • Deploying the Squid Web Proxy Cache Server 3. Enter the following acl tags immediately after the acl localhost src 127.0.0.1/255.255.255.255 entry (your addresses will differ depending on your proxy clients): acl proxy_client1 src 24.130.8.227/255.255.252.0 acl proxy_client2 src 24.130.10.205/255.255.252.0 4. Your squid.conf file should resemble Figure 10.13. Figure 10.13 Defining Specific Proxy Clients with the acl Tag 5. Press ESC to exit Insert mode.Enter the following to write the file: :w You will configure the squid.conf file further in the next section. The http_access Tag The http_access tag permits or denies access to Squid.You can allow or deny all requests.You can also allow or deny requests based on a defined access list.If you remove all of the http_access entries,all requests are allowed by default. Proxy clients will be unable to use the Squid proxy-caching server until you modify the http_access tags.Please note that some level of access control is rec- ommended,so do not remove all of the http_access tags.The http_access tag sec- tion of the squid.conf file is shown in Figure 10.14. For this demonstration,you will set up a simple access control.You will allow only the systems on your network to use the proxy cache.Each system will be specified by its IP address,as defined in the access control list (acl tag).This system works well for small businesses.To implement access control in a larger www.syngress.com
138_linux_10 6/20/01 9:50 AM Page 527 Deploying the Squid Web Proxy Cache Server • Chapter 10 527 organization,you should create classes or users,and then allow or deny these classes.You can place stricter access control after Squid is running by viewing the documentation at www.squid-proxy.org. Figure 10.14 Configuring the http_access tag to Allow or Deny Squid Requests NOTE Squid should never be used without some type of authentication system or access control list. You must restrict Internet users from relaying requests through your Web proxy cache. To implement access control to your proxy cache,complete the following steps.In this demonstration,there are two proxy clients defined in the acl, proxy_client1 and proxy_client2,that need to use the proxy cache.By default, the localhost can already use the proxy cache.
- Open the /etc/squid/squid.conf file by entering (if not already opened): vi /etc/squid/squid.conf
- Locate the http_access tags.Press I to enter Insert mode. www.syngress.com
138_linux_10 6/20/01 9:50 AM Page 528 528 Chapter 10 • Deploying the Squid Web Proxy Cache Server 3. Enter the following http_access tags immediately before the http_access deny all entry (your acl names might differ): http_access allow proxy_client1 http_access allow proxy_client2 4. Your squid.conf file should resemble Figure 10.15. Figure 10.15 Configuring the http_access Tag to Allow Specific Proxy Clients 5. Press ESC to exit Insert mode.Enter the following to write and quit the file: :wq Always leave the default access control rules,such as http_access deny all,in your squid.conf file.These entries stop people from exploiting your cache.For example,although the last entry states http_access deny all,it still allows incoming requests from the clients you explicitly identify.All other requests will be denied. The default http_access deny entries in the first part of Figure 10.15 protect your cache from some obscure vulnerabilities.These problems include cache tun- neling with SSL CONNECTs,bandwidth loops that consume bandwidth,and other access concerns. Starting and Testing Squid You have configured Squid for your network environment.To determine if it is functioning,you must start the Squid service,and then use the Squid client pro- gram on the localhost to ensure Web page data is being written to the cache.The Squid client displays data as it is written to the cache,and is extremely helpful in proving the proxy cache is working,and when troubleshooting any problems. Complete the following steps to start and test Squid. www.syngress.com
138_linux_10 6/20/01 9:50 AM Page 529 Deploying the Squid Web Proxy Cache Server • Chapter 10 529
- Start the Squid proxy cache by entering the following: /etc/rc.d/init.d/squid start
- Test that Squid is working by using the Squid client program.Enter: client http://www.squid-cache.org
- The data written to the cache is displayed in your terminal,as shown in Figure 10.16.If no data is written,you need to revisit the squid.conf file and determine any incorrect configurations. Figure 10.16 Testing Squid Using the Squid Client to Witness Web Page Data Written to the Proxy Cache You have successfully started and tested the Squid Web Proxy Cache server. Now you must configure proxy clients to use the cache.You will learn how to configure a proxy client in Netscape Navigator,Internet Explorer,and Lynx. Configuring Proxy Clients A proxy client is a system that uses the services of a Web proxy-caching server. Depending on your network configuration,a client may or may not have to be configured as a proxy client in order to use a Web proxy cache server.For www.syngress.com
138_linux_10 6/20/01 9:50 AM Page 530 530 Chapter 10 • Deploying the Squid Web Proxy Cache Server example,some firewalls are configured to forward all port 80 traffic leaving the network to the Web proxy cache server.In this case,the proxy clients do not need manual configuration.In other cases,the client automatically detects the proxy server information on the network and uses it for all Internet access.For this demonstration,you will configure a proxy client to use your Squid Web Proxy Cache. Configuring a proxy client is far easier than configuring Squid.All proxy client configuration is completed within the browser application.This demonstration will show you how to configure three browsers for a proxy server.One system is a Linux system running Netscape Navigator and Lynx.The other system is a Microsoft Windows Millennium Edition system running Internet Explorer. NOTE The proxy clients you configure in this demonstration must be the same proxy clients you added to the /etc/squid/squid.conf file. Configuring Netscape Navigator and Lynx In this demonstration,you will configure Netscape Navigator and Lynx on a Linux system.The client configured in the following steps is the proxy_client2 acl entry from the squid.conf file. Configuring Netscape Navigator In this section,you will configure the Netscape Navigator browser so it sends all Web requests to the Squid Web Proxy Cache server.
- Log in to a Linux proxy client that you configured in squid.conf.
- Start X Windows by entering: startx
- Open Netscape Navigator.
- Click the View menu,and choose the Preferences option.
- In the Category column,expand the Advanced tree and click Proxies.The proxy configuration window appears.Your screen will resemble Figure 10.17.
- Click Manual proxy configuration.View will activate.Click View. www.syngress.com
138_linux_10 6/20/01 9:50 AM Page 531 Deploying the Squid Web Proxy Cache Server • Chapter 10 531 Figure 10.17 Configuring a Network Proxy for Netscape Navigator 7. You can configure a proxy for each Internet protocol that Netscape sup- ports.Enter the IP address of the Squid Web Proxy Cache server in the HTTP Proxy field.For example,if your Squid system was 24.130.8.170 and you configured Squid to listen for cache request on port 3128,you would enter the values shown in Figure 10.18. NOTE Squid supports caching for the additional Internet protocols. For this demonstration, we are only testing Web page caching. 8. Click OK twice to return to the browser. 9. In Netscape Navigator,enter the following URL:www.squid-cache .org. 10. The Squid home page will appear.If not,your browser proxy settings are incorrectly configured. www.syngress.com
138_linux_10 6/20/01 9:50 AM Page 532 532 Chapter 10 • Deploying the Squid Web Proxy Cache Server Configuring Lynx In this section,you will configure the Lynx command-line browser so it sends all Web requests to the Squid Web Proxy Cache server.Pico is used in this demon- stration to facilitate the search.You can use any text editor you choose.
- Access the Linux lynx configuration file by entering: pico /etc/linux.cfg
- Press ALT+W to receive a search prompt.At the search prompt,enter: #http_proxy
- Change the http_proxy configuration line from: #http_proxy:http://some.server.dom:port/ to http_proxy:http://24.130.8.170:3128
- Your screen will resemble Figure 10.19. Figure 10.19 Configuring Lynx to Use the Squid Web Proxy Cache www.syngress.com
138_linux_10 6/20/01 9:50 AM Page 533 Deploying the Squid Web Proxy Cache Server • Chapter 10 533 5. Press ALT+X to exit the file.When prompted,type Y for “Yes”to save the file,and press ENTER to write the file. 6. Use Lynx to enter the following URL:lynx http://www .squid-cache.org. 7. The Squid home page will appear.If not,your browser proxy settings are incorrectly configured. Configuring Internet Explorer (Optional) In this demonstration,you will configure Internet Explorer 5.5 on a Microsoft Windows Millennium Edition system.The client configured in the following steps is the proxy_client1 acl entry from the squid.conf file.
- Open Internet Explorer.
- Click the Tools menu and choose Internet Options.
- Select the Connections tab,and click LAN Settings.
- Deselect Automatically Detect Setting.
- In the Proxy server section,click the Use a proxy server check box.
- In the Address field,enter the IP address of your Squid Web Proxy Cache server.
- In the Port field,enter port 8080. NOTE You configured Squid to list on both ports 3128 and 8080 for caching requests. Therefore, you can configure your clients for either port.
- Your LAN Settings window will resemble Figure 10.20.
- Click OK twice to return to the browser.
- In Internet Explorer,enter the following URL:www.squid-cache.org.
- The Squid home page will appear.If not,your browser proxy settings are incorrectly configured. www.syngress.com
138_linux_10 6/20/01 9:50 AM Page 534 534 Chapter 10 • Deploying the Squid Web Proxy Cache Server Figure 10.20 Configuring Internet Explorer as a Squid Proxy Client You have successfully implemented the Squid Web Proxy Cache server on a network.You have also configured three different types of proxy clients to use Squid’s cache. www.syngress.com
138_linux_10 6/20/01 9:50 AM Page 535 Deploying the Squid Web Proxy Cache Server • Chapter 10 535 Summary In this chapter,you learned that a proxy server is an intermediary between hosts on a local area network (LAN) and the Internet.It is used to implement caching for certain services,and for security and administrative control.Proxy cache servers are implemented at the Application layer and process specific Internet protocols,such as Hypertext Transfer Protocol (HTTP) and File Transfer Protocol (FTP).Rules are set up on the proxy server to determine how a workstation request should be processed. Proxy caching increases network performance because a Web page is immedi- ately downloaded to the client from the proxy server without having to down- load the Web page from the Internet each time.This speeds up Internet access on the network and saves bandwidth.Adding a small amount of data to a Web cache has a significant impact on browsing speed and bandwidth usage,especially in large networks. You also learned the difference between a packet filter and a proxy server.A packet filter analyzes traffic at the Network (Layer 3) and Transport layers (Layer 4) of the Open System Interconnection (OSI) reference model.It can also filter traffic by service,or port number.A proxy server is capable of analyzing packets at the Application layer (Layer 7) of the OSI model.This allows much more flexi- bility,because the traffic within one service,such as port 80 (HTTP) traffic,can be filtered. To learn how a proxy cache works,you implemented the Squid Web Proxy Cache server,which is a free,Unix open source Web proxy cache.Squid is a Web proxy cache that is based on the HTTP 1.1 specification.Squid is used only by proxy clients,such as Web browsers,that access the Internet using HTTP.Any client protocol supported by Squid must be sent as a proxy request in HTTP format. Most browsers support this function,so the following protocols are supported on most networks that implement Squid.The supported client protocols are FTP, HTTP,Secure Sockets Layer (SSL),Wide Area Information Server (WAIS),and Gopher.The protocols will work if you request them using your browser and if your browser is configured as a proxy client to the Web proxy cache server. Squid also supports internal and management protocols.These protocols are used between caches that might exist on different (or the same) proxy-caching servers,or for managing a proxy cache.The supported inter-cache and manage- ment protocols are Internet Cache Protocol (ICP),Cache Digest,HTTP, Hypertext Caching Protocol (HTCP),and Simple Network Management Protocol (SNMP). www.syngress.com
138_linux_10 6/20/01 9:50 AM Page 536 536 Chapter 10 • Deploying the Squid Web Proxy Cache Server The two main hardware subsystems that Squid (or any other proxy cache) uses heavily and must therefore perform well are the disk random seek time and the amount of system memory. You installed Squid and configured it using the /etc/squid/squid.conf file. The squid.conf file is configured for the Squid configuration default settings and can be used after several changes.You must make changes because squid.conf denies access to all browsers by default.Squid is completely useless until you make changes to the squid.conf.Each configuration option in squid.conf is identified as a tag. The http_port tag configures the HTTP port on which Squid listens for proxy clients.The default port is 3128.The cache_dir tag specifies where the cached data is stored.By default,the cache_dir is located in the /var/spool/squid directory.The acl tag allows you to define an access list.The http_access tag per- mits or denies access to Squid by using the access lists defined in the acl tags. Proxy clients will be unable to use the Squid proxy-caching server until you modify the http_access tags. After you configured the squid.conf file,you started and tested Squid.You used the Squid client program on the localhost to ensure that Web page data was written to the cache. Last,you configured several proxy clients to use the Squid Web Proxy Cache server.The demonstration showed you how to configure three browsers for a proxy server:a Linux system running Netscape Navigator and Lynx,and a Microsoft Windows Millennium Edition system running Internet Explorer. Solutions Fast Track Benefits of Proxy Server Implementation (cid:59) A Web proxy cache server can cache Web pages and FTP files for proxy clients.They can also cache Web sites for load balancing. (cid:59) Caching increases the performance of the network by decreasing the amount of data transferred from outside of the local network. (cid:59) Web proxy caching reduces bandwidth costs,increases network performance during normal traffic and spikes,performs load balancing, caches aborted requests,and functions even when a network’s Internet connection fails. www.syngress.com
138_linux_10 6/20/01 9:50 AM Page 537 Deploying the Squid Web Proxy Cache Server • Chapter 10 537 Differentiating between a Packet Filter and a Proxy Server (cid:59) Packet filters analyze traffic at the Network (Layer 3) and Transport layers (Layer 4) of the OSI model.A packet filter can determine whether it will allow a certain IP address or IP address range to pass through,or filter traffic by service,or port number. (cid:59) A proxy server analyzes packets at the Application layer (Layer 7) of the OSI model.This feature provides flexibility because the traffic within one service,such as port 80 (HTTP) traffic,can be filtered. Implementing the Squid Web Proxy Cache Server (cid:59) The Squid Web Proxy Cache server allows administrators to set up a Web proxy caching service,add access controls (rules),and cache DNS lookups. (cid:59) Client protocols supported by Squid must be sent as a proxy request in HTTP format,and include FTP,HTTP,SSL,WAIS,and Gopher. (cid:59) Squid is configured using the /etc/squid/squid.conf file,which defines configurations such as the HTTP port number on which Squid listens for HTTP requests,incoming and outgoing requests,timeout informa- tion,and firewall access data. (cid:59) Each configuration option in squid.conf is identified as a tag.The http_port tag configures the HTTP port on which Squid listens for proxy clients.The cache_dir tag specifies where the cached data is stored.The acl tag allows you to define an access list.The http_access tag permits or denies access to Squid.Squid will not function until you make changes to the squid.conf file. Configuring Proxy Clients (cid:59) Firewalls can be configured to forward all port 80 traffic leaving the net- work to the Web proxy cache server—clients do not need manual con- figuration.In other cases,proxy clients automatically detect the proxy server information on the network and use it for all Internet access. www.syngress.com
138_linux_10 6/20/01 9:50 AM Page 538 538 Chapter 10 • Deploying the Squid Web Proxy Cache Server (cid:59) All manual proxy client configurations are completed within the browser application,and it’s just a matter of specifying the address of the Web proxy cache server. Frequently Asked Questions The following Frequently Asked Questions, answered by the authors of this book, are designed to both measure your understanding of the concepts presented in this chapter and to assist you with real-life implementation of these concepts. To have your questions about this chapter answered by the author, browse to www.syngress.com/solutions and click on the “Ask the Author” form. Q:What amount of system resources does Squid require? A: Squid does not require an extremely fast processor;physical memory is the crucial resource.For high-volume caches,fast disks are important because the bottleneck generally occurs at the disk system.If possible,you should avoid using IDE disks if you want to run Squid. Q: Does Squid support any security protocols such as HTTPS,SSL,or TLS? A: Squid offers limited support for secure protocols in that it “tunnels”or relays encrypted bits between clients and servers. It provides an alternative to the direct SSL connection that a browser generally opens when it encounters an https://-prefixed URL.For HTTPS requests,Squid uses the CONNECT request method to tunnel the request from the browser.The CONNECT method enables tunneling of any con- nection type through an HTTP proxy.Proxies simply transport bytes between clients and servers,ignoring the connection’s contents.This provides secure transmission of the data passed from the browser to the server. Q: Can I run Squid behind a firewall? A:Yes.However,if Squid is behind a firewall,it cannot directly access the Internet.Therefore,you must use a parent cache for all connections. You can dictate which requests to forward to the parent cache outside the firewall by adding the never_direct access list to your squid.conf file.For example,suppose you want all servers to connect through your parent cache www.syngress.com
138_linux_10 6/20/01 9:50 AM Page 539 Deploying the Squid Web Proxy Cache Server • Chapter 10 539 except those servers whose names end with safedomain.org.You could add the following code to squid.conf: acl INSIDE dstdomain safedomain.org never_direct deny INSIDE Any domains that do not match the INSIDE acl will be excluded.If no domains are specified,then the opposite of the last action will occur by default:Essentially,never_direct allow all would be the default rule applied. Alternatively,you can use IP addresses instead of domain names to specify your internal servers,as shown in the following code: acl INSIDE_IP dst 207.58.100.45/24 never_direct deny INSIDE Consider that when using IP addresses instead of domain names,Squid must first convert URL host names to IP addresses by performing DNS lookups.Your DNS service might be unable to resolve external domains. If you use more than one parent cache and you want to include the never_direct access list in squid.conf,then it is advisable to specify one parent cache as the default,as shown in the following code: cache_peer abc.safedomain.org parent 3128 0 default By using the default keyword in the cache_peer line,Squid doesn’t have to decide which parent cache to use. Q: I need to configure my cache_dir setting.At what size will my cache direc- tory run Squid most effectively? A:Administrators generally dedicate a disk partition to the Squid cache.It is advisable to leave some space available rather than using the entire partition, however,because Squid may behave unpredictably if disk space runs out. Consider a 20GB disk,which will actually yield about 19GB of usable space.If you place and mount a file system on this disk,and then use the df program to determine the available space,you will see that some disk space is lost to file system overheads (such as inodes,directory entries,superblocks, etc.).Further consider that Unix generally reserves about 10 percent of disk space.Therefore,after formatting a 20GB disk,you probably have only about 18GB available for your use. www.syngress.com
138_linux_10 6/20/01 9:50 AM Page 540 540 Chapter 10 • Deploying the Squid Web Proxy Cache Server In addition,the Squid swap.state files that reside in each cache directory generally grow until the logs are rotated or Squid is restarted.Therefore,it is advisable to reserve an additional 10 percent for these Squid overheads.The more free space Squid has,the better it performs,so you may want to reserve still more space to allow Squid that freedom.Considering all these factors,a cache_dir setting of 14000 to 16500MB is advisable for a 20GB disk.You can configure your cache_dir setting using the following code: cache_dir ... 16000 16 256 Try this conservative setting initially,and then check the disk usage once the cache is full.You can increase the cache_dir setting gradually if you find that you have extra free disk space.You need to decrease your cache size immediately if you receive any “disk full”write errors. Q: I want to locate the largest objects in my cache.Is there a command I can use to do this? A: Enter the following command in Squid to return a list of the objects in your cache that are taking up the most space: sort -r -n +4 -5 access.log | awk '{print $5, $7}' | head -25 Q: How can I restart Squid with an empty cache? A: Use the % squid -k shutdown command to stop Squid before attempting to restart.There are a couple of methods you can use to restart Squid with a clean cache.The fastest is to overwrite the swap.state files for each cache directory.When using this method,leave a single byte of garbage in the swap.state file.It is ineffective to reduce the file size to zero or delete the file completely.For each cache directory,use the following command: % echo "" > /cache1/swap.state Do not change ownership or permissions on the swap.state files.After you have modified the file for each directory,restart Squid. Another more time-consuming method for this operation involves recre- ating all the cache directories.Before doing this,you must move the existing directories to another location,as demonstrated with the following code: www.syngress.com
138_linux_10 6/20/01 9:50 AM Page 541 Deploying the Squid Web Proxy Cache Server • Chapter 10 541 % cd /cache1 % mkdir TEMP % mv ?? swap.state* TEMP % rm -rf TEMP & Use the same process for each cache directory.Then issue the squid -z command and Squid will create the new directories for you.When you restart Squid,the cache will be clean. www.syngress.com
138_linux_10 6/20/01 9:50 AM Page 542
138_linux_11 6/20/01 9:51 AM Page 543 Chapter 11 Maintaining Firewalls Solutions in this chapter: (cid:2) Testing Firewalls (cid:2) Using Telnet, Ipchains, Netcat, and SendIP to Probe Your Firewall (cid:2) Understanding Firewall Logging, Blocking, and Alert Options (cid:2) Obtaining Additional Firewall Logging Tools (cid:59) Summary (cid:59) Solutions Fast Track (cid:59) Frequently Asked Questions 543
138_linux_11 6/20/01 9:51 AM Page 544 544 Chapter 11 • Maintaining Firewalls Introduction Regardless of the type of firewall you deploy,you will have to test and maintain it carefully.You need to actively monitor your firewall so that you can discover scanning attacks,connection attempts,and general weaknesses.Of course,you will have to scan your firewall to ensure that all extraneous ports and daemons are closed.You can use a scanner such as Nessus (www.nessus.org) to do this. However,even an application such as Nessus cannot implement the specific attacks necessary to truly test your firewall.In this chapter,you will learn about how to properly test and log activity.You will be able to verify that the firewall is working,make intelligent changes on demand,and generate useful reports. This chapter focuses on applications such as Telnet,Netcat,and SendIP,and Nmap to query the firewall.Doing so will help you determine if your firewall is truly protecting your network.Just one accidental omission of a rule can open a hole that could allow a hacker into your network. You may never know that a hacker has entered your network unless you carefully monitor your firewall logs.Doing so is sometimes an unglamorous, thankless job.However,using applications such as Firedaemon and Fwlogwatch, both of which are profiled in this chapter,you can receive automatic alerts. Fwlogwatch can even automatically reconfigure your firewall for you in case of a scanning attack.Even if you choose to not automatically block traffic,using the testing and logging tools discussed in this chapter you can maintain your firewall so that it is blocking and allowing the right traffic for your business. Testing Firewalls Before you can start logging access to your firewall,you need to ensure that you have configured it correctly in the first place.Even if you have extensive experi- ence configuring firewalls,you will have to test your implementation when you first install it.In fact,experienced professionals know that they have to continu- ally test a firewall to ensure that it is properly configured,and that its current configuration protects the network.It is not enough to just check or read the Ipchains/Iptables rules and then think that you have properly tested the firewall. You need to actively send packets and monitor your firewall and internal net- work to be sure. Before you learn about applications that can help you test your firewall,you first need to consider some of the actual attacks,problems,and issues to look for. When testing your firewall,consider the following: www.syngress.com
138_linux_11 6/20/01 9:51 AM Page 545 Maintaining Firewalls • Chapter 11 545 (cid:2) Internet Protocol (IP) spoofing Many hackers outside of the firewall try to imitate internal network hosts in order to bypass authentication. (cid:2) Open ports/daemons Many firewalls and/or routers allow unneces- sary ports to remain open,which can expose your firewall to threats unnecessarily. (cid:2) Monitoring system hard drives, RAM, and processors If your firewall runs out of disk space,or begins to run low on memory,your network may become incapacitated.Check your server’s performance regularly using standard tools (df,vmstat,top,and so forth). (cid:2) Suspicious users, logins, and login times Even if you allow only interactive login at your firewall,monitor it carefully to determine who has logged on.It is vital that you know exactly who is controlling the flow of packets on your network. (cid:2) Check the rules database One of the common moves by a hacker is to alter the rules database in subtle ways that make it easier for the hacker to gain access to the network.Check your rules and compare them carefully to ensure that no unauthorized changes have occurred. (cid:2) Verify connectivity After you have configured or reconfigured your firewall,make sure that these changes do not cause problems for management and employees. (cid:2) Remain informed concerning the operating system Bugs may be discovered in the kernel and/or daemons that you are using.If you do not keep current concerning the tools you are using,you may end up exposing yourself to hackers. (cid:2) Port scans If you are relatively new to securing firewalls,you will be amazed to find out how many times your firewall will be scanned. Logging all scans can consume an unnecessary amount of hard drive space and processor time.Still,the proper amount of logging will help you remain informed and will help you document scans that may be preludes to an attack. Following is a more detailed discussion concerning each of these issues. www.syngress.com
138_linux_11 6/20/01 9:51 AM Page 546 546 Chapter 11 • Maintaining Firewalls IP Spoofing Your firewall should not allow any packets to pass from outside the network into your internal network if the source address is the same as any host in your internal network.Suppose,for example,that your external network interface card (NIC) has the IP address of 128.1.2.3.4/16,and your internal NIC has the address of 192.168.1.0/24.You then need to find a way to test your firewall to see if any traffic is passing through the external interface from,say,the 192.168.1.1 IP address. If such packets are able to traverse your firewall,then a hacker can configure his or her system to use your firewall as a default gateway and participate on your network.Leaving your packet-filtering firewall open to spoofing attacks largely obviates the reason for having a firewall,so you should take every step to test exactly what your firewall drops and allows.If you require,for example,your end users to have access to the World Wide Web,you will find that it is necessary to allow ephemeral ports (any port over 1023) to access the Internet.However,if you are using private IP addresses (e.g.,the 192.168.45.0 network),no system outside of the firewall should ever be able to assume this IP address and access your internal network’s ephemeral ports. Open Ports/Daemons Your firewall should be as secure as possible.Disable all unused services and con- figure the used ones with security in mind.If you are running Squid or another proxy server on the firewall,make sure that only this port is open.Daemons such as Telnet,File Transfer Protocol (FTP),Hypertext Transfer Protocol (HTTP) and others should be shut down in almost all situations.In many situations,you may require the ability to remotely administer your firewall.Still,consider disabling all login to the outside interface. In many situations,it is best to allow only interactive logins at your firewall. This way,you need only secure the firewall’s physical security.If you must,use only a relatively secure login application,such as Secure Shell (SSH).You could also consider Kerberos,although this requires you to open several additional ports.Even using one-time passwords (OTP) at the firewall is a solution,although the use of OTP does not encrypt the data that subsequently passes from your system to the router.If you do need to leave certain ports open,be prepared to conduct regular scans of your firewall to test the daemons listening on these ports.As suggested earlier,applications such as Nessus (www.nessus.org) are ideal in this type of situation. www.syngress.com
138_linux_11 6/20/01 9:51 AM Page 547 Maintaining Firewalls • Chapter 11 547 Monitoring System Hard Drives, RAM, and Processors Firewall logs can consume hard drive space,especially in busy networks.If you configured your firewall to log both accepted incoming and outgoing access,you will find that your log files will grow very large in a short period of time.You may need to cut back on your log settings.However,if you cannot do this,regu- larly use the df -h command to discover the total amount of hard drive space you have left.You could,for example,create a simple crontab entry that sends you this information automatically every Monday at 8:05: 5 8 * * mon df -h | mail -s "HDRIVE" security.manager@yournetwork.com Of course,keeping the cron daemon enabled on your firewall can present its own problems,because it will require you to ensure that this daemon is not sub- ject to bugs that can cause a security problem.Any daemon,such as Cron,that acts automatically can cause problems if misconfigured,so carefully review all default scripts,and you will be in good shape.It is an additional service,after all. You will have to make the decision yourself. Following is a quick overview of standard Linux tools that can help you determine if your system is becoming overburdened: (cid:2) vmstat Informs you about the amount of random RAM and virtual RAM used on the system. (cid:2) top Used to inform you about the processes that occupy the largest percentage of CPU time.The busiest processes rise to the top of the dis- play.The Gtop and Ktop applications,both available from www.rpmfind.net,are graphical versions that are somewhat easier to use than the original. Suspicious Users, Logins, and Login Times Use the who and last commands to learn about who has logged in to the fire- wall.In addition,manually check the /etc/passwd and /etc/shadow files to deter- mine if any users have been added.An application such as Tripwire can be extremely helpful if you wish to remain informed about any changes to such files. www.syngress.com
138_linux_11 6/20/01 9:51 AM Page 548 548 Chapter 11 • Maintaining Firewalls Check the Rules Database Determine if any unauthorized changes have been made to your database.When you first created your firewall,you should have created a backup using either the ipchains-save or iptables-save commands.Use the diff command to compare the two files to see if any changes have occurred.You may also use md5 to gen- erate fingerprints of the configuration files to see whether any unauthorized changes have been made to them. Truly talented hackers are interested in entering a network and then control- ling it without your knowledge.Accordingly,many will deactivate certain logging rules on your firewall,and then activate them again.If you leave the ipchains or iptables commands on your system,this will be very easy.To at least slow down the hacker,try removing these applications from the system.This way,the hacker will at least be forced to install these applications on your system before he or she can manipulate it.If you have Tripwire installed,you will then be informed of massive changes to the hard drive. Verify Connectivity with Company Management and End Users After you install your firewall,check with various managers and employees to ensure that your firewall rules are working properly.You may have to further adjust your firewall to ensure that the right services are available to the company. You may have to inform people about certain services that are no longer available by design.Otherwise,you will receive help desk calls informing you that service has been interrupted. Employee education is often necessary whenever you make any changes to the firewall.Otherwise,you will receive complaints that the network is “down,” when in fact it is behaving according to your design.In order to cut down on ill will and employee frustration,find ways to carefully and tactfully inform employees concerning changes.Consider the following suggestions: (cid:2) Contact management and make sure that they understand and agree with the changes you are making. (cid:2) Many times,upper management will ask for certain changes and not quite understand how this will affect the end user.Decisions to cut off certain services (e.g.,Web traffic,or access to outside Post Office Protocol v3 [POP3] accounts) may negatively affect the company’s ability to conduct business,or may cause unnecessary problems with www.syngress.com
