Windows Desktop Security n n n n Assign

Windows Desktop Security n n n n Assign a good & difficult administrator password. Don’t ever enable the password remember option. If a machine is cracked/lost, change all passwords. Use & update Anti-virus s/w (e. g. AVG) regularly q Set up automatic updating on a regular basis q Schedule Virus Scans automatically. Use Good spy removal software q Microsoft antispy or Spybot destroyer Take the backup of Registry. Run regedit Control Panel Add / Rem S/w remove q my Search Bar, Date manager q weather tool, Bonzy Buddy etc,

Windows Desktop Security n n n Keep OS up to date q Visit http: //windowsupdate. microsoft. com regularly q Start Settings Control Panel Automatic Updates q Install & run 'Critical Update Notification' patch. n Automatically checks and notifies about patches. Keep your applications updated: q Update Web browsers and word processing applns. q Decide if the upgrade is appropriate for your h/w. Backup your files: q Have critical files on any machine which is backed up. q Back up the entire system on a regular basis.

WDS - Risk of File Sharing n n n n n Reduce sharing files thru floppies. Don’t open doubtful (. scr, . pif, . exe) attachments in mails. Accessing a file over a n/w neighborhood. Keep physical control of m/c & limit access to your system Disable File and Print sharing button q Control Panel N/w LAN Prop F & P Sharing Don't ever share the entire C: drive. q Share only the folder having files to be shared. q Establish a good password for shared access. Enable sharing on IPX/SPX protocol instead of TCP/IP. N/w Prop F&P Shg Install Protocol IPX N/w Prop Advanced Settings Adapters & Bindings F&P Shg IPX/SPX http: //www. tifr. res. in/~cc/ipx. htm

Windows Desktop Security n n n n DO NOT say yes to all questions while browsing. Use Personal firewalls : q Norton internet security, q Zone Alarm or q Sygate personal firewall etc Check what all Ports your PC is listening. Usually 10 -15 TCP/UDP ports will be listening. Unusual: Series of high no. ports opening to some particular IP Sign of Virus/Spy Remove the application not installed by you. Download and run Microsoft's BSA Ref: Google ”Securing windows”

C: >netstat -an |more Active Connections Proto TCP TCP TCP TCP Local Address Foreign Address 0. 0: 7 0. 0: 0 0. 0: 9 0. 0: 0 0. 0: 13 0. 0: 0 0. 0: 17 0. 0: 0 0. 0: 19 0. 0: 0 0. 0: 135 0. 0: 0 0. 0: 1025 0. 0: 0 0. 0: 1035 0. 0: 0 0. 0: 1730 0. 0: 1731 0. 0: 0 0. 0: 5000 0. 0: 0 127. 0. 0. 1: 1027 0. 0: 0 127. 0. 0. 1: 1031 0. 0: 0 127. 0. 0. 1: 10110 0. 0: 0 State LISTENING LISTENING LISTENING LISTENING Proto UDP UDP UDP UDP Local Address Foreign Address State 0. 0: 7 *: * 0. 0: 9 *: * 0. 0: 13 *: * 0. 0: 17 *: * 0. 0: 19 *: * 0. 0: 500 *: * 0. 0: 1028 *: * 0. 0: 1029 *: * 0. 0: 1058 *: * 0. 0: 1289 *: * 127. 0. 0. 1: 123 *: * 127. 0. 0. 1: 1900 *: * 127. 0. 0. 1: 2282 *: * 158. 144. 49. 8: 123 *: * 158. 144. 49. 8: 1900 *: *

Overview n n n Advantage Linux Threats to Linux machines. Securing Linux better.

Advantage Linux n n n User vs. administrator Only root can install software or change system settings. More difficult for viruses to spread. Commands, utilities, even the desktop run separately from the Kernel. Security updates are easier, quicker to deploy.

Threats to Linux machines n n Reasons for Break-in. q Loose Passwords q Improper Permissions q Careless Security q Unwanted Vulnerable Services q Brute force password attacks Buffer overflows in network services. q int main () {int buffer[10]; buffer[20]=10; } q Aim: overwrite some control information to change the flow of control in the program.

