1 / 28

Unix Security Overview: Protecting Your System

Learn about Unix security issues, basic safeguards, and how to secure a Linux system effectively. Discover common-sense security rules and tips to enhance protection. Stay informed and proactive in maintaining a secure Unix environment.

morozco
Download Presentation

Unix Security Overview: Protecting Your System

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Security Bo Ye, Quanhua Lu

  2. Overview • Unix vs. Security • Basic Unix Security Issues • How to Secure Linux Box • Other Security Issues • Security Tools • Miscellaneous

  3. Unix vs. Security • Unix was not designed to be secure. • Unix was designed by researchers to be an easy, friendly way to conduct and share research. (Security = 1 / Convenience) • Unix permissions are pretty much "all-or-nothing" -- root vs. everybody else. • Many Unix administrative functions are in programs external to the kernel, able to be inspected by the world.

  4. Your responsibility • Remember that breaking into a computer is a crime. People have been and will be prosecuted and sent to jail for it, so don't get tempted to try it. • If you discover a security problem, you should • Alert your system administrators (if you aren't the administrator). • Alert the vendor of your version of Unix. • Inform the Computer Emergency Response Team (CERT)

  5. Seven Common-sense Rules of Security • Don't put files on your system that are likely to be interesting to hackers. • Plug holes that hackers can use to gain access to you system. • Don't provide places for hackers to build nests on your system. • Set basic traps on systems that are connected to the Internet.

  6. Seven Common-sense Rules of Security (cont.) • Monitor the reports generated by these security tools. • Teach yourself about UNIX system security. Traditional know-how and common sense are the most important parts of a site secure. • Prowl around looking for unusual activity.

  7. Basic Unix Security Issues

  8. /etc/passwd file • Have no accounts without passwords. • Regularly verify that every login has a password. put:awk -F: '{ if ($2 == "") print $1 }' etc/passwd in a file and execute with cron and have results mailed • Avoid accounts with weak passwords. • Chose a good password. • Use npasswd or passed+ instead of passwd force users to select reasonably secure passwords. • Avoid share accounts • Avoid Group Logins and Shared Logins. • Use sudo to control access to rootly powers.

  9. /etc/passwd files (cont.) • Shadow your passwords • If at all possible, use shadow passwords. • "shadow passwords" put the passwords in a separate file, readable only by root. • Password Aging • Change passwords regularly,In particular, the root password should be changed on a regular basis • Beware of extra entries in your passwd file that are UID 0, or any other suspicious entries.

  10. /etc/passwd files (cont.) • Rootly Entries • Regularly verify that only the root login has id 0 by running the script: awk -F:'{if($3 == 0) print $1}'etc/passwd • Modify it to verify group ids and UID s of key individuals.

  11. Setuid Programs • If you are writing setuid programs: Minimize the number of setuid programs and keep the followings seven rules in minds: • Don't write setuid shell scripts. • You don’t have a enough control inside a shell script. • Don't use any library routines that invoke a shell. • These includes popen and system. • Don't use execlp()or execvp() to run another program • They allow you to give the program name without the path, which is very dangerous.

  12. Setuid Programs (cont.) • Always use full pathnames to identify files and programs. • Don’t rely on any kind of searching mechanism to find files. • Don't make the program setuid to root unless you have to. • Make a pseudo-users name or group name instead. • Don't make setuid-programs world-readable. • This can allow bad guys to attack and exploit your codes. • Don’t put secret back-door escapes in your code. • These features don’t stay secret for long.

  13. Setuid Program (cont.) • Check regularly for new setuid programs, or for changes in setuid programs. • Can help you catch an intruder early on. • Regularly compare the output of the following script to spot clandestine setuid programs. /usr/bin/find / -user root -perm -4000 -print/usr/ucb/mail -s "Setuid root files" netadmin

  14. Special File Permissions • /dev/kmem(which maps kernel memory) should not be world-readable. • /etc/passwd and /etc/group should not be world-writable (for obvious reasons). • Do not have world-writable anonymous ftp directories. • Give no "world" permissions to disk device files.

  15. How to secure linux box • Disable unused services. • User and password security. • Keep used services updated. • Use ssh wherever possible. • Packet filtering.