138_linux_11 6/20/01 9:51 AM Page 549 Maintaining Firewalls • Chapter 11 549 employee morale.Make sure that upper management understands the ramifications of any suggestions they make. (cid:2) Warn employees before any changes to the security policy/firewall rules will occur. (cid:2) Remind employees that changes have occurred. (cid:2) Use e-mail,word of mouth,and employee area bulletin boards to remind people about changes. Remain Informed Concerning the Operating System New bugs are found every day in any operating system.It is possible that a bug may be found in Ipchains/Iptables or the kernel that could be exploited.If you do not subscribe to the appropriate mailing lists (see www.cert.org and www.sans.org),you should.It is also likely that the version of Linux you are using has a newsgroup associated with it. The following are some additional strategies: (cid:2) Join mailing lists associated with your operating system. (cid:2) Carefully consider upgrades.Update only when you are certain that an upgrade enhances both your system’s security and functionality.Do not upgrade simply because an upgrade exists.Just because an upgrade offers a new feature does not mean that this upgrade will allow your system to remain secure.Added features often add complexity to your system,and such changes open a security hole unless you take the time to properly study the changes and alter your system’s configuration. (cid:2) Network with fellow systems administrators.Share your concerns and solutions with others.You will find that doing so will greatly increase your awareness of the many security solutions that exist. Port Scans Ipchains/Iptables-based firewalls are classic examples of packet-filtering firewalls. This type of firewall has traditionally been vulnerable to scanning attacks;they can simply allow scans to occur without informing anyone,because packet filters generally do not pay attention to Transmission Control Protocol (TCP)-based connections.They are interested,rather,in filtering out IP addresses and ports www.syngress.com
138_linux_11 6/20/01 9:51 AM Page 550 550 Chapter 11 • Maintaining Firewalls (i.e.,they pay attention to the Network layer of the Open System Interconnection Reference Model OSI/RM). The introduction of log analysis software such as Firelogd and Fwlogdaemon have made it possible to detect and block such scans,all the while sending an alert to the systems administrator.This type of software can help reduce a fire- wall’s exposure to distributed denial-of-service (DDoS) attacks,because it helps the firewall completely drop certain hosts.However,this strategy introduces new problems,because it is possible for attackers to spoof source IP addresses and assume the identity of hosts you trust.The result is that hackers can use your own strategies against you and make your own software conduct a DoS attack against you by blocking your network from its own Domain Name System (DNS) servers,default gateways,and other hosts that you trust implicitly.However,most adjunct software,such as Fwlogwatch,provides ways to exclude trusted hosts from being blocked.You will learn more about this later in this chapter. NOTE As long as unencrypted, non-IPsec versions of IPv4 remain the most com- monly used version of the Internet Protocol, spoofing will remain a fact of life. If you find that spoofing attacks keep occurring against your net- work, you can take the following actions: (cid:2) Edit the configuration files of your log-watching software and increase thresholds to eliminate false positives. (cid:2) Carefully manage any Ipchains/Iptables entries created by your log-scanning software so that sensitive hosts are not blocked. These strategies are ways that you can mitigate and manage spoofing attacks, as opposed to eliminating them, because until all systems use IPSec or move to IPv6, there is really no way to completely eliminate them. Even when IPSec and/or IPv6 become common, it is likely that hackers will find newer and cleverer ways to spoof these protocols as well. Using Telnet, Ipchains, Netcat, and SendIP to Probe Your Firewall Now that you understand what to look for,you can use the following tools to help you: www.syngress.com
138_linux_11 6/20/01 9:51 AM Page 551 Maintaining Firewalls • Chapter 11 551 (cid:2) Rule checkers Although Iptables does not support rule checking,the ipchains -C command allows you to check how your existing rule set operates.It will return information as to whether the packet is dropped or accepted.It is up to you to act on this information. (cid:2) Port scanners A simple port scan can help you determine which ports are left open on your firewall.Using applications such as Telnet and Netcat,you can then determine what daemon is listening behind that port. (cid:2) Packet generators Using applications such as SendIP,you can generate packets designed to test whether your firewall rules are working properly. Following is a discussion of some tools that allow you to quickly test your firewall rules. Ipchains The ipchains -C option allows you to send packets to test whether the rules you have created work properly.Iptables does not have the equivalent,as of this writing.When checking Ipchains rules,you simply place -C (make sure you use the uppercase C) in front of the rule.The --check and -C options,by the way, are equivalent.You will be informed if the packet is blocked.For example,sup- pose you create the following rule in Ipchains: ipchains -I input -i eth0 -s 0/0 -d 0/0 -p icmp -j DENY To test this rule,you would issue the following command on the same system: ipchains -C input -i eth0 -p icmp -s 0/0 1 -d 0/0 1 Ipchains will then inform you that the packet is denied.This tool is handy if you are logged in to the same system as you are testing,and you are becoming familiar with the existing rules and wish to send out packets that test how the rules are working. Telnet More universal testing methods exist.The humble Telnet application is still useful when testing a firewall.Do not use it for logging on,however.You can use it to test whether a certain firewall rule is running the way you think it should.For www.syngress.com
138_linux_11 6/20/01 9:51 AM Page 552 552 Chapter 11 • Maintaining Firewalls example,suppose that you allow all access but that which is explicitly denied by a rule,and that you have configured the following firewall rule in Iptables: iptables –A INPUT –i eth0 –s 0/0–p tcp --dport 80 –j LOG iptables –A INPUT –i eth0 –s 0/0–p tcp --dport 80 –j REJECT You can use your Telnet client to see whether it is working properly by speci- fying the port you are blocking and logging: prompt$ telnet firewall.yournetwork.com 80 You can then view the log by using the tail command to read the file where your system stores kernel messages.For the sake of convenience,use tail’s -f option so that you can view results as they happen: tail -f /var/log/messages Using Multiple Terminals If you have logged in to the firewall interactively,it is often useful to open two terminals.You can use the first terminal to issue the telnet command,and you can use the second terminal to view the results in the /var/log/messages file. Remember that if you specify more complex logging options,and then send too many packets,the kernel will stop logging traffic after a certain period of time (three logging instances an hour,with only the first five packets logged).If you do not remember this,you may make the mistake of thinking that a certain rule is not working,when in fact it really is. Netcat You are not limited to using Telnet.One commonly used firewall testing applica- tion is Netcat,available at www.l0pht.com/~weld/netcat/ and packetstorm.secu- rify.com.Netcat is quite versatile,and is the self-described “Network Swiss Army Knife.”Hackers and systems administrators alike use it as a tool to conduct scans, communicate with open ports,and even transfer information between hosts. Because it is so versatile,it can also be used against you,so if possible,you should install this application only on a client system,rather than on the router.This is because it can be used to open a back door on your system.Still,careful use of the application can allow you to quickly audit your firewall. Used in the simplest way,Netcat is much like a Telnet client,because it can be used to access any remote host at any port.To connect to the host named fire- www.syngress.com
138_linux_11 6/20/01 9:51 AM Page 553 Maintaining Firewalls • Chapter 11 553 wall.yournetwork.com at port 80,you would issue the following command: ./nc firewall.yournetwork.com 80 You will then have to press CTRL+C to exit the program.If the port is open, you can then enter any command you wish.As far as port 80 is concerned,you can just enter some gibberish once a connection is made,and the Web server will return an error message,which usually includes the name of the Web server. Chances are,the port will not recognize your command,but for the purposes of testing a firewall,you usually want to just see if a port is open and listening.The netcat -h command provides a list of all available options,which are listed in Table 11.1 for your reference: Table 11.1 Netcat Options Option Description -i value Tells Netcat to delay sending packets for a certain number of seconds. For example, to have Netcat wait five seconds between scanning ports, you would specify -i 5. -n Has Netcat report information using only IP addresses. This option is helpful when conducting ping scans, or if you do not have any DNS support. -p value A port spoofing option. Allows you to specify the port number of the packet being sent. For example, to have a packet appear as it were sent from port 53 of a host, you would enter -p 53. -r Allows you to have Netcat scan ports at random, instead of simply one after the other. -s value Spoofs the source address of a packet. This option does not work on all systems, however. -u Netcat defaults to sending TCP packets. This option allows you to send User Datagram Protocol (UDP) packets, instead. -v Verbose mode. Reports additional information about the connec- tions you are making. If you specify -v twice (-v -v), you will receive twice the amount of information. -w value Sets the time (in seconds) that Netcat will wait at a responding port. This option is often combined with -z. -z Called “zero-I/O mode,” this option has Netcat forbid any i/o from the source system. If you do not use this option, Netcat will Continued www.syngress.com
138_linux_11 6/20/01 9:51 AM Page 554 554 Chapter 11 • Maintaining Firewalls Table 11.1 Continued Option Description “hang” indefinitely at a port that responds. This option is mostly applicable when using Netcat as a scanner. -l Has Netcat open a listening port. Used with additional options, it is possible to bind a root shell to this listening portlisten mode, which can lead to security problems. Sample Netcat Commands To use Netcat in a more sophisticated and helpful way,you must use the fol- lowing syntax: nc [-options] hostname port[s] [ports] For example,if you wish to scan ports 1 through 1023 of your firewall and ensure that Netcat will not “hang”at any ports,you could issue the following command: ./nc –z –w 2 –v –v firewall.yournetwork.com 1-1023 The -z and -w 2 options tell Netcat to not bind a port,and to wait only two seconds in case a connection is accidentally made.The two -v options place Netcat into ultra verbose mode.It is likely,though,that only certain groups of ports will be open on an unsecured firewall.For example,the following com- mand scans only certain ports and groups of ports: ./nc –z –w 2 –v –v firewall.yournetwork.com 20-30, 53, 80, 100-112, 443, 6000-6050 Analysis of Netcat Scan The preceding scan searches for ports associated with several protocols,including: (cid:2) FTP (20 and 21) (cid:2) SSH (22) (cid:2) Telnet (23) (cid:2) DNS (53) (cid:2) WWW (both 80 and 443) www.syngress.com
138_linux_11 6/20/01 9:51 AM Page 555 Maintaining Firewalls • Chapter 11 555 (cid:2) X (ports in the 6000 range) Figure 11.1 shows the results of a scan against a router that has left several ports open. This firewall,for example,still allows connections to Simple Mail Transfer Figure 11.1 Scanning an Open Router Protocol (SMTP),the sunrpc portmapper service (port 111),and X.You can,of course,specify additional ports.For example,the ranges of 20 through 00 and 5900 through 7000 can reveal commonly used ports.Consult your /etc/services file for more ideas. Additional Netcat Commands When compiled properly,Netcat can also spoof IP addresses.If you wish to spoof the source IP address,you would use the -s option: ./nc -s 10.100.100.1 –z –w 2 –v –v firewall.yournetwork.com 20-30, 53, 80, 100-112, 443, 6000-6050 However,you should note that the -s option does not work well on some operating systems.Because Netcat defaults to TCP,you can use the -u option to send a UDP packet to a port: www.syngress.com
138_linux_11 6/20/01 9:51 AM Page 556 556 Chapter 11 • Maintaining Firewalls UDP Scans ./nc –u –w 2 firewall.yournetwork.com 80, 443 You will have to press ENTER twice to finish the command.Depending on the rules you have set (you will have to explicitly log UDP using either the -l option in Ipchains or the -j LOG target in Iptables),your firewall will log this traffic. Testing Source Ports If you have set a firewall rule to deny a particular source port,you can test it with Netcat.For example,if you have prohibited all hosts from accessing ports 1 through 1023 of an interface,you can test this by issuing the following command: ./nc -p 80 –w 2 –v –v firewall.yournetwork.com 1-1023 Tools & Traps… Additional Netcat Features If you wish to have Netcat open a shell and listen for inbound connec- tions (this is definitely not recommended in most circumstances), you would use the following syntax: nc -l -p port [-options] [hostname] [port] In addition, Netcat ships with several scripts and applications. Some of these are geared toward the hacker community, while others offer quick solutions to common problems. Most of them are less practical than they are interesting. For example, if you want to test port redirec- tion, you can use the webproxy and webrelay applications found in the scripts directory. You can learn more about using Netcat in this way by reading the README file that comes with the source code. For those who are truly curious about using Netcat to open up listening connections, a patch exists that allows you to authenticate and encrypt traffic that streams between versions of Netcat running on opposite servers. Called aes-netcat, you can download it from packetstorm.security.com and other sites. www.syngress.com
138_linux_11 6/20/01 9:51 AM Page 557 Maintaining Firewalls • Chapter 11 557 Testing DNS Connectivity Many times,you will want to allow UDP and TCP access from and to port 53,in case a domain zone transfer needs to be made.To test whether this port is open, you would issue the following commands: ./nc -p 53 –w 2 –v –v firewall.yournetwork.com 53 ./nc –u -p 53 –w 2 –v –v firewall.yournetwork.com 53 You can also scan a range of ports using Netcat.If,for example,you wished to scan ports 1 through 1023,you would issue the following command: ./nc firewall firewall.yournetwork.com 1-1023 Exercise: Using Netcat
- Create a new directory named netcat and change into it.This step is necessary,because the tarball will deposit many different files into the destination directory.
- Obtain Netcat version 1.10 from the CD that accompanies this book (the file name is nc110.tgz),or from http://packetstorm.securify.com. Just enter netcat in the search field.When you save the tarball,save it to the netcat directory.
- Once you have obtained Netcat and saved it to the netcat directory, untar and unzip it: tar –zxvf nc110.tgz
- Most versions of Linux do well with the following compile option: make generic However,you may want to read the file named Makefile and see if your operating system is specifically listed.
- Once you have compiled Netcat,the nc binary will be created in the present directory.Copy it to the /bin/ directory.Or,if you prefer,you can just leave it in the present directory and use ./ in front of the com- mand while it is in the same directory.Now that Netcat is ready to be used,create several firewall rules that log port scans.
- Open a terminal on your firewall and view the /var/log/messages file: tail –f /var/log/messages www.syngress.com
138_linux_11 6/20/01 9:52 AM Page 558 558 Chapter 11 • Maintaining Firewalls 7. Now,conduct a sample portscan against your firewall: ./nc–w 2 –v –v firewall 1-1023 You can now use Netcat to conduct tests against your firewall. SendIP: The Packet Forger Although Netcat does have the ability to create some packets in certain instances, it is not a true packet generator.SendIP is designed to allow you to create packets of your own choosing.This practice is often called “arbitrary packet generation.” SendIP allows you to create your own IP,Internet Control Message Protocol (ICMP),TCP,and UDP packets.For example,you can generate TCP packets with the FIN,ACK,and SYN bits set according to your testing needs.You can obtain SendIP from several sites,including www.earth.li/projectpurple/progs/ sendip.html and http://packetstorm.securify.com.RPM and tarball files for ver- sion 1.5 can be found on the accompanying CD (sendip-1.5-1.i386.rpm and sendip-1.5.tar.gz). SendIP Syntax Although there are many options,SendIP syntax is relatively straightforward: sendip [hostname] -p -d SendIP Options The -p option specifies the protocol you wish to generate,and the -d option allows you to enter a random text string.The options,many of which are listed in Table 11.2,allow you to customize the contents of the packets you generate. Table 11.2 SendIP Options Option Description -p value The option that determines which type of packet SendIP will create. Values include ip, icmp, tcp, and udp. -is Specifies a source IP address of your own choosing. By default, the “true” IP address of the local host is used. -id Specifies the destination IP address for the packet you are generating. Continued www.syngress.com
138_linux_11 6/20/01 9:52 AM Page 559 Maintaining Firewalls • Chapter 11 559 Table 11.2 Continued Option Description -ih For customizing the length of the IP header. -iy Sets the Type of Service (ToS) field for the packet. Consult the previous chapter for values that you can enter. The default value is to leave all fields blank. -il Sets the length of the packet. -it Sets the time-to-live (TTL) for the packet you generate. The default value is 255 bytes. -ip Tells SendIP to create an IP packet. -ct value For generating ICMP packet types. The default is echo-request (8), but you can specify any other type by entering -ct 03, for example. See the previous chapter or RFC 950. -us Specifies the source port for UDP packets. The default is the random port assigned to the packet when it is sent out. -ud The destination port of a UDP packet. You must specify a destination port. -ts Specifies the source port of a TCP packet. The default is the random port assigned to the packet when it is sent out. -td Sets the destination port for the TCP packet. You must specify a destination port. -tn Allows you to specify the TCP sequence number. By default, the number will be random. -tfa Sets the ACK bit on a TCP packet. By default, the value is not set, unless you use the -ta option along with -tfa. This is because an ACK packet is used to finish the process of tearing down a connection. -ta Allows you to request an acknowledgment packet, which is used to acknowledge that the TCP connection is ready to end. -tfr Creates a RESET packet. -tfs Alters the packet so that the SYN bit is set. -tu Creates a packet with the URGENT pointer set. This pointer begins the process of prioritizing traffic. -tfu Sets the URGENT bit in a TCP packet. The default is 0 unless you use the -tu option along with -tfu. For more information, consult RFC 1122. Continued www.syngress.com
138_linux_11 6/20/01 9:52 AM Page 560 560 Chapter 11 • Maintaining Firewalls Table 11.2 Continued Option Description -tff Sets the FIN bit. -r Randomizes all options. For example, if you specify IP as the protocol, the -r option automatically creates a random sending IP address. The SendIP man page contains additional options.As you can see,SendIP allows you to forge any part of a TCP session,as well as any element of an IP,UDP, or ICMP packet.SendIP also allows you to forge all elements of IPv6 addresses, and also allows you to forge Routing Information Protocol (RIP) packets. This tool is useful in regard to firewalls because it allows you to simulate any situation.The ipchains -C command has similar functionality.However,you can install SendIP anywhere,whereas many newer kernels do not support Ipchains. Besides,using SendIP,you can spend your time learning only one application. SECURITY ALERT! Applications such as SendIP and Netcat are often used in the hacker community. Take care that you do not allow all users on your network to access such applications. In fact, even using Telnet in the way shown pre- viously is not recommended unless you own the systems you are scan- ning, or you have explicit permission from the operator of the system you are going to scan. Educate your IT personnel that they should use this software very carefully, and that they should never assume that they are allowed to scan or otherwise issue packets to a system that is not their responsibility. To guard against illicit use of such applications, consider placing a note in your security policy to the effect that only certain users are allowed to access scanning and IP spoofing software for security auditing purposes. Exercise: Using SendIP to Probe a Firewall
- The source files do not differ from the RPM.Download SendIP RPM from http://www.earth.li/projectpurple/progs/sendip.html or packetstorm.securify.com. www.syngress.com
138_linux_11 6/20/01 9:52 AM Page 561 Maintaining Firewalls • Chapter 11 561 2. As root,type the following: rpm -ivh sendip-1.5-1.i386.rpm 3. Now that you have installed SendIP on this system,it will be known as the “attacking host.”You are now going to use SendIP on this attacking host to check your firewall’s ability to block spoofed packets coming in from the outside interface.If necessary,review Chapter 9 to learn how to create anti-spoofing rules for your firewall.To check your firewall’s configuration,set up a machine outside of your firewall,and then give your firewall’s IP address as the default gateway. 4. Suppose that you have only the internal networks of 192.168.2.0/24 and 10.100.100.0/24,and a simple Linux client using the IP address of 192.168.2.37.You wish to test your firewall to see if spoofed traffic from outside the network can get through your firewall to your Linux client. To test this,configure a system on your internal network (say,with the IP address of 192.168.2.37) to use a packet sniffer such as Tcpdump or Ethereal to view all packets on the 192.168.2.0 network.This will be the internal host.If necessary,review Chapter 5 to learn more about packet sniffers. 5. Put the NIC of the internal host into promiscuous mode so that it can capture the spoofed packet you are about to send.Hopefully,the spoofed packet won’t get through. 6. Issue the following command from the attacking host to the internal host: sendip 192.168.2.37 -p icmp -is 192.168.2.36 7. You have just issued a spoofing attack against your firewall and internal network.Now,stop your capture of packets on your internal host.Were you able to see an echo request from 192.168.2.36? Did the 192.168.2.37 system issue an echo reply? Did you see any DNS traffic that appears to be an attempt to resolve the 192.168.2.37 IP address? If you did,then review your spoofing rules.If you did not,chances are that you have properly configured anti-spoofing on your firewall. Remember,if you are on a switched network,you will have to con- figure a packet sniffer on the victim host,and then ping that victim host directly.This is because a switched network does not use broadcasting as does a standard hub-based network. www.syngress.com
138_linux_11 6/20/01 9:52 AM Page 562 562 Chapter 11 • Maintaining Firewalls 8. If you have enabled logging for such packets,use the tail -f command on your firewall to see if the kernel records capturing the packet. 9. Now,try spoofing with another protocol: sendip 192.168.2.37 -p tcp -ts 2 -td 80 -tn -is 192.168.2.36 This command sends a tcp packet with the source port of 2 to the 192.168.2.37 host at port 80.Your firewall should block this packet, because it should not allow packets to privileged ports (ports below 1023) to go into the internal network. 10. When you are reasonably sure that your firewall is blocking spoofed packets,issue the following command from your attacking host: sendip 192.168.2.37 -p tcp -ts 2 -td 80 -tn -is 45.2.5.6 11. This command does much the same thing,but instead,it creates a packet that has a stronger chance of passing through your firewall.Why? Because this packet apparently originates from the 45.2.5.6 host,which is an IP address that could plausibly originate from the Internet.In addition,at least for the purposes of this exercise,this address does not exist inside your network.However,this packet should not be passed through,either, because it originates from a privileged port and is directed at a privileged port (80) on the destination.Finally,issue the following command: sendip 192.168.2.37 -p tcp -ta 1 -ts 4356 -td 6450 -tn -is 45.2.5.6 12. Depending on your firewall configuration,this packet may be allowed to pass through.This is because the ACK bit has been set using the -ta option.As a result,the firewall rules may allow it through because it is part of an already-established session.In addition,notice that the source and destination ports are ephemeral,and not well known (below 1023). Consider using additional commands to further test your firewall.Make the necessary changes,without affecting the services that you wish to provide. www.syngress.com
138_linux_11 6/20/01 9:52 AM Page 563 Maintaining Firewalls • Chapter 11 563 Understanding Firewall Logging, Blocking, and Alert Options You have already seen how you can check the kernel messages for log entries using the tail -f /var/log/messages command.However,more elegant ways to capture and view firewall logs exist.Third-party logging applications such as Firewall Log Daemon (Firelogd) and FwLogwatch are available to help you sort and act on the information gathered by the firewall. Firewall Log Daemon Firelogd (Firewall Log Daemon) is a relatively simple program that can either be run as an application or (you might have guessed) as a daemon.It does two things: (cid:2) It reads the kernel log entries and passes them into a “first in,first out” (FIFO) pipe,which Firelogd can then process. (cid:2) Once its buffer is full,it e-mails a report of suspicious traffic to an account of your choosing.You can have it mailed to a local account,or to a remote system of your choice. The application supports both Ipchains and Iptables.Older versions required you to edit the dmn.h file,and then use the make command to compile the application.Now,however,Firelogd supports command-line arguments.You have various options,which are listed in the following sections. Obtaining Firelogd You can obtain Firelogd from the CD that accompanies this book.The RPM package is named firelogd-1.3-5.i386.rpm,and it has an accompanying MD5 signature (firelogdmd5sums.txt).You can download more recent versions from www.speakeasy.org/~roux/dmn/ or from http://packetstorm.securify.com.The RPM file is best for Red Hat systems.As of this writing,the tarball format does not have any special features. Syntax and Configuration Options The syntax for using Firelogd is as follows: /usr/sbin/firelogd [-dmskh] [-b buffersize] [-e email] [-l log] [-t template] [-] www.syngress.com
138_linux_11 6/20/01 9:52 AM Page 564 564 Chapter 11 • Maintaining Firewalls If you install Firelogd using the available RPM,you can also start Firelogd by using its startup script (/etc/rc.d/init.d/firelogd).You will have to edit this script to customize it if you wish to change or add any of the options. Commonly Used Options Following is a list of the most often-used options. (cid:2) Daemon mode If used without any options at all,Fwlogwatch runs as a simple application.The -d option has firelogd “fork off”and run as a daemon. (cid:2) E-mail destination The person who receives the e-mail messages. You can specify this either by using the -e option,or by editing the /etc/rc.d/init.d/firelogd script that comes with the RPM. (cid:2) Log file The location of the log file that Firelogd reads from.On Red Hat Linux,for example,this is usually /var/log/messages.You can specify a log file by either using the -l option,or by modifying the /etc/rc.d/ init.d/firelogd script. (cid:2) Buffer size Tells Firelogd to wait for x number of entries before mailing them.The default is 10,which means a single e-mail will con- tain 10 entries.A value of 100 may be a more reasonable number.Using the default,you will receive dozens of e-mails in the case of a simple Nmap scanning attack.Experiment with these settings.If 100 gives you too little information about the nature of traffic at your firewall,then decrease the setting. (cid:2) Template Firelogd allows you to customize the alert messages.You can have Firelogd send you a great deal of information,or you can configure it to be as sparse as possible.The /etc/firelog.conf file contains the default template. You can learn more about the additional options by consulting the firelogd man page. Message Format The e-mail message you receive will include multiple packet hits giving you the following information:
- The date and time of the rejected or logged packet.
- The name of the chain responsible for dropping or logging the packet. www.syngress.com
138_linux_11 6/20/01 9:52 AM Page 565 Maintaining Firewalls • Chapter 11 565 3. The input interface. 4. The packet’s TTL. 5. The IP of the firewall host and the number of the port to which the packet was sent (i.e.,the destination port). 6. The origin of the IP address.Remember,it is possible to spoof IP addresses. Here is an example of a default Firelogd log entry: 01:28:37/May-5 S TCP D REJECT/input-9 eth0 | ttl:64 badguy.hackerz.com -> hems(151) 128.37.08.43:4218 -> firewall.goodguys.com:151 Output Example Here is output from a more extended example: prompt# /usr/sbin/firelogd LOG ENTRY: April 5 09:53:37 firewall kernel: Packet log: input REJECT eth0 PROTO=6 45.128.2.3:2748 128.1.2.3.4:3049 L=60 S=0x00 I=0 F=0x4000 T=64 SYN (#9) CONTEXT INFORMATION: Time: April 5 09:53:37 Msg: REJECT/input-9 In: eth0 Out: Mac: IP DATAGRAM INFORMATION: Source: 45.128.2.3 badguy.badguy.com Dest.: 128.1.2.3.4 firewall.goodguys.com IPlen: 60 TOS: TOS-0x00, PREC-0x00 -> |* TTL: 64 FRAG: 0x4000 -> D www.syngress.com
138_linux_11 6/20/01 9:52 AM Page 566 566 Chapter 11 • Maintaining Firewalls ICMP SPECIFIC DATA: Type: Code: Info: Triggering Packet: TCP SPECIFIC DATA: Window: Reserved Bits: Flags: SYN -> ***S UDP SPECIFIC DATA: UDP Datagram length: TCP/UDP SERVICE PORTS: Source Port: 2748(fjippol-polsvr) -> 3049(nsws) In the preceding output,the attacking host’s IP address is 45.128.2.3,and the firewall’s IP address is 128.1.2.3.4.In this particular example,ICMP logging is not activated on the kernel.However,you can gather information about the nature of the attack by viewing the logs.This is an example of a simple,full TCP scan. Customizing Messages You can customize Firelogd messages by editing the /etc/firelogd.conf file and changing the values to suit your own situation.The default file comes with sev- eral suggested templates,which are commented out by using the following two words: startcomment endcomment Firelogd will not read anything within these lines.Firelogd contains three entries.The first,discussed previously,is moderately verbose.The second is described as a “one-liner,”and gives information about the time of the scan,as well as the source and destination IP addresses and ports.The final option is quite verbose,informing you about the details of the connection.You can,of course, www.syngress.com
138_linux_11 6/20/01 9:52 AM Page 567 Maintaining Firewalls • Chapter 11 567 create your own entry using the syntax described in the /etc/firelogd file.For example,the following sample code records the source IP address and the desti- nation port address,as well as the interface where the traffic occurred.The text “From the firewall at the company”acts as a header for the information. tab From the firewall at the company. nl tab srcip sp r_dstpt sp in sp The tab,space,and nl entries create tabs,single space,and new lines,respec- tively.The char srcip field has Firelogd inform you of the source IP address of the packet.The r_dspt field provides the destination port for the packet.Finally,the char in field has Firelogd report the interface.You can,of course,specify your own text and other options.The /etc/firelog.conf file shows you all of the options.Figure 11.2 shows an example of the configuration file. Figure 11.2 The /etc/firelog.conf File www.syngress.com
138_linux_11 6/20/01 9:52 AM Page 568 568 Chapter 11 • Maintaining Firewalls NOTE Firelogd simply parses the log files generated by either Ipchains or Iptables. It does not generate the log files themselves. Therefore, you must have logging enabled through Iptables or Ipchains in order for Firelogd to operate properly. Reading Log Files Generated by Other Firewalls You can read log files generated by other systems,as well.For example,if you downloaded the /var/log/messages file from a remote system,you can read it with the following command: cat messages | firelogd - The hyphen allows the application to read the command directly from standard input. Exercise: Configuring and Compiling Firelogd
- Obtain Firelogd from www.speakeasy.org/~roux/dmn/ or from packetstorm.securify.com.The RPM file is best for Red Hat systems. The tarball does not provide any special configuration options.
