CNT-2311-Chapter 10 Notes - Revision history

Evanz at 02:55, 11 April 2011

2011-04-11T02:55:13Z

← Older revision		Revision as of 02:55, 11 April 2011
Line 151:		Line 151:
	Scanning for UDP ports requires root privilages.		Scanning for UDP ports requires root privilages.

	== Administering Local Security ==		== Administering Local Security (P. 490) ==
	Passwords are a very important part of securing your network. Linux Configurations rely heavily on passwords.		Passwords are a very important part of securing your network. Linux Configurations rely heavily on passwords.
	Even if your physical network is completely secured, weak passwords present a problem. People near-by could guess them or hackers on the other side of the planet could crack them.		Even if your physical network is completely secured, weak passwords present a problem. People near-by could guess them or hackers on the other side of the planet could crack them.

	=== Requirements for a Strong Password ===		=== Requirements for a Strong Password (P. 490) ===
	*Upper and lower case letters		*Upper and lower case letters
	*Numbers		*Numbers
Line 167:		Line 167:
	*Be alert to shoulder surfing and social engineering		*Be alert to shoulder surfing and social engineering

	=== Password Cracking ===		=== Password Cracking (P. 491) ===
	Attackers can use cracking programs such as Crack to crack almost any password.		Attackers can use cracking programs such as Crack to crack almost any password.
	Some passwords include network interfaces, bank login, facebook, email, hash files, wifi, system passwords.		Some passwords include network interfaces, bank login, facebook, email, hash files, wifi, system passwords.

	=== Password Managers ===		=== Password Managers (P. 493)===
	Password Managers are more secure than using the standard password hash file.		Password Managers are more secure than using the standard password hash file.

Line 178:		Line 178:
	Shadow has more attributes to its hash file such as aging and account expiration.		Shadow has more attributes to its hash file such as aging and account expiration.

	=== Limit Root Access ===		=== Limit Root Access (P. 494) ===
	Root can do anything on a linux machine. It can even delete every single file on your operating system without verification.		Root can do anything on a linux machine. It can even delete every single file on your operating system without verification.
	Only let people who need and have common sense and knowledge have access to sudo.		Only let people who need and have common sense and knowledge have access to sudo.
Line 184:		Line 184:
	In this file you can choose which commands the sudoers can have access to.		In this file you can choose which commands the sudoers can have access to.

	=== Login, Process, and Memory Limits ===		=== Login, Process, and Memory Limits (P. 495-496) ===
	Allows you to create limits on how many users can log in, how much of the cpu they consume, how much RAM they can consume, and other hardware vitals.		Allows you to create limits on how many users can log in, how much of the cpu they consume, how much RAM they can consume, and other hardware vitals.

Evanz at 02:42, 11 April 2011

2011-04-11T02:42:45Z

← Older revision		Revision as of 02:42, 11 April 2011
Line 190:		Line 190:
	Four fields must be edited domain, type, item, value		Four fields must be edited domain, type, item, value

	Fields:		'''Fields:'''
	*Domain – what the limitation applies to (user or group)		*Domain – what the limitation applies to (user or group)
	*Type – Hard or soft. Hard is imposed by the system administrator and cannot be exceeded by any means. Soft may be temporarily exceeded by a user.		*Type – Hard or soft. Hard is imposed by the system administrator and cannot be exceeded by any means. Soft may be temporarily exceeded by a user.
	*Limited item – cpu, ram, hdd space, video mem, logins		*Limited item – cpu, ram, hdd space, video mem, logins
	*Value – Limited value applied to limited item.		*Value – Limited value applied to limited item.

Evanz at 02:40, 11 April 2011

2011-04-11T02:40:51Z

@@ Line 167: / Line 167: @@
 *Be alert to shoulder surfing and social engineering
-== Password Cracking ==
+=== Password Cracking ===
-Attackers can use cracking programs such as Crack to crack almost any password.�
+Attackers can use cracking programs such as Crack to crack almost any password.
 Some passwords include network interfaces, bank login, facebook, email, hash files, wifi, system passwords.

Evanz at 02:33, 11 April 2011

2011-04-11T02:33:57Z

← Older revision		Revision as of 02:33, 11 April 2011
Line 166:		Line 166:
	*Don’t use same password twice		*Don’t use same password twice
	*Be alert to shoulder surfing and social engineering		*Be alert to shoulder surfing and social engineering

			== Password Cracking ==
			Attackers can use cracking programs such as Crack to crack almost any password.�
			Some passwords include network interfaces, bank login, facebook, email, hash files, wifi, system passwords.

Evanz at 02:25, 11 April 2011

2011-04-11T02:25:29Z

← Older revision		Revision as of 02:25, 11 April 2011
Line 154:		Line 154:
	Passwords are a very important part of securing your network. Linux Configurations rely heavily on passwords.		Passwords are a very important part of securing your network. Linux Configurations rely heavily on passwords.
	Even if your physical network is completely secured, weak passwords present a problem. People near-by could guess them or hackers on the other side of the planet could crack them.		Even if your physical network is completely secured, weak passwords present a problem. People near-by could guess them or hackers on the other side of the planet could crack them.

