Windows Desktop Security Assign a good & difficult administrator password. Don’t ever enable the password remember option. If a machine is cracked/lost, change all passwords. Use & update Anti-virus s/w (e.g. AVG) regularly

Set up automatic updating on a regular basis Schedule Virus Scans automatically.

Use Good spy removal software Microsoft antispy or Spybot destroyer

Take the backup of Registry. Run regedit Control Panel Add / Rem S/w remove

my Search Bar, Date manager weather tool, Bonzy Buddy etc,

Windows Desktop Security Keep OS up to date

Visit http://windowsupdate.microsoft.com regularly Start Settings Control Panel Automatic Updates Install & run 'Critical Update Notification' patch.

Automatically checks and notifies about patches. Keep your applications updated:

Update Web browsers and word processing applns. Decide if the upgrade is appropriate for your h/w.

Backup your files: Have critical files on any machine which is backed

up. Back up the entire system on a regular basis.

WDS - Risk of File Sharing Reduce sharing files thru floppies. Don’t open doubtful (.scr,.pif,.exe) attachments in

mails. Accessing a file over a n/w neighborhood. Keep physical control of m/c & limit access to your

system Disable File and Print sharing button

Control Panel N/w LAN Prop F & P Sharing Don't ever share the entire C: drive.

Share only the folder having files to be shared. Establish a good password for shared access.

Enable sharing on IPX/SPX protocol instead of TCP/IP. N/w Prop F&P Shg Install Protocol IPX N/w Prop Advanced Advanced Settings

Adapters & Bindings F&P Shg IPX/SPX http://www.tifr.res.in/~cc/ipx.htm

Windows Desktop Security DO NOT say yes to all questions while browsing. Use Personal firewalls :

Norton internet security, Zone Alarm or Sygate personal firewall etc

Check what all Ports your PC is listening. Usually 10-15 TCP/UDP ports will be listening. Unusual: Series of high no. ports opening to

some particular IP Sign of Virus/Spy Remove the application not installed by

you. Download and run Microsoft's BSA Ref: Google ”Securing windows”

C:\>netstat -an |more

Proto Local Address Foreign Address State TCP 0.0.0.0:7 0.0.0.0:0

LISTENING TCP 0.0.0.0:9 0.0.0.0:0

LISTENING TCP 0.0.0.0:13 0.0.0.0:0

LISTENING TCP 0.0.0.0:17 0.0.0.0:0

LISTENING TCP 0.0.0.0:19 0.0.0.0:0

LISTENING TCP 0.0.0.0:135 0.0.0.0:0

LISTENING TCP 0.0.0.0:1025 0.0.0.0:0

LISTENING TCP 0.0.0.0:1035 0.0.0.0:0

LISTENING TCP 0.0.0.0:1730 0.0.0.0:0

LISTENING TCP 0.0.0.0:1731 0.0.0.0:0

LISTENING TCP 0.0.0.0:5000 0.0.0.0:0

LISTENING TCP 127.0.0.1:1027 0.0.0.0:0

LISTENING TCP 127.0.0.1:1031 0.0.0.0:0

LISTENING TCP 127.0.0.1:10110 0.0.0.0:0

LISTENING

Proto Local Address Foreign Address State

UDP 0.0.0.0:7 *:* UDP 0.0.0.0:9 *:* UDP 0.0.0.0:13 *:* UDP 0.0.0.0:17 *:* UDP 0.0.0.0:19 *:* UDP 0.0.0.0:500 *:* UDP 0.0.0.0:1028 *:* UDP 0.0.0.0:1029 *:* UDP 0.0.0.0:1058 *:* UDP 0.0.0.0:1289 *:* UDP 127.0.0.1:123 *:* UDP 127.0.0.1:1900 *:* UDP 127.0.0.1:2282 *:* UDP 158.144.49.8:123 *:* UDP 158.144.49.8:1900 *:*

Active Connections

Overview

Advantage Linux Threats to Linux machines. Securing Linux better.

Advantage Linux User vs. administrator Only root can install software or change

system settings. More difficult for viruses to spread. Commands, utilities, even the desktop

run separately from the Kernel. Security updates are easier, quicker to

deploy.

Threats to Linux machines

Reasons for Break-in. Loose Passwords Improper Permissions Careless Security Unwanted Vulnerable Services Brute force password attacks

Buffer overflows in network services. int main () {int buffer[10]; buffer[20]=10;} Aim: overwrite some control information to

change the flow of control in the program.