- Install the RPM.Once you install the RPM,the Firelogd will automati- cally begin running.Stop Firelogd by issuing the following command: /etc/rc.d/init.d/firelogd stop
- Issue the following command: /usr/sbin/firelogd
- Use a port scanner such as Gnome Service Scan or Nmap to scan your firewall.Remember that the firewall must have logging enabled at the interface you are scanning.
- You should see output on your screen.You will not receive any e-mail message,because you have not supplied any arguments.
- Stop Firelogd by pressing CTRL+C. www.syngress.com
138_linux_11 6/20/01 9:52 AM Page 569 Maintaining Firewalls • Chapter 11 569 7. Now,prepare firelogd to run as a daemon.Make a copy of the /etc/ rc.d/init.d/firelogd initialization script file and name it firelogd.bak.Edit the original so that the entries are as follows: QSIZE=30
Who is the administrator
MAIL=your_address@yourcompany.com
Where is the output template
You may have to adjust the QSIZE settings to fit your own situation. 8. Make a copy of the /etc/firelogd.conf in case anything goes wrong,and then edit the original file so that verbose logging is enabled.To do this, first comment out the default log entries,which are immediately below the text that reads “I like the look of the one below.”Use the startcom- ment and endcomment keywords.Then,uncomment the entry that begins with the text that reads “This one is very verbose,”and save the file. 9. Start Firelogd: /etc/rc.d/init.d/firelogd start 10. Use Gnome ServiceScan or Nmap to conduct an attack that scans multiple ports of your firewall. 11. View the message using your e-mail client. 12. Re-edit the /etc/firelogd file and comment out the verbose entries and uncomment the entries that are beneath the text that reads “This one is a one-liner.”This entry will send terse messages.If you wish,set the QSIZE value to 100,which means that each e-mail Firelogd sends will have 100 entries in it.It also means that Firelogd will not send you alerts as often;the larger the buffer value,the longer it will take to receive a message.Consequently,Firelogd will be less responsive to attacks,and will not inform you as often.However,one longer message is likely easier to read than several shorter messages. Fwlogwatch Fwlogwatch,written by Boris Wesslowski,is a logging and reporting mechanism that also allows you to automatically block all traffic that is identified as an attack.Used in conjunction with Firelogd,it helps create a system that continuously keeps you informed concerning port scans and other network events that surpass the www.syngress.com
138_linux_11 6/20/01 9:52 AM Page 570 570 Chapter 11 • Maintaining Firewalls thresholds you set.Fwlogwatch is available at the CERT-RUS Web site (http://cert .uni-stuttgart.de/projects/fwlogwatch) and Wesslowski’s personal Web site (www.kyb.uni-stuttgart.de/boris/software.shtml).It is available in both tarball and RPM format,and there is no significant difference between the two.The accompa- nying CD contains both the tarball and RPM versions (fwlogwatch-0.3-bin.tar.gz and fwlogwatch-0.3-1.i386.rpm).Although FwLogwatch is similar to Firelogd,it is far more versatile.You can configure Fwlogwatch to do the following: (cid:2) Parse the firewall log file and generate user-friendly HTML reports, which you can read with any Web browser.Fwlogwatch can read log files from any Ipchains or Iptables-enabled system,as well as Cisco fire- walls and routers. (cid:2) E-mail an alert to you when suspicious activity occurs (e.g.,when numerous connection attempts—usually port scans—surpass the threshold you set in /etc/firelogwatch.config,the Fwlogwatch configu- ration file).As with Fwlogwatch,this option will work only on packets that you decide to log. (cid:2) Issue a Windows Messenger Service alert that creates a “pop up”message to a Windows NT or 2000 server of your choice. (cid:2) Deliver summary-based e-mail messages informing management of the scans that have occurred. (cid:2) Insert Ipchains or Iptables-based rules that block hosts from connecting to your firewall and/or internal network hosts. (cid:2) Execute custom-created commands.You can have Fwlogwatch run any script that you wish to create. Fwlogwatch Modes Fwlogwatch operates in one of three modes.Table 11.3 describes each. Table 11.3 Fwlogwatch Modes Mode Description Realtime Fwlogwatch operates as a daemon and reads the kernel messages file (usually /var/log/messages), waiting for Ipchains/Iptables-generated packets to occur. When the packets surpass the threshold, Fwlogwatch generates an alert. This mode is generally not for generating reports. Several Common Continued www.syngress.com
138_linux_11 6/20/01 9:52 AM Page 571 Maintaining Firewalls • Chapter 11 571 Table 11.3 Continued Mode Description Gateway Interface (CGI) scripts are available to help you generate HTML reports. Interactive Allows you to have Fwlogwatch read the /var/log/messages file and issue e-mail messages to various destinations. To use this mode, you must uncomment various lines, such as at least one e-mail account, in fwlogwatch.conf (or whatever name you are using). The e-mail messages are formatted according to the information found in the /etc/fwlogwatch.template file. When you start Fwlogwatch in interactive mode, it will parse the /var/log/messages file and then ask you if you wish to send an e-mail message to your recipient. Log Time Has Fwlogwatch inform you concerning the total number of entries in the /var/log/messages file. It also includes the first and last entries the kernel makes. You can also manually generate HTML reports.Figure 11.3 shows the Help menu,which shows all of the command options.You can generate this list by entering fwlogwatch -h. Figure 11.3 Fwlogwatch Command Options www.syngress.com
138_linux_11 6/20/01 9:52 AM Page 572 572 Chapter 11 • Maintaining Firewalls You can also consult the fwlogwatch man page for additional details.This chapter will focus on generating reports and configuring Fwlogwatch to send real-time alerts. Fwlogwatch Options and Generating Reports Table 11.4 is a list of the more relevant options,if you choose not to use the /etc/fwlogwatch.config file. Table 11.4 FwLogwatch Options Option Description -c Allows you to specify your own configuration file. The default is /etc/fwlogwatch.config. If you leave this filename at its default, you will not be able to manually use Fwlogwatch or use CGI scripts to generate automatic reports. -f Allows you to read a different kernel log file, rather than the default of /var/log/messages. -L Has Fwlogwatch give the time of the first and last log entry. -l
138_linux_11 6/20/01 9:52 AM Page 573 Maintaining Firewalls • Chapter 11 573 Table 11.4 Continued Option Description -t If more than one of the same type of packet is logged, then show the start and end times that they entered the system. -z Show the total amount of time that elapses between a series of entries. The series is determined by the threshold. -y List all elements of the TCP session. -p Informs you concerning all logged protocols (TCP, ICMP, and so forth). -o Allows you to specify the location of an output file. -w Tells Fwlogwatch that the output file should be in HTML. Generating Reports As of this writing,if the /etc/fwlogwatch.config file is present,the Fwlogwatch binary automatically ignores any options you specify at the command line.This poses a problem,because if you wish to manually generate a report,you need to specify command-line options. NOTE You will need to rename the /etc/fwlogwatch.conf file to some other name if you wish to use Fwlogwatch to generate HTML reports via CGI or cron. To solve this problem,rename the /etc/fwlogwatch.config to /etc/fwlogwatch .config.alert.This way,you can still use this file to generate alerts,as discussed later, and still generate manual reports,when necessary.Although many different combi- nations are available to you,the following command is quite useful: prompt$./fwlogwatch -v -v -s -d -t -z -y -n -p -w -l 2d -o firewall.html -f /var/log/messages Resolving firewall-linux.goodguys.com Resolving 10.100.100.1.1 from cache Resolving 192.168.2.2 from cache Resolving sl-gw8-sj-0-3.sprintlink.net www.syngress.com
138_linux_11 6/20/01 9:52 AM Page 574 574 Chapter 11 • Maintaining Firewalls Resolving 217.0.54.100 Resolving pD9003664.dip.t-dialin.net Resolving 192.168.2.2 from cache Resolving 194.91.224.19 Resolving 10.46.247.251 Resolving pD9003664.dip.t-dialin.net Resolving adsl-63-206-155-186.dsl.lsan03.pacbell.net Resolving cpe-24-221-58-193.az.sprintbbd.net Resolving www.cnn.com Resolving www.abcnews.com from cache prompt$ The preceding command has Fwlogwatch read the -f /var/log/messages file and generate a report named firewall.html.The “Resolving ...”lines indicate that Fwlogwatch has found log entries and is finding the IP address or DNS name for the hosts.Notice that the preceding command reads the firewall entries for the last two days (-l 2d),and that it uses the -w option to generate an HTML file, instead of a plain text file.Figure 11.4 shows an example of the HTML file, which can be viewed with any Web browser. Figure 11.4 Viewing an Fwlogwatch HTML File www.syngress.com
138_linux_11 6/20/01 9:52 AM Page 575 Maintaining Firewalls • Chapter 11 575 Using Fwlogwatch manually is especially useful if you plan to view log file entries from a remote host,such as another Linux system or a Cisco router.You can obtain the log file,copy it to your home directory,and then issue the pre- ceding command,specifying the log file you wish to read. As long as you have renamed the /etc/fwlogwatch.config file,you can use cron to have Fwlogwatch automatically create HTML reports and place them in your Apache Server home directory (or any other properly aliased directory). Exercise: Generating an HTML-Based Firewall Log with Fwlogwatch
- Make sure that your system is using either Ipchains or Iptables to log packets.
- Create a user and a group named bw.These groups are necessary to enable Fwlogwatch to run additional processes as a nonroot user.
- Install the Fwlogwatch RPM.You can,if you wish,copy the fwlogwatch -0.3-1.i386.rpm file from the CD that accompanies this book.The fwlogwatch-0.3-bin.tar.gz file provides the same functionality.
- Rename the /etc/fwlogwatch.config file to /etc/fwlogwatch .config.alert.
- Issue the following command to create a simple HTML report: fwlogwatch -v -v -s -d -t -z -y -n -p -w -l 2d -o firewallreport.html -f /var/log/messages
- Open the firewallreport.html file in any browser.This report is,of course,portable,allowing anyone (even Windows users) to view it.See Figure 11.5. Automating Fwlogwatch Perhaps the most intriguing feature of Fwlogwatch is its ability to automatically configure Ipchains/Iptables and issue alerts.The best way to do this is to edit the three configuration files to suit your needs.The three files you will use are: (cid:2) /etc/fwlogwatch.config (or whatever you rename it to) The pri- mary configuration file.If you change this filename,then you must use the -c option to specify it when starting Fwlogwatch. www.syngress.com
138_linux_11 6/20/01 9:52 AM Page 576 576 Chapter 11 • Maintaining Firewalls Figure 11.5 Viewing a Report in Microsoft Internet Explorer (cid:2) /usr/sbin/fwlw_notify A script that allows you to configure all alerting options,including where e-mail and Samba/Windows “pop up” messages will be sent.Do not confuse these options with the interactive options,which are mutually exclusive.In other words,if you wish to have Fwlogwatch send you alerts,do not configure the interactive mode, which will ask you if you wish to send each report that Fwlogwatch generates. (cid:2) /usr/sbin/fwlw_respond This script determines Ipchains and Iptables behavior.You do not have to edit this file. The Fwlogwatch Configuration File You can customize all Fwlogwatch features by editing the /etc/fwlogwatch .config file (or /etc/fwlogwatch.config.alert,if you have renamed it in order to use the manual option).Figure 11.6 shows the configuration file. www.syngress.com
138_linux_11 6/20/01 9:52 AM Page 577 Maintaining Firewalls • Chapter 11 577 Figure 11.6 The Fwlogwatch Configuration File This file allows you to automatically invoke the options listed earlier in Table 11.4.For example,this file allows you to: (cid:2) Set verbose logging options. (cid:2) Create HTML files. (cid:2) Customize the alert threshold. (cid:2) Specify a different input file from /var/log/messages. (cid:2) Exclude hosts and ports. (cid:2) Sort host,protocol,port,and IP entries in the HTML files,as well as configure the files to inform you concerning the time the packets were generated,and the duration of a perceived attack. (cid:2) Determine how much of the kernel log file to read (e.g.,only two minutes,three days,and so forth). (cid:2) Set realtime,interactive,and log times mode options. (cid:2) Create a proprietary Web server (not recommended). www.syngress.com
138_linux_11 6/20/01 9:52 AM Page 578 578 Chapter 11 • Maintaining Firewalls If you change any of these values,you will have to restart Fwlogwatch so that it rereads this file. Setting the Alert Threshold in fwlogwatch.config It is likely that you will have to experiment with the ideal alert threshold for your firewall.The default value is 10,and you may find it necessary to increase this value significantly (say,to 100) so that you are not overwhelmed by the data you generate. Understand,however,that if you receive too much data,you may also need to adjust the logging in Iptables/Ipchains. Excluding Hosts Fwlogwatch will monitor all entries that pass through the kernel log file (usually /var/log/messages).Fwlogwatch will block any interface—including its own— that violates the alert threshold value.One of the features found in Fwlogwatch is the ability to exclude certain IP addresses and address ranges from alerts and Ipchains/Iptables rules.This is necessary,because anyone with a port scanner that can spoof IP addresses can conduct a port scan on your firewall and specify an IP address important to your network.Such addresses might include the DNS and e-mail servers necessary to keep your business on a paying basis.It is possible to exclude these addresses from Fwlogwatch by opening the configuration file and finding the following lines: known_host = known_host = Fwlogwatch allows you to get much more granular by using the additional entries shown here: #exclude_src_host = #exclude_src_port = #exclude_dst_host = #exclude_dst_port = #include_src_host = #include_src_port = #include_dst_host = #include_dst_port = These entries allow you to exclude certain source and destination ports,as well as source and destination IP addresses. www.syngress.com
138_linux_11 6/20/01 9:52 AM Page 579 Maintaining Firewalls • Chapter 11 579 Notification Options To configure Fwlogwatch to notify you about attacks,you must first edit the /etc/fwlogwatch.config file and uncomment the following values: realtime_response notify Once these values are uncommented,and once you have restarted Fwlogwatch,it will automatically call the /usr/sbin/fwlw_notify file.These files determine who will be informed,and what will be done,respectively.You will have to restart the Fwlogwatch binary for these changes to take effect. Thankfully,both the fwlw_notify and fwlw_respond files are even easier to understand than fwlogwatch.config.The /usr/sbin/fwlw_notify script,shown in Figure 11.7,allows you to determine who will receive notification messages,and allows you to determine how this notification will occur. Figure 11.7 The /usr/sbin/fwlw_notify File E-Mail Settings All you have to do is uncomment the lines for any function you wish to enable. Then,enter your own e-mail address in the EMAIL= field.The default setting is www.syngress.com
138_linux_11 6/20/01 9:52 AM Page 580 580 Chapter 11 • Maintaining Firewalls for Fwlogwatch to send e-mail to root@localhost.If you are happy with this set- ting,you don’t have to edit this line.The next entry to edit determines the actual contents of the e-mail message.By default,the message will contain the following information: (cid:2) Number of packets (as indicated by the $1 value) (cid:2) The source IP address (as indicated by the $2 value) (cid:2) The destination IP address (as indicated by the $2 value) You can,of course,edit any aspect of the e-mail configuration settings.If,for example,you wish to change the subject heading,edit the quoted line after the -s field.Just make sure that you retain the quotation marks,as they allow you to enter multiple words into one subject line.Figure 11.8 shows an example of an e-mail alert. Figure 11.8 Viewing E-Mail Alerts Generated by Fwlogwatch Note that Figure 11.8 actually shows two e-mail messages.The first e-mail message is a result of a log entry that blocks and logs all ICMP traffic.The second message has been generated at the same time.It is an alert informing the systems administrator that the loopback interface (127.0.0.1) has generated an attack.As a result,the loopback interface will be added to the Iptables fwlw user-defined chain,and no traffic will be allowed to pass through it.In many cases,this is not a problem,although it is a false positive.This systems administrator needs to add a rule excluding the local host being blocked. www.syngress.com
138_linux_11 6/20/01 9:52 AM Page 581 Maintaining Firewalls • Chapter 11 581 Windows Pop-Up Messages Fwlogwatch uses the smbclient application to send messages to remote Windows hosts.All you have to do is uncomment and edit the SMBHOST= line so that a message is sent to a real host,and then uncomment the next line so that a mes- sage is sent.For example,to send a pop-up message to a host named sandi,you would change the SMBHOST= entry and uncomment the following line: SMBHOST=sandi /bin/echo "fwlogwatch ALERT on $HOSTNAME: $1 packet(s) from $2" | /usr/bin/smbclient -M $SMBHOST You can alter the second line at will.Read the script for additional values to enter.For example,if you wish to be informed of the protocol,you could use the $4 value. This file also supports the creation of custom log entries through the use of the logger command,as well as the creation of a custom log file.Fwlogwatch also allows you to create your own alerting options.If,for example,your Linux system has a paging application installed,you can have your message sent directly to you.Figure 11.9 shows an example of a pop-up message received by a Windows 2000 Advanced Server system. Figure 11.9 A Windows 2000 Advanced Server “Pop Up” Message Response Options To configure Fwlogwatch to actually respond to attacks,edit the /etc/fwlogwatch .config file and uncomment the following values: realtime_response respond Then,restart Fwlogwatch.The /usr/sbin/fwlw_respond file is quite straight- forward.As with /usr/sbin/fwlw_notify,you can edit this file to enter custom commands.You can,for example,have this script load additional scripts and appli- cations that can reconfigure the local system,as well as remote systems.See Figure 11.10. www.syngress.com
138_linux_11 6/20/01 9:52 AM Page 582 582 Chapter 11 • Maintaining Firewalls Figure 11.10 The fwlw_Respond File How Hosts Are Blocked By default,Fwlogwatch creates a user-defined Ipchains or Iptables entry for the specific table and/or chain receiving the traffic.You can,of course,edit the script to alter this behavior,although it works quite efficiently as written. Fwlogwatch and Root Privileges Real-time response is protected.Only root can initiate Fwlogwatch to use Ipchains/Iptables blockings or e-mail and Samba-based alerts.Once initiated, Fwlogwatch will then run as the user bw.However,if you only require Fwlogwatch to generate reports,you do not need to run it as root.You must still ensure that Fwlogwatch can read the /var/log/messages file.You can do this by placing the user who will execute Fwlogwatch in the same group as the log file. NOTE In regard to Fwlogwatch, alerting and reporting are always two separate things. Do not be surprised that the e-mail message you receive is quite terse. You will learn how to automate reports using CGI scripts later in this chapter. www.syngress.com
138_linux_11 6/20/01 9:52 AM Page 583 Maintaining Firewalls • Chapter 11 583 NOTE In order to send pop-up messages, your system must have the samba- client package installed. If you are using RPM, the following command will tell you if you have the samba-client package installed: rpm -qa | grep samba Otherwise, search for the smbclient application. The Samba server is not necessary, and should not be activated at your firewall. Exercise: Configuring Fwlogwatch to Send Automatic Alerts and Block Users
- Make sure that you have Iptables/Ipchains entries that your kernel can log.You must have either the -l or -j LOG entries activated on at least one rule.
- If you have not already,rename your /etc/fwlogwatch.config file to /etc/fwlogwatch.config.alert.The file named /etc/fwlogwatch.config should no longer exist. If you do not do this,you will not be able to issue command-line options,nor will you be able to issue alerts.
- Edit the /etc/fwlogwatch.config.alert file and adjust the following parameters: (cid:2) Enable verbose logging by simply uncommenting both lines that read verbose. (cid:2) Uncomment the resolve option. (cid:2) Enable the times and duration options.The former gives the times of the connections,while the latter gives the entire duration of the session. (cid:2) Uncomment the known_host lines,and enter the IP addresses of your DNS and e-mail servers,as well as others that you do not want to block. (cid:2) Enable the html line so that the daemon generates HTML pages. www.syngress.com
138_linux_11 6/20/01 9:52 AM Page 584 584 Chapter 11 • Maintaining Firewalls (cid:2) Uncomment the recent value and change it from three days (3d) to one day (1d). (cid:2) Uncomment the at_least value to 10 may have to change lower. (cid:2) Enable and change the alert_threshold setting to 15. (cid:2) Activate the notify and respond values by simply uncommenting them. 4. Edit the /usr/sbin/fwlw_notify file and adjust the following parameters: (cid:2) Activate the e-mail and Samba settings. (cid:2) Enter an e-mail address that you can check. (cid:2) In the Samba settings,alter the HOST=line so that Fwlogwatch sends a message to the correct system.Make sure that your Windows NT/2000 system is configured to receive messages. 5. Review the /usr/sbin/fwlw_respond file,but do not make any changes unless you have a very good idea of what to do. 6. Start Fwlogwatch,making sure you tell it where the configuration file is: /usr/sbin/fwlogwatch -c /etc/fwlogwatch.config.alert 7. Now,using Nmap or Gnome ServiceScan,conduct a scan of your fire- wall so that your activity matches some of the Ipchains/Iptables rules you have created. 8. You will receive e-mail and Samba “pop up”messages informing you that activity has surpassed established thresholds. Using Fwlogwatch with CGI Scripts Fwlogwatch ships with two CGI scripts that,with minor modifications,can allow you to check your logs via a Web server.Although it is often important to shut down all services,activating Apache Web server may be a useful and relatively safe exception to this rule.If you have installed the scripts using the RPMP,you can obtain the raw scripts in the /usr/share/doc/fwlogwatch-0.3/ directory.If you have installed the files using a tarball,they will be in the source directory. The first CGI script is quite simple.It creates an HTML page and tells Fwlogwatch to place all of the events that have occurred within the last hour inside of it.With some modifications,it can create an HTML file in your Apache Server directory.See Figure 11.11. www.syngress.com
138_linux_11 6/20/01 9:52 AM Page 585 Maintaining Firewalls • Chapter 11 585 Figure 11.11 The fwlogsummary.small.cgi File This file first has the command echoed so that if it is run by Cron,a message will be sent to the systems administrator via e-mail,informing him or her that the command has been executed.The actual command is shown here: /usr/sbin/fwlogwatch -w -l 1h -z -s -d -o /var/www/html/fwlogsmallsummary.html You can,of course,alter this script as you wish.For example,if your Web server’s HTML directory is located at /home/httpd/html/,you can edit the file accordingly.If you wish to have a more verbose log entry,you can specify -v -v. However,this file is meant specifically for a quick rundown of the last hour’s traffic. To automate this file,place the script in the /etc/cron.hourly directory,or create the following crontab owned by root: 1 * * * * /fwlogsummary/fwlogsummary.small.cgi When this script executes,you will be able to view the HTML file,as long as you have activated Apache Server.See Figure 11.12. Figure 11.12 Viewing the Results of the fwlogsummary.small.cgi Script www.syngress.com
138_linux_11 6/20/01 9:52 AM Page 586 586 Chapter 11 • Maintaining Firewalls Obtaining More Information For a more detailed view of the file,use the fwlogsummary.cgi file.Before you use this file,however,edit it so that it has the following characteristics: (cid:2) The file should point to a directory supported by your Web server.As of this writing,the fwlogsummary.cgi file defaults to using the /home/ httpd/html/ directory,so make sure you specify the correct directory for your Web server. Red Hat 7.1 uses the /var/www/html/ directory,so create a subdirectory named /var/www/html/fwlogdaemon/.Or,you can create an entirely different directory and use an alias.It is up to you.It is important,however,that you create a dedicated directory,because the fwlogsummary.cgi script will create several files inside of it.The most important file is index.html,which contains several links that allow you to view all log entries as defined by the $RECENT value (the default,which you can change,is 1 hour). (cid:2) The file should specify the full path of the fwlogwatch binary. (cid:2) Remove the line that reads <a href=”/cgi-bin/fwlogwatch .cgi”>Regenerate summaries now.As of this writing,this feature is not yet supported sufficiently.The edited file is shown in Figure 11.13. Figure 11.13 The fwlogsummary.cgi File www.syngress.com
138_linux_11 6/20/01 9:52 AM Page 587 Maintaining Firewalls • Chapter 11 587 You can make additional trivial changes,such as altering the colors used in the HTML file.Once you have edited the file to your liking,you can place a script in the /etc/cron.hourly file,or create a crontab similar to the one discussed for the fwlogsummary.small.cgi script. 1 * * * * /fwlogsummary/fwlogsummary.cgi Viewing the Results Once you have edited the necessary files,created the necessary directories,and started the daemons (Apache Server and Cron),you can use your Web browser to view the index.html file generated by fwlogwatch.cgi.You will have to specify a directory or alias,but you will not have to specify a filename,because most Web servers present index.html by default.Thus,if your firewall Web server’s root directory for HTML pages is /var/www/html/,and you have created a directory named /var/www/html/fwlogwatch/,then you would enter the following URL: http://firewall.goodguys.com/fwlogwatch.Figure 11.14 shows an example for the system named “keats.” Figure 11.14 Viewing the Index Page Generated by fwlogsummary.cgi If you click on the All and name resolution link,for example,you will see a report summary similar to that shown in Figure 11.15. www.syngress.com
138_linux_11 6/20/01 9:52 AM Page 588 588 Chapter 11 • Maintaining Firewalls Figure 11.15 Viewing the All and Name Resolution Page You will see that this particular HTML page is similar to the results of the Fwlogsummary.small.cgi file,except that you will see more hosts listed.The addi- tional links will help you determine what has happened at your firewall. NOTE When you capture traffic using the Linux Netscape browser, you may find that it will “hang” for some time before rendering the HTML. You may have to wait for a few minutes to see the Fwlog output. At other times, you may find that the browser has crashed. Lynx, a text-based Web browser, and Windows-based browsers usually do not exhibit this behavior. Exercise: Using Cron and Fwlogwatch CGI Scripts to Generate an Automatic HTML Report
- Create the /fwlogsummary directory.This directory will hold your CGI scripts. www.syngress.com
138_linux_11 6/20/01 9:52 AM Page 589 Maintaining Firewalls • Chapter 11 589 2. Find and copy the fwlogsummary.small.cgi and fwlogsummary.cgi scripts to the /fwlogsummary directory. 3. Find the directory that contains your Web server’s HTML documents. Create a new subdirectory off of this directory named fwlogwatch.This directory will contain all of the files generated by the fwlogsummary.cgi file. 4. Create another subdirectory off your Web server’s HTML document directory named fwlogwatchshort.This directory will contain the results of the fwlogsummary.small.cgi script. 5. Edit the fwlogsummary.small.cgi and fwlogsummary.cgi scripts so that they reflect your environment.For example,make sure that the both scripts refer to the fwlogwatch subdirectory.The fwlogsummary.small.cgi script should specify the fwlogsmallsummary.html file as an output file. This file should go into the fwlogwatchshort directory.Be especially careful to edit the fwlogsummary.cgi file so that it refers to the correct Web server directory,and that it no longer has the <a href=”/cgi- bin/fwlogwatch.cgi”>Regenerate summaries now link.Read ear- lier in this chapter for more details. 6. Now,create crontab entries for each script.Make sure that you specify the correct path of the CGI scripts.For example,if you have created the /fwlogsummary directory,you would create the following crontab entries: 1 * * * * /fwlogsummary/fwlogsummary.small.cgi 1 * * * * /fwlogsummary/fwlogsummary.cgi You can create these entries by issuing the following command as root: crontab -e You can also create scripts in the /etc/cron.hourly directory,if you wish. 7. Now,after 30 minutes,you will see that these scripts have generated sev- eral files.Point your Web browser to your firewall’s /fwlogsummary sub- directory,and view the links generated by the fwlogsummary.cgi script. 8. For a more succinct description of the last hour’s activities,point your browser at the /fwlogwatchshort directory.You will have to specify the www.syngress.com
138_linux_11 6/20/01 9:52 AM Page 590 590 Chapter 11 • Maintaining Firewalls fwlogsmallsummary.html file,because it is doubtful that your Web browser uses this as a default document.If you wish,you can edit the CGI script to create an index.html file.For the purposes of this exercise, a different name was used to eliminate confusion with the /fwlogsum- mary directory. 9. Finally,consider the following options: (cid:2) If you are using Apache Server,use .htaccess files and htpasswd so that this information is password protected. (cid:2) Further secure this directory with Secure Sockets Layer (SSL).You can learn about enabling SSL support with Apache Server at www.openssl.org. Additional Fwlog Features Fwlogwatch contains the following features not discussed in this chapter: (cid:2) Sorting By editing the /etc/fwlogwatch.conf file,you can determine which events are listed first.This is a very useful feature,which allows you to emphasize information that it is important to you. (cid:2) Web server The Web server offered by Fwlogwatch is not as robust as Apache Server,nor is it as well documented.It is advised that you use Apache Server if you wish to use CGI at all. Obtaining Additional Firewall Logging Tools Table 11.5 contains an all-too-brief discussion of additional tools available to you. Table 11.5 Additional Logging Tools Tool Description Ipchains logger A logging enhancer similar to Fwlogd, but limited to Ipchains. It is especially strong in its ability to log masqueraded connections. Its home page is at http://ipchainslog.sourceforge.net. LogGrep This daemon uses the grep utility to read and sort log files. It is limited, as of this writing, to Ipchains. With this utility, you can sort protocol, date, IP port firewall Continued www.syngress.com