			=== Requirements for a Strong Password ===
			*Upper and lower case letters
			*Numbers
			Special Characters (!@#$%^&())
			*At least 8 Characters
			*Change password frequently
			*Use Passwords from /etc/shadow
			*Never reveal your password to anybody
			*Use Secure login protocols (SSH)
			*Don’t use same password twice
			*Be alert to shoulder surfing and social engineering

Evanz at 02:16, 11 April 2011

2011-04-11T02:16:46Z

← Older revision		Revision as of 02:16, 11 April 2011
Line 150:		Line 150:
	The -sT option only scans for TCP ports if you want to scan for UDP ports type: nmap -sU hostname.		The -sT option only scans for TCP ports if you want to scan for UDP ports type: nmap -sU hostname.
	Scanning for UDP ports requires root privilages.		Scanning for UDP ports requires root privilages.

			== Administering Local Security ==
			Passwords are a very important part of securing your network. Linux Configurations rely heavily on passwords.
			Even if your physical network is completely secured, weak passwords present a problem. People near-by could guess them or hackers on the other side of the planet could crack them.

Byron at 17:25, 10 April 2011

2011-04-10T17:25:40Z

← Older revision		Revision as of 17:25, 10 April 2011
Line 144:		Line 144:
	For a shortcut to find active servers type: # lsof -i \| grep LISTEN.		For a shortcut to find active servers type: # lsof -i \| grep LISTEN.

	=== Using Remote Network Scanners (page 487~~-488~~)		=== Using Remote Network Scanners (page 487) ===
	Nmap and Nessus are two network scanners that can scan for open ports on the local computer or other computers.		Nmap and Nessus are two network scanners that can scan for open ports on the local computer or other computers.
	Nessus which is a more sophisticated scanner can check for known vulnerabilities so you can tell if a server will be comprimised if you leave it running.		Nessus which is a more sophisticated scanner can check for known vulnerabilities so you can tell if a server will be comprimised if you leave it running.

Byron at 17:23, 10 April 2011

2011-04-10T17:23:42Z

← Older revision		Revision as of 17:23, 10 April 2011
Line 137:		Line 137:

	=== Using lsof (page 485-486) ===		=== Using lsof (page 485-486) ===
			lsof can identify what files are open in a directory, and find who's accessing them.
			To locate servers that are in use using lsof type the -i parameter: # lsof -i.
			Connections are identified by the existence of two hostnames in the NAME column and by the keyword ESTABLISHED in the same column.
			You can restrict the output of lsof by entering an address after the -i option.
			You can search for connections associated with an FTP port by typing: # lsof -i :ftp. If their ar not FTP connections than the command won't return an output.
			For a shortcut to find active servers type: # lsof -i \| grep LISTEN.

			=== Using Remote Network Scanners (page 487-488)
			Nmap and Nessus are two network scanners that can scan for open ports on the local computer or other computers.
			Nessus which is a more sophisticated scanner can check for known vulnerabilities so you can tell if a server will be comprimised if you leave it running.
			To perform a basic check for open ports using Nmap enter the -sT parameter and the name of the target system. $ nmap -sT seeker.rodsbooks.com.
			The -sT option only scans for TCP ports if you want to scan for UDP ports type: nmap -sU hostname.
			Scanning for UDP ports requires root privilages.

Byron at 17:03, 10 April 2011

2011-04-10T17:03:16Z

← Older revision		Revision as of 17:03, 10 April 2011
Line 132:		Line 132:
	To spot unnecessary servers you can use netstat's -a and -p options: # netstat -ap		To spot unnecessary servers you can use netstat's -a and -p options: # netstat -ap
	If a server or port is't actively connected its local and foreign address will show up with an * in place of an address.		If a server or port is't actively connected its local and foreign address will show up with an * in place of an address.
			Type netstat -ap \| less to to see a list of servers listaning for connections and servers with established connections.
			Servers that have LISTEN in the State column of output are lestening for a connection.
			Type -ap \| grep ssh to find connections involving SSH.

			=== Using lsof (page 485-486) ===

Byron at 16:56, 10 April 2011

2011-04-10T16:56:29Z

← Older revision		Revision as of 16:56, 10 April 2011
Line 116:		Line 116:
	To restart xinetd after configuring it type a similar command to this one: #/etc/rc.d/init.d/xinetd restart.		To restart xinetd after configuring it type a similar command to this one: #/etc/rc.d/init.d/xinetd restart.
	The other option to restarting xinetd is to use the kill or killall command.		The other option to restarting xinetd is to use the kill or killall command.

			=== Controlling Access via xinetd (page 481-482)
			Security is handled on a server by server basis with the use of parameters.These parameters are in either the xinetd.conf file or the server-specific configuration files. Some options are similar to the function of hosts.allow and hosts.deny.
			You can use the bind option with bind = (use a specific router number) to tell xinetd to listen to only one network interface.
			Use the only_from option to specify which computers, networks or IP address connections xinetd accepts.
			The no_access option tells xinetd which computers, networks or IP address not to accept.
			Use the access_times option to set times during which users can access the server.

			=== Disabling Unused Servers (page 483) ===
			Begin by locating unwanted servers. Several tools can be used to help do this this such as: netstat, lsof, and remote network scanners.
			You can disable servers by uninstalling the package or reconfiguring the server.

			=== Using netstat (page 483) ===
			netstat can help network activity or open ports on a computer.
			To spot unnecessary servers you can use netstat's -a and -p options: # netstat -ap
			If a server or port is't actively connected its local and foreign address will show up with an * in place of an address.