Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 


Forgot your password?
Close
typodupeerror
×
Linux Software

Making Your Linux Box Secure 139

Posted by CmdrTaco from the two-scoops-of-know-how dept.
pryan writes "rootprompt.org has some interesting articles on locking down a Linux box on a hostile network (read: Internet) and cloaking a Debian box so script kiddies don't find it. Check out fortress building, part 1, and part 2. For you Debian freaks (I'm wearing a Debian swirl t-shirt as I type this), check out cloaking Debian. Of course, the cloaking article is easily adaptable to other distributions. Let's lock down those boxes! "
This discussion has been archived. No new comments can be posted.

Making Your Linux Box Secure More

Making Your Linux Box Secure

Comments Filter:

  • Another great resource (NT, Linux, Solaris) (Score:3)

    by Saron ( 192618 ) on Wednesday September 13, 2000 @10:03AM (#781942)
    Is Lance Spitzner's Security Whitepapers [enteract.com].

    Its a handy little site, covers firewalls in NT and Linux, how to properly armor a NT, Solaris, or Linux install (from the perspective of Redhat, but thats easily adaptable), and for those of you that are a bit more curious, he has a "How to build a honeypot" section.

    Enjoy!

  • I should also add, without an obvious penetration (except for the simple mail hack we actually invite on the web page). The fact that it ran 50 days without a reboot would not necessarily interest security people, except as anecdotal evidence that nobody was able to remotely crash the kernel.

    Bruce

  • I have to agree with you when you say that Dan's stuff is great. I just wish the guy could code so others could understand it. Not a single comment, dubious variable names, half the programs don't have any kind of -h or --help (decent web documentation though)... About the only thing he does do is formatting.

  • I never understood having wheel coded into su.

    You can get the same capability with GNU su as follows:

    chgrp wheel su
    chmod 4750 su

    In fact, when I was in college and had fellow CS majors using accounts on my box for development, I did that with a bunch of su related stuff.
  • Care to name your sources? I've never heard of any qmail exploits, period, and I have a feeling that I have been watching more closely than you have.
  • The provisio is quite fair. Do you want me to include, when I count vulnerabilites in Linux, all the apache and FP vulnerabilities too?

    Since W2K has been released (before actually, anyone remember the www.windows2000test.com test?) every script kiddie and cracker has tried to be the first to break in. I am not aware of any that have succeeded.

    Besides, those older OSes have had much longer to find the holes and patch them, W2K is a baby and supposedly full of holes right? ha!

    And, what false assumptions anyway? You say something but don't explain or back it up. In summary, don't be a lazy lamer.
  • IP MASQ. Linux 2.2.16, Xinetd Partial firewall
    indestructable.... LINUXGOD.NET.
  • Hey, I just found a site that has some "how to secure your machine" info.

    Can someone tell me how I go about getting it posted on Slashdot?
  • Once, I tried to run killall on a Tru64 Unix system.. Well, I killed the process alright, and the one with PID 0.

    Moral of the story: Read man pages, folks. Don't assume that killall kills a named process on Tru64.
  • We should compare notes. I've been getting loads of just the probes you mention (and a few others: port 1243 (SubSeven again), udp port 22 (pcAnywhere), and I'm reasonably certain my logs point to at least one person running queso on me).

    We should compare notes at some point. (or I could just go set up a web page listing what people are running against me and have people comment on that)
  • OpenBSD isn't as secure as you think it is.
  • I also usually explicitly deny packets from offensive hosts like flycast, doubleclick etc. These days it's also probably a good idea to not let everything out. If somehow somebody lobbed something in you don't want them to initiate a connection out.

    A Dick and a Bush .. You know somebody's gonna get screwed.

  • Bruce did not say that Dan had no right to distribute his code under any license he chooses. He just stated that it was not open source. So what is the big deal? Was he wrong?

    A Dick and a Bush .. You know somebody's gonna get screwed.

  • Yeah, i would assume they could find out what kernel (within a certain version range) you are running, but Distribution specific vulnerabilities would be not as easier to find (they wouldnt be able to do a search for "+redhat +r00t" to find a way in).

  • Not that I use it at home, but at work, I was testing 3 different "Security" schemes (probably available as expert install only?):
    Medium: httpd,inetd (and a number of other services) are running; root login allowed at console
    High: no httpd,inetd; root login allowed at console
    Paranoid: what is root?

    And when I initially installed it as High, I couldn't figure out why, even with inetd and httpd enabled, I couldn't ftp or telnet or access the web server.
    ---
    Please read the following backwards to reveal the true meaning:
    Live not on evil
    Madam, I'm Adam
  • I agree, with a few additions. Make sure none of the IP server daemons are running - lpd, portmap, sendmail, as well as inetd. Have a buddy run a portscan on you firewall to make sure nothing is listening. AFAIK, there are no exploits of simple ipmasquerading.
  • Yeah I find nmap pretty nifty too. My experience is that if a server has *any* ports open, __ and those aren't ports that one's ISP hijacks (kinda screws thing!) :-( __ nmap -O has a pretty damn good guess at the OS (at least the family).

    But if you subsititute tcpserver for inetd and limit ports to internal-side interface(s) then you simply won't have a port open, and nmap or anyone else won't find it. I'm not sure if cloaking is really cloaking if it just means not opening inet-side ports?

    I only skimmed for now, but I'd reckon you have to alter the TCP stack in the kernel to change the SYN response, etc., to packets?? For example for a port to look totally closed to one person but not to another.

    But then you would have to rely on IP to authenticate (at that stage anyway), which can be spoofed... hmm... nothing's ever easy, but these replacement servers sound interesting at least.

  • Agreed with all of it, BUT his software has never been broken into either. Hard to argue with success if you define success as "secure".
    -russ

  • In Other News: (Score:5)

    by Denor ( 89982 ) <denor@yahoo.com> on Wednesday September 13, 2000 @10:11AM (#781960) Homepage
    Change of Pace for Slashdot Disturbing, Posters Find.

    ASSOCIATED PRESS - Dozens were shocked today as popular website Slashdot posted a story that had nothing to do with a corporate or governmental conspiracy.
    "I'm absolutely floored" one frequent poster commented. "I mean, I was all ready to get out one of my 'damn the man' rants for karma, but it turns out it's completely offtopic for this story. I mean, I'd actually have /lost/ karma! That was close. I have no clue why Slashdot would do this."
    Many others were confused as well. Local trolls were dismayed, one going so far as to assert "I'm betting this is a slashdot conspiracy to try to lull us into a false sense of security."
    Many contributors fell into the pattern of trying to form a Slashdot editorial conspiracy, but ultimately failed as the comments did not have nearly the manifesto-inspiring potential that the earlier front page stories had included.
    "I was all ready to boycott this 'debian' thing they mentioned in the blurb," commented one disillusioned poster, "But then I went and read the article, and there was nothing about corporate conspiracy at all!"
    While there was still theorizing by those who had not read the article, for the most part conversation was stilted and akward, with many participants struggling to figure out exactly what, if not governmental or corporate conspiracy, the article was actually about.