138_linux_11 6/20/01 9:52 AM Page 591 Maintaining Firewalls • Chapter 11 591 Table 11.5 Continued Tool Description log entries to generate custom log files. Currently, it can also discover port scans, and generate HTML pages. The project’s home page is at http://loggrep .sourceforge.net/. Open Correlation Although this project has not produced any files as of this writing, this project hopes to create an all-purpose logging daemon that can scan as many different types of log files as possible. Although it is dangerous to mention the word universal when discussing anything concerning Linux, this promises to be a helpful tool. The project’s home page is at http://sourceforge.net/ projects/opencorrelation/. Fwlogsum This application generates HTML-based reports. The developers aim to create a logging utility that is powerful, yet easy to configure. HTML reports are meant to emulate those created by the popular, com- mercial Checkpoint FW-1 log firewall. The project’s home page is at http://fwlogsum.sourceforge.net/. IP Firewall This logging software is meant to enhance IP Accounting (IPFA) accounting log information. It allows you to gather the following information: (cid:2) Per month protocol usage (cid:2) User monitoring, as long as identd is enabled on client hosts (cid:2) Binding of IP addresses to MAC addresses You can obtain this software at www.tucows.com, or at http://linuxberg.eunet.fi/conhtml/adm_firewall.html. Appsend An application similar to SendIP. However, this applica- tion also allows you to simulate additional attacks, such as SYN floods and additional denial-of-service attacks. http://www.tucows.com, or at http://linuxberg .eunet.fi/conhtml/adnload/58289_31510.html. IPmeter IPmeter monitors network usage, and is designed to help you bill clients for usage. It generates HTML reports with embedded graphics. You can download it at www.ipmeter.com. Mrtg A traffic load monitor that generates HTML reports with embedded graphics. Similar to IPmeter, Mrtg is intended as a network management and monitoring Continued www.syngress.com
138_linux_11 6/20/01 9:52 AM Page 592 592 Chapter 11 • Maintaining Firewalls Table 11.5 Continued Tool Description tool, but it can also be very helpful as a security tool, because network management and security manage- ment concerns and tools are closely related. You can obtain Mrtg at www.mrtg.org, or at http://ee-staff.ethz .ch/~oetiker/webtools/mrtg/. Ntop The a ccompanying CD contains a version of Ntop (ntop-1.3.1-2.i386.rpm) that is compatible with most Linux versions. The latest version is available at www.ntop.org, Ntop is a powerful tool that allows you to identify the nature of all egress and ingress traffic. It is much like the standard top application, in that it gathers information about hosts, and then places the most active hosts at the top of the display. It can be run on a terminal just like the standard top application; you can run it in Web server mode, or as a Web server. This mode supports authentication, thus it allows you to easily limit access to only specific users. www.syngress.com
138_linux_11 6/20/01 9:52 AM Page 593 Maintaining Firewalls • Chapter 11 593 Summary This chapter focused on ways for you to gain information from your firewall and take action.You read about ways that you can make your firewall aware of port scans,and enhance its reporting and blocking capacity. It is vital that you make it as easy as possible to read your firewall log files and respond to new threats.Although the premier reason to create a firewall is to selectively allow traffic in and out of a network,the second most important ben- efit of a firewall is its ability to log traffic.In this chapter,you learned how to test your firewall by conducting limited attacks against it.You also learned how to remain informed concerning scanning attacks and others designed to crash your firewall.You now have the tools and skills required to receive automatic alerts, and have your firewall automatically drop connections to scanning hosts. It is vital that you maintain your firewall,and with the tools presented in this chapter,you can gather the information required to maintain it intelligently.You now can receive informative alerts,and comprehensive information concerning your firewall.In regard to logging,both Firelogd and Fwlogwatch can be used together to create a comprehensive information system.Of course,new tools are being developed all the time,and you should work to remain informed about new projects,as well as updates to the tools presented in this chapter. Solutions Fast Track Testing Firewalls (cid:59) To disallow IP spoofing,your firewall should not allow any packets to pass from outside the network into your internal network if the source address is the same as any host in your internal network.If you are using private IP addresses,no system outside of the firewall should ever be able to assume this IP address and access your internal network’s ephemeral ports. (cid:59) Disable all unused services and configure the used ones keeping security in mind.If you are running Squid or another proxy server on the fire- wall,make sure that only this port is open.Daemons such as Telnet,File Transfer Protocol (FTP),Hypertext Transfer Protocol (HTTP),and others should be shut down in almost all situations.In many situations,it is best to allow only interactive logins at your firewall. www.syngress.com
138_linux_11 6/20/01 9:52 AM Page 594 594 Chapter 11 • Maintaining Firewalls (cid:59) Monitor your system hard drives,RAM,and processors.You may need to cut back on your log settings.Standard Linux tools that can help you determine if your system is becoming overburdened are vmstat and top. (cid:59) Use the who and last commands to learn about who has logged in to the firewall. (cid:59) Check the rules database.Determine if any unauthorized changes have been made to your database.Use the diff command to compare the two files to see if any changes have occurred.You may also use md5 to gen- erate fingerprints of the configuration files to see whether any unautho- rized changes have been made to them.If you have Tripwire installed, you will then be informed of massive changes to the hard drive. (cid:59) Verify connectivity with company management and end users,and remain informed concerning the operating system. (cid:59) The introduction of log analysis software such as Firelogd and Fwlogdaemon have made it possible to detect and block port scans,all the while sending an alert to the systems administrator.Most adjunct software,such as Fwlogwatch,provides ways to exclude trusted hosts from being blocked. Using Telnet, Ipchains, Netcat, and SendIP to Probe Your Firewall (cid:59) Although Iptables does not support rule checking,the ipchains -C command allows you to check how your existing rule set operates.It will return information as to whether the packet is dropped or accepted. It is up to you to act on this information.This tool is handy if you are logged in to the same system as you are testing,and you are becoming familiar with the existing rules and wish to send out packets that test how the rules are working. (cid:59) A simple port scan can help you determine which ports are open on your firewall.Using applications such as Telnet and Netcat,you can then determine what daemon is listening behind that port. (cid:59) If you have logged in to the firewall interactively,it is often useful to open two terminals.You can use the first terminal to issue the telnet command,and you can use the second terminal to view the results in the /var/log/messages file. www.syngress.com
138_linux_11 6/20/01 9:52 AM Page 595 Maintaining Firewalls • Chapter 11 595 (cid:59) When compiled properly,Netcat can also spoof IP addresses.If you have set a firewall rule to deny a particular source port,you can test it with Netcat.Because Netcat is so versatile,it can also be used against you to open a back door on your system.Therefore,if possible,you should install this application only on a client system,rather than on the router. (cid:59) Although Netcat does have the ability to create some packets in certain instances,it is not a true packet generator.SendIP is designed to allow you to create packets of your own design to test whether your firewall rules are working properly. (cid:59) SendIP allows you to forge any part of a Transmission Control Protocol (TCP) session,as well as any element of an IP,User Datagram Protocol (UDP),or Internet Control Message Protocol (ICMP) packet.SendIP also allows you to forge all elements of IPv6 addresses,and also allows you to forge Routing Information Protocol (RIP) packets.This tool is useful in regard to firewalls because it allows you to simulate any situation. Understanding Firewall Logging, Blocking, and Alert Options (cid:59) Third-party logging applications such as Firewall Log Daemon (Firelogd) and FwLogwatch are available to help you sort and act on the informa- tion gathered by the firewall. (cid:59) Firelogd,which supports both Ipchains and Iptables,can be run either as an application,or as a daemon.It reads the kernel log entries generated by either Ipchains or Iptables and passes them into a “first in,first out” (FIFO) pipe,which Firelogd can then process.Once its buffer is full,it e-mails a report of suspicious traffic to an account of your choosing.You can have it mailed to a local account,or to a remote system of your choice. (cid:59) Fwlogwatch is a logging and reporting mechanism,similar to Firelogd but far more versatile,that allows you to automatically block all traffic that is identified as an attack.Used in conjunction with Firelogd,it helps create a system that continuously keeps you informed concerning port scans and other network events that surpass the thresholds you set. www.syngress.com
138_linux_11 6/20/01 9:52 AM Page 596 596 Chapter 11 • Maintaining Firewalls (cid:59) The most intriguing feature of Fwlogwatch is its ability to automatically configure Ipchains/Iptables and issue alerts.The best way to do this is to edit the three configuration files to suit your needs:/etc/ fwlogwatch.config (or whatever you rename it to), /usr/sbin/ fwlw_notify,and /usr/sbin/fwlw_respond. Obtaining Additional Firewall Logging Tools (cid:59) Additional firewall logging tools include Ipchains logger,LogGrep,Open Correlation,Fwlogsum,IP Firewall Accounting (IPFA),Appsend, Ipmeter,Mrtg,and Ntop. (cid:59) Ipchains logger is a logging enhancer similar to Fwlogd,but limited to Ipchains.It is especially strong in its ability to log masqueraded connections. (cid:59) The LogGrep daemon uses the grep utility to read and sort log files.It is limited,as of this writing,to Ipchains.With this utility,you can sort pro- tocol,date,IP port firewall log entries to generate custom log files. Currently,it can also discover port scans,and generates HTML pages. (cid:59) Ntop is a powerful tool that allows you to identify the nature of all egress and ingress traffic.It is much like the standard top application,in that it gathers information about hosts,and then places the most active hosts at the top of the display.It can be run on a terminal just like the standard top application;you can run it in Web server mode,or as a Web server.This mode supports authentication,thus allowing you to easily limit access to only specific users. www.syngress.com
138_linux_11 6/20/01 9:52 AM Page 597 Maintaining Firewalls • Chapter 11 597 Frequently Asked Questions The following Frequently Asked Questions, answered by the authors of this book, are designed to both measure your understanding of the concepts presented in this chapter and to assist you with real-life implementation of these concepts. To have your questions about this chapter answered by the author, browse to www.syngress.com/solutions and click on the “Ask the Author” form. Q: You mention the use of Nmap as a scanner in this chapter.What other ways can I use Nmap to test my firewall? A: Use Nmap’s “slow scan”feature to map out your firewall’s ports.See if your IDS applications and logging daemons such as Firelogd and Fwlogwatch can recognize and report scans that,for example,take five minutes between sending out packets.If you find that you have to set thresholds too low in order to get satisfactory results for slow scans,consider using the Shadow intrusion detection suite (www.nswc.navy.mil/ISSEC/CID). Q: Some of the solutions,such as using Fwlogwatch,require the use of Cron, while others require the use of a Web server such as Apache.Isn’t it a bad idea to use Cron and Web servers on your firewall? A: Sometimes,it is necessary to run services on your firewall.If you require automated logging,you will either have to use Cron or resort to an internal scheduling application found in one of the applications you use.As long as your system’s ports and services are locked down as much as possible,and as long as you keep current concerning the daemons that you do run,you will be both safe and informed.Just to make sure you are on the safe side,use both network-level packet filtering and access control lists (ACLs) in the Web server.If possible,use HTTPS instead of plain HTTP. Q: I thought packet-filtering routers couldn’t detect port scans.Yet,it seems like they now can.Is this a new feature given by Iptables and the 2.4 kernel? A: No.Packet-filtering routers generally cannot detect port scans.Applications such as Firelogd and Fwlogwatch add this ability. Q: What command do I use to create entries in the /etc/cron.hourly and/or /etc/cron.daily directories? www.syngress.com
138_linux_11 6/20/01 9:52 AM Page 598 598 Chapter 11 • Maintaining Firewalls A: You simply create a text file in the directory that contains the relevant com- mands.This file must begin with a “shebang,”which appears as follows: #/bin/sh You can then add whatever commands you wish.For example,you can specify the fwlogsummary.cgi file,and it will run hourly or daily,depending on the directory in which it is placed.You do not have to use any of the time fields,as you would if you use the crontab -e command.However,if you place a file in the /etc/cron.d/ directory,you will have to use the time fields, just as if you were creating a crontab entry. Q: Fwlogwatch once created an Iptables rule blocking a host.I have since deleted this entry because I thought it was a false positive.However,I was wrong and I have noticed that this host is constantly scanning my firewall. Why doesn’t Fwlogwatch add this host again? A: Because Fwlogwatch already thinks that it has added the host.You can either add the host to the fwlw chain manually,or restart Fwlogwatch.However,if you restart Fwlogwatch,you will lose any existing blocking rules,so save them before you restart. Q: I am getting flooded by a huge number of e-mails from Fwlogwatch.What do I do? A: Increase the alert_threshold value in your Fwlogwatch configuration file. Firelogd allows you to set the threshold as well.If you have installed Firelogd from an RPM,just edit the /etc/rc.d/init.d/firelogd file and increase the QSIZE= value.If you do not have access to this file,then start firelogd with the -b value option and argument,and specify the buffer size there. www.syngress.com
138_linux_AppA 6/20/01 9:54 AM Page 599 Appendix A Bastille Log 599
138_linux_AppA 6/20/01 9:54 AM Page 600 600 Appendix A • Bastille Log The following table is provided for logging your Bastille choices.Bastille is simple to use,but it’s easy to lose track of the changes you implement.This can be a problem if you are unable to perform a typical operation on the system,or are denied access to a command or service.Many times,it is because you locked down part of the system by mistake,or misjudged the impact of a particular Bastille choice.It is always a good idea to create a hard-copy log of the options you select in Bastille.When you configure Bastille on your systems,use this Bastille log to record the changes you implemented. Question Yes No Module 1: IPChains.pm
- Would you like to run the ipchains script? (Choosing “No” will skip to Module 2.)
- Do you need the advanced networking options?
- DNS Servers
- Public interfaces
- TCP services to audit (name or port number)
- UDP services to audit (name or port number)—the “Back Orifice” port number on Microsoft clients is listed by default.
- ICMP services to audit (name or port number)—an example is the Microsoft “echo-request” service (Microsoft ping and tracert commands).
- TCP service names or port numbers to allow on public interfaces (typical workstations should not allow any services).
- UDP service names or port numbers to allow on public interfaces (typical workstations should not allow any services).
- Force passive mode (i.e., for clients connecting to an FTP server).
- TCP services to block (if you force passive mode, you can skip this step).
- UDP services to block
- ICMP allowed types:
- Enable source address verification Continued www.syngress.com
138_linux_AppA 6/20/01 9:54 AM Page 601 Bastille Log • Appendix A 601 Question Yes No 15. Reject method 16. Interfaces for DHCP queries 17. NTP servers to query 18. ICMP types to disallow outbound Module 2: PatchDownload.pm
- Would you like to download and install the updated RPMs? Module 3: FilePermissions.pm
- Would you like to set more restrictive permissions on the administration utilities?
- Would you like to disable SUID status for mount/umount?
- Would you like to disable SUID status for ping?
- Would you like to disable SUID status for dump and restore?
- Would you like to disable SUID status for cardctl?
- Would you like to disable SUID status for at?
- Would you like to disable SUID status for DOSEMU?
- Would you like to disable SUID status for news server tools?
- Would you like to disable SUID status for printing utilities?
- Would you like to disable SUID status for the r-tools?
- Would you like to disable SUID status for usernetctl?
- Would you like to disable SUID status for traceroute? Module 4: AccountSecurity.pm
- Would you like to set up a second UID 0 account? 1a. What should we name the second UID 0 account? Continued www.syngress.com
138_linux_AppA 6/20/01 9:54 AM Page 602 602 Appendix A • Bastille Log Question Yes No 2. May we take strong steps to disallow the dangerous r-protocols? 3. Would you like to enforce password aging? 4. Would you like to create a nonroot user account? 4a. What should we name your nonroot account? 5. Would you like to restrict the use of cron to administrator accounts? Module 5: BootSecurity.pm
- Would you like to password protect the LILO prompt? 1a. Enter LILO password, please.
- Would you like to reduce the LILO delay time to zero?
- Do you ever boot Linux from the hard drive?
- Would you like to write the LILO changes to a boot floppy? 4a. Floppy drive device name
- Would you like to disable Ctrl_Alt_Delete rebooting?
- Would you like to password protect single-user mode? Module 6: SecureInetd.pm
- Would you like to modify inetd.conf and /etc/ hosts.allow to optimize use of Wrappers?
- Would you like to set sshd to accept connections only from a small list of IP addresses? 2a. IP addresses to accept ssh from:
- Would you like to make “Authorized Use” banners? Module 7: DisableUserTools.pm
- Would you like to disable the compiler? Continued www.syngress.com
138_linux_AppA 6/20/01 9:54 AM Page 603 Bastille Log • Appendix A 603 Question Yes No Module 8: ConfigureMiscPAM.pm
- Would you like to put limits on system resource usage?
- Should we restrict console access to a small group of user accounts? 2a. What accounts should be able to log in at console? Module 9: Logging.pm
- Would you like to add additional logging?
- Do you have a remote logging host? 2a. What is the IP address of the machine you want to log to?
- Would you like to set up process accounting? Module 10: MiscellaneousDaemons.pm
- Would you like to disable apmd?
- Would you like to deactivate NFS and Samba?
- Would you like to disable atd?
- Would you like to disable PCMCIA services?
- Would you like to disable the DHCP daemon?
- Would you like to disable GPM?
- Would you like to disable the news server daemon?
- Would you like to deactivate the routing daemons?
- Would you like to deactivate NIS server and client programs?
- Would you like to disable SNMPD? Module 11: Sendmail.pm
- Do you want to leave sendmail running in daemon mode?
- Would you like to run sendmail via cron to process the queue?
- Would you like to disable the VRFY and EXPN sendmail commands? Continued www.syngress.com
138_linux_AppA 6/20/01 9:54 AM Page 604 604 Appendix A • Bastille Log Question Yes No Module 12: RemoteAccess.pm
- Would you like to download and install SSH? Module 13: DNS.pm
- Would you like to chroot named and set it to run as a nonroot user?
- Would you like to deactivate named, at least for now? Module 14: Apache.pm
- Would you like to deactivate the Apache Web server?
- Would you like to bind the Web server to listen only to the localhost?
- Would you like to bind the Web server to a particular interface? 3a. Address to bind the Web server to:
- Would you like to deactivate the following of symbolic links?
- Would you like to deactivate server-side includes?
- Would you like to disable CGI scripts, at least for now?
- Would you like to disable indexes? Module 15: Printing.pm
- Would you like to disable printing? Module 16: FTP.pm
- Would you like to disable user privileges on the FTP daemon?
- Would you like to disable anonymous download? www.syngress.com
138_linux_AppB 6/20/01 9:55 AM Page 605 Appendix B Hack Proofing Linux Fast Track This Appendix will provide you with a quick, yet comprehensive, review of the most important concepts covered in this book. 605
138_linux_AppB 6/20/01 9:55 AM Page 606 606 Appendix B • Hack Proofing Linux Fast Track ❖ Chapter 1 Introduction to Open Source Security Using the GNU General Public License (cid:59) The GPL protects the software code,not a corporation or an individual. (cid:59) Protecting code rather than individuals is a radical change,because it allows code to be improved upon without being made completely proprietary. (cid:59) Open source code does not necessarily have to be free.For example,compa- nies such as Red Hat and Caldera sell their products,which are based on the open source Linux kernel. Soft Skills: Coping with Open Source Quirks (cid:59) As you use open source code,remember that this code may represent a work in progress. (cid:59) Sometimes,open source code changes radically,forcing you to retrain users. You may find that updates happen irregularly,and that it is sometimes more challenging to update open source code.Furthermore,once you upgrade the code,you may be presented with an application that behaves very differ- ently,or has a radically different interface. (cid:59) Before installing open source software,make sure that your operating system contains all of the necessary supporting applications and libraries. Should I Use an RPM or Tarballs? (cid:59) RPMs sometimes offer convenience.However,precompiled RPMs often do not have all of the features necessary to implement a truly useful product. (cid:59) Tarballs often require editing of a special file called a makefile.However,this is not necessarily all that difficult.It simply requires that you know where your supporting applications and libraries are.Also,most open source soft- ware will contain instructions concerning how to edit the makefile.Most well-known operating systems,such as Red Hat Linux and Slackware,do not require makefile modification. www.syngress.com
138_linux_AppB 6/20/01 9:55 AM Page 607 Hack Proofing Linux Fast Track • Appendix B 607 Chapter 1 Continued (cid:59) RPMs often contain useful startup scripts that are not found elsewhere. Sometimes,it is useful to install the RPM,then the tarball version,and then combine elements from the two for a complete solution. Obtaining Open Source Software (cid:59) Sites such as SourceForge (www.sourceforge.com),RPMFind (www.rpmfind.net),and SecurityFocus (www.securityfocus.com) are valuable software sources. (cid:59) Be especially careful when downloading any source code,regardless of format.Digital signatures can help you determine the author of a package,as well as whether a package has been altered. (cid:59) The Gnu Privacy Guard (GPG) and Pretty Good Privacy (PGP) packages are available to help you verify signatures.They do not stop the execution of malicious code,however.They simply inform you about the nature of the code’s author,and of any changes that may have occurred to the code. A Brief Encryption Review (cid:59) Symmetric encryption is the use of one key to encrypt and decrypt infor- mation.If a malicious user is able to intercept the key,he or she can then use it to decrypt your secret messages. (cid:59) Asymmetric encryption uses a mathematically related key pair to encrypt and decrypt information.This type of encryption is commonly used on the Internet and on LANs,because it reduces the likelihood that the key can be learned by a malicious user,and aids in authentication. (cid:59) One-way encryption is the use of an algorithm to encrypt information so that it is,mathematically speaking,impossible to unencrypt.One-way encryption is also used to read a file and then create a hash of that file.The resulting hash value is said to be mathematically unrecoverable.Hash code is often used to compare one value to another during the login process:the person logging in enters a username and password,and the authentication mechanism creates a hash of these two values and compares it to the hash values generated from the /etc/passwd and /etc/shadow databases.If the values match,access is allowed. www.syngress.com
138_linux_AppB 6/20/01 9:55 AM Page 608 608 Appendix B • Hack Proofing Linux Fast Track Chapter 1 Continued Public Key and Trust Relationships (cid:59) You must generate a key pair to begin using your public key to authenticate yourself or to encrypt network transmissions. (cid:59) Establishing a trust relationship involves exchanging public keys.Sometimes, individual users must give public keys.At other times,public keys are exchanged between network hosts. (cid:59) Never reveal your private key.If your private key is made available to a third party,this person will be able to read all of your encrypted files. Auditing Procedures (cid:59) As an auditor,your job is to lock down your network,which means that you must consider the security of each host using tools that allow you to determine changes in files and directories,and who has scanned and accessed your system.You must also monitor network transmission and con- figure your firewall to establish an effective network perimeter that separates your network from all others. (cid:59) An Intrusion Detection System (IDS) acts as an auditing host or series of auditing hosts that allow you to monitor and secure data as it passes across the network. (cid:59) Protecting the network perimeter involves proper firewall and proxy server configuration,logging,and monitoring. ❖ Chapter 2 Hardening the Operating System Updating the Operating Systems (cid:59) Operating system releases usually contain software bugs and security vulnerabilities. (cid:59) Operating system vendors or organizations offer fixes,corrections,and updates to the system.For example,Red Hat offers this material at its Web site,which includes Update Service Packages and the Red Hat Network. www.syngress.com
138_linux_AppB 6/20/01 9:55 AM Page 609 Hack Proofing Linux Fast Track • Appendix B 609 Chapter 2 Continued (cid:59) You should always ensure your system has the latest necessary upgrades. Many errata and Update Service Packages are not required for every system. You should always read the associated documentation to determine if you need to install it. Handling Maintenance Issues (cid:59) After your system goes live,you must always maintain it by making sure the most current patches and errata are installed,which include the fixes,cor- rections,and updates to the system,as well as the applications running on it. (cid:59) You should always check the Red Hat site at www.redhat.com/apps/ support/updates.html for the latest errata news. (cid:59) For example,Red Hat security advisories provide updates that eliminate security vulnerabilities on the system.Red Hat recommends that all admin- istrators download and install the security upgrades to avoid denial-of- service (DoS) and intrusion attacks that can result from these weaknesses. Manually Disabling Unnecessary Services and Ports (cid:59) You should always disable vulnerable services and ports on your system that are not used.You are removing risk when you remove unnecessary services. (cid:59) The /etc/xinetd.d directory makes it simple to disable services that your system is not using.For example,you can disable the FTP and Telnet ser- vices by commenting out the FTP and Telnet entries in the respective file and restarting the service.If the service is commented out,it will not restart. Locking Down Ports (cid:59) When determining which ports to block on your server,you must first determine which services you require.In most cases,block all ports that are not exclusively required by these services. (cid:59) To block TCP/UDP services in Linux,you must disable the service that uses the specific port. www.syngress.com
138_linux_AppB 6/20/01 9:55 AM Page 610 610 Appendix B • Hack Proofing Linux Fast Track Chapter 2 Continued Hardening the System with Bastille (cid:59) The Bastille program facilitates the hardening of a Linux system.It saves administrators time from configuring each individual file and program throughout the operating system. (cid:59) Administrators answer a series of “Yes”and “No”questions through an interactive text-based interface.The program automatically implements the administrators’preferences based on the answers to the questions. (cid:59) Bastille can download and install RPM updates,apply restrictive permissions on administrator utilities,disable unnecessary services and ports,and much more. Controlling and Auditing Root Access with Sudo (cid:59) Sudo (Superuser Do) allows an administrator to give specific users or groups the ability to run certain commands as root or as another user. (cid:59) Sudo features command logging,command restrictions,centralized adminis- tration of multiple systems,and much more. (cid:59) The sudo command is used to execute a command as a superuser or another user.In order to use the sudo command,the user must supply a username and password.If a user attempts to run the command via sudo and that user is not entered in the sudoers file,an e-mail is automatically sent to the administrator,indicating that an unauthorized user is accessing the system. Managing Your Log Files (cid:59) Logging allows administrators to see who and what has accessed their system. Many helpful Linux log files are located in the /var/log directory. (cid:59) Linux offers commands that allow administrators to access useful log files. Two commands of interest are last and lastlog.The message file also offers useful data for determining possible security breaches on your system. www.syngress.com
