CMOS Boot loader xlock, vlock
Boot loader boot: linux single root /etc/lilo.conf restricted password=pickyourpassword /etc/lilo.conf /sbin/lilo Login timeout ~/.bashrc ~/.bash_profile TMOUT=nn Logout ~/.bash_logout clear xlock, vlock
OS ftp, telnet, http TCP/IP fingerprint : nmap, queso OS /etc/inetd.conf /usr/sbin/in.telnetd -h nmap, queso http://www.innu.org/~sean/
Port nmap, strobe, nc ID exploit Port scan finger, telnet, login /etc/inetd.conf # snort : port scan detector
Exploit remote/local attack
: ntucrack, John the Ripper (Brute-force attack) : tcpdump, snort, sniffit, ethereal
Shadow password /etc/passwd /etc/shadow MD5 DES MD5 /etc/pam.d/login /etc/pam.d/passwd password required pam_unix.so nullok obscure min=4 max=8 md5 min max cracklib otp, makepasswd
root /etc/securetty root /etc/pam.d/login auth requisite pam_securetty.so /etc/pam.d/login account required pam_access.so /etc/security/access.conf -:wheel:all EXECEPT LOCAL.win.tue.nl Local *.win.tue.nl wheel /etc/pam.d/login /etc/security/time.conf
chroot shell chroot shell jail http://www.aarongifford.com/computers/chrsh.html rbash (restricted bash) redirection shell root:x:0:0:root:/root:/bin/csh xfs:x:101:234:x Font Server:/etc/X11/fs:/bin/false ftp:x:14:50:ftp User:/home/ftp:
Resource local DoS /etc/pam.d/login session required pam_limits.so /etc/security/limits.conf core, rss, nproc Super user /etc/pam.d/su # auth auth wheel groupadd wheel su sufficient pam_rootok.so required pam_wheel.so group=wheel usermod G wheel username
sudo root Shell sudo bash, csh, vipw, vigr, visudo, more visudo /etc/sudoers User_Alias Host_Alias Cmnd_Alias FULLTIMERS = millert, mikef, dowdy SERVERS = master, mail, www, ns SHUTDOWN = /usr/sbin/shutdown FULLTIMERS SERVERS = NOPASSWD: SHUTDOWN
root SUID race condition buffer overflow heap overflow format string bug ftp, http, sendmail, bind NFS(Network File System)
: user(u), group(g), other(o) : read (r), write(w), execute(x) sticky bit(t/t) SUID/SGID (s/s)
SetUID/SetGID passwd, chsh, chfn /etc/passwd /etc/shadow su, sudo, mount, umount, ping, sendmail, traceroute, at, lpr SUID root SUID backdoor, race condition, buffer overflow, format string bug # find / -user root perm 4000 exec ls l {} \; 2> /dev/null more
root HDD DoS /etc/fstab /tmp, /var/tmp noexec, nosuid exploit /tmp exploit Quota Quota support (CONFIG_QUOTA) [n] y /etc/fstab usrquota grpquota root quota.user, quota.group edquota
umask umask 077 MFM(Magnetic Force Microscopy) wipe chattr ext2 chattr +i filename
find, diff, cmp, strings, grep root SUID tripwire MD5 CFS, TCFS, SFS, VS3FS tar, dd, resotre
Network sniffing Port scanning, OS detection, Remote vulnerabilities scanning NFS NIS IP spoofing & session hijacking ftp, http, sendmail, dns Remote buffer overflow Backdoors, Reverse telnet, Bounce attack DoS, DDoS Ping-of-Death, SYN flooding
IP Spoofing & Session Hijacking
sniffit
DoS/DDoS(Distributed Denial of Service). Victims in mid-february 2000 Yahoo CNN Interactive Amazon.Com ebay Datek Online E*Trade ZDNet Buy.com
netstat a grep LISTEN more lsof grep portnumber more # /etc/inetd.conf echo, chargen, daytime, discard, time finger - ID telnet, ftp, talk, ntalk, auth, login, shell, imap, pop3 /etc/init.d/inetd restart
tcp wrapper / /etc/hosts.allow in.fingerd, in.telnetd : 192.168.192. /etc/hosts.deny ALL : PARANOID in.fingerd, in.rlogind, in.telnetd, in.ftpd: ALL : spawn ( /usr/sbin/safer_finer l @h \ /bin/mail s %d=%h root )&
IP spoofing /etc/host.conf nospoof on /etc/network/options spoofprotect=yes /etc/sysctl.conf net/ipv4/conf/all/rp_filter=1 ipchain # rules for standard unroutables ipchains A input i eth0 s 255.255.255.255/32 b j DENY ipchains A input i eht0 s 127.0.0.0/8 b j DENY # rules for private(rfc1918) addresses ipchains A input i eth0 s 10.0.0.0/8 b j DENY ipchains A input i eth0 s 172.16.0.0/12 b j DENY ipcahins A input i eth0 s 192.168.0.0/16 b j DENY # rules for reserved addresses(multicast) ipchains A input i eth0 s 240.0.0.0/5 b j DENY
IP spoofing telnet, rlogin, rcp ssh, scp, telnet-ssl, ssl-telnet, apache-ssl
SYN Attack IP: TCP syncookie support (CONFIG_SYN_COOKIES) [y/n] Y /etc/network/options syncookies=yes /etc/sysctl.conf net/ipv4/tcp_syncookies = 1 Ping flooding /etc/sysctl.conf net/ipv4/icmp_echo_ignore_all = 1 ping net/ipv4/icmp_echo_ignore_broadcasts = 1
/
http://www.securityfocus.com http://packetstorm.securify.com http://www.linuxsecurity.org http://www.phrack.com/ http://www.insecure.org http://www.hack.co.za http://khdp.org http://cert.or.kr
Filesystems HOWTO Firewall HOWTO IPChain HOWTO Net HOWTO NFS HOWTO NIS HOWTO Quota mini HOWTO Security HOWTO Secure POP+SSH HOWTO Shadow Password HOWTO Securing and Optimizing Linux RedHat Edition