  16. Disable Unused Services • Edit /etc/inetd.conf and comment out unused services: ftp, telnet,rstatd, etc. • Run ‘ps aux’ and exam the output carefully, look for extra daemons: sendmail, named, nfsd, etc. • If you don’t need it, kill it.

  17. Disable Unused Services (cont.) • Run ‘netstat -a | fgrep LISTEN’ and look for unusual ports. This will print up something like this • tcp 0 0 *:6000 *:* LISTEN • tcp 0 0 *:www *:* LISTEN • tcp 0 0 *:auth *:* LISTEN • tcp 0 0 *:finger *:* LISTEN • tcp 0 0 *:shell *:* LISTEN • tcp 0 0 *:sunrpc *:* LISTEN

  18. Keep Used Services Updated • Install Updateme, a handy script for keeping your system up-to-date. • Learn how your vendor provides software updates! Many packages have security problems discovered with them after release, and Linux vendors will release new versions to fix these. • Redhead 5.2: • <URL: ftp://ftp.redhat.com/linux/redhat-5.2/updates/> • SuSE 6.0: • <URL: ftp://ftp.suse.com/pub/SuSE-Linux/suse_update/SuSE-6.0/>

  19. User and password Security • Run ‘pwconv’to turn on shadow passwords. • If possible, get PAM (Pluggable Authentication Modules) installed. • Don’t run routinely as root. • Use sudo to aid in delegating root tasks.

  20. Installing ssh • Download source: • <URL: ftp://ftp.cs.hut.fi/pub/ssh/ssh-1.2.26.tar.gz> • Unpack source: tar -xzof ssh-1.2.26.tar.gz • Configure: cd ssh-1.2.26; sh configure • Build: make • Install: (as root) make install • You may also wish to install ssh version 2 after version1.

  21. Using ssh • Other end must run sshd server. • Use just like telnet or rlogin. Like rlogin can use a different remote username by adding ‘-l name’. Use config file (see ssh manpage) to set common parameters persistently. • Use scp to copy files like rcp. Example: • scp pcecs237.cs.umbc.edu:myprog.c .

  22. Packet Filtering • Allows you control what packets reach your machine from the network,and only allow in data to services you intend to offer. • Helps prevent hostile scanning for accidentally open services. • In Linux 2.0.x look for ipfwadm, in 2.2.x ipchains. • For more information see • <URL: http://www.xos.nl/linux/ipfwadm/>

  23. Other Security Issues • Remote Event Logging • Use "syslog" to send important events to a secure machine • Secure Terminals • Restrict root logins to specific terminals by listing them in /etc/securettys • Be very careful with /etc/hosts.equiv and .rhosts files • NIS and NFS • Security and Sendmail

  24. Security Tools • COPS -- Computer Oracle and Password System • COPS does many scans for common security problems on Unix systems. • Warns you of problems. You have to fix them. • Crack • Tries to guess passwords by using dictionary words, encrypting them, and comparing with the encrypted password

  25. Security Tools (cont.) • TCP wrapper (tcpd) • A package that is used to monitor incoming IP connections • Allows you to selectively block hosts and provides logging of all connections via syslog • /etc/inetd.conf telnet stream tcp nowait root etc/in.telnetd in.telnetd you can change this to: telnet stream tcp nowait root /usr/ets/tcpd in.telnetd

  26. Security Tools (cont.) • Tripwire • A file integrity checker • Notifies you of changes to important system files • SATAN • Analyzes hosts on your network for certain well-known (and dangerous) vulnerabilities

  27. Miscellaneous • Backups • Have regular backups • To recover from destructive attacks • To have a known "clean" configuration to compare against • Trojan Horses • Be careful with software off the net • Get software from known sources • Don't compile things right away. • Don't install it if you can't get source, unless you're sure of what it is

  28. Miscellaneous (cont.) • Packet Filtering • Controlling access to a network by analyzing the incoming and outgoing packets • Packet filtering is one technique, among many, for implementing security firewalls • Kerberos • an authentication system developed at MIT • uses DES encryption • requires a secure "authentication" server

More Related