138_linux_AppB 6/20/01 9:55 AM Page 611 Hack Proofing Linux Fast Track • Appendix B 611 Chapter 2 Continued (cid:59) The Linux logs should be checked frequently to determine if any security violations have occurred on your system.Logs do not offer solutions,so you must analyze the data and decide how to counteract the attack. Using Logging Enhancers (cid:59) Logging enhancers are tools that simplify logging by allowing logging information to be filtered and often displaying logs in simplified formats. (cid:59) Viewing text-based files with hundreds or thousands of entries can be burdensome,especially if you are only looking for one specific error entry. (cid:59) Three popular logging services used by administrators are SWATCH, scanlogd,and the next generation of syslogd (syslogd-ng). ❖ Chapter 3 System Scanning and Probing Scanning for Viruses Using the AntiVir Antivirus Application (cid:59) Virus scanners will perform the following tasks:check the system’s boot record;search directories and subdirectories;automatically delete infected files;save scans into a log file;use an internal scheduler,or an external scheduler,such as at or cron;scan NFS-mounted drives;delete infected files; and move infected files to a central,“quarantine”area of your own choosing. (cid:59) The AntiVir for Servers binary is a truly impressive command-line virus scanner sold by H+BDEV.It is capable of searching for and deleting macro viruses,boot sector viruses,e-mail viruses,and DDoS daemons. (cid:59) An antivirus application is only as useful as its virus definition file.Your application should provide you with frequent updates. www.syngress.com
138_linux_AppB 6/20/01 9:55 AM Page 612 612 Appendix B • Hack Proofing Linux Fast Track Chapter 3 Continued Scanning Systems for DDoS Attack Software Using a Zombie Zapper (cid:59) Attackers wage denial of service (DoS) attacks by first finding and hacking into insecure systems on the Internet.Then,they install programs such as Tribe Flood Network 2000 (Tfn2k),stacheldraht,and others.The compro- mised systems now have illicit programs installed on them called zombies. (cid:59) Once a zombie is commanded to attack a victim,it will generally continue the attack until it is forced to stop.If you notice large amounts of unknown traffic when you monitor your network or network perimeter,you can use a zombie zapper against the host or hosts generating this traffic. (cid:59) Limitations of a zombie zapper can include the following:they are pro- grammed to shut down only certain DDoS servers;it may be blocked by a firewall;the malicious user may have changed the password of the illicit server;or the attack server may have spoofed packets. Scanning System Ports Using the Gnome Service Scan Port Scanner (cid:59) Systems administrators find port scanners useful when auditing their own systems.Although a simple port scanner such as GSS does not actually test for flaws in binaries and Web applications,a good port scanner can help you isolate which ports are open,and then take any action that is necessary. (cid:59) Port scanning a machine may set off an alarm for the system’s administrator, who might take a dim view of your actions.Unless you have explicit (some- times,even written) permission from the system administrator,you may cause a serious violation of your security policy. Using Nmap (cid:59) Nmap is an advanced Unix-based port scanner.It can be used to audit your network,test your router and switch configurations,test your firewall configurations,and identify the nature of suspicious remote systems. www.syngress.com
138_linux_AppB 6/20/01 9:55 AM Page 613 Hack Proofing Linux Fast Track • Appendix B 613 Chapter 3 Continued (cid:59) You can use Nmap as a basic port scanner for a system on your internal net- work,or you can have it identify the operating system version of a remote system on another firewall-protected network.Nmap is capable of manipu- lating aspects of TCP to hide its scans from firewalls. (cid:59) Nmap’s “interactive mode”allows you to do two things that you should be aware of as a systems administrator:It can conduct multiple Nmap sessions, and it can disguise the fact that it is running on your system. Using Nmapfe as a Graphical Front End (cid:59) The Nmap Front End (NmapFE) provides a well-written,stable GUI that allows you to control almost every aspect of Nmap. (cid:59) Note that this interface is somewhat unstable,and given to faults that lead to complete crashes (core dumps).This is especially the case in systems that have been upgraded (say,from Red Hat version 7.0 to 7.1). Using Remote Nmap as a Central Scanning Device (cid:59) Remote Nmap (Rnmap) enables a client system to connect to a central Nmap server.It is currently in beta,but both the client and the server are quite strong. (cid:59) Rnmap has the following features:user authentication,a command-line and GUI client,and available encryption (still in beta form).Rnmap is written in the Python scripting language,which means that your Linux system must have Python installed. Deploying Cheops to Monitor Your Network (cid:59) Billed as a graphical network neighborhood,Cheops is related to applica- tions such as HP OpenView.Both Cheops and HP OpenView allow you to create a graphical map of the network,and then manage any host on that map.Although Cheops is not nearly as sophisticated,it still allows you to quickly learn which hosts are up on a particular network segment. www.syngress.com
138_linux_AppB 6/20/01 9:55 AM Page 614 614 Appendix B • Hack Proofing Linux Fast Track Chapter 3 Continued (cid:59) Cheops issues network broadcasts,and then processes these replies to dis- cover remote hosts.Some older versions of Cheops use an application called Queso to read the replies of remote systems.Queso is similar to Nmap, although not as sophisticated or as recent.As with Nmap,Queso does use stack fingerprinting to guess the operating system of a remote server. (cid:59) Cheops is capable of two types of monitoring.First,it can have your Linux system issue simple ping requests to see if a remote host is up.Second, instead of relying on a crude ping request,Cheops allows you to pick a specific service offered by the remote host. Deploying Nessus to Test Daemon Security (cid:59) Using vulnerability detection software,you can find out exactly what spe- cific application is listening on that port.A good hacker is well informed concerning the popular servers on the Internet,and can quickly take advan- tage of a specific daemon that has a security problem.Nessus allows you to proactively scan your system to determine its weaknesses. (cid:59) The Nessus client allows you to connect to the Nessus daemon,which is usually on a remote server.Several different clients exist,including those for Windows,Macintosh,and Unix/Linux systems. (cid:59) The Nessus project has been quite active,and has a good record for providing regular plug-in updates. (cid:59) When you launch the client for the first time,it will take some time to create a public key pair,which will be used to authenticate with any Nessus daemon. (cid:59) The compilation option allows the client to “remember”past sessions and to configure a nessus daemon to conduct a scan all by itself.These capabilities are respectively called differential and detached scanning.The ability to save sessions allows you to begin sessions that have been interrupted. www.syngress.com
138_linux_AppB 6/20/01 9:55 AM Page 615 Hack Proofing Linux Fast Track • Appendix B 615 ❖ Chapter 4 Implementing an Intrusion Detection System Understanding IDS Strategies and Types (cid:59) An Intrusion Detection System (IDS) is any system or set of systems that has the ability to detect a change in the status of your system or network. Because an IDS can contain multiple hosts and applications,this chapter will often use the term IDS application to refer to a specific IDS element. (cid:59) Two general strategies are used when it comes to detecting intrusions,rule- based IDS applications (also called signature-based) and anomaly-based IDS applications. (cid:59) IDS applications do their work either continuously in real-time,or at certain intervals (interval-based intrusion detection). (cid:59) Two different types of IDS applications exist:host-based and network-based. (cid:59) In many cases,an effective IDS application requires a great deal of processor time in order to work well.Log files require a great deal of hard drive space, especially in busy networks.Thus,simply for the sake of performance,con- sider using multiple systems to gather,store,and analyze information. (cid:59) Most network-based IDS applications do not work properly in a switched network. (cid:59) An IDS stores its information in several places:System logs,simple text files and directories,and databases. (cid:59) An IDS can act as a supplement to a firewall,because it can help you mon- itor traffic on the internal network.Sometimes it may be useful to place an IDS application outside the firewall,or in the DMZ so that you can learn more about the attacks waged against the firewall itself. Installing Tripwire to Detect File Changes (cid:59) Tripwire is one of the most popular applications for determining when a file or directory has been altered.It scans your system’s hard drive and cre- ates a database.After its database has been created,Tripwire can conduct reg- ular scans of your hard drive and inform you (via e-mail or a log file) about any changes. www.syngress.com
138_linux_AppB 6/20/01 9:55 AM Page 616 616 Appendix B • Hack Proofing Linux Fast Track Chapter 4 Continued Updating Tripwire to Account for Legitimate Changes in the OS (cid:59) Eventually,legitimate changes will occur to your operating system.These changes will keep appearing in reports unless you update your database. Database update mode allows you to update the database so that it no longer recognizes any differences between itself and the operating system. (cid:59) Updating the policy is different than updating the database.It is sometimes necessary to update your policy.If,for example,you install a new applica- tion,you may want to ensure that these files are protected by Tripwire. Configuring Tripwire to Inform You Concerning Changes (cid:59) As with any Linux/Unix application,you will have to do quite a bit of “tweaking”to make Tripwire suit your needs.Refer back to the Installing Tripwire,Securing the Tripwire Database,and Using Cron to Run Tripwire Automatically Exercises for more information on how to install and use Tripwire. Deploying PortSentry to Act as a Host-Based IDS (cid:59) PortSentry is a host-based IDS application that monitors all open ports.It is an effective tool if you wish to detect TCP and/or UDP port scans,and if you wish to have your host reconfigure itself in case of a port scan. (cid:59) PortSentry will compile on any standard Linux system that has TCPWrapper and Ipchains or Ipfw support. (cid:59) All of the PortSentry files are located off of the /usr/local/psionic/ portsentry/ directory.All files are owned by root,and the program must be started as root,because it places your NIC into promiscuous mode. www.syngress.com
138_linux_AppB 6/20/01 9:55 AM Page 617 Hack Proofing Linux Fast Track • Appendix B 617 Chapter 4 Continued Configuring PortSentry to Block Users (cid:59) The Advanced Stealth Scan Detection Options determine the port numbers that PortSentry will monitor when you use the -stcp option to start PortSentry.By default,PortSentry listens only to ports up to 1023. (cid:59) The Dropping Routes section allows you to determine how PortSentry will deny connections.The KILL_ROUTE options allow you to configure various system tools to actually do the work of denying hosts. Optimizing PortSentry to Sense Attack Types (cid:59) You can start PortSentry in various ways,depending upon the types of attacks you wish to detect.Customize each system that you have depending upon its function and place in your network. Installing and Configuring Snort (cid:59) Snort,available at www.snort.org,is best-suited to detailed log analysis.Like PortSentry,it places your NIC into promiscuous mode.It captures all traffic on your network segment,as opposed to traffic destined for just one host. (cid:59) Snort can log its findings into remote or local databases.Snort’s analysis fea- ture is able to read the contents of the captured packets and then inform you about any attacks waged against your network. (cid:59) Snort is able to automatically detect attacks based solely upon the rules it uses. (cid:59) You can use several detection plug-ins.Sometimes,plug-ins do not require additional arguments.At other times,they require you to specify additional parameters. Running Snort as a Network-Based IDS (cid:59) However,the snort.conf file gives you the ability to use Snort as a true IDS because it has Snort use rules and plug-ins.You can also specify more sophisti- cated home network and logging methods.After you begin using the rules and plug-ins found in snort.conf,it will begin selectively logging traffic. www.syngress.com
138_linux_AppB 6/20/01 9:55 AM Page 618 618 Appendix B • Hack Proofing Linux Fast Track Chapter 4 Continued Configuring Snort to Log to a Database (cid:59) On busy networks,it is necessary to configure Snort to log less information. Certain command-line options help you control how much your IDS will log. (cid:59) Additional configuration options are available,including the ability to con- figure Snort to send alerts to Windows systems that have the Server service running. Identifying Snort Add-Ons (cid:59) SnortSnarf is a collection of Perl scripts designed to read the Snort alert file (/var/log/snort/alert) and then generate HTML output.The program is available from www.silicondefense.com/software/snortsnarf. ❖ Chapter 5 Troubleshooting the Network with Sniffers Understanding Packet Analysis and TCP Handshakes (cid:59) Analyzing TCP traffic is one of the most important tasks for a security administrator.It can tell you a great deal about your network connections, as well as identify many denial-of-service (DoS) attacks and man-in-the- middle,or hijacking,attacks. (cid:59) A TCP handshake must occur whenever two hosts establish a connection on a TCP/IP network.This handshake consists of rules that the two hosts must follow. (cid:59) Special mechanisms,called flags,are used to establish and terminate a TCP connection.Flags are included in the TCP header,and each flag completes a different function in the TCP handshake.The flags used are SYN,FIN,RST, PSH,ACK,and URG. www.syngress.com
138_linux_AppB 6/20/01 9:55 AM Page 619 Hack Proofing Linux Fast Track • Appendix B 619 Chapter 5 Continued Creating Filters Using Tcpdump (cid:59) Tcpdump captures packets on a given interface,or on all interfaces on a system,for analysis.It is a command-line tool,which can make it difficult to read. (cid:59) Tcpdump options allow you to filter the packets that are captured.For example,you can limit the capture to ARP packets or display only IP addresses (not host names). (cid:59) Tcpdump expressions allow you to specify the hosts from which you will capture packets.For example,an expression will ensure that only the data you require,such as the traffic between your interface and a specific host, will be printed. Configuring Ethereal to Capture Network Packets (cid:59) Ethereal provides a GUI environment for capturing network packets,which makes it easier for many administrators to use. (cid:59) Ethereal and tcpdump capture packets using the pcap library (libpcap).Since they both use the pcap library (libpcap) syntax,they can share many of the same commands,such as filtering options and primitives. (cid:59) You can easily save Ethereal filters and access them as needed for each packet capture you make.You can have multiple filters from which to choose for different needs. Viewing Network Traffic between Hosts Using EtherApe (cid:59) EtherApe is a GUI that displays networking activity graphically by identi- fying hosts and the links that exist between the hosts.It displays real-time traffic,as well as traffic saved to a file. (cid:59) EtherApe also uses the pcap library (libpcap),the library for packet capturing and filtering,which is similar to tcpdump and Ethereal. (cid:59) EtherApe uses options to specify the capture information,such as the interface,link colors,or whether names or numbers will be used. www.syngress.com
138_linux_AppB 6/20/01 9:55 AM Page 620 620 Appendix B • Hack Proofing Linux Fast Track ❖ Chapter 6 Network Authentication and Encryption Understanding Network Authentication (cid:59) Even if employees remain behind the firewall,many system services allow clear text authentication,including Telnet,File Transfer Protocol (FTP),and standard Network Information Service (NIS).Even though transmissions can be encrypted,many tools exist that help hackers wage a sniffing attack to capture encrypted information. (cid:59) After the packets containing the encrypted passwords are captured,hackers use cracking applications such as L0phtCrack,which are designed to both capture and crack sniffed encrypted passwords. Creating Authentication and Encryption Solutions (cid:59) To authenticate safely,you have two options:Find a way to authenticate without sending passwords across the network,or find a way to discard any password that is sent across the network. The accepted phrase for this strategy is one-time passwords (OTP). (cid:59) Kerberos has the added ability to encrypt transmissions after authentication occurs.The use of OTP,however,does not encrypt subsequent transmis- sions.OTP is usually much easier to implement than Kerberos,however. (cid:59) Other encrypting solutions include Secure Sockets Layer (SSL),Secure Shell (SSH),and IPSec. Implementing One-Time Passwords (OTP and OPIE) (cid:59) In the Linux world,the most universal way to implement one-time pass- word (OTP) support in your Linux systems is to install the One-Time Passwords in Everything (OPIE) application.OPIE supports the Message Digest 5 (MD5) algorithm. (cid:59) By default,OPIE does not enforce OTP whenever you log in interactively. Any user is given the choice of using OTP or the standard login procedure. www.syngress.com
138_linux_AppB 6/20/01 9:55 AM Page 621 Hack Proofing Linux Fast Track • Appendix B 621 Chapter 6 Continued (cid:59) Using opiepasswd to create OPIE users.As soon as the opiepasswd com- mand is used against a user,it is then possible for that user to use OTP to log in.The opiekey command generates responses. (cid:59) When the systems administrator creates an OTP password list,the user can use the opieinfo command to generate a list of passwords for later use. Implementing Kerberos Version 5 (cid:59) Kerberos v5 is a revolutionary step in network authentication,because it allows you to establish a domain that authenticates not only individual hosts and users,but individual daemons,as well.Using Kerberos,you can centrally control which hosts and users can access the daemons on your network. (cid:59) After Kerberos is established on a network,passwords do not ever cross the network,not even in encrypted form.You can configure Kerberos to encrypt ensuring communications between authenticated hosts. (cid:59) A principal is the name for any host,service,or user that is allowed to authenticate on a Kerberos network.A principal consists of a primary (also known as a “root”),an instance,and a realm. (cid:59) The kadmin application,also found in the /usr/kerberos/sbin/ directory,is designed to add principals to the Kerberos database.The kadmin command also lists,modifies,and deletes principals.It is also used to populate and update the Key table files for each Kerberos host. Using kadmin and Creating Kerberos Client Passwords (cid:59) Standard principal policy settings include policy name,minimum password life (in seconds),maximum password life (in seconds),and minimum pass- word length. (cid:59) You can create a policy by using the addpol command from within kadmin. www.syngress.com
138_linux_AppB 6/20/01 9:55 AM Page 622 622 Appendix B • Hack Proofing Linux Fast Track Chapter 6 Continued (cid:59) The kinit command allows a user to obtain a ticket granting ticket (TGT) from the Key Distribution Center (KDC).Issuing the kinit command has the Kerberos client contact the KDC and obtain a TGT. (cid:59) After you run kinit,the cache will contain only the TGT.Additional creden- tials,such as actual tickets to access a daemon such as FTP,will be added only after you access the remote host. Establishing Kerberos Client Trust Relationships with kadmin (cid:59) The only way to establish a trust relationship on the Kerberos client host is to use the kadmin command. (cid:59) The administrator must use the kadmin -ktadd command on each Kerberos client that wishes to participate in the Kerberos realm.The kadmin ktadd -k command gives each client the ability to prove that it has the public keys of the services used. Logging On to a Kerberos Host Daemon (cid:59) Client A,the Kerberized client,first uses its TGT to request a session ticket. The Kerberos KDC checks to see if Client B has a host principal entry,then also checks to see if Client B has a host daemon entry for FTP.Then,the KDC determines that Client A has the proper host and host daemon keys for client B.If all of these credentials match,then client A can connect to client B’s FTP server. (cid:59) When you try to administer Kerberos using kadmin,it is important to realize that if you make significant changes to the database concerning a user,you will have to use kdestroy and then kinit to obtain new credentials. (cid:59) You must configure your Kerberos client hosts to use only Kerberized clients.In order to use Kerberos properly,no other client applications or server daemons should be used on the network,unless they use OTP, encryption,or a similarly secure protocol. www.syngress.com
138_linux_AppB 6/20/01 9:55 AM Page 623 Hack Proofing Linux Fast Track • Appendix B 623 ❖ Chapter 7 Avoiding Sniffing Attacks through Encryption Understanding Network Encryption (cid:59) Network encryption is used for any data transfer that requires confiden- tiality.Encryption ensures that data sent across a network from one host to another is unreadable to a third party. (cid:59) Rlogin,remote shell (rsh),and Telnet are three notoriously unsafe protocols. They do not use encryption for remote logins or any type of data transmis- sion.If a malicious hacker captured this traffic,it would display the data, such as usernames or any passwords,in clear text. Capturing and Analyzing Unencrypted Network Traffic (cid:59) You can capture packets during a Telnet login session using the open source packet sniffer Ethereal.Once the session is captured,you can locate the Telnet data packet that includes the data:password field. (cid:59) Another way to discover the Telnet password is to follow the TCP stream.To do this,simply select any packet involved in this Telnet connection,then select the Tools menu,and select Follow TCP Stream in Ethereal.The username and password are displayed in clear text. Using OpenSSH to Encrypt Network Traffic between Two Hosts (cid:59) OpenSSH encrypts all traffic between two hosts using Secure Shell (SSH). It is a secure replacement for common Internet programs used for remote connectivity,such as Telnet,rlogin,and rsh. (cid:59) It features strong encryption using Triple Data Encryption Standard (3DES) and Blowfish,as well as strong authentication using public keys,one-time passwords (OTPs),and Kerberos Authentication. www.syngress.com
138_linux_AppB 6/20/01 9:55 AM Page 624 624 Appendix B • Hack Proofing Linux Fast Track Chapter 7 Continued Installing and Configuring Secure Shell on Two Network Hosts (cid:59) OpenSSH implementations are significantly different between operating sys- tems.The OpenSSH Portability Team uses the OpenBSD OpenSSH code to develop portable versions for other operating systems.You must make sure a specific version exists for your operating system at www.openssh.org. (cid:59) The method for implementing SSH combines similar r-command concepts with a private and public key method. (cid:59) SSH can create a DSA private/public key pair for a user by using the ssh-keygen -d command.In SSH 2.0,the private DSA key is placed in the $HOME/.ssh/id_dsa file.The public key is placed in the $HOME/.ssh/ id_dsa.pub file.The public key should be renamed and copied to the $HOME/.ssh/authorized_keys2 file on the remote system. Implementing SSH to Secure Data Transmissions over an Insecure Network (cid:59) Both hosts must have SSH installed to transmit data securely,such as the SSH implementation. (cid:59) You must first use ssh-keygen to create a private and public key on each host using either RSA or DSA authentication.Then,distribute the public key to the host with which you wish to communicate,and vice versa. (cid:59) To establish the connection using SSH,the ssh command is used in the format ssh remotehost.Remotehost is the name of the host you will connect to using SSH. Capturing and Analyzing Encrypted Network Traffic (cid:59) You can capture packets between two hosts using an SSH session to deter- mine if the data is secure.For example,you can attempt to identify any login data,as well as any session data. (cid:59) Using Ethereal,or any packet-capturing program,you will find that all Application layer data is encrypted.No passwords,usernames,or usable data www.syngress.com
138_linux_AppB 6/20/01 9:55 AM Page 625 Hack Proofing Linux Fast Track • Appendix B 625 Chapter 7 Continued is displayed.Following a TCP stream is fruitless.Only the TCP ports are displayed in the capture. ❖ Chapter 8 Creating Virtual Private Networks Secure Tunneling with VPNs (cid:59) VPNs provide a private data network over public telecommunication infra- structures,such as the Internet,by providing authentication and encryption through a data “tunnel”between devices.All data transmitted between the devices through the tunnel is secure,regardless of what programs the devices are running. (cid:59) Telecommuter,router-to-router,and host-to-host are three the basic types of VPN solutions.The solution you choose will depend on your specific needs. (cid:59) Tunneling protocols are responsible for encapsulating a data packet before a host transmits it.The data is encapsulated and sent over the network to its destination.Upon arrival,the capsule is removed and the data is processed by the destination host.IP tunneling protocols are powerful because they can transmit foreign protocols over the Internet. Explaining the IP Security Architecture (cid:59) IPSec is an Internet Engineering Task Force (IETF) security protocol that is becoming a standard component of VPN tunneling protocols. (cid:59) IPSec secures all packets at Layer 3 (the network layer) of the OSI model by providing secure authentication and encryption over a network.Layer 3 secu- rity ensures that everything on the network is secure,such as IP addressing and routing over the Internet,as well as all application data. Creating a VPN by Using FreeS/WAN (cid:59) FreeS/WAN is a Linux VPN implementation that uses IPSec and IKE. (cid:59) IKE is a key management protocol standard that enhances IPSec.It provides enhancements such as simplifying IPSec configuration and adding flexibility www.syngress.com
138_linux_AppB 6/20/01 9:55 AM Page 626 626 Appendix B • Hack Proofing Linux Fast Track Chapter 8 Continued and more features.It is not required for IPSec,but is often used in conjunc- tion with it.FreeS/WAN uses Pluto,which is an IKE daemon. (cid:59) The Authentication Header (AH) performs authentication at the packet level in IPSec.The Encapsulating Security Payload (ESP) performs encryp- tion as well as authentication.FreeS/WAN uses the Kernel IPSec (KLIPS) to perform AH and ESP functions. ❖ Chapter 9 Implementing a Firewall with Ipchains and Iptables Understanding the Need for a Firewall (cid:59) Linux natively supports the ability to route and/or filter packets.Modern Linux systems use either Ipchains or Iptables to do this.Ipchains supports Linux kernel versions up to 2.2.If you are using any kernel newer than 2.2, you must use Iptables.The Iptables package supports packet masquerading and filtering functionality as found in the 2.3 kernel and later.This func- tionality is known as netfilter.Therefore,in order to use Iptables,you must recompile the kernel so that netfilter is installed,and you must install the Iptables package. (cid:59) Ipchains and Iptables also allow you to configure your Linux router to mas- querade traffic (i.e.,to rewrite IP headers so that a packet appears to originate from a certain host),and/or to examine and block traffic.The practice of examining and blocking traffic is often called packet filtering. (cid:59) The primary difference between a packet-filtering router (e.g.,one created by using Ipchains or Iptables) and a proxy server (e.g.,one enabled by Squid) is that a packet-filtering router does not inspect network packets as deeply as a proxy server does.However,proxy servers require more system resources in order to process network packets. (cid:59) Watch for bug reports concerning Ipchains,Iptables,and the Linux kernel. Keeping current about such changes can help you quickly upgrade your system in case a problem is discovered. www.syngress.com
138_linux_AppB 6/20/01 9:55 AM Page 627 Hack Proofing Linux Fast Track • Appendix B 627 Chapter 9 Continued Deploying IP Forwarding and Masquerading (cid:59) IP forwarding is the ability for a Linux system to act as a router. (cid:59) A Linux system with simple IP forwarding enabled can route any network address to another.If you are allotted a range of IP addresses from a local or regional Internet registry,you can use a multihomed Linux system to route this set of addresses to another network. (cid:59) In order to allow private network addresses to reach the Internet,you need to invoke Ipchains/Iptables-based IP masquerading. (cid:59) In a Linux router,you can use either Ipchains or Iptables to forward and/or alter the IP headers of packets originating from private-IP address networks to pass through Internet routers.Both Ipchains and Iptables do this by pro- cessing IP packets through the Linux kernel.You should note that this option is not necessarily secure—IP masquerading leaves all client hosts wide open to attack. (cid:59) Masquerading is when your Linux system rewrites the IP headers of a net- work packet so that the packet appears to originate from a different host.The practice of rewriting IP packets is colloquially known as packet mangling. Masquerading is useful because you can use it to invoke network address translation (NAT),where one IP address can stand in for several. (cid:59) Translating the private to routable Internet address is accomplished by a database stored on the Ipchains/Iptables-based Linux router.The Linux masquerading router keeps this database so that it knows how to “untrans- late,”as it were,the packets that have been mangled so that they can then be addressed to the local,private network. Configuring Your Firewall to Filter Network Packets (cid:59) To create packet-filtering rules for outgoing traffic,configure your Linux firewall to deny all outgoing traffic unless explicitly allowed.Where incoming traffic is concerned,you have many options,including to forbid all incoming traffic unless it is part of an already established session,and to dis- able all forwarding except for networks that require it. www.syngress.com
138_linux_AppB 6/20/01 9:55 AM Page 628 628 Appendix B • Hack Proofing Linux Fast Track Chapter 9 Continued (cid:59) Most Linux operating systems,such as Red Hat,Slackware,SuSE,and Caldera,support IP forwarding,masquerading,and firewalling by default. However,you may have to reconfigure your kernel in order to provide full functionality. Understanding Tables and Chains in a Linux Firewall (cid:59) Iptables derives its name from the three default tables it uses:filter,nat,and mangle.Each interface on your system can have its packets managed and modified by the chains contained in each of these tables. (cid:59) A chain is a series of actions to take on a packet.Whenever you use Ipchains or Iptables to configure a firewall,the proper perspective to adopt is to view all packets from the firewall itself. (cid:59) If you are using the filter table,each interface on your network has three different default chains:INPUT,FORWARD,and OUTPUT. (cid:59) Ipchains and Iptables use built-in targets to specify the destination of a packet.By far,the common most built-in targets are DROP and ACCEPT. Logging Packets at the Firewall (cid:59) The Iptables -l option allows you to log matching packets.You can insert -l into any rule,as long as you do not interrupt a particular option.Iptables allows you to log packets in a more sophisticated way because it uses the LOG target,which you specify just like DROP or ACCEPT. (cid:59) By default,Iptables will limit logging of packets.The default limit rate is three logging instances an hour.This behavior is meant to ensure that log files do not get too large. (cid:59) An example used in this section uses Ipchains and Iptables commands to add and remove packet-filtering rules,prohibiting every service from entering your firewall,except for Secure Shell (SSH),which uses port 22.This would not allow any user interactively logged in to the system to check e-mail or any other Internet-based service—the rule is restrictive,but is designed to lock down the firewall as much as possible. (cid:59) With Iptables,you can reject specific ICMP types. www.syngress.com
