NETWORK SECURITY HACKS * Andrew %pckhart Ji O'REILLY* Beijing Cambridge Farnham Koln Paris Sebastopol Taipei Tokyo
Contents Credits Preface ix xi Chapter 1. Unix Host Security 1 1. Secure Mount Points 2 2. Scan for SUID and SGID Programs 3 3. Scan For World- and Group-Writable Directories 5 4. Create Flexible Permissions Hierarchies with POSIX ACLs 5 5. Protect Your Logs from Tampering 8 6. Delegate Administrative Roles 10 7. Automate Cryptographic Signature Verification 12 8. Check for Listening Services 14 9. Prevent Services from Binding to an Interface 16 10. Restrict Services with Sandboxed Environments 18 11. Use proftp with a MySQL Authentication Source 21 12. Prevent Stack-Smashing Attacks 23 13. Lock Down Your Kernel with grsecurity 25 14. Restrict Applications with grsecurity 30 15. Restrict System Calls with Systrace 32 16. Automated Systrace Policy Creation 35 17. Control Login Access with PAM 38 18. Restricted Shell Environments 42 19. Enforce User and Group Resource Limits 44 20. Automate System Updates 45
Chapter 2. Windows Host Security 47 21. Check Servers for Applied Patches 47 22. Get a List of Open Files and Their Owning Processes 53 23. List Running Services and Open Ports 54 24. Enable Auditing 55 25. Secure Your Event Logs 56 26. Change Your Maximum Log File Sizes 57 27. Disable Default Shares 58 28. Encrypt Your Temp Folder 60 29. Clear the Paging File at Shutdown 62 30. Restrict Applications Available to Users 63 Chapter 3. Network Security 66 31. Detect ARP Spoofing 67 32. Create a Static ARP Table 69 33. Firewall with Netfilter 71 34. Firewall with OpenBSD's PacketFilter 75 35. Create an Authenticated Gateway 80 36. Firewall with Windows 82 37. Keep Your Network Self-Contained 86 38. Test Your Firewall 87 39. MAC Filtering with Netfilter 90 40. Block OS Fingerprinting 91 41. Fool Remote Operating System Detection Software 94 42. Keep an Inventory of Your Network 98 43. Scan Your Network for Vulnerabilities 100 44. Keep Server Clocks Synchronized 106 45. Create Your Own Certificate Authority 108 46. Distribute Your CA to Clients 111 47. Encrypt IMAP and POP with SSL 113 48. Set Up TLS-Enabled SMTP 115 49. Detect Ethernet Sniffers Remotely 117 50. Install Apache with SSL and suexec 121 51. Secure BIND 125 52. Secure MySQL 128 53. Share Files Securely in Unix 130 vi I Contents
Chapter 4. Logging 134 54. Run a Central Syslog Server 135 55. Steer Syslog 136 56. Integrate Windows into Your Syslog Infrastructure 138 57. Automatically Summarize Your Logs 144 58. Monitor Your Logs Automatically 146 59. Aggregate Logs from Remote Sites 149 60. Log User Activity with Process Accounting 154 Chapter 5. Monitoring and Trending 156 61. Monitor Availability 157 62. Graph Trends 164 63. Run ntop for Real-Time Network Stats 166 64. Audit Network Traffic 169 65. Collect Statistics with Firewall Rules 171 66. Sniff the Ether Remotely 172 Chapter 6. Secure Tunnels 176 67. Set Up IPsec Under Linux 176 68. Set Up IPsec Under FreeBSD 179 69. Set Up IPsec in OpenBSD 182 70. PPTP Tunneling 183 71. Opportunistic Encryption with FreeS/WAN 188 72. Forward and Encrypt Traffic with SSH 189 73. Quick Logins with SSH Client Keys 191 74. Squid Proxy over SSH 193 75. Use SSH as a SOCKS Proxy 195 76. Encrypt and Tunnel Traffic with SSL 198 77. Tunnel Connections Inside HTTP 200 78. Tunnel with VTun and SSH 202 79. Automatic vtund.conf Generator 207 80. Create a Cross-Platform VPN 211 81. Tunnel PPP 216 Chapter 7. Network Intrusion Detection 219 82. Detect Intrusions with Snort 220 83. Keep Track of Alerts 224 Contents I vii
84. Real-Time Monitoring 227 85. Manage a Sensor Network 233 86. Write Your Own Snort Rules 239 87. Prevent and Contain Intrusions with Snort_inline 244 88. Automated Dynamic Firewalling with SnortSam 247 89. Detect Anomalous Behavior 250 90. Automatically Update Snort's Rules 252 91. Create a Distributed Stealth Sensor Network 253 92. Use Snort in High-Performance Environments with Barnyard 254 93. Detect and Prevent Web Application Intrusions 257 94. Simulate a Network of Vulnerable Hosts 261 95. Record Honeypot Activity 265 Chapter 8. Recovery and Response 268 96. Image Mounted Filesystems 268 97. Verify File Integrity and Find Compromised Files 270 98. Find Compromised Packages with RPM 274 99. Scan for Root Kits 276 100. Find the Owner of a Network 278 Index 281 viii I Contents