  • Our comany firewall (Score:5)

    by doomy ( 7461 ) on Wednesday September 13, 2000 @12:15PM (#781961) Homepage Journal
    Here is the scripts I used to secure our file wall
    and enable a nice well secured debian based internal network.

    SERVER_IP= #set this to server ip

    #
    # Local area network
    ifconfig eth1 192.168.0.1 netmask 255.255.255.0 up
    route add -net 192.168.0.0 netmask 255.255.255.0 window 16384 eth1

    # S E C U R I T Y ################################################## ###

    #
    # Enable syncookies and ip forward

    echo 1 > /proc/sys/net/ipv4/tcp_syncookies
    echo 1 > /proc/sys/net/ipv4/ip_forward

    #
    # Let local calls through

    /sbin/ipchains -A input -j ACCEPT -s 0/0 -d 0/0 -i lo

    #
    # External calls to 127 blocking.

    /sbin/ipchains -A input -j DENY -p all -l -s 127.0.0.0/8 -i eth0 -d 0.0.0.0/0 -l

    #
    # IP MASQ Forwarding for 192.168.0.2 subnet
    /sbin/ipchains -P forward DENY
    /sbin/ipchains -A forward -s 192.168.0.2/24 -j MASQ

    #
    # Modprobing
    modprobe ip_masq_user
    modprobe ip_masq_ftp
    modprobe ip_masq_irc ports=6667,6668,6669,6670
    modprobe ip_masq_raudio
    modprobe ip_masq_quake ports=26000,27000,27910,27960

    #
    # Now block some ports we dont want people to use from outside
    # block from ICMP troubled ports

    /sbin/ipchains -A input -p icmp -j DENY -s 0/0 -d 0/0 21 -l
    /sbin/ipchains -A input -p icmp -j DENY -s 0/0 -d 0/0 23 -l
    /sbin/ipchains -A input -p icmp -j DENY -s 0/0 -d 0/0 25 -l
    /sbin/ipchains -A input -p icmp -j DENY -s 0/0 -d 0/0 79 -l
    /sbin/ipchains -A input -p icmp -j DENY -s 0/0 -d 0/0 139 -l
    /sbin/ipchains -A input -p icmp -j DENY -s 0/0 -d 0/0 143 -l
    /sbin/ipchains -A input -p icmp -j DENY -s 0/0 -d 0/0 1080 -l
    /sbin/ipchains -A input -p icmp -j DENY -s 0/0 -d 0/0 6000 -l
    /sbin/ipchains -A input -p icmp -j DENY -s 0/0 -d 0/0 12345 -l
    /sbin/ipchains -A input -p icmp -j DENY -s 0/0 -d 0/0 31337 -l

    #
    # Block ICMP flooding/pinging

    /sbin/ipchains -A input -p icmp -j DENY -s 0/0 8 -d 0/0 -l

    #That's some basic stuff to be blocked. These rules will block: ftp, telnet,
    #smtp, finger, netbios, imap, socks, X11, netbus and Back Orfice. It will
    #also create a syslog entry as logging (-l) has been enabled. You can add or
    #remove ports as you want.
    # got this bit from a security listing

    # Block everthing on eth0 for the following ports
    /sbin/ipchains -A input -j DENY -p tcp -l -s 0.0.0.0/0 -i eth0 -d ${SERVER_IP}/32 2401
    /sbin/ipchains -A input -j DENY -p tcp -l -s 0.0.0.0/0 -i eth0 -d ${SERVER_IP}/32 6000
    /sbin/ipchains -A input -j DENY -p tcp -l -s 0.0.0.0/0 -i eth0 -d ${SERVER_IP}/32 515
    /sbin/ipchains -A input -j DENY -p tcp -l -s 0.0.0.0/0 -i eth0 -d ${SERVER_IP}/32 752
    /sbin/ipchains -A input -j DENY -p tcp -l -s 0.0.0.0/0 -i eth0 -d ${SERVER_IP}/32 1024
    /sbin/ipchains -A input -j DENY -p tcp -l -s 0.0.0.0/0 -i eth0 -d ${SERVER_IP}/32 111
    /sbin/ipchains -A input -j DENY -p tcp -l -s 0.0.0.0/0 -i eth0 -d ${SERVER_IP}/32 5432

    Basically it blocks almost every kind of ICMP and any unwanted attempts by intruders and also blocks access to resources used only within our network. Eg: Our postgresql server and so on.. Also it logs any illegal activities.

    Enjoy.
    --
  • The 'Associated Press', to be referred to as party 'A', is hereby challenging 'Denor', to be referred to as party 'B', with illegal usage of the term 'Associated Press' in his Slashdot editorial entitled 'In Other News'. Party 'B', at no point in time, referred to, contacted, eluded to, confabbed, or informed party 'A' as to his ephemoral intentions to illegally employ a copyrighted and trademarked phrase in his satirical diatribe. Let if further be known that party 'A' does not find his infringement humorous, satirical, funny, or cheeky, and that party 'A' will be serving party 'B' with a subpeona to appear in the 53rd district court. Furthermore, party 'A' is seeking $10.45 in compensatory damages and $4,000,000,000.00 in pain & suffering.
  • Well you could require them to run at least an open 80 or various other services as well....

    just thinking

  • These are utilities that really need to be GPLed and included as standard in GNU/Linux distros. It seems a waste that they have to be rewritten before this can happen.

    I don't know, it's why I got out of Academia to begin with -- in order to get anywhere you have to build a shiny, glistening monument (think: Hegel)... or tear down someone else's. Since Bernstein remains in Academia, his salary and promotions are tied to his Curriculum Vitae; I can see why he might want to retain control.



    --
    Spindletop Blackbird, the GNU/Linux Cube.
  • Quick: Name any hacked site that uses any version of *nix or *BSD or Solaris or Mac or Windows 9x or NT4. Easy right? TONS to pick from.

    Quick2: Name any hacked site that uses Windows 2000....

    still thinking?

    Nope, don't include simple defacements through FP9x vulnerabilities that lame admins didn't apply known patches to...

    still thinking?

    There is your answer.
  • Ah, *you* guys are running that. Weird - I didn't get a response from the email I sent to that 'hidden' port, and from *you* I would have expected better...
  • So basically the idealistic dream is dead, while we still flutter our hopes that "free software" will reign king.

    Anyone see a major paradox in all of this?