138_linux_AppB 6/20/01 9:55 AM Page 629 Hack Proofing Linux Fast Track • Appendix B 629 Chapter 9 Continued (cid:59) Port redirection in Ipchains and Iptables is where a packet destined for a certain port (say,port 80) is received by an interface,and is then sent to another port,using the REDIRECT target.Redirecting ports is common in networks that use proxy servers. Configuring a Firewall (cid:59) Regardless of whether you are using Ipchains or Iptables,the first thing you will have to do for your firewall is to flush all existing rules using the -F option.Then,you need to use the -P option to set the firewall policies to deny all connections by default.The subsequent rules you create will then allow the protocols you really want.Then,use the necessary commands to enable forwarding and masquerading.Without this foundation,you will not be able to forward packets at all,and thus firewalling them would be superfluous. (cid:59) Many times,a hacker will try to use your firewall as a default gateway and try to spoof internal packets.If a firewall’s “Internet interface”(i.e.,the one that is responsible for addressing packets to the Internet) is not configured to explicitly deny packets from the network,then you are susceptible to this attack. (cid:59) The example describing allowing inbound and outbound TCP connections illustrates that with Ipchains and Iptables,the ! character reverses the meaning of anything that is in front of it. (cid:59) Creating the ideal packet-filtering rules requires some trial and error,as well as research specific to your own situation. Counting Bandwidth Usage (cid:59) A Linux firewall can inform you about the number of packets it has pro- cessed,in addition to blocking and logging attacks.The process of counting packets is often called packet accounting. (cid:59) Many routers,including Linux routers using Ipchains or Iptables,are capable of shaping traffic as it passes through.The IP header for all packets has a spe- www.syngress.com
138_linux_AppB 6/20/01 9:55 AM Page 630 630 Appendix B • Hack Proofing Linux Fast Track Chapter 9 Continued cial field called the Type of Service (ToS) field,which allows you to priori- tize traffic as it passes through the router. (cid:59) The main reason why you would set the ToS field in network traffic is to cut down on network congestion,especially in networks that have high amounts of traffic. Using and Obtaining Automated Firewall Scripts and Graphical Firewall Utilities (cid:59) Several attempts have been made to automate the process of creating a fire- wall in Linux.Many of these utilities are quite useful,although they are mostly effective in beginning your firewall configuration;you will likely have to customize the rules these applications generate. (cid:59) Most of these applications are still in beta form,so remember that they often provide limited functionality. (cid:59) Firestarter is a fairly sophisticated graphical tool that supports both Ipchains and Iptables.It can be used to create a personal firewall,but also supports multihomed systems. (cid:59) Mason is designed to first listen in on traffic passing through your firewall, and then generate Ipchains or ipfwadm (the precursor to ipchains and Iptables) rules. (cid:59) Firewall Builder is in many ways the most ambitious open source GUI tool. It allows you to create rules for multiple interfaces,networks,and hosts. ❖ Chapter 10 Deploying the Squid Web Proxy Cache Server Benefits of Proxy Server Implementation (cid:59) A Web proxy cache server can cache Web pages and FTP files for proxy clients.They can also cache Web sites for load balancing. www.syngress.com
138_linux_AppB 6/20/01 9:55 AM Page 631 Hack Proofing Linux Fast Track • Appendix B 631 Chapter 10 Continued (cid:59) Caching increases the performance of the network by decreasing the amount of data transferred from outside of the local network. (cid:59) Web proxy caching reduces bandwidth costs,increases network performance during normal traffic and spikes,performs load balancing,caches aborted requests,and functions even when a network’s Internet connection fails. Differentiating between a Packet Filter and a Proxy Server (cid:59) Packet filters analyze traffic at the Network (Layer 3) and Transport layers (Layer 4) of the OSI model.A packet filter can determine whether it will allow a certain IP address or IP address range to pass through,or filter traffic by service,or port number. (cid:59) A proxy server analyzes packets at the Application layer (Layer 7) of the OSI model.This feature provides flexibility because the traffic within one service, such as port 80 (HTTP) traffic,can be filtered. Implementing the Squid Web Proxy Cache Server (cid:59) The Squid Web Proxy Cache server allows administrators to set up a Web proxy caching service,add access controls (rules),and cache DNS lookups. (cid:59) Client protocols supported by Squid must be sent as a proxy request in HTTP format,and include FTP,HTTP,SSL,WAIS,and Gopher. (cid:59) Squid is configured using the /etc/squid/squid.conf file,which defines con- figurations such as the HTTP port number on which Squid listens for HTTP requests,incoming and outgoing requests,timeout information,and firewall access data. (cid:59) Each configuration option in squid.conf is identified as a tag.The http_port tag configures the HTTP port on which Squid listens for proxy clients.The cache_dir tag specifies where the cached data is stored.The acl tag allows you to define an access list.The http_access tag permits or denies access to Squid.Squid will not function until you make changes to the squid.conf file. www.syngress.com
138_linux_AppB 6/20/01 9:55 AM Page 632 632 Appendix B • Hack Proofing Linux Fast Track Chapter 10 Continued Configuring Proxy Clients (cid:59) Firewalls can be configured to forward all port 80 traffic leaving the net- work to the Web proxy cache server—clients do not need manual configu- ration.In other cases,proxy clients automatically detect the proxy server information on the network and use it for all Internet access. (cid:59) All manual proxy client configurations are completed within the browser application,and it’s just a matter of specifying the address of the Web proxy cache server. ❖ Chapter 11 Maintaining Firewalls Testing Firewalls (cid:59) To disallow IP spoofing,your firewall should not allow any packets to pass from outside the network into your internal network if the source address is the same as any host in your internal network.If you are using private IP addresses,no system outside of the firewall should ever be able to assume this IP address and access your internal network’s ephemeral ports. (cid:59) Disable all unused services and configure the used ones keeping security in mind.If you are running Squid or another proxy server on the firewall, make sure that only this port is open.Daemons such as Telnet,File Transfer Protocol (FTP),Hypertext Transfer Protocol (HTTP),and others should be shut down in almost all situations.In many situations,it is best to allow only interactive logins at your firewall. (cid:59) Monitor your system hard drives,RAM,and processors.You may need to cut back on your log settings.Standard Linux tools that can help you deter- mine if your system is becoming overburdened are vmstat and top. (cid:59) Use the who and last commands to learn about who has logged in to the firewall. (cid:59) Check the rules database.Determine if any unauthorized changes have been made to your database.Use the diff command to compare the two files to see if any changes have occurred.You may also use md5 to generate finger- prints of the configuration files to see whether any unauthorized changes www.syngress.com
138_linux_AppB 6/20/01 9:55 AM Page 633 Hack Proofing Linux Fast Track • Appendix B 633 Chapter 11 Continued have been made to them.If you have Tripwire installed,you will then be informed of massive changes to the hard drive. (cid:59) Verify connectivity with company management and end users,and remain informed concerning the operating system. (cid:59) The introduction of log analysis software such as Firelogd and Fwlogdaemon have made it possible to detect and block port scans,all the while sending an alert to the systems administrator.Most adjunct software,such as Fwlogwatch,provides ways to exclude trusted hosts from being blocked. Using Telnet, Ipchains, Netcat, and SendIP to Probe Your Firewall (cid:59) Although Iptables does not support rule checking,the ipchains -C com- mand allows you to check how your existing rule set operates.It will return information as to whether the packet is dropped or accepted.It is up to you to act on this information.This tool is handy if you are logged in to the same system as you are testing,and you are becoming familiar with the existing rules and wish to send out packets that test how the rules are working. (cid:59) A simple port scan can help you determine which ports are open on your firewall.Using applications such as Telnet and Netcat,you can then deter- mine what daemon is listening behind that port. (cid:59) If you have logged in to the firewall interactively,it is often useful to open two terminals.You can use the first terminal to issue the telnet command, and you can use the second terminal to view the results in the /var/log/messages file. (cid:59) When compiled properly,Netcat can also spoof IP addresses.If you have set a firewall rule to deny a particular source port,you can test it with Netcat. Because Netcat is so versatile,it can also be used against you to open a back door on your system.Therefore,if possible,you should install this application only on a client system,rather than on the router. (cid:59) Although Netcat does have the ability to create some packets in certain instances,it is not a true packet generator.SendIP is designed to allow you to create packets of your own design to test whether your firewall rules are working properly. www.syngress.com
138_linux_AppB 6/20/01 9:55 AM Page 634 634 Appendix B • Hack Proofing Linux Fast Track Chapter 11 Continued (cid:59) SendIP allows you to forge any part of a Transmission Control Protocol (TCP) session,as well as any element of an IP,User Datagram Protocol (UDP),or Internet Control Message Protocol (ICMP) packet.SendIP also allows you to forge all elements of IPv6 addresses,and also allows you to forge Routing Information Protocol (RIP) packets.This tool is useful in regard to firewalls because it allows you to simulate any situation. Understanding Firewall Logging, Blocking, and Alert Options (cid:59) Third-party logging applications such as Firewall Log Daemon (Firelogd) and FwLogwatch are available to help you sort and act on the information gathered by the firewall. (cid:59) Firelogd,which supports both Ipchains and Iptables,can be run either as an application,or as a daemon.It reads the kernel log entries generated by either Ipchains or Iptables and passes them into a “first in,first out”(FIFO) pipe,which Firelogd can then process.Once its buffer is full,it e-mails a report of suspicious traffic to an account of your choosing.You can have it mailed to a local account,or to a remote system of your choice. (cid:59) Fwlogwatch is a logging and reporting mechanism,similar to Firelogd but far more versatile,that allows you to automatically block all traffic that is identified as an attack.Used in conjunction with Firelogd,it helps create a system that continuously keeps you informed concerning port scans and other network events that surpass the thresholds you set. (cid:59) The most intriguing feature of Fwlogwatch is its ability to automatically configure Ipchains/Iptables and issue alerts.The best way to do this is to edit the three configuration files to suit your needs:/etc/fwlogwatch.config (or whatever you rename it to), /usr/sbin/fwlw_notify,and /usr/sbin/fwlw_respond. www.syngress.com
138_linux_AppB 6/20/01 9:55 AM Page 635 Hack Proofing Linux Fast Track • Appendix B 635 Chapter 11 Continued Obtaining Additional Firewall Logging Tools (cid:59) Additional firewall logging tools include Ipchains logger,LogGrep,Open Correlation,Fwlogsum,IP Firewall Accounting (IPFA),Appsend,Ipmeter, Mrtg,and Ntop. (cid:59) Ipchains logger is a logging enhancer similar to Fwlogd,but limited to Ipchains.It is especially strong in its ability to log masqueraded connections. (cid:59) The LogGrep daemon uses the grep utility to read and sort log files.It is limited,as of this writing,to Ipchains.With this utility,you can sort pro- tocol,date,IP port firewall log entries to generate custom log files. Currently,it can also discover port scans,and generates HTML pages. (cid:59) Ntop is a powerful tool that allows you to identify the nature of all egress and ingress traffic.It is much like the standard top application,in that it gathers information about hosts,and then places the most active hosts at the top of the display.It can be run on a terminal just like the standard top application;you can run it in Web server mode,or as a Web server.This mode supports authentication,thus allowing you to easily limit access to only specific users. www.syngress.com
138_linux_AppB 6/20/01 9:55 AM Page 636
138_linux_index 6/20/01 9:28 AM Page 637 Index A IDS applications and,205 Appsend,591 access lists,defining Squid,525–526 Asia Pacific Network Information Center accounting logs,Bastille and,59 (APNIC),454 ACID.SeeAnalysis Console for Intrusion Astaro Security Linux,442 Databases (ACID) asymmetric key encryption,17,18–19.See also ACK TCP connection flag,265 public key encryption acl tag,Squid access lists and,525–526 Atd service,59 active monitoring,32–33,39 AtStake Web site,12 Adore,111 auditing procedures,31–34,39 advisories,Red Hat Linux,42–43,44–46 firewalls.See firewall testing tools;firewalls aggressive scans,142 locking down network hosts,31 AH protocol.SeeAuthentication Header (AH) protecting network perimeter,33 protocol securing data across the network,32–33 alerts auditing stations,32–33,192 Firewall Log Daemon e-mail,563, Authentication Header (AH) protocol,403 564–567 authentication process,overview of Fwlogwatch e-mail,570,579–580 network,300–301 Fwlogwatch Windows pop-up,581 authentication schemes,300 intrusion detection system (IDS),202 firewalls and,448 setting threshold for Fwlogwatch,578 IPSec.See IP Security Architecture (IPSec) American Registry for Internet Numbers Kerberos v5,300,303,319–344 (ARIN),454 one-time passwords (OTP),300,303–304, Ampd service,59 305 Analysis Console for Intrusion Databases r-command authentication,368–370 (ACID),252–253 authentication servers,Kerberos,321 anomaly-based IDS applications,194,195 authentication tokens,Kerberos,300 anonymous downloads,disabling with Bastille, authorized use banners,Bastille and,57 63 anti-spoofing rules,479 B antivir -h command,112 AntiVir for Services,110,112 backward compatibility,open source software acquiring,110 and,7 command-line arguments,112–113 bandwidth,reduction of by proxy caching,510 installing,114–116 Bastille,55–77 licensing options,114,189 acquiring,64 TkAntivir interface for,116–123,189 anonymous download disablement,63 types of viruses detected by,111 Apache Web server and,61–62 Apache Web server authorized use banners and,57 checking HTML logs via,584–587 chroot named and,59–60 hardening with Bastille,61–62 compilers,disablement of,57–58 663377
138_linux_index 6/20/01 9:28 AM Page 638 638 Index configuration changes,undoing,74–77 CacheRaq4,515 console access restrictions,58 CacheXpress,515 daemons,disablement of,59,63 chains,461–463,475–477.See also Ipchains; downloading RPM updates,55 Iptables installing and configuring,64–74 Checkpoint Firewall-1,442 ipchains script and,55 Cheops,151–165 limiting system resource usage,58 acquiring,154 log for tracking configuration changes,65, connecting remote systems with,159–160 600–604 features overview,151–152 logs,adding additional,59 installing and configuring,160–164 password aging and,56 mapping relations between computers password protection of LILO prompt, with,157 56–57 monitoring options,157–158 password protection of single-user mode, Nmap and,153 57 plug-ins,backups of,165 print disablement,62–63 Queso and,153 r-protocol disablement,56 required libraries and settings,154–155 rebooting,disablement of,57 SNMP protocol and,152–153 restrictive permissions,applying,55 user interface,155–156 second root accounts,56 Cheops-ng,159–160 Secure Shell (SSH) and,59 chmod u+s command,22 TCP wrapper optimization with,57 chroot named,disablement of,59–60 troubleshooting,108 CIFS.See Common Internet File System versions of,63–64 (CIFS) Bliss virus,110,111 Cisco Routers,442 Blowfish,363 Classless Internet Domain Routing (CIDR) Boolean operators,Tcpdump filters and, notation,138 275–276 clear text passwords,300 boot sector viruses,111,117–120 client,Kerberos,321 Borderware,442 command-line interfaces,problems with,6–7 brute force attacks,18 command logging,sudo and,77,79,93–96 buffer size,Firewall Log Daemon and,564 Common Internet File System (CIFS),301 bug fixes,Red Hat Linux,42–43,44 common object file format (COFF),111 accessing,45 compilers,disabling with Bastille,57–58 case study for applying,46–47 compress command,10 built-in targets,specifying packet Connectiva,441 destination by,462 console access,restricting with Bastille,58 bzip program,10 content filtering,firewalls and,448 continuous scans,Nessus,181 C copyleft movement,4–5 Corel Linux,441 cache aborted requests,proxy caching and, corrections,Red Hat Linux,42–43,44–46 510 Courtesan Consulting,77 Cache Digest protocol,Squid and,514 credential cache,Kerberos,323–324 cache directory,Squid destroying with kdestroy,333–334 locating largest object in,540 listing credentials in with klist,333 size of,539–540 credentials,network authentication process specifying location of,523–524 and,300 cache_dir tag,Squid cache data storage and,523–524
138_linux_index 6/20/01 9:28 AM Page 639 Index 639 D E daemons e-commerce,360 disabling unnecessary with Bastille,59 e-mail limiting open on firewall,545 clear text passwords and,300 databases Tripwire configuration for,214,218,258 burning Tripwire to CD,215,219–220 e-mail alerts creating Kerberos,325 Firewall Log Daemon (Firelogd),563, IDS logging to,202 564–567 querying Snort from remote host,250–251 Fwlogwatch,570,579–580,584 Snort logging to,238–239,243–250 e-mail servers,placement of,107 starting Tripwire,208,212–213 e-mail viruses,111,117–120 Debian (.deb) packages,10,11 EasyChains GUI tool,489 defrag Snort plug-in,232 echo-reply ICMP message name,473 demilitarized zone (DMZ),107 echo-request ICMP message name,473 denial-of-service (DoS) attacks,123–124,448 egress,450 destination IP address,450 ELF-style files,111 destination ports,450 employees,communicating firewall informa- destination-unreachable ICMP message name, tion to,548–549 473 --enable-save-kb option,182,183 detached scans,Nessus,180,181,182–184 --enable-save-sessions option,182 DHCP BOOTP Client,port number for,50 Encapsulating Security Payload (ESP),403 DHCP BOOTP Server,port number for,50 encryption,16–17 dial-up connections,506 asymmetric,17,18–19 differential scans,Nessus,180–181,182–184 firewalls and,448 digital encryption standard (DES) encryption, importance of,16–17 443 one-way,17,20–21 digital signatures,16 overview of network-based,354–355 creating with GPG,29 public key.See public key encryption verifying tarball with GPG,30 symmetric,17–18 disk random seek time,Squid and,516,538 encryption applications,17 distributed denial-of-service (DDoS) attacks, GNU Privacy Guard (GPG),17,21–27 123–125 OpenSSH,361–367 AntiVir scanning for,111 Pretty Good Privacy (PGP),17 preventing with firewalls,446 encryption protocols zombie zappers for,125–129 IPSec,304,396–401 Domain Name Service (DNS) protocol Secure Shell (SSH).See Secure Shell (SSH) Netcat connectivity checks for,557 Secure Sockets Layer (SSL),304,360 Netcat port scans for,554 susceptibility to packet sniffing,301,304 port number for,50 See also authentication schemes DoS attacks.See denial-of-service (DoS) ESP.See Encapsulating Security Payload (ESP) attacks Eth0 NIC address,478 downloads,security of,16,107 Eth1 NIC address,478 dpkg -i command,11 Eth2 NIC address,478 Dynamic Host Configuration Protocol EtherApe,262–263,288–289 (DHCP),59 acquiring,12,290 configuring to view network traffic, 290–292
138_linux_index 6/20/01 9:28 AM Page 640 640 Index installing,290 installing,491 troubleshooting,297 masquerading configurations,498,499 Ethereal,262,263,279–281 saving packet logs,498 acquiring,12 setting rules,494–497 capturing packets with,284–288,355–359, troubleshooting,505 381–384 Firewall Builder GUI tool,489 filtering with,283,284–288 firewall GUI tools,488–489,505 GUI interface (panes),280 applications currently in installing and configuring,283–284 development,490 options available in,281–282 benefits of using,489 troubleshooting,296–297 creating personal firewall with,490–499 ethereal command,283 EasyChains,489 eTrust Intrusion Detection,Computer Firestarter,488,490–499 Associate’s,204 Firewall Builder,489 Ettercap,204 Knetfilter,488 Executable and Linking Format (ELF),110, Mason,488 111 Firewall Log Daemon (Firelogd),563–569, expressions,Tcpdump,271–275 597 acquiring,563,568 F configuring and compiling,568–569 e-mail reports sent by,563,564–567 F-Secure VPN for Windows,443 reading log files generated by other fire- false positives,intrusion detection walls,568 systems and,193–194 syntax and configuration options,563–564 fault tolerance,intrusion detection applications firewall log tools and,197–198 Appsend,591 fee-based GPL software,5 Firelogd,563–569 file system verification software,202 Fwlogsum,591 File Transfer Protocol (FTP) Fwlogwatch,569–590 clear text passwords and,300 IP Firewall Accounting (IPFA),591 disabling access by,546 Ipchains logger,590 disabling FTP daemons,63 IPmeter,591 Netcat port scans and,554 LogGrep,590–591 one-time passwords (OTP) and,306, Mrtg,591–592 318–319 Ntop,592 port number for,50 Open Correlation,591 Squid support of,514 firewall logs filter tables,461 logging packets,448–449,471–472,482 filters logging port scans,545,549–550 Ethereal,283,284–288 size of and system resources,547 Tcpdump,268–276 See also firewall log tools Tcpdump-style Snort,237 firewall scripts,488–489 FIN TCP connection flag,265 firewall testing tools,550–551 fingerprinting,operating system,134–135 ipchains -C command,551 Firelogd.See Firewall Log Daemon (Firelogd) Netcat,552–558 Firestarter GUI tool,488,490–499 SendIP packet forger,558–562 acquiring,491 Telnet,551–552 configuring,491–494 firewalls,446–447 creating ToS associations,498,499 anti-spoofing rules,479
138_linux_index 6/20/01 9:28 AM Page 641 Index 641 auditing,33–34,544–550,544–550 UDP filtering,481–482 authentication and encryption by,448 verifying connectivity,545,548–549 building Linux-based personal,449, See also Ipchains;Iptables 474–477,490–499 fixes,Red Hat Linux,42–43,44 configuring,478–482 accessing,45 content filtering by,448 bug fix case study,46–47 corporate environments and,506 flags,TCP handshake,265 DoS/DDoS attacks and,446,448 FORWARD chain,461,462 FreeS/WAN interoperability and,442 forwarding routers,Linux system as,447, intrusion detection systems as 453–456 supplement to,203 Free Secure WAN (FreeS/WAN),402–438 IP and port filtering by,448 acquiring,402,404–405,441–442 IP forwarding and,453–456 compiling Linux kernel to run,407–416 IP spoofing and,545,546 configuring host-to-host VPN with, IPSec support by,403 420–433 Kerberos v5 and,350–351 DES encryption and,443 Linux kernel configuration for,460 downloading,404–407 logging.See firewall logs GMP library and,443 logging port scans,545,549–550 installing,406–407,441–442 masquerading IP traffic,446–447,456–458, interoperability issues,403,442–443 467–471 IPSec protocol implementation,403–404 modem banks and,470 Linux versions compatible with,443 monitoring system resources,545 protocols used by,402–403 Netcat port scans,552–558 recompiling into Linux kernel,417–420 network differentiation with,448 testing IP networking,420–424 Nmap and,134,141 testing IPSec configuration,419–420 open ports/daemons on,545,546, free software licensing,3–4 551–553 See also GNU General Public License packet accounting and,460,483–487 (GPL) packet filtering,configuring,459–460 FreeBSD,442 packet filtering rules,adding,472–473 Freegate,442 packet redirection by,448 FreeS/WAN.See Free Secure WAN passive monitoring by IDS systems and, (FreeS/WAN) 453 Freshmeat Web site,12,13–14 port redirection and,477–478 FTP.See File Transfer Protocol (FTP) probing with SendIP,558–562 ftp Kerberos client application,342 remaining informed of new developments Fwlogsum,591 in,545,549 Fwlogwatch,569–590,597 role of tables and chains in,461–471 acquiring,570 as routers between networks,447 alert threshold for automatic rules database,checking,545,548,551 notification,578 Squid Web Proxy Cache server and, automatic response options,581–584 538–539 blocking of hosts by,569,570,578, suspicious users and logins and,545,547 582–584 system requirements for,452 CGI scripting and,584–590 TCP connections,allowing,479–480 command options,571–573 Telnet port scans,551–552 configuration files,575–578 testing tools.See firewall testing tools custom-created commands and,570 troubleshooting,505–506 e-mail alerts,570,579–580,584
138_linux_index 6/20/01 9:28 AM Page 642 642 Index Interactive mode,571 gpg --verify signaturefile.tar.gz Log Time mode,571 taballpackage.gz command,30 notification options,579–581 gpg:waiting for lock message,27 Realtime mode,570–571 GPL.See GNU General Public License (GPL) report generation,570,571,573–575,582 graphical user interfaces (GUIs) sorting features,590 command-line,6–7 troubleshooting,598 Ethereal,280 Web server offered by,590 firewall,488–489 Windows pop-up message alerts,581 version to version changes in,8 Fyodor,133 GSS.See Gnome Service Scan (GSS) GTK toolkit,169 G GUI.See graphical user interfaces (GUIs) gunzip program,10 Gauntlet firewall GVPN,442 gzcat program,10 Gibraltar,442 gzip command,10 Gimp toolkit,169 gzip program,10 gkadmin GUI utility,329 gkadmin interface,328–329 H GMP library,Pluto and,443 Gnome,117 hack attacks Gnome Service Scan (GSS),129–132 brute force,18 acquiring,129 clear text authentication and,300–301 benefits of using,131 man-in-the middle,301–302,303 ethics of scanning other people’s ports open door,355–359 with,189–190 password cracking,18,302 installing,132 sniffing attacks,18,301–302 required libraries and settings for,130–131 hardening,system,42,450 GNU General Public License (GPL),3–5 accessing system logs,96–97 advantages of using,38 applying Red Hat Linux errata,43–47 fee-based software and,5 with Bastille software,55–63,77 Gnu is Not Unix (GNU) organization,3 controlling and auditing root access with GNU Privacy Guard (GPG),17,21–27 sudo,77–80,90–96 acquiring,21 determining which ports to block,52–53 deploying,21–27 manually blocking ports,53–54 encrypting files with,29 manually disabling unnecessary Pretty Good Privacy (PGP) and,26 services,47–49,53–54 public key can’t be found message,38 operating system updates,42–43 verifying installation of,21 testing of system,44 verifying tarball signatures with,30 hash files GNU Zip programs,10 generating with md5sum command,30 Gopher,50,514 one-way encryption and,17,20–21 GPG.See GNU Privacy Guard (GPG) HCP.See Hypertext Caching Protocol (HCP) gpg --decrypt managerreport.txt.gpg > man- Heimdall Linuxconf Firewall,490 agerreport.txt command,29 host-based intrusion detection gpg --encrypt --r systems,195,196 public_keyname_of_recipeint manager- Hostsentry,205 report.txt command,29 log analyzers,196 gpg --genkey command,22 PortSentry,204,220–228 gpg --sign command,25 system drive analyzers,196 traffic identification by,200–201
138_linux_index 6/20/01 9:28 AM Page 643 Index 643 Tripwire,204,206–220 Internet Engineering Task Force (IETF), host-to-host Virtual Private Networks (VPNs), 396–397 395 Internet Explorer,configuring as Squid proxy configuring public key encryption, client,533–534 424–433 Internet Key Exchange (IKE) protocol, creating new tunnels,434–436 401–402,403 testing IP networking,420–424 Internet Message Access Protocol (IMAP),50, host# gpg --clearsign yourname 52 command,29 Internet registries,454 hosts,locking down network,31 Internet Security Association and Key Hostsentry,205 Management Protocol (ISAKMP),401 HP OpenView,152 Internetwork Packet Exchange/Sequenced HTML reports,Fwlogwatch and,571,573, Packet Exchange (IPX/SPX),395 574–575,584–590 intrusion detection system (IDS) HTTP.See Hypertext Transfer Protocol applications (HTTP) alterting features,200,202 HTTP GET command,280–281 automatic system reconfiguration by,200 http_access tag,Squid access and,526–528 eTrust Intrusion Detection,204 http_decode Snort plug-in,232 Ettercap,204 http_port tag,Squid HTTP ports and, false positives by,193–194 522–523 fault tolerance and,197–198 HTTPS.See Secure Hypertext Transfer file system verification by,200,202 Protocol (SHTTP) host-based,195,196 Hypertext Caching Protocol (HCP),515 Hostsentry,205 Hypertext Transfer Protocol (HTTP) log analysis applications,196 disabling access by,52,546 logging enhancement with,200,201–202 port number for,50 NetProwler,204 Squid and,514,515 network-based,195,196–197,199 Network Flight Recorder,204 I PortSentry,203,204,220–228 real-time detection by,195 I/O cards,firewalls and,452 RealSecure,204 -I option,11 required supporting applications,205 i810 chipset,Red Hat Linux 6.2,46–47 rules and,194 ICANN.See Internet Corporation for Shadow,204 Assigned Numbers (ICANN) signatures and,194 ICMP types,Iptables and,473–474,483 Snort,203,204 IKE.See Internet Key Exchange (IKE) proto- system drive analyzers,196 col threshold enforcement by,200,202 illicit servers,Trojan horses and,16 traffic identification by,200–201 ingress,450 Tripwire,203,204,206–220 Initial Sequence Number (ISN),265,267 intrusion detection systems (IDS),32–33,141, INPUT chain,461,462 192–194 insane scans,142 additional resources on,259 installation support,lack of open source soft- factors to consider before implementing, ware,6 199 Internet Cache Protocol (ICP),514 as firewall supplement,203 Internet Corporation for Assigned Numbers interval-based detection by,195 (ICANN),454 passive monitoring by,453
