Softpanorama (slightly skeptical) Open Source Software Educational Society

May the source be with you, but remember the KISS principle ;-)

Softpanorama University
Classic Unix Security Tools

E-business does not wait for security standards. Everybody understands that Unix security can be much better if administrators install and use available security tools. Often this is not the case and  often people do not use tools because there are so many of them. In a recent survey SAFARI authors have found that the most frequent reasons for continuing to operate hosts without available countermeasures were:

• Insufficient resources
• Difficulty in finding and understanding countermeasure information
• The inability to administer configuration management across a large number of hosts.

At many of these sites, the basic computing infrastructure is an impediment to timely distribution of configuration changes. These sites operate at a substantially higher level of risk and are more likely to be compromised. Moreover they are also less likely to be able to adequately detect and recover from compromises. In case of compromises if the required resources for full recovery are unavailable temporary fixes create prerequisites for future troubles.

I created a list of several classic Unix security tools that IMHO should be considered before other tools and especially before buying any commercial security software:

1. Installation minimizers/OS hardening tools. They permit to determine what operating system packages are required for a particular set of applications and select only necessary packages for installation (and/or delete unnecessary after installation). The minimal system is the most secure system and any unnecessary service can be a source of troubles.  Those tools are nost developed for Solaris. See SolarisTM Operating Environment Minimization for Security- A Simple, Reproducible and Secure Application Installation Methodology
2. Pluggable authentication modules (PAM). They is very useful and largely underutilized security feature invented by Sun and most popular in Solaris environment although now implemented in all UNIXes. If it's not enabled by default it's not that difficult to configure PAM and select most useful modules. Checking of passwords (proactive !) against common blunders should be always enabled. I strongly believe that if PAM are not used in a particular installation then sysadmin is either ignorant or do not care about password security or both ;-). PAMs can also be used for token authentication, although currently shell wrapper is most common implementation.
3. Sudo -- lessen risks by limiting number of SUID programs and providing better logging of who when and how is using root.
4. Integrity checkers. Tripwire  seems to be a classic integrity checker. There are alternatives but one such tool is a must for any security conscious sysadmin. Tripwire is somewhat primitive, but its free. Several other tools are available but non is more popular than Tripwire.
5. Log analyses tools. Log analysis tools are covered in a separate page. Perl-based tools are preferable
6. Hardening Scripts. Operating system specific hardening scripts are the best (ASET and Titan for Solaris, SUSE tools for Suse Linux, , Bastille for Red Hat etc.);
7. Internal vulnerability scanners(IVS). Universal internal scanners are endangered specie. Cops and Tiger contain a lot of interesting ideas but both now are obsolete. Perl-based tools are preferable.
8. ssh should be used instead of regular telnet; especially if you are connecting to the computer from your ISP -- if ISP is compromised than you password can be stolen and your machine will be compromised next. SSH is pretty useful, easy to use and more secure than the archaic telnet/rlogin/rsh.|
9. TCP Wrappers can help to protect TCP/IP services listed in inetd.conf. They are installed by default in most Linux distributions including Red Hat (starting with v. 5.2), but not on Solaris. Also the sysadmin needs to configure them properly, which is often not the case :-(.  By using TCP_wrappers one can limit possibilities of connecting to machine using all services that are controlled via inetd.cong (including telnet and ftp) to the minimum number of sites.
10. Configuration management tools. CVS, cfengine (a tool for managing the config files of a large network of computers), or other specializes tools like Host Factory, SAFARI or Depot. Although none of them is a security tool per se, they are very useful for understanding changes on a particular machine. Some permit storing and parallel updating of all versions of config files. The latter can prevent some costly mistakes. It also simplify recovery if something happened.

Other tools that can be helpful, but IMHO they do not provide as great return on investment as tools mentioned above:

• Honeypots. I believe that specialized honeypots as well as fake daemons on some production servers are very useful and can serve as an effective alarm and deterrent mechanism. They lessen predictability of the environment and and can drive port scanners crazy...
• Port scanners like nmap, Satan, Saint, etc. Internal scanning is generally much more efficient unless you have really large network. Post scanners are often used as attack tools and in such situation one should used decoys than drive them crazy (if incoming ftp is disabled one neat trick is in addition to registering connection attempt is randomly imitate different ftp daemons; that trick is useful for other non-active but frequently attacked ports too. The main idea is to avoid predictability of environment ;-)
• Password Checkers/Crackers like Crack. If you use PAM, you can prevent users from choosing weak passwords and generally you do not need Crack.