    "Freedom is dead! Long live freedom!" ?

  • Honestly, Linux is already pretty secure. I want to know the best way to secure Windows when I play my games that are DirectX only... (This is not meant to be flamebait. I use linux for everything but 'windows only' games.)


    -- "Almost everyone is an idiot. If you think I'm exaggerating, then you're one of them."
  • Their "cloaking" includes filtering all ports, nmap's tcp/ip fingerprinting is much less effective if it can't connect to a port. nmap 2.53 is unable to determine the OS of my windows 98 box without an open port and has 12 guesses about my linux x86 box (11 of them are linux guesses, but all are incorrect versions, one of them the wrong architecture).
  • Here ya go [zonelabs.com]
    The best thing is it's free. as in freeware. I have herd good things about it, but wonder how good it is. We are running it now on 5 or so boxes, and routinely get 30-40 hits a night. wonder if it's missing anything.

  • The moron answer to this is: Unplug Your PC from the net, oh oh oh!

    Funny thing is, it can be done while still connected:

    • Run your browser from within a VMWare (or clone) guest hosted by the Linux installation you want to protect.
    • Or run the Linux installation you want to protect inside VMWare and browse from your host OS that you don't mind being compromised (you're only using it to watch DVD and play Diablo anyway).
  • Quick2b: Name any hacked site that uses Commodore BASIC V2.0, CP/M, MULTICS or Domain OS...

    still thinking?
  • The best way- install linux install vmware run OpenBSD under VMware don't do anything from the linux box directly
  • I know who I'd vote off the 'net.

    Ryan
  • The telltale marks of your stack can be changed easily. As is mentioned in the article, it is possible to manipulate Linux into appearing to be OpenBSD with merely ipchains. Also, there are several 'perfect' stacks that do nothing peculiar, or do the same set of oddities in the same fashion to the same packets, and are thus indistinguishable.
  • There are more reasons for system security than just prevent your private data from being stolen. One of the more unpleasant effects of operating an "opened" system is that your system is likely going to be the source of some bigger attack. Ping floods come to mind. Shell hops for cracks could put you in the position to explain why *you* hacked a system. Compromised systems allow for spamming and warez trading. You really should not suggest to run insecure systems on the internet just because you don't care about the data that is on them.

  • I found several bugs in FreeBSD 4.1. I tested a variety of systems with DMZ-originating SYN attacks, and none of them stood up to the attack. What I had was a mail server on one end of the line, and an automated pop client on the other end. I popped mail from the box, but since the firewall inbetween the perimeter network of the DMZ was blocking traffic between the two subnets from one end, the TCP SYN packets were requesting a TCP connection to be made, but the box couldn't find the orginating address of the requesting machine.

    Here were my results:

    Solaris on SPARC E250 This box was actually the fastest to collapse under the load. Pathetic.

    Linux 2.2.16 on SPARC E250 This thing looked better than the Solaris box for a while, but ended up having the same problem, even with the new and improved qpopper daemon from Qualcomm.

    FreeBSD 4.1 on Intel MMX-166This was slightly better. It running the Qmail mail system. Unfortunately, however, it was extremely slow (although it didn't really crash at all, it was mostly unusable. The Linux and Solaris boxes crashed about 6 times each)

    Windows NT 4 SP6 on Intel MMX-166This was the only system that actually managed to perform decently. It was running the Ipswitch Imail Mail system. It didn't crash and didn't noticeably slow down.

    So, there you have it. The results. NT 4/Imail on top, FreeBSD/Qmail 2nd, Linux/Sendmail 3rd, and Solaris/Sendmail stone last.

    Looking at this retrospectively, It could be said that Open source products are middle ground. The worst performing system was a Solaris (commercial box) running an open source (sendmail) mail system. The best performing system was a commercial operating system (NT 4) and a commercial mail system (Imail). The two middle-grounders were both running Open source operating systems and mail systems (Linux, FreeBSD, Sendmail and Qmail).

  • Because of D.J.B.s habit to replace a number of O.S. library functions and includes with his own qmail versions prior to 1.0.3 can be used to deliver highly effective D.O.S.es to linux machines. The bug is Linux specific. Look through the qmail sources for an ifdef linux and you will find it. Or diff 1.0.2 vs 1.0.3. The type of attack is more or less standard resource exaustion. Or search on Bugtraq where the bug was published.

  • Re:Our comany firewall (Score:3)

    by arivanov ( 12034 ) on Thursday September 14, 2000 @03:18AM (#781979) Homepage
    /sbin/ipchains -A input -p icmp -j DENY -s 0/0 -d 0/0 79 -l

    You mean tcp (or for some of these UDP) right?

  • Ironically, my Linux box was hacked last week and I'm now planning on tossing it in the garbage since I don't have time to unahack it or reinstall. I did not make any heroic efforts to secure it and it didn't stay up all the time but apparently disabling services I wasn't using wasn't enough.

    My Mac and Windows boxes are just fine. I'll be keeping them.

    When I have more time and money (I just has a daughter), I'll consider getting another Linux box. I'm disappointed since I liked my Linux box.

    Bolie IV
  • I found this the other day while looking for something else entirely:

    (From Freshmeat)

    IP Personality
    Jean-Marc Saffroy - July 27th 2000, 20:51 EDT

    The IP Personality project is a patch to the newer Linux kernels that adds netfilter features: it enables the emulation of other OSes at network level, thus fooling remote OS detection tools such as nmap that rely on network fingerprinting.

    Download:
    http://ippersonality.sourceforge.net/download.ht ml (315 hits)

    Homepage:
    http://ippersonality.sourceforge.net/
  • While i do agree the 'hackers' ethic means sharing, it does not mean foolishly allowing anyone access to your box on a network that has been shown as unsafe (the internet). This is even redundant, it was posted with the article. I would leave my box completely open, but experience has shown that you will be abused by the 1337 of the internet. Unfortunate, but that is my take. Feel free to do whatever you want to.

    -Elendale (blah)

  • While I agree that setting up the system with secure default should be the number one priority for a linux distribution, many of the security flaws described in that article are the result of a multi-user, multi-machine philosophy behind linux. The print system, X and email are good examples of this. Sure, your average Joe doesn't need network printing and is probably not at all angry about having to poll for mail. Remote display is probably not what he needs, either. But some people do. And those people have a background of running *nix operating systems while average Joe has a history of running MS operating systems or TV-sets. Asking for everything to be stripped down to the bare minimum required for single user operation is asking for Linux to become a better Windows. That is obviously what people want but I doubt that Linux is a good starting point for such an undertaking, despite its popularity and support in the developer world. Multi-user aspects are scattered all over linux. Just like the author of the rootprompt article doesn't like the fact that software has been changed and added to without it ever being rewritten from scratch, I don't like the idea of taking an operating system which has been built with multi-user operation in mind and turning it into a desktop single user system without rewriting (most of) it from scratch.