138_linux_index 6/20/01 9:28 AM Page 644 644 Index selecting best strategy for,203 flushing rules with,466–467 services provided by,200–202 listing tables and chains,464–465 strategies used to detect intrusions, logging packets,471,482 194–195 masquerading IP traffic with,457,459, switched networks and,199 467–468 system performance and,206 packet accounting and,483–484 testing configuration with Nmap,134,141 personal firewall configuration and, IP addresses,450,451 474–477 IP Firewall Accounting (IPFA),591 port redirection and,477–478 IP forwarding,447,453–456 PortSentry and,227,449 IP networking,testing VPN,420–424 restoring rules with,467 IP packet accounting,460,483–484 saving rules with,465–466,548 IP packet rules,450,451 setting policies and rules with,464–467 anti-spoofing rules,479 setting Type of Service (ToS),486–487 checking,545,548,551 specifying interfaces,463 flushing,466–467 troubleshooting,505,506 Ipchains and,464–467,472–473,548 user-defined chains and,462–463,475–477 listing,464–465 ipchains -C command,testing firewalls with, restoring,467 551 saving,465,548 Ipchains logger,590 setting,464–467 IPmeter,591 IP packets IPSec.See IP Security Architecture (IPSec) counting,460,483–484 ipsec --copyright command,434 logging,448–449,471–472,482 ipsec --help command,434 tracking by IDS systems,200–201 ipsec --version command,434 IP protocol,396 ipsec auto --down command,434 IP Security Architecture (IPSec),304, ipsec auto --rereadsecrets command,434 396–400 ipsec auto --up command,434 closing a tunnel with,438 ipsec bark command,434 common commands,435 ipsec look command,434 FreeS/WAN interoperability issues,403, ipsec pluto command,434 442–443 ipsec whack command,434 Internet Key Exchange (IKE) Iptables,446–447,451,461–462,597 protocol and,401 acquiring,446 starting a tunnel with,435–436 adding packet filtering rules with,472–473 testing FreeS/WAN implementation, allowing TCP connections,480–481 419–420 anti-spoofing rules,479 VPN tunneling and,400–401 built-in targets,packet destination and,462 IP spoofing,395–396,545,546,555–556 commonly used modules,471 Ipchains,446–447,451,461–462 creating policies with,464 acquiring,446 default tables and chains,461–462 adding packet filtering rules with,472–473 firewalling UDP,482 allowing TCP connections,479–481 flushing rules with,466–467 anti-spoofing rules,479 ICMP types and,473–474 Bastille and,55 listing tables and chains,464–465 built-in targets,packet destination and,462 logging packets,471,472,482 creating policies with,464 masquerading private networks,457,459 default tables and chains,461–462 packet accounting and,483–484 firewalling UDP,481 port redirection and,477–478
138_linux_index 6/20/01 9:28 AM Page 645 Index 645 restoring rules with,467 client applications,341–342 saving rules with,465–466,548 client configuration,342–344 setting policies and rules with,464–467 creating new policies,330 setting Type of Service (ToS),486–487 creating new principals database,325, specifying interfaces,463 335–336 troubleshooting,505–506 credential cache,323–324 user-defined chains and,462–463,475–477 eliminating credential cache,333–334 IPv6,397 establishing client trust relationships, IPv6 protocol,395 337–344 IPX/SPX.See Internetwork Packet firewalls and,350–351,546 Exchange/Sequenced Packet Exchange installing,334–335 (IPX/SPX) Key Distribution Center (KDC),319, IRE Safenet/SoftPK,442 320–321,323–324 ISAKMP.See Internet Security Association key table,323 and Key Management Protocol listing current credentials,333 (ISAKMP) managing principals,328 islands,IPv6,395–396 multiple realms,351 obtaining TGT from KDC,330–333 J OpenSSH authentication by,363 password format,329 jb dynFW,490 policies,323,330 John the Ripper password-cracking program, principals,322–323 302 realms,319,320 removing principles from keytabs,349 K Ticket Granting Ticket (TGT),321, kadmin command,Kerberos 323–324 adding principals to database with, tickets,321–322 326–327,336 time stamping by,324 creating new policies with,330 troubleshooting,340–341 establishing client trust relationships with, updating Key table files,328–329 337–344 kernel log entries,Firelogd and,563 managing principals with,328 Kernel IPSec (KLIPS),404 updating client Key table files with, ketremove option,349 328–329 Key Distribution Center (KDC),319, kadmin.local command,Kerberos,325 320–321 KB saving,182–183,190 backup of KDC database,349–350 KDC.See Key Distribution Center (KDC) configuring,334–337 kdestroy command,Kerberos,333–334 role in Kerberos authentication process, Kerberized hosts/applications,319 323–324 Kerberos v5,300,303,319–320 key pairs,17,18–19 accessing kerberized network key table,Kerberos,323 daemon,340 kinit command,Kerberos,323–324,330–333 adding principals to database,326–327, Knetfilter GUI tool,488 336,339 Kondara,11 administration of,325,335 kpasswd Kerberos client application,342 authentication process,323–324 krlogin Kerberos client application,342 authentication server,321 krsh Kerberos client application,342 backup of KDC database,349–350 ksu Kerberos client application,342 benefits of using,319,320–231
138_linux_index 6/20/01 9:28 AM Page 646 646 Index L reading files generated by other firewalls,568 L0phtCrack password-cracking simplifying display of with enhancers, program,18,302 97–102 L2F.See Layer 2 Forwarding (L2F) Snort database,238–239 protocol Snort packet sniffing,236,241 L2TP.See Layer 2 Tunneling Protocol (L2TP) sudo command,77,79,93–96 last command,96,547 logging enhancers,97–102 lastlog command,96–97 Scanlogd,100–101 Layer 2 Forwarding (L2F) protocol,396 SWATCH,97–99 Layer 2 Tunneling Protocol (L2TP),396, Syslogd-ng,101–102 400–401 LogGrep,590–591 Layer 3 security,397 logins LILO prompt,password protection of,56–57 checking for suspicious,545 Linux disabling,49 flavors of,10–11 Lynx,configuring as Squid proxy client, licensing of software,3–5 532–533 problems with Linux-based software,6–8 RAM and Red Hat Linux 6.2,46–47 M reasons for popularity of,38–39 See also open source software m4 utility,169 Linux/Bliss virus,110,111 macro viruses,111 Linux kernel mailing lists,firewall-related,549 compiling to run FreeS/Wan,407–416 make command,11 configuring for firewalls,460 makefiles,tarball,10,11 recompiling FreeS/WAN into,417–420 Makinen,Tuomo,147 Linux Router Project,442 malware,open source software as,8–9 Linux viruses,110–112 man-in-the middle attacks,301–302,303 boot sector,111 management,communicating firewall infor- Linux/Bliss,110,111 mation to,548–549 Loadable Kernal Module (LKM) root kits, managerreport.txt file,29 111 Mandrake,11 scanning for.See virus scanners mangle tables,461,462 LinuxLinks Web site,12 Mason GUI tool,488 LKM root kits.See Loadable Kernal Module masquerading IP traffic,446–447,455, (LKM) root kits 456–458 load balancing,proxy caching and,510 with Ipchains,467–468,471 Loadable Kernal Module (LKM) root kits,111 with Iptables,468–471 lock downs,network,31 setting with Firestarter,498,499 log analysis applications,196 troubleshooting,506 log files md5sum command,30 accessing system logs,96–97 Message Digest 5 (MD5) algorithm,305 accounting,59 Microsoft,Kerberos v5 and,351 adding new with Bastille,59 Miller,Todd,77 Firewall Log Daemon (Firelogd) and,563, minifrag Snort plug-in,232 564,568 MIT Web site,27 firewalls and,448–449 modem banks,470 intrusion detection systems and,201–202 MonMotha’s IPTables script,488–489 Ipchains,471 Mrtg,591–592 Iptables,471 multihomed hosts,450,454
138_linux_index 6/20/01 9:28 AM Page 647 Index 647 N susceptibility of encrypted protocols and, 301 N2H2,515 theft of network passwords by NAT.See Network Address Translation (NAT) hackers,301–302 nat tables,461,462 Virtual Private Networks and.SeeVirtual Nessus,165–166 Private Networks (VPNs) client/server relationship,167–169 network-based intrusion detection continuous scans,181 system (IDS) applications,195,196–197 creating new users,174 eTrust Intrusion Detection,204 detached scans,180,181,182–184 Ettercap,204 differential scans,180–181,182–184 as firewall supplement,203 disabling gtk support,171 NetProwler,204 firewalls and,546 Network Flight Recorder,204 KB saving,182–183,190 RealSecure,204 plug-ins,166,167,173 Snort,204,229–253 private keys,losing,175 switched networks and,199 reports generated by,168–169 network encryption,354–355 required libraries and settings for,169–170 e-commerce transactions and,360 RPM-based installation,172 insecure protocols for,354–355,367, rules database and,174–175 368–370 running a scan with,176–179 OpenSSH and,361–367 tarball-based installation,170–171 packet sniffing over unsecured updating,179–180 networks and,355–359 Windows-based,169 Secure Shell (SSH) and,367–368,371–381 NetBIOS Session Service,50 trying to capture encrypted traffic, NetBSD,442 381–384 Netcat,552–558 Virtual Private Networks and.SeeVirtual acquiring,552 Private Networks (VPNs) command syntax,554 Network File System (NFS),59 exercise in using,557–558 Network Flight Recorder,NFR Security’s, IP spoofing with,555–556 204 options available in,553–554 Network Information Service (NIS),59,300, port scanning with,553,554–555 319 testing DNS connectivity with,557 network interface card (NIC),450 testing port redirection with,556 IP addresses for,478 use by hackers,560 routing of private IP addresses and, NetFilter-1,490 455–456 Netfilter4.1,515 network management,Cheops and,151–164 netfilters,446 Network Management Station (NMS) appli- NetProwler,Symantec’s,204 cations,152 Netscape Navigator,configuring as Squid network mapping,Cheops and,157 proxy client,530–531 network passwords,theft of,301–302 Network Address Translation (NAT),457–458, network performance,proxy caching and,510 508,510–511 network perimeter,implementing,33 network authentication,300–301 networks encryption protocols and,304 locking down,31 Kerberos v5 and.See Kerberos v5 monitoring with Cheops,151–153, one-time passwords (OTP) and.See one- 157–160 time passwords (OTP) protecting network perimeter,33
138_linux_index 6/20/01 9:28 AM Page 648 648 Index scanning entire with Nmap,138–139 open source software securing data across,32–33 backward compatibility and,7 News server daemon,59 changes in GUI interfaces between ver- NIC.See network interface card (NIC) sions,8 Nmap command-line interfaces for,6–7 acquiring,133,136,143 conflicting system libraries and,7,8 benefits of using,133–134 deciding if most appropriate solution,8–9 control of scan speed and sequence by, evaluating security of,8–9 135,142–143 fee-based,5 ethics of scanning other people’s ports free licensing of,3–5 with,189–190 inconvenient upgrade paths of,7 extended features of,134–136 infrequent or irregular updates for,6 firewall testing with,544,597 installation and configuration support for,6 installing,136,143–144 RPM Linux.See Red Hat Package interactive mode,144–146 Manager (RPM) files Nessus and,169 security of downloaded,16 NmapFE GUI for,146–147 source tarballs.See tarballs operating system fingerprinting by, Web sites for acquiring security 134–135 software,12–15 ping and port scan capabilities,134 working with partially developed,8 scanning entire networks/subnets with, Open Systems Interconnection Reference 138–139 Model (OSI/RM),196 scanning options,136–137 OpenBSD-based OpenSSH,364 scanning remote systems with,134 OpenBSD Project,361–362,442 selective scanning with,139 OpenSSH,361–367 sequence prediction with,135 acquiring,361 spoofing features,135,142 agent forwarding by,363 stealth options,139–140 authentication methods used by,363 testing firewall configuration with,134, encrypted port forwarding by,363 141 encryption by,363,364 testing router and switch configurations installing,365–367 with,134 key-length warning messages,388 text files,saving to and reading from,136, operating systems including,365,366 140–141 passing of tickets to remote systems by,364 Nmap Front End (NmapFE),146–147 protocols supported by,363,364 NNTP port numbers,50 secure copy program (SCP),362 NOPASSWD tag,92–93,108 secure file transfer program (SFTP),362 normal scans,142 SSH and.See Secure Shell (SSH) Nortel (Bay Networks) Contivity switch,442 SSH daemon (SSHD) and,362 Ntop,592 troubleshooting,389 upgrades,388 O versions of,364–365 X Windows traffic and,363 Oakley key exchange,401 OpenSSH Portability Team,364 one-time passwords (OTP),300,303–304,305 operating system hardening,42,450 firewalls and,546 accessing system logs,96–97 implementing with OPIE.See OPIE applying Red Hat Linux errata,43–47 OpenSSH authentication by,363 with Bastille,55–63,77 one-way encryption,17,20–21 controlling and auditing root access with Open Correlation,591 sudo,77–80,90–96
138_linux_index 6/20/01 9:28 AM Page 649 Index 649 determining which ports to block,52–53 TCP connection termination,266–267 manually blocking ports,53–54 TCP connections establishment,265–266 manually disabling unnecessary TCP handshakes,265 services,47–49,53–54 packet filtering,447,451 testing of system,44 configuring firewall for,458–460 updating the operating system,42–43 creating rules for,458–459 operating systems customizing,459–460 errata and Update Service Package for, packet filters,447,512–513 42–43 packet forgers,558–562 fingerprinting,134–135 packet generators,testing firewalls with,551, updating,42–43 558–562 OPIE,305–309,348,349 packet mangling,456 configuration options,310–312,313 packet redirection,firewalls and,448 creating new users,314 packet rules,450,451 files and applications used by,306–307 anti-spoofing rules,479 files replaced by,305 checking,545,548,551 generating password list for later use,310, flushing,466–467 314 listing,464–465 how it works,305–306 restoring,467 installing,310,311–313,315 saving,465,548 opie-tk for Windows deployment,307, setting,464–467 316–317 packet sniffers,262–263,296 opiekey command,306,309 capturing unsecured Telnet traffic with, opiepassword command and,305,306, 355–359 307–308 EtherApe,262–263,288–292 OTP via FTP and,306,318–319 Ethereal,262,263,279–288 password format,308,309 reducing attacks by,300 response generation,309,313,314–315 Snort as,233–236 troubleshooting,307,348 susceptible protocols,354–355 uninstalling,312 Tcpdump,262,263,268–279 user key generation,307–309,313 packet sniffing attacks,18,301–302,448 opieaccess file,306 Packetstorm Web site,12,14–15,112 opieftpd file,306,318–319 parameter-problem ICMP message name,474 opieinfo utility,307,310 paranoid scans,142,143 opiekey command,312 passive monitoring,32,39,453 opiekey utility,306,307,310 password aging,implementing with Bastille, opiepasswd command,305,306,307 56 -c option for,307–308,312 password-cracking programs,18 troubleshooting,307 John the Ripper,302 opie.tk utility,307,316–317 L0phtCrack,18,302 OTP.See one-time passwords (OTP) passwords OUTPUT chain,461,462 clear text,300 one-time (OTP).See one-time P passwords (OTP) removing sudo requirement for,92–93, package enhancements,Red Hat errata,44, 108 45–46 theft of network by hackers,301–302 packet accounting,460,483–484 PCMCIA service,59 packet analysis,264 Perl,intrusion detection systems and,205
138_linux_index 6/20/01 9:28 AM Page 650 650 Index PHP.See PreHypertext Processor (PHP) clearing Ipchains rules,227 PHP Ipchains project,490 configuring to block users,222–223,225 plug-ins important files,221–222 backing up Cheops,165 installing,222,224 Nessus,166,167,173 optimizing to sense attack types,223–224, Snort,232–233 226–227 Pluto,FreeS/WAN,404,434,443 running external commands with, Point-to-Point (PPP) frames,400–401 227–228 Point-to-Point Protocol (PPP),396,400–401 troubleshooting,258 Point-to-Point Tunneling Protocol (PPTP), Positive Control,490 396,400–401,457 PostgreSQL,intrusion detection system (IDS) policies,Kerberos,323,330 applications and,205 Polish(ed) Linux Distribution,441 postmapper services,manually disabling,54 polite scans,142 POSTROUTING chain,461,462 POP3 port numbers,50 PPP.See Point-to-Point Protocol (PPP) port filtering,firewalls and,448 PPTP.See Point-to-Point Tunneling Protocol port numbers,50 (PPTP) Kerberos v5,350–351 PreHypertext Processor (PHP),205 numbers 1023 and below,50 PREROUTING chain,461,462 registered,50 Pretty Good Privacy (PGP),17,26,27–29 well-known ports,50 primitives,Tcpdump expression,271, port scanners 272–273,274–275 benefits of using,131 principals,Kerberos,322–323,325 Gnome Service Scan (GSS),129–132 print disablement,Bastille and,62–63 Netcat,552–558 private IP addresses,451 Nmap,133–146 forwarding to Internet by proxy Rnmap,147–151 server,455–456 Telnet,551–552 masquerading and rerouting of,456–458 testing firewalls with,551 private keys,18–19,175 ports,50,53–54 private networks.SeeVirtual Private Networks destination,450 (VPNs) determining which to block,52–53 proof of concept exploits,9 ethics of scanning other people’s,189–190 proxy cache servers,508–510 limiting open on firewall,545,546 benefits of using,509–510 logging scans of,545,549–550 Squid Web Proxy Cache server.See Squid manual disablement of unnecessary,47 Web Proxy Cache server manually blocking,53–54 proxy clients,Squid,529–530 registered,50,51–52 configuring Internet Explorer,533–534 scanning with Gnome Service Scan (GSS), configuring Lynx,532–533 129,131,132 configuring Netscape Navigator,530–531 scanning with Netcat,552–553,554–555, configuring Squid to listen for,522–523 557–558 controlling access to by http_access tag, scanning with Remote Nmap,149–151 526–528 scanning with Telnet,551–552 defining specific with acl tag,525–526 source,450 proxy servers,508 well-known,50–52 filtering by,509 portscan-ignorehosts Snort plug-in,232 forwarding private IP addresses with, portscan Snort plug-in,232 455–456 PortSentry,204,220–221,220–228
138_linux_index 6/20/01 9:28 AM Page 651 Index 651 Network Address Translation (NAT) and, checking for presence of,131 508,510–511 errata and Update Service Package for, packet filters vs.,447,512–513 44–47,55 proxy caching by,508–510 installing,11 Squid Web Proxy Cache server.See Squid redirect ICMP message name,474 Web Proxy Cache server registered ports,50,51–52 PSH TCP connection flag,265 remote shell (rsh) protocol,49 public key encryption,18–20 lack of encryption by,354 configuring host-to-host VPN,424–433 use of OpenSSH in place of,361 establishing trust relationships,19–20 remote systems GPG deployment and,23–26 connecting with Cheops,159–160 OpenSSH authentication by,363 installing OPIE on,315 PGP deployment and,27–29 querying Snort database from,250–251 Secure Shell (SSH) authentication and, reports 371–381 Fwlogwatch,570,582 skipping verification of,29 Nmap,136,140–141 Tripwire,215 Q Réseaux IP Européens (RIPE),454 RFC 1700,50 qualifiers,Tcpdump expression,271,272 .rhosts,363 Quality of Service (QoS),484 Ripper password-cracking program,18 Queso,153 rlogin protocol lack of encryption by,354 R use of OpenSSH/SSH in place of,361, r-command authentication,368–370 367–368 r-protocols,disabling with Bastille,56 rlogin service,49,368–370 Radguard,442 Rnmap (Remote Nmap),147–151 RAID 0,firewalls and,452 acquiring,147,148 RAM installing,148 firewall requirements,452 requirements for,147 Red Hat Linux 6.2 and,46–47 scanning with,149–151 Squid requirements,516,538 troubleshooting,190 tools for determining firewall usage of,547 root access,controlling with sudo,77–80, Raptor Firewall,442 90–96 Raymond,Eric,4–5 root accounts,creating second with Bastille, rcp command,368 56 realms,Kerberos,319,320 root kits,Trojan horses and,16 RealSecure,Internet Security System’s,204 router,Linux,451,453–456 rebooting,disabling with Bastille,57 router-to-router Virtual Private Networks,392 Red Hat Linux errata,42–43,44 Routing daemon,59 bug fix case study,46–47 RPC Services,disabling,54 download of with Bastille,55 rpm -ivh command,11 steps for accessing,44–46 RPM Linux.See Red Hat Package Manager types of errata available,44 (RPM) files Web site for,44 RPM utility,11 Red Hat Linux system,hardening.See harden- RPMFind Web site,12 ing,system RSA algorithm,425 Red Hat Package Manager (RPM) files,10, rsh (remote shell),354,368 11,55 disabling,49
138_linux_index 6/20/01 9:28 AM Page 652 652 Index use of OpenSSH/SSH in place of,361, Secure Sockets Layer (SSL),360,398,514,538 367–368 security advisories,Red Hat errata,42–43,44, RST TCP connection flag,265 45 rule-based IDS applications,194 security analyzer software,44 rule checkers,551 SecurityFocus Web site,12,15 rules,intrusion detection system,194 SendIP packet forger,558–562 rules,packet,450,451 command syntax,558 anti-spoofing rules,479 exercise in using,560–562 checking,545,548,551 obtaining,558 flushing,466–467 options available in,558–560 listing,464–465 use by hackers,560 restoring,467 Sendmail daemon mode,59 saving,465,548 server,hardening of.See hardening, setting,464–467 system services S determining which ports to block and, 52–53 S/Key,305 disabling with Bastille,59 Samba,59 manual disablement of,47–49,53–54 Scanlogd,100–101 Shadow,204 scanners,vulnerability,165.See also Nessus Shiva/Intel LANrover,442 scans,local system,31 --sign command,30 scans,port signature-based IDS applications,194 with Gnome Service Scan (GSS),129,131, signatures,intrusion detection systems and, 132 194 logging of,545,549–550 Simple Network Management Protocol with Netcat,552–553,554–555,557–558 (SNMP),59,152–153,515 with Remote Nmap,149–151 Simple WATCHdog.See SWATCH with Telnet,551–552 Simple WATCHer.See SWATCH Scotty,152 single-user mode,password protection with SCSI hard drives,firewalls and,452 Bastille,57 secure copy program (SCP),OpenSSH’s,362 6bone,395–396 secure file transfer program (SFTP), Skeme key exchange,401 OpenSSH’s,362 Slackware,10 Secure Hypertext Transfer Protocol (SHTTP), SMBs.SeeWindows NT Server Message 398,538 Blocks (SMBs) Secure Shell (SSH),59,205,300,304,354, SMTP,50,52,554 362,397–398 sneaky scans,142 firewalls and,453,546 sniffers.See packet sniffers implementing,373–376 sniffing attacks,18,301–302,448 important files,371,372–373 SNMP.See Simple Network Management Netcat port scans and,554 Protocol (SNMP) OpenSSH and,361,367 snmpget,152 protocols supported by,364 snmpwalk,152 public key cryptography and,371–381 Snort,204,229 speeding resolution of glibc 2.1 by, Analysis Console for Intrusion Databases 388–389 (ACID) add-in,252–253 testing encryption by,381–384 automating,258 use of in place of insecure protocols,361, files and directories used by,231 367–368
138_linux_index 6/20/01 9:28 AM Page 653 Index 653 ignoring network hosts with,237 restarting with empty cache,540–541 installing,240 starting,528–259 libraries required for,229–230 testing,529 logging entries,236,237–239,241, Web site,513 243–250 squid.conf file,configuring Squid with, mailing list for,240 520–528 plug-ins,232–233 configuring HTTP ports,522–523 querying database from remote host, controlling Squid access,526–528 250–251 defining access lists,525–526 rules,detecting attacks based on,230 specifying cache directory,523–524 running as network-based IDS,236, SSH.See Secure Shell (SSH) 241–243 SSH daemon (SSHD),OpenSSH’s,362 running as packet sniffer,233–235,240 ssh-keygen -d command,371 SnortSnarf and,251,252,253 stacheldraht,123 troubleshooting,259 Stallman,Richard,3,4 user archives page,240 stand-alone services,disabling ports assigned variables,230–231 to,54 versions of,229 Standard Network Information Service (NIS), SnortSnarf,251,252,253 300 Sonicwall,442 Startplaza Web site,12 Source IP address,450 stream Snort plug-in,232 source ports,450 su command,22 source-quence ICMP message name,474 subnets,scanning with Nmap,138–139 source RPM files (.srpm),11 sudo,77–79 source tarballs.See tarballs acquiring,80–81 SourceForge Web site,12–13 command logging by,77,79,93–96 Spade plug-in,232 command options,79–80 Spencer,Mark,151 configuring,86–90 spoofing,135,142,395–396,545,546, downloading,81 555–556 important features of,77–78 Squid Web Proxy Cache server,513–534,546 installing,82–86 acquiring,517 password requirements,removing,92–93, cache directory,locating largest object in, 108 540 running,90–92 cache directory size and,539–540 sudo command and,79–80 commercial products based on,515 system requirements for,79 configuring,520–528 troubleshooting,108 development of,514 Web site for,77,78 disk random seek time and,516,538 SUID root,GPG deployment and,21–22 firewalls and,538–539 Sun Remote Procedure Call Service (RPC), free basic support for,515–516 54 installing,517–520 Sun Solaris,442 operating systems offering,517 Superuser Do.See sudo packet filters vs.,447 SuSE Linux,441 processor requirements,517,538 suspicous users,checking network for,545 protocols supported by,514–515,538 SWATCH,97–99 proxy client configurations,529–534 switched networks,intrusion detection sys- RAM requirements,516,538 tems (IDS) and,199 refresh time,509 symmetric key encryption,17–18
138_linux_index 6/20/01 9:28 AM Page 654 654 Index SYN TCP connection flag,265 lack of encryption by,354 Syslogd-ng,101–102 Netcat port scans and,554 system drive analyzers,196 port number for,50 system libraries,conflicts in,7,8 testing firewall configuration with, system logs,intrusion detection systems (IDS) 551–552 and,202 use of OpenSSH/SSH in place of,361, system resource usage 367–368 limiting with Bastille,58 text files monitoring firewall,545 IDS logging to,202 system scans,Nessus and.See Nessus Nmap and,136,140–141 TFTP,port number for,50 T three-way handshakes,265–266 3DES encryption,363 tar applications,10 threshold enforcement,intrusion detection tar zxvf command,10 systems (IDS) and,202 tarballs,10–11,30 Ticket Granting Ticket (TGT),321 targets,Ipchains/Iptables,462 obtaining from KDC with kinit,330–333 TCP connections role in Kerberos authentication,323–324 allowing with Ipchains,479–481 ticket,Kerberos,321–322,323,324 establishing,265–266 ticketing system,sudo’s,78,79–80 flags used in,265 time-exceeded ICMP message name,474 Initial Sequence Number (ISN) and,266, Timestep,442 267 TkAntivir AntiVir interface,116–123 terminating,266–267 acquiring,116,120 TCP handshakes,265–267 installing,120–122 flags used in,265 required libraries and settings for,117 TCP connection establishment,265–266 troubleshooting,189 TCP connection termination,266–267 TLS,Squid and,538 TCP/IP networks top tool,547 determining ports to block on,52–53 tracebacks,201 well-known and registered ports in,50–52 Tribe Flood Network 2000 (Tfn2k),111,123 TCP ports Triple Data Encryption Standard (3DES),363 common numbers for,51 Tripwire,204,206–207,547 determining which to block,52–53 accessing reports,215,219 manually blocking,53–54 acquiring,208 TCP Stream Reassembly plug-in,232 automating with cron,220 TCP wrappers,optimizing,57 burning database to CD,215,219–220 Tcpdump network traffic monitor,205, database creation,208,212–213 237–238,262,263,268,277–279 database initialization mode,206,212 Boolean search operators and,275–276 dependencies,207 expressions and,271–275 e-mail configurations,214,218,258 filter options and,268–271 important files,208–209 installing,276–277 installing and configuring,208,212, telecommuting,Virtual Private Networks for, 217–219 392–394 integrity checking mode,206–207, Telnet 214–215,218 capturing traffic sent over,355–359 policy file configuration,208,209–212 clear text authentication and,300 policy file creation,212 disabling access by,48–49,546 policy file updates,216,219 disabling interactive login utility,48–49
138_linux_index 6/20/01 9:28 AM Page 655 Index 655 rewriting database for operating interoperability issues,403 system changes,215–217,218 public key encryption between Trojan horses,16,111 endpoints,424–433 trust relationships router-to-router,394 establishing,19–20 secure tunneling with,392,395 Kerberos v5,337–344 for telecommuting,392–394 Trustix Secure Linux,441 testing IP networking over,420–424 Tsunami,515 tunneling protocols,395–396,400–401 Tucows Web site,12 See also FreeS/WAN tunneling protocols,VPN,395–396,400–401 virus scanners tunnels,VPN,392,395 AntiVir for Services,110,112–116 capturing traffic sent over,436–438 TkAntivir AntiVir interface,116–123 closing,438 viruses,110–112 creating,434–436 boot sector,111 TurboLinux,11 e-mail,111 Type of Service (ToS) fields,484–487 Linux/Bliss,110,111 service values,485 Loadable Kernal Module (LKM) root kits, setting in Ipchains/Iptables,486–487 111 setting with Firestarter,498,499 macro,111 scanning for with AntiVir,110,112 U scanning for with TkAntivir,116,117–120, 122–123 UDP ports vmstat tool,547 common numbers for,51 VPN Consortium (VPNC),403 determining which to block,52–53 VPNs.SeeVirtual Private Networks (VPNs) firewalling,481–482 vulnerability detection software.See Nessus manually blocking,53–54 numbers for,50–51 W scanning,556 Unix system,hardening.See hardening,system Watchguard,443 Update Service Package,42–43 Web browsers updates,open source software Internet Explorer Squid proxy client con- general frequency of,6 figuration,533–534 Red Hat Linux,42–43 Lynx Squid proxy client configuration, upgrades,open source software 532–533 backward compatibility issues,7 Netscape Navigator Squid proxy client inconvenience of some,7 configuration,530–531 URG TCP connection flag,265 Squid-support by,514 User Datagram Protocol (UDP),400,401 viewing CGI-generated logs over,587–588 user-defined chains,462–463,475–477 Web pages,caching,508–509 See alsoWeb proxy servers V Web proxy servers,508–510 See also Squid Web Proxy Cache server -vh option,11 Web servers Virtual Private Networks (VPNs),392 checking logs via Apache,584–587 closing tunnels,438 Fwlogwatch,590 creating tunnels,434–436 hardening Apache with Bastille,61–62 creating with FreeS/WAN,402–404, IDS applications and Apache,205 420–433 host-to-host,395,420–433
138_linux_index 6/20/01 9:28 AM Page 656 656 Index Web sites,open source security software, Wide Area Information Server (WAIS),514 12–15 Wide Area Networks (WANs),Virtual Private AntiVir for Services,110 Networks (VPNs) and,394 AtStake,12 wildcards,Nmap and,138 Bastille,64 Windows 2000,FreeS/WAN and,443 Cheops,154 Windows clients,FreeS/WAN and,443 Firewall Log Daemon (Firelogd),563 Windows NT Server Message Blocks (SMBs), FreeS/WAN,402 301 Freshmeat,12,13–14 Windows servers,OPIE deployment and, Fwlogwatch,570 316–317 Gnome,117 WinKey,306,307 Gnome Service Scan (GSS),129 winkey.exe,316 intrusion detection system WinNessus,169 applications,204–205 worms,Linux,110 LinuxLinks,12 Netcat,552,557 X Nmap,133 X Windows NmapFE GUI,146 OpenSSH and,363 OpenSSH,361 opie.tk for,307,316–317 Packetstorm,12,14–15 Xedia Access Point/QVPN,443 Red Hat Linux errata,44 xinetd.conf file,disabling services with,48–49, Rnmap (Remote Nmap),147 53 RPMFind,12 security of downloads from,16 Z SecurityFocus,12,15 SendIP packet forger,558 Zombie Zapper,126–129 SourceForge,12–13 acquiring,126,127 Squid Web Proxy Cache server,513 command-line arguments for,126–127 Startplaza,12 installing,127–129 sudo,77,78,80–81 requirements for,127 TkAntivir AntiVir interface,116,120 zombie zapper utilities Tripwire,204,208 benefits of using,125 Tucows,12 limitations of,124–125 Zombie Zapper,126,127 selecting,125–126 well-known ports,50–52 Zombie Zapper,126–129 interaction with registered ports,51–52 zombies,124 port numbers for,50–51 easy targets for,124 whereis command,21 zombie zappers and.See zombie who command,identifying users with,547 zapper utilities
138_linux_BMglobal 6/20/01 9:31 AM Page 657 Train with Global Knowledge The right content, the right method, delivered anywhere in the world, to any number of people from one to a thousand. Blended Learning Solutions™ from Global Knowledge. Train in these areas: Network Fundamentals Internetworking A+ PC Technician WAN Networking and Telephony Management Skills Web Development XML and Java Programming Network Security UNIX, Linux, Solaris, Perl Cisco Enterasys Entrust Legato Lotus Microsoft Nortel Oracle www.globalknowledge.com
138_linux_BMglobal 6/20/01 9:31 AM Page 658 Every hour, every business day all across the globe Someone just like you is being trained by Global Knowledge. Only Global Knowledge offers so much content in so many formats—Classroom, Virtual Classroom, and e-Learning. This flexibility means Global Knowledge has the IT learning solution you need. Being the leader in classroom IT training has paved the way for our leadership in technology-based education. From CD-ROMs to learning over the Web to e-Learning live over the Internet, we have transformed our traditional classroom-based content into new and exciting forms of education. Most training companies deliver only one kind of learning experience, as if one method fits everyone. Global Knowledge delivers education that is an exact reflection of you. No other technology education provider integrates as many different kinds of content and delivery. www.globalknowledge.com
138_linux_BMglobal 6/20/01 9:31 AM Page 659 this could be you Win a 2002 Chrysler PT Cruiser It’s simple to sign up to win. Visit globalknowledge.com. Completely fill out the form and you’re entered! See our web site for official rules. www.globalknowledge.com. Not valid in Florida and Puerto Rico.
