The mission of the DFWUUG is to promote interest in and an understanding of UNIX All meetings are open to the public without charge. The group meets the first Thursday of the month, with the exception of those months where the Thursday falls on or near a holiday. Everyone is cordially invited to attend. For current information, please check out the user group's web site www.dfwuug.org.
Everyday, more and more corporations are looking to implement VPN's to allow remote access for home and road workers, as well as lowering cost through elimination of dedicated access lines. When deciding which technology to utilize, an administrator can be overwhelmed. Every IT vendor suddenly seems to have some VPN offering. This presentation will examine the different VPN technologies available in the marketplace today, as well as the security risks and other factors that need to be considered when implementing VPN's. Bio: Ward Holloway is the Senior Systems Engineer for Check Point Software Technologies in the Southern Region, providing technical assistance and knowledge in the design, implementation and troubleshooting of all Check Point products, as well as speaking at security and product seminars throughout the region. Previously, he worked for Check Point's Worldwide Technical Services as a Senior Consultant, providing on-site support, training, design and installation services worldwide to Check Point partners and end users, as well as training internal groups within Check Point. Prior to joining Check Point, he worked on a two-year project for Global Integrity, implementing a worldwide security infrastructure for a major financial institution. Mr. Holloway began his career with Software Academy as a Unix System Administrator and instructor. He is currently contributing an article providing an overview of what makes up computer security to a new security website, intro2security.com.
Recently, I taught UNIX with no textbook. The only book for the whole course in basics of Unix was the O'Reilly reference "Unix in a Nutshell: A Desktop Quick Reference for SVR4 and Solaris". Nothing to teach from, so I built my own handouts, and in doing so, created my own direction. Here's what I did, and the direction in which I taught. With your knowledge of UNIX you may want to get involved in this dialogue. I am interested! 1) A very short history of Unix. We'll emphasize hand-on, not history
OK, now there's plenty of space for your comments. What am I missing, that you think one should include? Just as I find that teaching operator overloading in C++, goes best
What textbooks do you suggest for Unix? Enough for now! Email me.
A Column
Devoted to Computer Security One of the facts of computer security is there are no silver
bullets. If there were silver bullets, the movie of our lives would
go more like this: We’d load up our guns with the silver bullets.
Then we’d take a bead on the hacker werewolves. As they’re running
towards the servers with claws and fangs ready to rend them asunder,
we’d fire those silver bullets. Finding their targets, the silver
bullets would kill the hacker werewolves. The servers are saved.
The theme music swells in the background and the title credits rolls
End of movie. Unfortunately, life is not like a Hammer film. There are
no silver bullets, but there are the Golden Principles of Security.
Here they are: Golden Principle No. 1: Know Your System. Before you can
know say what is abnormal for your system, you first have to know
what is “normal.” To do that you need to know your system. Is it
normal for your main server to be spending 50 percent of its time
in kernel mode? You do a “ps –ef” of your system and there’s this
process running as root named “update-db”. Is this part of the normal
operation? Where does “update-db” come from? Who installed it and
when? You are looking through the /sbin directory and find a program
that is setgid root but you don’t recognize the program name. Should
it be there? Here’s another one: you notice lots of ICMP echo replies
destined for an IP address on the Internet without corresponding
echo requests. Is this as it should be? The answer to all of these
questions if you don’t know your system is: Beats the socks off
of me! The solution to this knotty big problem is spending time
learning what is reasonable for your system. Regularly do a “ps
–ef” and inspect the results identifying what processes are and
their source. Find what programs in /, /usr/bin, /usr/sbin, and
/sbin are setuid and setgid with the find commands such as find
/usr –perm +4000 –print respectively. Monitor your network traffic to see determine what percentage of bandwidth is consumed by the various protocols running on it. Sure, this is time consuming work, but it will keep you from feeling dump when trouble arises. Surely, that’s worth something. Golden Principle No. 2: Defense in Depth. This idea is taken from the castles of old. They didn’t just have a moat around the castle to protect them. They had a lot more. They had thick walls to prevent easy entry. They had high walls that were difficult to scale. They had turrets from which to pour boiling oil or pitch on the attackers. They had slits from which archers could fire arrows in safety. And finally they had a plan so that when they were under attack everybody knew what to do and not run around like chickens with their heads cut off. Applying this lesson to computer security: doesn’t just have a firewall to