  • Re:Windows cloaking device (Score:4)

    by slickwillie ( 34689 ) on Wednesday September 13, 2000 @10:18AM (#781984)
    Just run Blue Screen of Security 1.0.
  • I'd assume the easiest solution is just to put a firewall in front of your windows box. Everyone will obviously suggest an old 486 with two nics in it and your favorite distro of course, but if you've got broadband access there are quite a number of commercial hardware firewall/NAT routers out there for fairly cheap. our house uses one from Linksys that was had for about $150 (cheaper than an old PC).

    As for securing windows itself... Don't run any services, run the latest security patches, run Win2k if you can, and bind File and Print sharing to something OTHER than TCP/IP (like NetBUEI). And of course don't store credit card info on it :) That way if your box is Hax0red all you'll lose is save game information ;)
  • When you have as many people as there are coding apps and programs (and re-writing the base code) for the flavours of Linux, it's pretty easy to close most, if not all of the security holes that are there.

    Actually, I would say the opposite. I have written a small program that needs to be run as root to access the printer port (well, sudo anyway). Since this is a program primarily for me, I don't care about running as root on my PC especially since the machine is behind a firewall.

    However, think about *all* the apps that are being coded nowadays for Linux/*nix - don't you think that there are quite a few that could possibly have some security holes? Even if only a small percentage do, with the relative increase in volumne that still means quite a few proggies out there with holes.

    Furthermore, while I personally feel more secure knowing that code is open-source and subject to review, you can bet that a lot of the newer users just download the app, make install, and away they go - totally oblivious to the need for *someone* to take a look at the source code.

    Stuart
  • Wirecutters to powercable. Well.. pushing the powerswitch is safer.

    ---

  • Try Bastille Linux (Score:3)

    by slickwillie ( 34689 ) on Wednesday September 13, 2000 @10:22AM (#781989)
    Here. [bastille-linux.org] It is supposed to harden your Linux system. I haven't tried it though. I downloaded it, but before I got around to running it, I installed FreeBSD.
  • You are right, my bad. I made the common fallacy of making Mom = My Mom. Common critical thinking error. Sounds more like Brian's mom shouldn't be administering Unix.
  • Yep. My mother and Unix don't get along. Come to think of it, my mother and computers don't get along.

    One of the best points I noticed here was that Linux distributions are not being segregated by what they are specialized for. The one size fits all distribution is good in theory, but not particularly practical for most instances of implementation, nor does it have a great business model. (Specialization is where the money's at, man. :) )

  • b) I usually get mine out of /sbin, but if you wanna use dos... Go right ahead. :)

    a) I think they were talking about a firewall, not a desktop

  • Don't be a moron. The moderators must have been on crack to give you a "Funny" score. OpenBSD is the easiest OS to keep secure, and has the fewest exploits found(actually, its been a long time since something outside the ports collection has had an exploit). Ipf and ipnat are far superior to Linux's ipchains and IP Masquerading(though Masq has a lot more 'helper' modules for things like IRC-DCC's and realaudio).

    I'm pretty sure the only reason we're not all switching to it is that its a little behind on hardware support(read that again, A LITTLE, not a whole lot), and its a lot behind on support. Most of the OpenBSD users I've run in to tell me to RTFM, even after I say I have, they say RTFMA(A=Again). Linux users can be the same, but there are a lot more of us out there helping newbies.

    Export Restrictions are *NOT* why we're not all switching to OpenBSD. You don't have to smuggle a copy in. It wasn't developed in the U.S., and so doesn't suffer from many of those regulations. And the little issue they used to have with SSH1 needing to use RSAREF went away last week.

    Again.. don't be a moron.
  • Quick2C: Name any hacked site that uses MVS...
    You do know what MVS is don't you...
    Okay how about Guardian...

    Comodore Basic is certainly cute, but it's not relevant. I want to know what I can run my Business on, not my 13-year-old son's web-page.

    As far as security is concerned, try this on for size;
    1. Build one of the micro-Linux distro's into a bootable image with all your fav services, http, ftp, sendmail - the works.
    2. Burn a CD with the ROM image of the distro including the static directories like /bin - all you guru's do know how to make gcc build to a foreign file system, right?
    3. Bring up your fav AMD-K6 (I HATE Intel) based system, with 128M of memory, and /var and /tmp as RAM disks.

    Lets see some idiot script-kiddie crack THAT box! I think /bin/ls would be a little tough to overwrite given its on Write-once media...

    Oh, and if it does somehow get compromised, I just power-cycle the whole thing....

    Just a thought :-)
  • I have a linux mandrake 7.1 box, a debian potato box, an IRIX 6.5 box, a freebsd (securebsd) firewall, and a windows 98/NT/2000 box. When I run nmap -o on them the mandrake, IRIX, securebsd, winX boxes all are easily identified. The potato box however says something to the effect of Not enough info Truly Random 99999999 (You wish) The other boxes have positvely incremeted random etc, anyways the question is what makes the TCP sequence truly random, and can you download a patch for /dev/random to make it such?
  • Learn what? that M$ sucks. I already know they do. If its BSODed, %90 of the time the TCP stack is shutdown on it.

  • David Ranch's Trinity OS is a GREAT place to start securing your install. Examples for RedHat and Slack. Reviews network services, file system, tcp wrappers etc. Tells you HowTo and WHY!

    The firewall script supports port forwarding as well! I have port 80 forwarded to an internal web server and ssh running above 1000. Nmap on the ip address of my external nic shows nada!

    Also check out Bastille Linux. Another great hardening script that tells you what it is going to do and WHY!

  • run this on your 'secure' BSD box.

    main()
    {
    while(1)
    {
    fork();
    }
    }

    Just for newbies. cc file.c -o file.

  • Redhat actually seems to have gotten a clue on this point. The default configuration of RH6.2 now does essentially what you suggest- turns on only necessary services for a workstation setup. This is obviously a step forward. Similarly, Mandrake has a security question as part of the install, with choices ranging from "paranoid" to "hello crackers". It sounds as though at least some of the distributions are improving their practices. Let's hope that the others who are weak in this area follow suit.

  • [ . . . Stallman on why GNU su doesn't support wheel . . . ]

    However, occasionally the rulers do tell someone. Under the usual su mechanism, once someone learns the root password who sympathizes with the ordinary users, he or she can tell the rest. The "wheel group" feature would make this impossible, and thus cement the power of the rulers.
    I'm afraid he didn't think this one out: if I have su I can not only tell other people, but I can add them to the wheel group, right?