Securing Linux

1. Secure the console 2. Set good passwords 3. Set right permissions4. Secure the network connection5. Restrict Access6. Iptables 7. Firewalls, Ports & Services8. Handling / Restricting Services9. Adding security to desktop10. Keep the system up to date

Securing the console Physical Security

Password protect the screensaver. Set a password on the boot loader (lilo / grub). Use xlock or xautolock while away. Do NOT normally login as root in own machine. Set BIOS Password. Machine in safe location. Set boot hierarchy to HDD first (not CD,HDD).

Restrict Remote access. Set up an idle timeout, to logout idle users.

Passwords

Use strong, unique passwords (especially for root) Must have a minimum length of 8 characters. Must be alpha-numeric not based on dictionary

words. Password must be changed every 30 days. Account will be locked out after 3 consecutive

unsuccessful login attempts. Don’t write down passwords or User-id &

password. Passwords must contain multiple characters

(Lower / Upper Case, numbers, punctuation etc.) Root password should be very hard to crack.

Permissions Correct permissions & ownerships on all directories &

files. Never make files world-writable / world readable. Search for world-writable files in pwd find . -perm -2 -print Improper file permissions in /dev : read/write directly

to hardware like hard disks and network interfaces. /dev files should only be writable by root & readable

only by their group Exception : /dev/tty, /dev/pty, /dev/null, /dev/zero. find /dev -perm -2 -print chmod -R 700 /etc/rc.d/init.d/* Lock the /etc/services file so that no one can modify it

Securing the Network Remove all unwanted users and groups. Enable nospoof option in /etc/host.conf. Don't create /etc/hosts.equiv or a .rhosts file Don't run rlogind or rshd. (pw in plain text) Run sshd to allow remote access via SSH Use TCP Wrappers “tcpd” Use /etc/hosts.deny & /etc/hosts.allow hosts.allow overrides hosts.deny Disable unwanted services thru xinetd.conf also Ref: man hosts_access

http://linux.about.com/od/commands/l/blcmdl5_hostsal.htm

http://www.userlocal.com/security/securinginetdetc.php

More of /etc/access.[allow|deny] /etc/hosts.deny

Only Local host allowed access ALL:ALL

/etc/hosts.allow sshd: ALL @.tifr.res.in ALL: .tifr.res.in EXCEPT xyz.tifr.res.in Allow localhost ALL : 127.0.0.1 Allow another m/c to connect to any service ALL : 192.168.1.2 Let all ssh except 192.168.1.3 and 192.168.1.4 sshd: ALL EXCEPT 192.168.1.3, 192.168.1.4

Firewalls Hardware firewall - A device between Internet & LAN. Software firewall: Software on a desktop/server that

rejects certain types of network traffic. Consider implementing a firewall. man iptables Restrict n/w traffic to a machine or network segment. Improves security and network performance. Why do I need a software firewall? Protects the m/c even if the h/w firewall is

compromised. Protects the m/c against compromised m/c s on n/w. When can't one use a firewall? Some services (like Samba) may use unspecified

ports. Some applications want to use arbitrary ports.

Iptables

System Settings > Security Level System Settings > Server Settings >

Services Activate iptables in runlevels 3 & 5 Chains: INPUT, OUTPUT,FORWARD. Effects : ACCEPT, DENY, DROP List all iptables rules # iptables –L # iptables -A INPUT -s <SIP> -j DROP # iptables -D <Chain name> <Rule no>

Iptables (Contd…) Drop all incoming telnet packets # iptables -A INPUT -j DROP -p tcp --destination-port

telnet Block any incoming tcp packets on 2nd Eth card (eth1) # iptables -A INPUT -j DROP -p tcp -i eth1 Drop incoming sync ie. anything not initiated by our PC # iptables -A INPUT -p tcp --syn -j DROP Block by mac address iptables -A INPUT --mac-source 00:0B:DB:45:56:42 -j

DROP Ref:

http://www.cae.wisc.edu/site/public/?title=liniptables http://www.redhat.com/docs/manuals/enterprise/

RHEL 4 Manual/ref guide/ch iptables.html

Ports What are ports?