protect your network, have multiple layers of defense. Augment your firewall by adding filtering rules to your router. Harden the firewall to make it more tamper resistant. Get rid of unneeded services on the internal systems that serve as attack points for intruders. Improve the security of the systems by removing setgid and setuid programs with security weaknesses. Audit the userids and remove those that have been inactive for sometime. Last but not least, have a plan in place that details who is to do what when an intrusion does occur. Golden Principle No. 3: Principle of Least Privilege. This one says, “Don’t give a program or individual more privilege that it absolutely requires.” Take for instance the Windows domain. Is it necessary for lots of individuals to be domain administrators? Absolutely not. Most times, this can be taken care of by making an individual the local administrator of a machine. In the Unix domain, do lots of individuals need to know the root password? Absolutely not. Most of times, using sudo appropriately installed and configured can give individuals the privilege level that they require. Now, let’s take the case of programs. Sendmail has to be the poster child for insecure programs. The mail has to get through despite wind, rain, gloom of night, and anthrax. The solution: make a sendmail sandwich. Get smap and smapd from the Firewall Toolkit. Run these daemons around sendmail so that it never executes directly. They also can keep certain kinds of denial of service attacks out as well. Take for instance the new whipping boy, bind. There are several things you can do mitigate the risk of running bind: limit zone transfers from only well-known trusted systems, don’t run bind as root, and run it in a chroot-ed jail. Golden Principle No. 4: Protection is key but detection is a must. There are lots of attacks out there. There’s Smurf, Tribal Flood, Trinoo, Ping of Death, Fragmentation Bombs, Denial of Service, Distributed Denial of Serve, Port Scans, Stack Fingerprinting… The list goes on and on. Yes, you can protect you network against these attacks and more. You can also protect your network against being stuck by meteor, too. Rather than spending the money and time to construct a meteor defense system, wouldn’t it make more sense to have a meteor detection system? That way, when one of those errant rocks out there was headed straight for your data center your could know about it and take appropriate action. The same is true for your computer security. Protect your network from the things you can. This sets up the protection. Now set up the detection. Configure your logging to log to a central server. With all the logs in once place you can review the logs for patters. Make it sure somebody reviews the logs at least once a week. To make log review easier, set up a timeserver and synchronize all the systems in the network to the same time. With this done, log analysis is greatly simplified. You might also see some NFS strangeness go away when all the systems have the same time. Install and configure an intrusion detection system to let you know when an attack is in progress. There are many commercially available intrusion detection systems. A good free intrusion detection system is Snort. Get one and use it. Knowing a meteor is approaching is better than worrying “Have I made the walls thick enough?”
Here is the DFWUUG
program schedule to date:
The Linux SIG will have a real live demonstration of SmoothWall,
the Open Source firewall and VPN (Virtual Private Network) gateway
(http://www.smoothwall.org/gpl/about/)
. In the past, we've tried 2 times to demonstrate a VPN, but have
failed miserably. SmoothWall should be our answer and we'll give it
one more try. In addition, Jeff Rush will demonstrate how to hack an internet phone appliance. It should be alot of fun and I look forward to seeing you there. -Greg
TBA
********************************************************************** O'Reilly User Group Program members receive 20% discount on conference prices. Register early--limited space is available. Please use the discount code *DSUG* when registering. This discount is meant for use by your current UG members only. If posting information about this conference on your website, please do not include discount information. For more details or brochures, please contact Denise Olliffe, deniseo@oreilly.com or 707-829-0515 ext 339. ********************************************************************** O'Reilly is a registered trademark of O'Reilly & Associates, Inc. All other trademarks are property of their respective owners.
UNIX shell differences and how to change your shell
Want to write a program for your PALM.
PERL -- Practical Extraction and Report Language
DFWUUG Members, BOOK EXCHANGE
The question is, or how do you recycle those technical books and journals
you never read anymore? The answer is, bring them to the next DFWUUG
meeting and put them on display so members can browse through them and
take home whatever is of interest. There is no monetary reward but you
may find something you want and your stuff may get recycled through
another great mind. Due to storage limitations, please be prepared to
take you leftover stuff home with you afterward. Otherwise it will be
sent to the trash. Think of it as a form of spring house cleaning.
There is a new mail list for the DFW Unix Users Group:
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