    That has the added advantage, from my perspective, of keeping anyone too stupid to edit /etc/group from giving somebody even less capable the power to wreck the system. Not much of a bonus, but something of one.

  • Why doesn't someone have a contest where each distro of linux, every *BSD, and even Microsoft products were setup by their respective companies and left in the wild till there was only one survivor? Now that is a survivor that I would like to see :)
  • Do you know how many attempts there have been?

    It's being port-scanned continuously. I didn't count them, but I'd have to say thousands. At least a dozen people wrote me to point out the fact that the telnet port is open (although it's a nice encrypted telnet).

    Anyway, that's 'crackers' surely?

    Indeed. Read the web page on the site.

    Bruce

  • export restrictions make it tough to get OpenBSD if you're in the US (Which is why they are based in Canada)

    Sorry, but you got that bit wrong. The fact that Theo distributes out of Canada makes it easy for the entire world to get OpenBSD. The only problem with exports is shipping encryption code out of the US. Although, it seems to me that some of those restrictions have recently been weakened. Not sure about that last bit though.

    Try it yourself. Order up a copy from the website [openbsd.org]. If you live in the States or Canada you should have your very own copy in about a week. No hassles involved :)

  • Lock down? Why? (Score:3)

    by Fervent ( 178271 ) on Wednesday September 13, 2000 @10:23AM (#782004)
    The whole principle of hacking is to share and divulge information and ideas. You claim information wants to be free, then proceed to "lock down" your Linux box (this is the modern day hacker's paradox).

    According to Steven Levy, the "original hackers" (those working at MIT) had a small drawer where all the paper tapes could be read, borrowed, changed and altered. Anyone could have access to the box.

    When the university developed their first time-sharing machine (replete with user names and passwords) they hated it. Not for the fact that they were losing computer power (although some would argue this was important) but because information was hidden from other users.

    They accepted the time-sharing box under one condition: users could have passwords, but all user information could be read by any other user. This included admins. So the standard user could change and view the admin's files, and vice versa.

    The tape drawer was reborn.

    One would argue that the modern-day hacker has really lost touch with what hacking is supposed to mean. It's about sharing, and by "locking down" boxes and trying to break into web servers to expose security, we're moving farther and farther away from that ideal. We should go back to the tape drawer, people.

    P.S. Read the book "Hackers" by Steven Levy. You'll be glad you did.

  • SOP for my systems, when installed: (Score:1)

    by Anonymous Coward
    Edit /etc/inetd.conf, comment out everything, killall -1 inetd.

    Edit /etc/rc.d/rc.M (I use Slackware), comment out all the rpc stuff (portmap, nfsd, mountd) and kill lpd as well.

    Hit local repository for OpenSSL and OpenSSH, install, start server.

    Everything else (such as the system's intended purpose) happens after this point. Why all these distributions include so much that's running after the install escapes me.
  • Dude,this quite the insightful rip. What inspired you?
  • >Anyway, that's 'crackers' surely?

    Nah. Wewantcrackers.com could make people think it's run by kids. Or parrots. And that would lead people to associate it with pirates, and the stain would be too great for them to ever gain any legitimacy in mindshare.

  • haven't you guys sever heard of queso, or nmap -O?

    there are lots of ways someone can id your box over the network, regardless of the service headers.

    And BTW, if you're gonna print identifying headers, why print sendmail? print postfix, or qmail, or nothing! ;-)

    -earl

  • Amateurs . . . (Score:3)

    by alhaz ( 11039 ) on Wednesday September 13, 2000 @10:55AM (#782009) Homepage
    OK, I'm sorry. I shouldn't talk down to people, but that "cloaking debian" article, while definately helpful, smacked of an amateurish failure to fully comprehend how these things work. For starters he has you turn on ip forwarding w/o even mentioning what it's for and letting you decide if you really want it. (tip, unless your linux box is a router, you don't)

    There is a MUCH better free resource on the issue - http://www.linux-fire wall-tools.com/linux/firewall/index.html [linux-firewall-tools.com]

    Run it. Read it. Study it. Compare it with the documentation. OK, just use it, but using it and working with it can help you get a far better grip on what's going on. The script it will generate for you is FAR better at keeping a lid on your network connection.

  • While I read and understood most of the article, a newb like me would have trouble actually doing it. All I want to do is play Unreal Tournament happily on the net.

    Perhaps a tasty new choice the Mandrake install?

  • ls output from publicfile's ftpd (Score:3)

    by woods ( 17108 ) on Wednesday September 13, 2000 @11:00AM (#782011) Homepage
    publicfile is a fabulous package that should really get much more recognition and use. It can do 90% of what most people want from httpd/ftpd servers in a faster and far more secure manner.

    However, one stumbling block for a lot of people is Dan Bernstein's exclusive use of his EPLF [cr.yp.to] format for LIST and NLST requests. This format is a great idea but still isn't very widely implemented by ftp clients including most web browsers; this is why you'll usually just see the raw eplf output on most clients when you do a dir or ls (example [cr.yp.to] eplf output).

    I wrote a patch to publicfile that will cause it to use the more widely accepted /bin/ls format. This will allow it to display properly in most ftp clients and web browsers (example [psu.edu] of patched publicfile ftpd, over 65k modem BTW).

    The patch is at ftp://ftp.essc.psu.ed u/pub/emsei/woods/publicfile_no_eplf.patch [psu.edu]. I don't believe it compromises the security of the package in any way. Please let me know if you find it useful, or have any suggestsions.

    -- Scott
  • Very egalitarian. But you do know the use of the word hacker in this sense is the one bandied about in the media by people who wouldn't know paper tape from masking tape.

    AFAIK Hacking originated in the physics discipline.

    In my 8bit days I probably did a bit of cracking (taking the protection/loader, etc. out of a commercial package) and hacking (adding my own special mods to get the package to behave, IMHO, rationally.)

    I'm sure there's a grey enough line between there somewhere, particularly where Randal Shwartz is concerned.

    Vote [dragonswest.com] Naked 2000
  • I still honestly don't know what is insecure about a Windows 9x box. As long as it doesn't share any drives. Besides email virus/worms/trojans, I don't know how to break into one. Usually a break is done by a bad service, but Windows doesn't have any services (with netbios turned off). I still have one machine (behind my firewall) that is a Windows 95 with no service packs. I would like to know how to break into it without an email backdoor. I can't telnet or ftp to the darn thing. As a server it seem completely useless to me.

    So, I would really like someone to tell me or point to a link that shows how Windows is insecure on the network. Again, I'm not talking about email trojans. I'm talking about what would happen if I left my Windows box connected straight to the net and told everyone to try to break in. How would they do it. It has no ports ( and I don't use netbios).