Network connection analogous to a lane highway. Each type of traffic needs to be in its own lane A port is analogous to a lane on the highway;

different types of traffic (http, ftp, ssh, etc.) use different ports (80,21,22 etc)

What ports need to be open? Open the ports for services you need to use and/or

offer others. SSH (remote access to your machine): 22 FTP (file sharing server): 21 Web server: 80 X (display graphics on remote machines): 6000 See /etc/services for an exhaustive list. Close unused ports/terminate unwanted

services.

Services / Daemons Services : Special applications that start before any login

Web server (httpd or Apache) File services (samba, NFS, ftpd) Print services (lpd, CUPS) Remote access (telnetd, sshd, vncserver) Management tools (crond, rhnsd)

Why can services be dangerous? Many services offer themselves to local & remote m/c s If a flaw exists in the program providing the service, an

attacker can exploit this flaw and break into the machine

RULE: don't run any services you don't need. RULE: if you're running a service, restrict access

possible.

Handling Services How services work ?

1 -- single user mode 2 -- multi-user without networking 3 -- normal multi-user text mode 4 -- custom runlevel, not normally used 5 -- normal multi-user, graphical desktop

Default level is chosen in /etc/inittab How are Services started ?

/etc/inittab (startup configuration file) /etc/rc.d/rc.sysinit (configuration file) /etc/rc.d/rcN.d

xinetd (service that starts network services as u need)

Identify running services using redhat config services OR /usr/sbin/ntsysv OR /sbin/chkconfig list

Restricting Services What services are unnecessary & how to stop ?

Use ssh instead of the r* services (rlogin, rsh, etc.) telnet, ftp, NFS related services (portlock, nfslock,

netfs) Substitute for ftp -- use scp and sftp sendmail – can use SMTP server

(mailhost.tifr.res.in) redhat config services : Highlight service & Stop Uncheck the service not required for each run level. Use /usr/sbin/ntsysv OR /etc/rc.d/init.d/servicename stop OR /sbin/chkconfig service off commands. Secure each service using its configuration files.

Adding Security to Desktop Prevent remote root login.

Login as a real user and then su to root. /etc/securetty has no entry starting "ttyp" / "pts". /etc/sshd_config change PermitRootLogin "no". Insert StrictHostKeycheck in /etc/sshd_config.

Turn off / uninstall all unwanted services chkconfig --list | grep on

Turn off boot time “ON” of unwanted services e.g.: exec, finger, ftp, httpd, login, lpd, nfs, ntalk, rexd,

sendmail, shell, talk, telnet, tftp, uucp etc chkconfig uucp off

Use SSH rather than the "r*" commands ssh -l id remotehost : secure remote login (rlogin / telnet). ssh -l id remotehost command :issue remote command

(rsh). scp localfile id@remotehost:remotefile : secure copy

(rcp).

Adding Security to Desktop (Contd..) Disable unwanted suid and sgid files

find -type -perm -04000 -o perm 02000. Eg.: gpasswd, wall, and traceroute Install sxid to keep an eye on suid and sgid scripts.

http://linux.cudeso.be/linuxdoc/sxid.php Install libsafe

Protects against Buffer Overflow Attacks in Process stacks

Install tmpwatch to delete the unused files from /tmp Check for unwanted scripts in /root, /usr/local,

/var/spool/mbox.

Adding Security to Desktop (Contd..) Check your machine's uptime: uptime

Linux doesn't crash or reboot under normal conditions. If rebooted, try to find out the actual reason behind it

Take regular backups Use rpm -Va to find out if an rpm is modified. Apply security patches / upgrade vulnerable software

patch -p1 < patch file Check system logs (eg: /var/log/messages, /var/log/secure) Detect Intrusions with proper tools

Use Tripwire / aide to detect unauthorized changes to files.

System logs should be checked regularly for any trouble. Install a log-checking tool. Freeware: webalizer, awstats

Do penetration test with tools like nessus, nikto, and nmap and see how well your machine is secured.

System up2date Install system updates as soon as they become

available. Register system with RedHat N/w:

/usr/sbin/rhn_register Config up2date :: up2date-config update up2date itself :: up2date u up2date Update a package using up2date u “packagename” Updating Everything :: up2date update Create a cron job to run up2date every night. # mkdir /redhat to mount the Red Hat mirror. Automount redhat mirror at boot in /etc/fstab linuxserver:/redhat /redhat nfs intr, bg 0 0 Run script /usr/sbin/getupdates in crontab Monday

midnight 0 0 * * 1 /usr/sbin/getupdates 0 min 0 hr All months