138_linux_BMglobal 6/20/01 9:31 AM Page 660 Blended Learning Solutions ™ from Global Knowledge The Power of Choice is Yours. Get the IT Training you need— how and when you need it. Mix and match our Classroom, Virtual Classroom, and e-Learning to create the exact blend of the IT training you need. You get the same great content in every method we offer. Self-Paced Virtual Classroom Classroom e-Learning Learning Learning Self-paced training via CD or Live training with real Train in the classroom with our over the Web, plus mentoring instructors delivered over the expert instructors. and Virtual Labs. Web. 1-800-COURSES www.globalknowledge.com
138_linux_BMglobal 6/20/01 9:31 AM Page 661 9000 Regency Parkway, Suite 500 Cary, NC 27512 1-800-COURSES www.globalknowledge.com At Global Knowledge,we strive to support the multiplicity of learning styles required by our students to achieve success as technical professionals.We do this because we know our students need different training approaches to achieve success as technical professionals.That’s why Global Knowledge has worked with Syngress Publishing in reviewing and recommending this book as a valuable tool for successful mastery of this subject. As the world’s largest independent corporate IT training company,Global Knowledge is uniquely positioned to recommend these books.The first hand expertise we have gained over the past several years from providing instructor-led training to well over a million students worldwide has been captured in book form to enhance your learning experi- ence.We hope the quality of these books demonstrates our commitment to your life- long learning success.Whether you choose to learn through the written word, e-Learning,or instructor-led training,Global Knowledge is committed to providing you the choice of when,where and how you want your IT knowledge and skills to be delivered.For those of you who know Global Knowledge,or those of you who have just found us for the first time,our goal is to be your lifelong partner and help you achieve your professional goals. Thank you for the opportunity to serve you.We look forward to serving your needs again in the future. Warmest regards, Duncan M.Anderson President and Chief Executive Officer,Global Knowledge P.S. Please visit us at our Web site www.globalknowledge.com.
138_linux_BMglobal 6/20/01 9:31 AM Page 662
138_linux_BMglobal 6/20/01 9:31 AM Page 663 Enter the Global Knowledge Chrysler PT Cruiser Sweepstakes This sweepstakes is open only to legal residents of the United States who are Business to Business MIS/IT managers or staff and training decision makers, that are 18 years of age or older at time of entry.Void in Florida & Puerto Rico. OFFICIAL RULES No Purchase or Transaction Necessary To Enter or Win, purchasing will not increase your chances of winning.
- How to Enter: Sweepstakes begins at 12:00:01 AM ET May 1,2001 and ends 12:59:59 PM ET December 31,2001 the (“Promotional Period”). There are four ways to enter to win the Global Knowledge PT Cruiser Sweepstakes: Online,at Trade shows,by mail or by purchasing a course or software. Entrants may enter via any of or all methods of entry. [1]To be automatically entered online,visit our web at www.globalknowledge.com click on the link named Cruiser and complete the registration form in its entirety. All online entries must be received by 12:59:59 PM ET December 31,2001. Only one online entry per person,per e-mail address. Entrants must be the registered subscriber of the e-mail account by which the entry is made. [2]At the various trade shows,during the promotional period by scanning your admission badge at our Global Knowledge Booth. All entries must be made no later than the close of the trade shows.Only one admission badge entry per person. [3] By mail or official entry blank available at participating book stores throughout the promotional period. Complete the official entry blank or hand print your complete name and address and day & evening telephone # on a 3”x5”card,and mail to: Global Knowledge PT Cruiser Sweepstakes,P.O.Box 4012 Grand Rapids,MN 55730-4012.Entries must be postmarked by 12/31/01 and received by 1/07/02. Mechanically reproduced entries will not be accepted. Only one mail in entry per person. [4] By purchasing a training course or software during the promotional period:online at http://www.globalknowledge.com or by calling 1-800-COURSES,entrants will automatically receive an entry onto the sweepstakes.Only one purchase entry per person. All entries become the property of the Sponsor and will not be returned. Sponsor is not responsible for stolen,lost,late,misdirected,damaged,incomplete,illegible entries or postage due mail.
- Drawings: There will be five [5] bonus drawings and one [1] prize will be awarded in each bonus drawing. To be eligible for the bonus drawings,on-line entries,trade show entries and purchase entries must be received as of the dates listed on the entry chart below in order to be eligible for the corresponding bonus drawing. Mail in entries must be postmarked by the last day of the bonus period,except for the month ending 9/30/01 where mail in entries must be postmarked by 10/1/01 and received one day prior to the drawing date indicated on the entry 663
138_linux_BMglobal 6/20/01 9:31 AM Page 664 chart below. Only one bonus prize per person or household for the entire promotion period. Entries eligible for one bonus drawing will not be included in subsequent bonus drawings. Month starting/ending Bonus Drawings 12:00:01 AM ET/11:59:59 PM ET Drawing Date on or about 1 5/1/01-7/31/01 8/8/01 2 8/1/01-8/31/01 9/11/01 3 9/1/01-9/30/01 10/10/01 4 10/1/01-10/31/01 11/9/01 5 11/1/01-11/30/01 12/11/01 There will also be a grand prize drawing in this sweepstakes. The grand prize drawing will be conducted on January 8,2002 from all entries received.Bonus winners are eligible to win the Grand prize. All random sweepstakes drawings will be conducted by Marden-Kane,Inc.an independent judging organization whose decisions are final. All prizes will be awarded. The estimated odds of winning each bonus drawing are 1:60,000,for the first drawing and 1:20,000 for the second, third,fourth and fifth drawings,and the estimated odds of winning the grand prize drawing is 1:100,000. However the actual odds of winning will depend upon the total number of eligible entries received for each bonus drawing and grand prize drawings. 3. Prizes: Grand Prize: One (1) PT Cruiser 2002 model Approx.Retail Value (ARV) $18,000. Winner may elect to receive the cash equivalent in lieu of the car. Bonus Prizes: Five (5), awarded one (1) per bonus period. Up to $1,400.00 in self paced learning products ARV up to $1,400.00 each. No substitutions,cash equivalents,except as noted,or transfers of the prize will be permitted except at the sole discretion of the Sponsor,who reserves the right to substitute a prize of equal or greater value in the event an offered prize is unavailable for any reason.Winner is responsible for payment of all taxes on the prize,license,registration,title fees,insurance,and for any other expense not specifically described herein.Winner must have and will be required to furnish proof of a valid driver’s license.Manufacturers warranties and guarantees apply. 4.Eligibility: This sweepstakes is open only to legal residents of the United States,except Florida and Puerto Rico residents who are Business to Business MIS/IT managers or staff and training decision makers,that are 18 years of age or older at the time of entry.Employees of Global Knowledge Network,Inc and its subsidiaries,advertising and promotion agencies including Marden-Kane,Inc.,and immediate families (spouse,parents,children,siblings and their respective spouses) living in the same household as employees of these organizations are ineligible. Sweepstakes is void in Florida and Puerto Rico and is subject to all applicable federal,state and local laws and regulations.By participating,entrants agree to be bound by the official rules and accept decisions of judges as final in all matters relating to this sweepstakes. 5. Notification: Winners will be notified by certified mail,return receipt requested,and may be required to complete and sign an Affidavit of Eligibility/Liability Release and,where legal,a Publicity Release,which must be returned,properly executed,within fourteen (14) days of 664
138_linux_BMglobal 6/20/01 9:31 AM Page 665 issuance of prize notification. If these documents are not returned properly executed or are returned from the post office as undeliverable,the prize will be forfeited and awarded to an alternate winner. Entrants agree to the use of their name,voice and photograph/likeness for advertising and promotional purposes for this and similar promotions without additional compensation,except where prohibited by law. 6. Limitation of Liability: By participating in the Sweepstakes,entrants agree to indemnify and hold harmless the Sponsor,Marden-Kane,Inc.their affiliates,subsidiaries and their respective agents,representatives,officers,directors,shareholders and employees (collectively,“Releasees”) from any injuries,losses,damages,claims and actions of any kind resulting from or arising from participation in the Sweepstakes or acceptance,possession,use,misuse or nonuse of any prize that may be awarded. Releasees are not responsible for printing or typographical errors in any instant win game related materials;for stolen,lost,late,misdirected,damaged,incomplete,illegible entries;or for transactions,or admissions badge scans that are lost,misdirected,fail to enter into the processing system,or are processed,reported,or transmitted late or incorrectly or are lost for any reason including computer,telephone,paper transfer,human,error;or for electronic, computer,scanning equipment or telephonic malfunction or error,including inability to access the Site. If in the Sponsor’s opinion,there is any suspected or actual evidence of electronic or non-electronic tampering with any portion of the game,or if computer virus,bugs,unauthorized intervention,fraud,actions of entrants or technical difficulties or failures compromise or corrupt or affect the administration,integrity,security,fairness,or proper conduct of the sweepstakes the judges reserve the right at their sole discretion to disqualify any individual who tampers with the entry process and void any entries submitted fraudulently,to modify or suspend the Sweepstakes,or to terminate the Sweepstakes and conduct a random drawing to award the prizes using all non-suspect entries received as of the termination date. Should the game be terminated or modified prior to the stated expiration date,notice will be posted on http://www.globalknowledge.com. Any attempt by an entrant or any other individual to deliberately damage any web site or undermine the legitimate operation of the promotion is a violation of criminal and civil laws and should such an attempt be made,the sponsor reserves the right to seek damages and other remedies from any such person to the fullest extent permitted by law. Any attempts by an individual to access the web site via a bot script or other brute force attack or any other unauthorized means will result in the IP address becoming ineligible.Use of automated entry devices or programs is prohibited. 7. Winners List: For the name of the winner visit our web site www.globalknowledge.com on January 31,2002. 8. Sponsor: Global Knowledge Network,Inc.,9000 Regency Parkway,Cary,NC 27512. Administrator:Marden-Kane,Inc.36 Maple Place,Manhasset,NY 11030. 665
138_linux_BMglobal 6/20/01 9:31 AM Page 666 GNU GENERAL PUBLIC LICENSE Version 2,June 1991 Copyright (C) 1989,1991 Free Software Foundation,Inc. 59 Temple Place - Suite 330,Boston,MA 02111-1307,USA Everyone is permitted to copy and distribute verbatim copies of this license document,but changing it is not allowed. Preamble The licenses for most software are designed to take away your freedom to share and change it.By contrast,the GNU General Public License is intended to guarantee your freedom to share and change free software—to make sure the software is free for all its users.This General Public License applies to most of the Free Software Foundation’s software and to any other program whose authors commit to using it.(Some other Free Software Foundation software is covered by the GNU Library General Public License instead.) You can apply it to your programs,too. When we speak of free software,we are referring to freedom,not price.Our General Public Licenses are designed to make sure that you have the freedom to distribute copies of free software (and charge for this service if you wish),that you receive source code or can get it if you want it, that you can change the software or use pieces of it in new free programs;and that you know you can do these things. To protect your rights,we need to make restrictions that forbid anyone to deny you these rights or to ask you to surrender the rights.These restrictions translate to certain responsibilities for you if you distribute copies of the software,or if you modify it. For example,if you distribute copies of such a program,whether gratis or for a fee,you must give the recipients all the rights that you have.You must make sure that they,too,receive or can get the source code.And you must show them these terms so they know their rights. We protect your rights with two steps:(1) copyright the software,and (2) offer you this license which gives you legal permission to copy,distribute and/or modify the software. Also,for each author’s protection and ours,we want to make certain that everyone understands that there is no warranty for this free software.If the software is modified by someone else and passed on,we want its recipients to know that what they have is not the original,so that any problems introduced by others will not reflect on the original authors’reputations. Finally,any free program is threatened constantly by software patents.We wish to avoid the danger that redistributors of a free program will individually obtain patent licenses,in effect making the program proprietary.To prevent this,we have made it clear that any patent must be licensed for everyone’s free use or not licensed at all. The precise terms and conditions for copying,distribution and modification follow. TERMS AND CONDITIONS FOR COPYING,DISTRIBUTION AND MODIFICATION 0.This License applies to any program or other work which contains a notice placed by the copyright holder saying it may be distributed under the terms of this General Public License.The 666
138_linux_BMglobal 6/20/01 9:31 AM Page 667 “Program”,below,refers to any such program or work,and a “work based on the Program” means either the Program or any derivative work under copyright law:that is to say,a work con- taining the Program or a portion of it,either verbatim or with modifications and/or translated into another language.(Hereinafter,translation is included without limitation in the term “modi- fication”.) Each licensee is addressed as “you”. Activities other than copying,distribution and modification are not covered by this License;they are outside its scope.The act of running the Program is not restricted,and the output from the Program is covered only if its contents constitute a work based on the Program (independent of having been made by running the Program).Whether that is true depends on what the Program does. 1.You may copy and distribute verbatim copies of the Program’s source code as you receive it,in any medium,provided that you conspicuously and appropriately publish on each copy an appro- priate copyright notice and disclaimer of warranty;keep intact all the notices that refer to this License and to the absence of any warranty;and give any other recipients of the Program a copy of this License along with the Program. You may charge a fee for the physical act of transferring a copy,and you may at your option offer warranty protection in exchange for a fee. 2.You may modify your copy or copies of the Program or any portion of it,thus forming a work based on the Program,and copy and distribute such modifications or work under the terms of Section 1 above,provided that you also meet all of these conditions: a) You must cause the modified files to carry prominent notices stating that you changed the files and the date of any change. b) You must cause any work that you distribute or publish,that in whole or in part contains or is derived from the Program or any part thereof,to be licensed as a whole at no charge to all third parties under the terms of this License. c) If the modified program normally reads commands interactively when run,you must cause it,when started running for such interactive use in the most ordinary way,to print or display an announcement including an appropriate copyright notice and a notice that there is no warranty (or else,saying that you provide a warranty) and that users may redistribute the program under these conditions,and telling the user how to view a copy of this License. (Exception:if the Program itself is interactive but does not normally print such an announce- ment,your work based on the Program is not required to print an announcement.) These requirements apply to the modified work as a whole.If identifiable sections of that work are not derived from the Program,and can be reasonably considered independent and separate works in themselves,then this License,and its terms,do not apply to those sections when you distribute them as separate works.But when you distribute the same sections as part of a whole which is a work based on the Program,the distribution of the whole must be on the terms of this License,whose permissions for other licensees extend to the entire whole,and thus to each and every part regardless of who wrote it. 667
138_linux_BMglobal 6/20/01 9:31 AM Page 668 Thus,it is not the intent of this section to claim rights or contest your rights to work written entirely by you;rather,the intent is to exercise the right to control the distribution of derivative or collective works based on the Program. In addition,mere aggregation of another work not based on the Program with the Program (or with a work based on the Program) on a volume of a storage or distribution medium does not bring the other work under the scope of this License. 3.You may copy and distribute the Program (or a work based on it,under Section 2) in object code or executable form under the terms of Sections 1 and 2 above provided that you also do one of the following: a) Accompany it with the complete corresponding machine-readable source code,which must be distributed under the terms of Sections 1 and 2 above on a medium customarily used for soft- ware interchange;or, b) Accompany it with a written offer,valid for at least three years,to give any third party,for a charge no more than your cost of physically performing source distribution,a complete machine- readable copy of the corresponding source code,to be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange;or, c) Accompany it with the information you received as to the offer to distribute corresponding source code.(This alternative is allowed only for noncommercial distribution and only if you received the program in object code or executable form with such an offer,in accord with Subsection b above.) The source code for a work means the preferred form of the work for making modifications to it.For an executable work,complete source code means all the source code for all modules it contains,plus any associated interface definition files,plus the scripts used to control compilation and installation of the executable.However,as a special exception,the source code distributed need not include anything that is normally distributed (in either source or binary form) with the major components (compiler,kernel,and so on) of the operating system on which the executable runs,unless that component itself accompanies the executable. If distribution of executable or object code is made by offering access to copy from a designated place,then offering equivalent access to copy the source code from the same place counts as dis- tribution of the source code,even though third parties are not compelled to copy the source along with the object code. 4.You may not copy,modify,sublicense,or distribute the Program except as expressly provided under this License.Any attempt otherwise to copy,modify,sublicense or distribute the Program is void,and will automatically terminate your rights under this License.However,parties who have received copies,or rights,from you under this License will not have their licenses terminated so long as such parties remain in full compliance. 5.You are not required to accept this License,since you have not signed it.However,nothing else grants you permission to modify or distribute the Program or its derivative works.These actions are prohibited by law if you do not accept this License.Therefore,by modifying or distributing 668
138_linux_BMglobal 6/20/01 9:31 AM Page 669 the Program (or any work based on the Program),you indicate your acceptance of this License to do so,and all its terms and conditions for copying,distributing or modifying the Program or works based on it. 6.Each time you redistribute the Program (or any work based on the Program),the recipient automatically receives a license from the original licensor to copy,distribute or modify the Program subject to these terms and conditions.You may not impose any further restrictions on the recipients’exercise of the rights granted herein.You are not responsible for enforcing compli- ance by third parties to this License. 7.If,as a consequence of a court judgment or allegation of patent infringement or for any other reason (not limited to patent issues),conditions are imposed on you (whether by court order, agreement or otherwise) that contradict the conditions of this License,they do not excuse you from the conditions of this License.If you cannot distribute so as to satisfy simultaneously your obligations under this License and any other pertinent obligations,then as a consequence you may not distribute the Program at all.For example,if a patent license would not permit royalty- free redistribution of the Program by all those who receive copies directly or indirectly through you,then the only way you could satisfy both it and this License would be to refrain entirely from distribution of the Program. If any portion of this section is held invalid or unenforceable under any particular circumstance, the balance of the section is intended to apply and the section as a whole is intended to apply in other circumstances. It is not the purpose of this section to induce you to infringe any patents or other property right claims or to contest validity of any such claims;this section has the sole purpose of protecting the integrity of the free software distribution system,which is implemented by public license prac- tices.Many people have made generous contributions to the wide range of software distributed through that system in reliance on consistent application of that system;it is up to the author/donor to decide if he or she is willing to distribute software through any other system and a licensee cannot impose that choice. This section is intended to make thoroughly clear what is believed to be a consequence of the rest of this License. 8.If the distribution and/or use of the Program is restricted in certain countries either by patents or by copyrighted interfaces,the original copyright holder who places the Program under this License may add an explicit geographical distribution limitation excluding those countries,so that distribution is permitted only in or among countries not thus excluded.In such case,this License incorporates the limitation as if written in the body of this License. 9.The Free Software Foundation may publish revised and/or new versions of the General Public License from time to time.Such new versions will be similar in spirit to the present version,but may differ in detail to address new problems or concerns. Each version is given a distinguishing version number.If the Program specifies a version number of this License which applies to it and “any later version”,you have the option of following the terms and conditions either of that version or of any later version published by the Free Software 669
138_linux_BMglobal 6/20/01 9:31 AM Page 670 Foundation.If the Program does not specify a version number of this License,you may choose any version ever published by the Free Software Foundation. 10.If you wish to incorporate parts of the Program into other free programs whose distribution conditions are different,write to the author to ask for permission.For software which is copy- righted by the Free Software Foundation,write to the Free Software Foundation;we sometimes make exceptions for this.Our decision will be guided by the two goals of preserving the free status of all derivatives of our free software and of promoting the sharing and reuse of software generally. NO WARRANTY 11.BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE,THERE IS NO WAR- RANTY FOR THE PROGRAM,TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM “AS IS”WITHOUT WAR- RANTY OF ANY KIND,EITHER EXPRESSED OR IMPLIED,INCLUDING,BUT NOT LIMITED TO,THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU.SHOULD THE PROGRAM PROVE DEFECTIVE,YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION. 12.IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER,OR ANY OTHER PARTY WHO MAY MODIFY AND/OR REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE,BE LIABLE TO YOU FOR DAMAGES,INCLUDING ANY GENERAL,SPECIAL,INCI- DENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. END OF TERMS AND CONDITIONS How to Apply These Terms to Your New Programs If you develop a new program,and you want it to be of the greatest possible use to the public, the best way to achieve this is to make it free software which everyone can redistribute and change under these terms. To do so,attach the following notices to the program.It is safest to attach them to the start of each source file to most effectively convey the exclusion of warranty;and each file should have at least the “copyright”line and a pointer to where the full notice is found.and one line to give the program’s name and an idea of what it does. 670
138_linux_BMglobal 6/20/01 9:31 AM Page 671
Copyright (C) yyyy name of author
This program is free software; you can redistribute it and/or
modify it under the terms of the GNU General Public License
as published by the Free Software Foundation; either version 2
of the License, or (at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program; if not, write to the Free Software
Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307,
USA.
Also add information on how to contact you by electronic and paper mail.
If the program is interactive,make it output a short notice like this when it starts in an interactive
mode:
Gnomovision version 69, Copyright (C) year name of author
Gnomovision comes with ABSOLUTELY NO WARRANTY; for details
type show w’. This is free software, and you are welcome to redistribute it under certain conditions; type show c’ for details.
The hypothetical commands show w’and show c’should show the appropriate parts of the
General Public License.Of course,the commands you use may be called something other than
show w’and show c’;they could even be mouse-clicks or menu items—whatever suits your
program.
You should also get your employer (if you work as a programmer) or your school,if any,to sign a
“copyright disclaimer”for the program,if necessary.Here is a sample;alter the names:
Yoyodyne, Inc., hereby disclaims all copyright
interest in the program `Gnomovision’
(which makes passes at compilers) written
by James Hacker.
signature of Ty Coon, 1 April 1989
Ty Coon, President of Vice
This General Public License does not permit incorporating your program into proprietary pro-
grams.If your program is a subroutine library,you may consider it more useful to permit linking
proprietary applications with the library.If this is what you want to do,use the GNU Library
General Public License instead of this License.
671
138_linux_BMglobal 6/20/01 9:31 AM Page 672 LICENSE AGREEMENT THIS PRODUCT (THE “PRODUCT”) CONTAINS PROPRIETARY SOFTWARE,DATA AND INFORMATION (INCLUDING DOCUMENTATION) OWNED BY SYNGRESS PUBLISHING,INC.(“SYNGRESS”) AND ITS LICENSORS.YOUR RIGHT TO USE THE PRODUCT IS GOVERNED BY THE TERMS AND CONDITIONS OF THIS AGREEMENT. LICENSE: Throughout this License Agreement,“you” shall mean either the individual or the entity whose agent opens this package. You are granted a limited, non-exclusive and non- transferable license to use the Product subject to the following terms: (i) If you have licensed a single user version of the Product,the Product may only be used on a single computer (i.e., a single CPU). If you licensed and paid the fee applicable to a local area network or wide area network version of the Product,you are subject to the terms of the following subparagraph (ii). (ii) If you have licensed a local area network version, you may use the Product on unlimited workstations located in one single building selected by you that is served by such local area network. If you have licensed a wide area network version, you may use the Product on unlimited workstations located in multiple buildings on the same site selected by you that is served by such wide area network;provided,however,that any building will not be considered located in the same site if it is more than five (5) miles away from any building included in such site.In addition,you may only use a local area or wide area network version of the Product on one single server.If you wish to use the Product on more than one server, you must obtain written authorization from Syngress and pay additional fees. (iii) You may make one copy of the Product for back-up purposes only and you must maintain an accurate record as to the location of the back-up at all times. PROPRIETARY RIGHTS; RESTRICTIONS ON USE AND TRANSFER: All rights (including patent and copyright) in and to the Product are owned by Syngress and its licensors.You are the owner of the enclosed disc on which the Product is recorded.You may not use, copy, decompile, disassemble, reverse engineer, modify, reproduce, create derivative works, transmit, distribute,sublicense,store in a database or retrieval system of any kind,rent or transfer the Product, or any portion thereof,in any form or by any means (including electronically or otherwise) except as expressly provided for in this License Agreement.You must reproduce the copyright notices, trademark notices,legends and logos of Syngress and its licensors that appear on the Product on the back-up copy of the Product which you are permitted to make hereunder.All rights in the Product not expressly granted herein are reserved by Syngress and its licensors. TERM: This License Agreement is effective until terminated. It will terminate if you fail to comply with any term or condition of this License Agreement. Upon termination, you are obligated to return to Syngress the Product together with all copies thereof and to purge and destroy all copies of the Product included in any and all systems,servers and facilities. DISCLAIMER OF WARRANTY: THE PRODUCT AND THE BACK-UP COPY OF THE PRODUCT ARE LICENSED “AS IS”.SYNGRESS,ITS LICENSORS AND THE AUTHORS MAKE NO WARRANTIES,EXPRESS OR IMPLIED,AS TO RESULTS TO BE OBTAINED 672
138_linux_BMglobal 6/20/01 9:31 AM Page 673 BY ANY PERSON OR ENTITY FROM USE OF THE PRODUCT AND/OR ANY INFORMATION OR DATA INCLUDED THEREIN.SYNGRESS,ITS LICENSORS AND THE AUTHORS MAKE NO EXPRESS OR IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE OR USE WITH RESPECT TO THE PRODUCT AND/OR ANY INFORMATION OR DATA INCLUDED THEREIN.IN ADDITION,SYNGRESS,ITS LICENSORS AND THE AUTHORS MAKE NO WARRANTY REGARDING THE ACCURACY,ADEQUACY OR COMPLETENESS OF THE PRODUCT AND/OR ANY INFORMATION OR DATA INCLUDED THEREIN. NEITHER SYNGRESS,ANY OF ITS LICENSORS,NOR THE AUTHORS WARRANT THAT THE FUNCTIONS CONTAINED IN THE PRODUCT WILL MEET YOUR REQUIREMENTS OR THAT THE OPERATION OF THE PRODUCT WILL BE UNINTERRUPTED OR ERROR FREE.YOU ASSUME THE ENTIRE RISK WITH RESPECT TO THE QUALITY AND PERFORMANCE OF THE PRODUCT. LIMITED WARRANTY FOR DISC: To the original licensee only,Syngress warrants that the enclosed disc on which the Product is recorded is free from defects in materials and workmanship under normal use and service for a period of ninety (90) days from the date of purchase.In the event of a defect in the disc covered by the foregoing warranty,Syngress will replace the disc. LIMITATION OF LIABILITY: NEITHER SYNGRESS, ITS LICENSORS NOR THE AUTHORS SHALL BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, PUNITIVE,CONSEQUENTIAL OR SIMILAR DAMAGES,SUCH AS BUT NOT LIMITED TO, LOSS OF ANTICIPATED PROFITS OR BENEFITS, RESULTING FROM THE USE OR INABILITY TO USE THE PRODUCT EVEN IF ANY OF THEM HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.THIS LIMITATION OF LIABILITY SHALL APPLY TO ANY CLAIM OR CAUSE WHATSOEVER WHETHER SUCH CLAIM OR CAUSE ARISES IN CONTRACT,TORT, OR OTHERWISE. Some states do not allow the exclusion or limitation of indirect,special or consequential damages,so the above limitation may not apply to you. U.S.GOVERNMENT RESTRICTED RIGHTS. If the Product is acquired by or for the U.S. Government then it is provided with Restricted Rights.Use,duplication or disclosure by the U.S. Government is subject to the restrictions set forth in FAR 52.227-19.The contractor/manufacturer is Syngress Publishing,Inc.at 800 Hingham Street,Rockland,MA 02370. GENERAL: This License Agreement constitutes the entire agreement between the parties relating to the Product.The terms of any Purchase Order shall have no effect on the terms of this License Agreement.Failure of Syngress to insist at any time on strict compliance with this License Agreement shall not constitute a waiver of any rights under this License Agreement.This License Agreement shall be construed and governed in accordance with the laws of the Commonwealth of Massachusetts.If any provision of this License Agreement is held to be contrary to law,that provision will be enforced to the maximum extent permissible and the remaining provisions will remain in full force and effect. *If you do not agree,please return this product to the place of purchase for a refund. 673
138_linux_BMglobal 6/20/01 9:31 AM Page 674 SYNGRESS SOLUTIONS… AVAILABLENOW ORDER at www.syngress.com Hack Proofing Your Network Internet Tradecraft Systems and software packages are being connected to the Internet at an astounding rate. Many of these systems and packages were not designed with security in mind. IT professionals need to keep their systems secure: This book shows readers how to make a meaningful security assessment of their own systems, by helping them to think like a hacker. Using forensics-based analysis, this book gives the reader crucial insights into security, classes of attack, diffing, decrypting, session hijacking, client and server holes, and choosing secure systems. ISBN: 1-928994-15-6 Price: $49.95 US, $77.50 AVAILABLENOW ORDER at www.syngress.com Hack Proofing Your E-Commerce Site From the authors of the bestselling Hack Proofing Your Network.E-Commerce giants, previously thought to be impenetrable are now being exposed as incred- ibly vulnerable. This book gives e-commerce architects and engineers insight into the tools and techniques used by hackers to compromise sites. The security of e-commerce sites is even more imperative than non-commerce sites, because of the added responsibility of maintaining customers’ personal and financial information. This book will provide Web architects and engineers with all the information they need to design and implement security measures. ISBN: 1-928994-27-X Price: $49.95 US, $77.95 CAN AVAILABLEAPRIL 2001 ORDER at www.syngress.com Hack Proofing Sun Solaris 8 Is your Sun Solaris operating system protected from both external and internal threats that could theoretically cripple your business? This book will give system administrators the edge they need to fortify their organization’s technological infrastructure and protect themselves from the never-ending threat of "hackers." Providing hands-on information written by both security professionals and self- proclaimed hackers, this book is for system administrators and security profes- sionals concerned with protecting their Sun Solaris operating system. Hack Proofing Sun Solaris 8 covers everything from the motivation of a hacker to the tools and techniques that hackers use. ISBN: 1-928994-44-x Price: $49.95 US, $77.95 CAN s o l u t i o n s @ s y n g r e s s . c o m