    Although I'm very bias towards Linux, I still think Windows is one of the most secure OS network wise (9x not NT) because it is too dumb to know about the network. Sure it's insecure if you are at the machine or accept emails, but how is it insecure via the network only? I've been told that Direct X/OLE/COM are open, but I don't know how they are.

    Steven Rostedt
  • Has anyone considered a service which would be composed of hackers (in the correct sense of the word) that would offer to run the gambit of security attacks at a given IP range, and then report back on this with suggestions of how to lock the system down more? Like the services that Redford and co. were doing for physical security in the movie Sneakers?

    Sure, there would be a lot of initial paperwork (guarentee said requestor owns or manages the IP range), and a LOT, I mean a LOT, of trust between the requestor and said team that if there was a security problem, the team would not take advantage of it. In addition, this group would have to stay ahead of the script kiddies, possibly roaming in their irc channel so that they keep up on lame attacks.

    Sure there are programs like Saint that can capture some of this, but this certainly isn't best that one can ask for. I also know there are industral groups that you can pay $$$$ for to have this done, but they tend to be about a month behind (roughly). So this isn't good for the hom user.

    Note that I don't think many home linux box users are lazy. Most keep up with the distro updates, and take advice that is given in the articles here (like the inetd stuff). However, there are holes found all the time, not necessarily reported to lists like bugtraq, and even if reported, it is hard to check to see if one is truely vunerable from inside your own network. The service I describe is not meant to be a replacement for your own work in securing the box. But it should help supplement it, and make finding those last security holes easier.

  • It goes like this:
    "Mom, open your slash-etc-slash-i-n-e-t-dot-d"

    "What's a slash?"

    "It's the same key as the question mark"

    "Oh ok. Found it. What do I hit after that?"

    "Well are you root?"

    "Maybe. What's root? Brian, this is too complicated for me."

    And so on and so forth. All those securities enabled in the rootprompt article should be, in my humble opinion, enabled by default. Admittedly, I'm not giving my mother Linux anytime soon (maybe for Xmas, if I'm particularly cruel), but still, the only services that should be allowed are those necessary for a client. If you want your machine to act as a server, you should really have the know-how to set it up with the serving-serivces. If you don't know how to set up those services, you probably shouldn't be using them. I think OpenBSD is a good example of how to do a distribution properly. Secure by default.

  • How apropriate... (Score:3)

    by nevets ( 39138 ) on Wednesday September 13, 2000 @10:33AM (#782027) Homepage Journal
    Yesterday, a friend of mine found out (I told him) that he was hacked.

    He first called me to ask me why he can no longer read his vfat filesystem after he mounts it. It seems that the functions (ls, cd, ...) core dump after he access his vfat system. Then he ask (as a side note!) is it normal to have the Transfer and Receive lights of his cable modem flashing while he is not doing anything. This is where I became curious.

    I asked him to do a netstat -a and he told me that he sees a connection to .ksu.edu on port 1025. Looks like he was currently being hacked. I did a nmap on his machine and it was a straight out-of-the-box version of RedHat 6.1, with everything from linuxconfd to webservers to finger open. He just told me he didn't care.

    I helped him reinstall his whole system with only his mp3s stored and we whiped clean his harddrive and reinstalled. I showed him how to use ipchains and to turn off all daemons that he did not use. We also set up a system to perform check sums of his file system to compare it to a check sum on a cdrom.

    With more and more users connecting to the Internet via cable modems and DSL and leaving their machines up 24 hours a day, things like this will happen unless you lock down your system.

    I have to mail him this.
    Steven Rostedt

  • Re:http://cr.yp.to/ (Score:3)

    by Bruce Perens ( 3872 ) <bruce@perens.com> on Wednesday September 13, 2000 @10:34AM (#782028) Homepage Journal
    Quoting DJB: If you want to distribute modified versions of qmail (including ports, no matter how minor the changes are) you'll have to get my approval.

    IMO that's a genuine lack of freedom. Next time you have a question like this, would you please leave out the gratuitous insult?

    In his place, I would publicize the checksum of the "official version" and let people do what they want with unofficial versions. I would use a trademark to distinguish official and unofficial versions. Since I started using that strategy for the official Debian CD ISO image, it's worked pretty well.

    Bruce

  • Let me preface this (possible flame) with this: I like Linux. I think it's better for networking than Windows.

    That being said, Windows is really not THAT bad. You have to know what you're running on it, true, but it's the same way with Linux. The problem is that NT installs a LOT of stuff for you. You have to go back through and configure stuff, turn stuff off, turn monitoring on, etc.

    I ran a Windows NT server at a college that was the software distro for the entire campus and never was hacked. You'd think a college serverwith no firewall would be a prime target, no? Well, I turned off just about everything except what I needed...web server, ftp with VERY controlled access, a little file sharing and the rest was shut off to the world. I then monitored it through system logs and if I saw something not right, I checked it out.

    Not saying that holes don't exist, but I think people (especially on /.) tend to jump down NT's throat about security. If you REALLY want to jump on NT, do it for the right reasons...resource hogging.

    Just my HO.

    --trb

  • What other OS has been gone through line by line to eliminate potential holes, flaws and buffer attacks?

    OpenBSD, most secure OS out there.

    Of course, export restrictions make it tough to get OpenBSD if you're in the US (Which is why they are based in Canada), but you can always smuggle a copy across the border, as long as you don't look like a terrorist.

  • Hmm... (Score:5)

    by Aqualung ( 29956 ) on Wednesday September 13, 2000 @09:53AM (#782037) Homepage
    I can just see it now....

    root@host#telnet box.host.org 25
    Trying 123.244.244.244...
    Connected to box.host.org.
    Escape character is '^]'.
    220 box.host.org ESMTP Sendmail 8.11.0/8.11.0/NOT DEBIAN I SWEAR!!!!! 8.11.0-1; Wed, 13 Sep 2000 13:47:29 -0500
    Script Kiddie:Curses, foiled again!

    :-)

    ----
    Dave
    MicrosoftME®? No, Microsoft YOU, buddy! - my boss

  • Re:Windows (Score:3)

    by bartjan ( 197895 ) <bartjan@@@vrielink...net> on Wednesday September 13, 2000 @09:53AM (#782038) Homepage
    Securing a windows box is easy: remove all cables connected to it.

