212.4. Security tasks

Weight: 3

Description: Candidates should be able to receive security alerts from various sources, install, configure and run intrusion detection systems and apply security patches and bugfixes.

Key Knowledge Areas:

  • Tools and utilities to scan and test ports on a server

  • Locations and organizations that report security alerts as Bugtraq, CERT or other sources

  • Tools and utilities to implement an intrusion detection system (IDS)

  • Awareness of OpenVAS and Snort

Terms and Utilities:

  • telnet

  • nmap

  • fail2ban

  • nc

  • iptables

Talking about Linux security can be subject of a full course. Many Linux Security titles are covered in LPIC3 303 exam but for now we just discuss about what we are required to pass LPIC2 exam.

What we can do for system security?

Updates :

We should keep our system(s) updated. Daily updates is recommended but in busy production environment it might be posteponed. Do not forget updates, keeping our critical remote access systems updated weekly is a must. Subscribing to third party systems that can provide security information is also important

Monitoring

We can gain valuable information of our system by doing periodic manual audits, but that is not something we can always rely on. Having automated monitoring of key systems is a must.

Security tools

There are some embeded security tool, some of them are free and some others cost mony.

  • nmap

  • nc

  • telnet

  • iptables

  • fail2ban

  • snort

  • openVAS

Lets start with updates and where we can gain information about lates Security Vulnerability and issues.There are some websites and organizations which we can gain valuable information from them:

CERT (http://www.cert.org)

  • Computer Emergency response Team (specifically the CERT Coordination Center or CRET-CC is located at Carnegie Mellon University )

  • Provides tools for vulnerability assessments and analysis including comprehensive list of known vulnerabilities and attack vectors.

  • Often found working with goverments organizations or private institutions regarding computer security policy issues.

US-CERT (http://www.us-cert.gov)

  • United States- Computer Emergency Response Team

  • Provides classified governments responses to computer security incidents.

  • Works with the CERT-CC on computer policy issues.

BugTraq (mailing list hosted by http://www.securityfocous.com)

  • this is a subscription based e-mail list.

  • Created and paid for by the Security Focous Organization.

  • This list is a moderated (and very detailed list) for the discussion of (and announcements of new) security vulnerabilities.

  • This list provides details on vulnerabilities as they are discovered and reported, including what is affected (versions, types, devices and operating systems), what the vulnerability is and any known attack vectors.

We have already talked about nmap and nc in previous courses, so lets just have a quick review of them here and show some related examples of them.

nc

netcat (or nc in short) is a powerful and easy-to-use utility that can be employed for just about anything in Linux in relation to TCP, UDP, or UNIX-domain sockets.

We have used it to: open TCP connections, listen on arbitrary TCP and UDP ports, send packets, and port scanning which we review here.

By using netcat we can check if a single or multiple or a range of open ports exist in our system(We use Ubuntu16.04 here):

-zsets nc to simply scan for listening daemons, without actually sending any data to them. -v enables verbose mode. netcat can be used for port scanning under both IPv4 and IPv6 protocols.

nmap

We have discussed about nmap but as a review, nmap is an open source and a very usefull tool for Linux system/network administrators. Nmap is used for exploring networks, perform security scans, network audit and finding open ports on remote machine. It scans for Live hosts, Operating systems, packet filters and open ports running on remote hosts.

-v option is giving more detailed information about the remote machine.-r Scan Ports Consecutively and doesn’t randomize.

telnet

Telnet is a user command and an underlying TCP/IP protocol for accessing remote computers. Through Telnet, an administrator or another user can access someone else's computer remotely. On the Web, HTTP and FTP protocols allow us to request specific files from remote computers, but not to actually be logged on as a user of that computer. With Telnet, we log on as a regular user with whatever privileges you may have been granted to the specific application and data on that computer.

Telnet is one of the earliest remote login protocols on the Internet. It was initally released in the early days of IP networking in 1969, and was for a long time the default way to access remote networked computers. It is a client-server protocol that provides the user a terminal session to the remote host from the telnet client application. Since the protocol provides no built-in security measures, it suffers from serious security issues that have limited its usefulness in environments where the network cannot be fully trusted. The use of Telnet over the public Internet should be avoided due to the risk of eavesdropping.

The most usage of telnet command is for testing perposes:

TELNET security problems

The Telnet session between the client and the server is not encrypted. Anyone with access to the TCP/IP packet flow between the communicating hosts can reconstruct the data that flows between the endpoints and read the messaging, including the usernames and passwords that are used to log in to the remote machine. This network attack requires very little expertise and can be performed with network debugging tools that are readily available.

Packet sniffing attacks like the above were the underlying reason for developing SSH, and they were the most common security problem on the Internet already in the mid-1990s.

replace insecureTELNET with secure shell(SSH)

SSH (Secure Shell) provides a secure alternative to Telnet. SSH protects user identities, passwords, and data from network snooping attacks, and allows secure logins and file transfers.

SSH has practically replaced Telnet, and the older protocol is used these days only in rare cases to access decades old legacy equipment that does not support more modern protocols. And there are still organizations that simply do not care about security.