Notes: Those pages are written by people for whom English is not a native language. Some amount of grammar and spelling errors should be expected. This is a Spartan WHYFF (We Help You For Free) site. It cannot replace the best teachers and the best books. The site contain some obsolete pages as it develops like a living tree... Some links on older pages are broken. Please try to use Google, Open directory, etc. to find a replacement link (see HOWTO search the WEB for details). We would appreciate if you can mail us a correct link. Search Amazon by keywords:     Open directory Research Index

News

[Apr. 12, 2001] Quality Security Tools -- Top 50 Security Tools

In May/June of 2000, we conducted a survey of 1200 Nmap users from the nmap-hackers mailing list to determine their favorite security tools. Each respondent could list up to 5.

I was so impressed by the list they created that I am putting the top 50 up here where everyone can benefit from them. I think anyone in the security field would be well advised to go over the list and investigate any tools they are unfamiliar with. I also plan to point newbies to this page whenever they write me saying "I do not know where to start".

Respondents were allowed to list open source or commercial tools on any platform. Commercial tools are noted as such in the list below.

I may change this list occasionally as new tools are created and others fade into obscurity due to security enhancements becoming mainstream. Or maybe I'll just have another survey next year.

Also note that many of the descriptions in this list were taken from the Debian package descriptions, the Freshmeat descriptions, or from the home pages of the application. I didn't count any votes for Nmap because the survey was taken on an Nmap mailing list.

Without further ado, here is the list (starting with the most popular):

[Nov. 19, 2000] System Administration xinetd

xinetd - extended Internet services daemon - provides a good security against intrusion and reduces the risks of Deny of Services (DoS) attacks. Like the well known couple (inetd+tcpd), it allows to fix the access rights for a given machine, but it can do much more. In this article we will discover its many features.

You could now ask which daemon should I choose xinetd or inetd. As a matter of fact, xinetd requires a bit more administration, especially as long as it won't be included into distributions (it is in Red Hat 7.0). The most secure solution is to use xinetd on machines with public access (like Internet) since it offers a better defense. For machines within a local network inetd should be enough.

See also

• Security main page

• Security books

• Integrity checkers

• Audit, scanning and hardening

• Perl security scripts

Recommended Links

Top 75 Network Security Tools

Swatch

Stephen E. Hansen, E. Todd Atkins, Automated System Monitoring and Notification With Swatch
Abstract: This paper describes an approach to monitoring events on a large number of servers and workstations. While modern UNIX systems are capable of logging a variety of information concerning the health and status of their hardware and operating system software, they are generally not configured to do so . Even when this information is logged, it is often hidden in places that are either not monitored regularly or are susceptible to deletion or modification by a successful intruder. Also, a system administrator must often monitor several, perhaps dozens, of systems. To address these problems, our approach begins with the modification of certain system programs to enhance their logging capabilities. In addition, our approach calls for the logging facilities on each of these systems to be configured in such a way as to send a copy of the critical system and security related information to a dependable, secure, central logging host system . As one might expect, this central log can see a megabyte or more of data in a single day. To keep a system administrator from being overwhelmed by a large quantity of data we have developed an easily configurable log file filter/monitor, called swatch . Swatch monitors log files and acts to filter out unwanted data and take one or more user specified actions (ring bell, send mail, execute a script, etc .) based upon patterns in the log .

See also: i005_P3_swatchv3

IP chains

LinuxPlanet - Tutorials - Linux Networking Using Ipchains - Multiple Machines, A Single Connection

Security for the Home Network LG #46

• ipchains

IP Chains HOWTO

Application: ipchains
Stable Version: 1.3.8

Brief Description:
Linux packet filter control utility (replaces ipfwadm for kernels 2.1.102+).

Deception toolkit

Application: Deception Toolkit
Stable Version: 0.7

stable version: 0.7

homepage: http://all.net/dtk/dtk.html

download location: http://all.net/dtk/download.html

author: Fred Cohen

Minitools

• Check-ps

Application: check-ps
Development Version: 1.2alpha5

Brief Description:
Reports or kills processes 'hidden' from the system administrator

lsof

Vic Abell, lsof
Abstract: Lsof version 3 lists open files for running UNIX processes. It is a descendent of ofiles, fstat, lsof version 1, and lsof version 2.

For system amdinistration on UNIX or UNIX-like systems, lsof (LiSt Open Files) is a life-saver. lsof will show what files a program has open, to include network connections, shared libraries, pipes, sockets, etc. It is the Swiss Army knife of programmer/administrator tools. See author Vic Abel's home page for details: http://people.freebsd.org/~abe/

sXid

 sXid

All in one suid/sgid monitoring script written in C

sXid is an all in one suid/sgid monitoring program written in C and designed to be run from cron on a regular basis. It has many features not found in other more "specific" scripts of this kind. Basically it tracks any changes in your s[ug]id files and folders. If there are any new ones, ones that aren't set any more, or they have changed bits or other modes then it reports the changes.

This version is mainly bug fixes and changes for compiles on more OS's including HP/UX, AIX, and a few Solaris fixes. It should be a little more efficient as well.

• Download
• Changelog
• Homepage
• Appindex Record

Created: May 16, 1997; Last modified: June 05, 2008