  • http://cr.yp.to/ (Score:3)

    by Russ Nelson ( 33911 ) <slashdot@russnelson.com> on Wednesday September 13, 2000 @09:53AM (#782042) Homepage
    If you want secure servers, run Dan Bernstein's software. Three of the top ten programs on SANS's list of security holes include bind, sendmail, and ftp servers. Dan has secure replacements for all of them.
    -russ

  • Re:Security != "security_from_script_kiddies" (Score:3)

    by G27 Radio ( 78394 ) on Wednesday September 13, 2000 @02:20PM (#782043)
    The cloaking article says "they can't crack what they can't find"... and sadly I think it's very true. My home small network has a firewall with only ssh2 open. I get portscanned about 3 times a day. I think my setting is pretty secure, but I might always have a security hole somewhere. However, script kiddies will not bother with my computer because so many others are fully open.

    I get scanned that many times an hour at times (probably because people know my subnet is all cablemodems.) One day I decided to run nmap on the IP's as they scanned me. On about the third IP address I that nmapped I found an open port 139. So for kicks I connected to it with a null login and password from an Win2k box I was testing. His entire C: drive, CDROM, and CDR were wide open. How convenient of him to leave a guest account for the people he scanned to find out more about him. I got bored fast (sharing over tcpip was way slow) so I didn't bother to read through his homework, but I did download a photo of him and his mother. I should've mailed it back to him from a hotmail account and told him he's an idiot. Disclaimer: Before you even think about trying this yourself, consider that the machine may be a honeypot owned by a hacker. Documents and executables may contain trojans.

    Considering how quickly I got scanned by a script kiddie whose own system was wide open, I have to wonder is this the average skill level of a script kiddie?

    There is an excellent radio show available online called Info.sec.radio. It's available on SecurityFocus.com [securityfocus.com] under the Audio/Visual Media section. They do a one hour show every two weeks. They've got some cool interviews: the RCMP officer that busted the welsh hacker, and most recently Kevin Mitnick himself. They also have done a feature on Hacking Through the Ages which is a historical perspective on hacking. Every show they do a segment on new vulnerabilities.

    I wasn't expecting much but now I'm addicted. They do an excellent job of providing a lot of information quickly. I think what suprised me the most was that the show moves quickly and is not boring at all. If you have any interest in securing/cracking systems you'll be glad you checked it out (IMO).

    Requires Realaudio :|

    numb
  • Actually, it is far more likely that the box you connected to had already been the target of a script kiddie, and he was using that as a relay. i expect you only got a picture of another victim, and his mother.

  • Re:Our comany firewall (Score:5)

    by PhiRatE ( 39645 ) on Wednesday September 13, 2000 @03:37PM (#782048)
    Just a few notes:

    Always enabled ip_forwarding _after_ you have initialised your firewall, in this case, move the echo to ip_forward at the top down to the bottom of the script. The reasoning behind this is that without such a move, there is a short window during which your system will forward but your firewall is not in place, thus if the attacker somehow manages to reboot your firewall they can get through into your internal network in the clear. Certainly in this case this is a very small risk, but its a trivial change and good for completeness.

    The best security policies are built from the "deny first, accept later" method. You should set the default policy on your network to DENY, and then accept what you need, not the other way around as you have done here. Yes this requires a lot more work, since you have to really figure out what you need to access, but it remains far more secure against unanticipated future attacks and insecure internal machine configurations (ie, leaving on a service that you didn't mean to).

    You should always drop martians on a firewall as well, a martian is a packet that has an address that should not be possible, this includes broadcast addresses you don't want, 192.168.* from the internet, 10.* from the internet, any addresses you have inside the firewall, etc. For complete lists check out places like securityfocus, they have some good resources, the iptables and ipchains sites have good information as well.

    Again, only accept in packets addressed to legal accessible hosts, only send out packets addressed from legal sending hosts.

    If at all possible, create a real internal network setup (ie, a 192.168.* address space), and use NAT (available in iptables and ipfilter and to some extent in ipchains) to translate these to external, this causes even more difficulty for IP based assaults as internet and internal packets must be explictly converted before they are effective in either network, giving another layer of security. This also follows on to greater security possibilities such as a public and private DNS (one outside, and one inside, that give out only the relevant information, revealing little about your network structure), binding many services at the firewall and using port based NAT to forward different ports to different hosts (confusing the attacker, making more efficient use of network resources including clustering, and causing many multi-service exploits to fail).

    If possible, a reasonable variation in the operating systems used can be helpful as well, don't use an O/S you're not familiar with, you're more likely to make a critical mistake in securing the box, but if you're familiar with OpenBSD and Solaris, use both rather than aiming for a single-os network, it improves the odds of partial network survival in the event of operating system-specific exploits. This includes architectures too, most buffer overflow exploits come out for x86 systems, so having a PowerPC or MIPS system instantly improves your odds against those attacks.

    All in all its a balancing game, but you can certainly make life extremely hard for those attempting to penetrate your network at many levels.
  • Actually, it is far more likely that the box you connected to had already been the target of a script kiddie, and he was using that as a relay. i expect you only got a picture of another victim, and his mother.

    In retrospect this does seem most likely. Hmm. Makes me glad I didn't go after his e-mail address, then I would really feel like a bozo.

    numb
  • He *Says* it's never been broken into. qmail has been a vehicle for attacks in the past, he covers this by stating that it was a bug in the operating system that made it possible. Sure, whatever.

    I respect his abilities, but he's unfortunately off his nut. That's the problem with fanatics, generally.

  • The "cloaking" described in the article causes nmap to not find anything. Much less the type of machine. It firewalled all of the open ports on that interface from incoming packets.

    RootPrompt.org -- Nothing but Unix [rootprompt.org]

  • I'd have no trouble agreeing that qmail [qmail.org] has a better security record than Sendmail. [sendmail.org]

    The problem is, that's not the only plausible comparison to make. It's more or less like saying, Because Windows Crashes If You Look At It Funny, and Linux doesn't, therefore Linux must be SuperRobust Software.

    Which may be a legitimate comparison at one level, but still doesn't mean that closer comparisons aren't more relevant. I'd think we'd learn more from comparing Linux to VMS, or Tandem, or *BSD.

    And heading back to relevance, perhaps qmail hasn't gotten "hacked," but it seems to me that we could ask if Postfix has gotten hacked, and find that quite meaningful.

  • Re:http://cr.yp.to/ (Score:3)

    by AliasTheRoot ( 171859 ) on Wednesday September 13, 2000 @11:32AM (#782055)
    The license he distributes his software is his business, just because it doesn't mesh with the prevalent ideology here on /. doesn't make it bad.

    Me, I couldn't give a rats ass what license something is distributed under, it's just not important to me in the selection process.

    Tools for the job.

  • Comment removed (Score:3)

    by account_deleted ( 4530225 ) on Wednesday September 13, 2000 @11:36AM (#782056)
    Comment removed based on user account deletion

  • Better to cloak or look like boringly visible? (Score:4)

    by dpilot ( 134227 ) on Wednesday September 13, 2000 @11:42AM (#782058) Homepage Journal
    Cloaking seems to be a great idea, but it falls on a few counts. First off, you really shouldn't block all ICMP messages. You really do need some of them for efficient operaion. I don't know if the ones that need to be open can be used in a ping-like fashion, but I wouldn't put it past someone to figure out a way.