For Unix and Linux operating systems, the OpenSSH implementation comes free with the operating system and can be used to replace Telnet.(see the previous course).

fail2ban

Fail2ban is a log-parsing application that monitors system logs for symptoms of an automated attack on our server. When an attempted compromise is located, using the defined parameters, Fail2ban will add a new rule to iptables to block the IP address of the attacker, either for a set amount of time or permanently. Fail2ban can also alert us Fail2ban is primarily focused on SSH attacks, although it can be further configured to work for any service that uses log files and can be subject to a compromise.through email that an attack is occurring.

Fail2ban is primarily focused on SSH attacks, although it can be further configured to work for any service that uses log files and can be subject to a compromise. Lets install it (Ubuntu):

fail2ban configuration files

The fail2ban service keeps its configuration files in the/etc/fail2bandirectory.

Fail2ban reads .conf configuration files first, then.localfiles override any settings. Because of this, all changes to the configuration are generally done in .localfiles, leaving the .conf files untouched.

Configure fail2ban.local

fail2ban.conf contains the default configuration profile. The default settings will give us a reasonable working setup. If we want to make any changes, it’s best to do it in a separate file,fail2ban.local, which overridesfail2ban.conf. Rename a copyfail2ban.conftofail2ban.local.

Configuring jail.local Settings

Thejail.conffile will enable Fail2ban for SSH by default for Debian and Ubuntu, but not CentOS. All other protocols and configurations (HTTP, FTP, etc.) are commented out. If we want to change this, we should create ajail.localfor editing:

as jail.conf has is a big configuration file, we just take a look at general configurations and ssh related ones:

Ban Time and Retry Amount:

  • ignoreip : To ignore specific IPs, add them to theignoreipline. By default, this command will not ban the localhost

  • bantime: The length of time in seconds for which an IP is banned. If set to a negative number, the ban will be permanent. The default value of600is set to ban an IP for a 10-minute duration.

  • findtime: The length of time between login attempts before a ban is set. For example, if Fail2ban is set to ban an IP after five (5) failed log-in attempts, those 5 attempts must occur within the set 10-minutefindtimelimit. Thefindtimevalue should be a set number of seconds.

  • maxretry: How many attempts can be made to access the server from a single IP before a ban is imposed. The default is set to 3.

email alerts:

  • destemail: The email address where you would like to receive the emails.

  • sendername: The name under which the email shows up.

  • sender: The email address from which Fail2ban will send emails.

Service specified Jail Configurations

  • enabled: Determines whether or not the filter is turned on.

  • port: The port Fail2ban should be referencing in regards to the service. If using the default port, then the service name can be placed here. If using a non-traditional port, this should be the port number. For example, if we move our SSH port to 3456, ew would replacesshwith3456.

  • filter: The name of the file located in/etc/fail2ban/filter.dthat contains the failregex information used to parse log files appropriately. The.confsuffix need not be included.

  • logpath: Gives the location of the service’s logs.

  • maxretry: Will override the globalmaxretryfor the defined service.findtimeandbantimecan also be added.

  • action: This can be added as an additional setting, if the default action is not suitable for the jail. Additional actions can be found in theaction.dfolder.

Failregexs

Although Fail2ban comes with a number of filters, you may want to further customize these filters or create your own to suit your needs. Fail2ban uses regular expressions (regex) to parse log files, looking for instances of attempted break-ins and password failures. Fail2ban uses Python’s regex extensions.

as you can there are sshd.conf and sshd-ddos.conf which are related to ssh service. Lets chek it in action, we ssh to ubuntu server1 from buntu server2 and enter many bad passwords:

Wow lets see what fail2ban has been done:

Firewall vs IDS vs IPS

What is difference?

Firewall- A device or application that analyzes packet headers and enforces policy based on protocol type, source address, destination address, source port, and/or destination port. Packets that do not match policy are rejected.

Intrusion Detection System (IDS)- A device or application that analyzes whole packets, both header and payload, looking for known events. When a known event is detected a log message is generated detailing the event.

Intrusion Prevention System (IPS)- A device or application that analyzes whole packets, both header and payload, looking for known events. When a known event is detected the packet is rejected.

Now lets talk about some other security tools, openVAS and snort:

OpenVAS (Open Vulnerability Assessment System) is a suite of tools that provide information on vulnerabilities and provide various levels of alerting when discovered. Good news is that All OpenVAS products are free software, and most components are licensed under the GNU General Public License(GPL).

  • Uses a database (constantly updated) of know vulnerability for varous remote tools and remote acess applications.

  • Identifies and reports on security holes that are known or discovered in our environment.

  • test configuration settings for security issues and highlights changes to make.

  • Commercially available and supported.

Snort is a free open source network intrusion detection system (IDS)created by Martin Roesch in 1998. Snort is now developed by Sourcefireand and bad news is that it has been owned by Cisco since 2013 .The means we have to pay for signature files.

  • Snort Can help to determine when someone/something is "probing" our system for vulnerabilities, or attacking with known vectors.

  • Network traffic analysis is used in real time (called 'sniffing') to determine if/when attacks are occurring.

  • Snort can be configured in three main modes:

  • sniffer

  • packet logger

  • network intrusion detection.

    In sniffer mode, the program will read network packets and display them on the console. In packet logger mode, the program will log packets to the disk. In intrusion detection mode, the program will monitor network traffic and analyze it against a rule set defined by the user. The program will then perform a specific action based on what has been identified

A good alternative free open source for snort is Suricata.

Previous212.3 Secure shell (SSH)Next212.5. OpenVPN

Last updated