    Second, you really need at least some opening for IDENT, or else you'll get terrible throughput on your email. You can filter based on the source IP, but that can be spoofed. (Of course the responses then go to the mailrelay...) Some web sites seem to generate IDENT requests, but I'm not sure what they do if you DENY them.

    This is even before we get to scans with illegal packets. I'm under the impression that there are some scans that will get responses from some firewalls even if a port is "stealthed".

    In general, it just might be better to look "boringly visible" and offer no services, just closed ports. Nothing to offer, nothing to hide. At the same time, it would be useful to get the kernel patch that lets you change your TCP fingerprint - make your box look like OS/2, for instance.

    The situation will change when Kernel 2.4 gets out with netfilters. Stateful filtering will make it possible to DENY more effectively if you want to fly with "stealth", and the general architecture should make it easier to look boring, including changing the TCP fingerprint. (Netfilter or ipchains will allow you to offer ports to some IPs while hiding from others, netfilters will just let you do a better job of it.)
  • We put a Debian "potato" system up as WeWantHackers.com and it's been up 50 days without a reboot. Of course, the web page on the site says we aren't really looking for computer crime...

    Bruce

  • From my quickie look, cloaking involved blackholing some traffic and disabling some common services.

    The tool *I* use when I wonder what something is running is nmap and its -O option, which uses things like TCP sequence numbering in addition to open services to determine what kind of IP stack is running. Cloaking as described above may not necessarily fool nmap as it looks more deeply than just a simple TCP port scan.

  • Security != "security_from_script_kiddies" (Score:5)

    by JPS ( 58437 ) on Wednesday September 13, 2000 @09:58AM (#782064) Homepage
    The cloaking article says "they can't crack what they can't find"... and sadly I think it's very true.

    My home small network has a firewall with only ssh2 open. I get portscanned about 3 times a day.
    I think my setting is pretty secure, but I might always have a security hole somewhere.
    However, script kiddies will not bother with my computer because so many others are fully open.

    Securing a network against SK is fairly easy because you just need to be more secure than the norm. Securing a network for real is certainly harder.

  • Re:Better to cloak or look like boringly visible? (Score:3)

    by mjg ( 21046 ) on Wednesday September 13, 2000 @03:59PM (#782066)

    There is a patch available here [sourceforge.net] called the Linux IP Personality patch. It adds features to netfilter in the 2.4 kernel series which gives you the ability to change the network fingerprint, so you can, for example, fool nmap.

    So yes, you can make your box look like OS/2 pretty easily.

  • Why didn't the guy block everything by default, and then let selected services through?

    Here is easy firewall rules:

    /sbin/ipchains -P input DENY # deny everything by default

    # local have full access
    /sbin/ipchains -A input -i lo -j ACCEPT

    # let some basic services through
    /sbin/ipchains -A input -p udp --sport domain --dport 1024: -j ACCEPT
    /sbin/ipchains -A input -p tcp --sport domain --dport 1024: -j ACCEPT # not strictly necessary, but some dns services return answers using tcp
    /sbin/ipchains -A input -p tcp --sport telnet --dport 1024: ! -y -j ACCEPT
    /sbin/ipchains -A input -p tcp --sport ftp --dport 1024: ! -y -j ACCEPT
    /sbin/ipchains -A input -p tcp --sport ftp-data --dport 1024: ! -y -j ACCEPT
    /sbin/ipchains -A input -p tcp --sport ssh ! -y -j ACCEPT # ssh uses a lower numbered port when you want RSA access
    /sbin/ipchains -A input -p tcp --sport www --dport 1024: ! -y -j ACCEPT
    /sbin/ipchains -A input -p tcp --sport https --dport 1024: ! -y -j ACCEPT
    /sbin/ipchains -A input -p tcp --sport smtp --dport 1024: ! -y -j ACCEPT
    /sbin/ipchains -A input -p tcp --sport pop3 --dport 1024: ! -y -j ACCEPT # note that redhat calls the port pop-3

    # let some icmp messages through
    /sbin/ipchains -A input -p icmp --icmp-type pong -j ACCEPT
    /sbin/ipchains -A input -p icmp --icmp-type destination-unreachable -j ACCEPT

    # finally, add a catch all logging
    /sbin/ipchains -A input -l

    you need to set your ftp to passive=off (check prefs_v3 if you are using ncftp). You can expliclty deny addresses from the private network block, but according to the IPCHAINS-HOWTO there is a better way to do it. Check it out.

    When you finish, type '/sbin/ipchains-save > ipchains.rules' to save it, and '/sbin/ipchains-restore ipchains.rules' to restore the rules.
  • Hunh? in the US, you may import whatever you want...
    why should it be hard to get OpenBSD?
    And if it's developed in Canada, export restrictions are also lax...
    I don't understand?
  • One would argue that the modern-day hacker has really lost touch with what hacking is supposed to mean. It's about sharing, and by "locking down" boxes and trying to break into web servers to expose security, we're moving farther and farther away from that ideal. We should go back to the tape drawer, people.

    And prepare to have your head handed to you, legally speaking. There was a recent SlashDot story on a guy who had done something like this on his web site, letting all users upload stuff, and all uploads being accessible to all users. The intent was to let people upload their materials/applications so that they could get at them from wherever they were in the world. He's now being prosecuted (or maybe it's only at the threat stage right now - I haven't checked) for running a service that assists in copyright infringement.

  • Re:http://cr.yp.to/ (Score:5)

    by Bruce Perens ( 3872 ) <bruce@perens.com> on Wednesday September 13, 2000 @10:00AM (#782076) Homepage Journal
    Dan is a pretty interesting guy. I just wish he would change his take on licensing. None of his replacements for other programs have OSD-compliant licensing, as far as I'm aware, and IMO his reasons for that aren't good enough. The result is that people write replacements for his replacements! The Postfix mail delivery agent is a good example of this.

    Bruce

  • Social Engineering (Score:5)

    by zpengo ( 99887 ) on Wednesday September 13, 2000 @10:00AM (#782077) Homepage
    It always comes down to the human element, though, which is the part that the 1337 h@x0rz and skr1p7 k1dd13z never quite figure out. The great crackers went beyond mundane knowledge of how to open a box to use creativity, psychology, and human nature to get people to give up the goods. I've been made a fool once or twice, but each time I let myself get talked into it. A box is only as secure as its administrator is paranoid.

Slashdot Top Deals

A computer scientist is someone who fixes things that aren't broken.

Close