Securing Linux 1. 2. 3. 4. 5. 6. 7. 8. 9. 10. Secure the console Set good passwords Set right permissions Secure the network connection Restrict Access Iptables Firewalls, Ports & Services Handling / Restricting Services Adding security to desktop Keep the system up to date

Securing the console n n n Physical Security q Password protect the screensaver. q Set a password on the boot loader (lilo / grub). q Use xlock or xautolock while away. q Do NOT normally login as root in own machine. q Set BIOS Password. q Machine in safe location. q Set boot hierarchy to HDD first (not CD, HDD). Restrict Remote access. Set up an idle timeout, to logout idle users.

Passwords n n Use strong, unique passwords (especially for root) q Must have a minimum length of 8 characters. q Must be alpha-numeric not based on dictionary words. q Password must be changed every 30 days. q Account will be locked out after 3 consecutive unsuccessful login attempts. q Don’t write down passwords or User-id & password. q Passwords must contain multiple characters (Lower / Upper Case, numbers, punctuation etc. ) Root password should be very hard to crack.

Permissions n n n n n Correct permissions & ownerships on all directories & files. Never make files world-writable / world readable. Search for world-writable files in pwd find. -perm -2 -print Improper file permissions in /dev : read/write directly to hardware like hard disks and network interfaces. /dev files should only be writable by root & readable only by their group Exception : /dev/tty, /dev/pty, /dev/null, /dev/zero. find /dev -perm -2 -print chmod -R 700 /etc/rc. d/init. d/* Lock the /etc/services file so that no one can modify it

Securing the Network n n n n n Remove all unwanted users and groups. Enable nospoof option in /etc/host. conf. Don't create /etc/hosts. equiv or a. rhosts file Don't run rlogind or rshd. (pw in plain text) Run sshd to allow remote access via SSH Use TCP Wrappers “tcpd” Use /etc/hosts. deny & /etc/hosts. allow overrides hosts. deny Disable unwanted services thru xinetd. conf also Ref: man hosts_access q q http: //linux. about. com/od/commands/l/blcmdl 5_hostsal. htm http: //www. userlocal. com/security/securinginetdetc. php

More of /etc/access. [allow|deny] n n /etc/hosts. deny q Only Local host allowed access q ALL: ALL /etc/hosts. allow q sshd: ALL @. tifr. res. in q ALL: . tifr. res. in EXCEPT xyz. tifr. res. in q Allow localhost q ALL : 127. 0. 0. 1 q Allow another m/c to connect to any service q ALL : 192. 168. 1. 2 q Let all ssh except 192. 168. 1. 3 and 192. 168. 1. 4 q sshd: ALL EXCEPT 192. 168. 1. 3, 192. 168. 1. 4

Firewalls n n n Hardware firewall - A device between Internet & LAN. Software firewall: Software on a desktop/server that rejects certain types of network traffic. Consider implementing a firewall. man iptables Restrict n/w traffic to a machine or network segment. Improves security and network performance. Why do I need a software firewall? Protects the m/c even if the h/w firewall is compromised. Protects the m/c against compromised m/c s on n/w. When can't one use a firewall? Some services (like Samba) may use unspecified ports. Some applications want to use arbitrary ports.

Iptables n n n n n System Settings > Security Level System Settings > Server Settings > Services Activate iptables in runlevels 3 & 5 Chains: INPUT, OUTPUT, FORWARD. Effects : ACCEPT, DENY, DROP List all iptables rules # iptables –L # iptables -A INPUT -s -j DROP # iptables -D

Iptables (Contd…) n n n n n Drop all incoming telnet packets # iptables -A INPUT -j DROP -p tcp --destination-port telnet Block any incoming tcp packets on 2 nd Eth card (eth 1) # iptables -A INPUT -j DROP -p tcp -i eth 1 Drop incoming sync ie. anything not initiated by our PC # iptables -A INPUT -p tcp --syn -j DROP Block by mac address iptables -A INPUT --mac-source 00: 0 B: DB: 45: 56: 42 -j DROP Ref: q http: //www. cae. wisc. edu/site/public/? title=liniptables q http: //www. redhat. com/docs/manuals/enterprise/RHE L 4 Manual/ref guide/ch iptables. html

Ports n n What are ports? q Network connection analogous to a lane highway. q Each type of traffic needs to be in its own lane q A port is analogous to a lane on the highway; different types of traffic (http, ftp, ssh, etc. ) use different ports (80, 21, 22 etc) What ports need to be open? q Open the ports for services you need to use and/or offer others. q SSH (remote access to your machine): 22 q FTP (file sharing server): 21 q Web server: 80 q X (display graphics on remote machines): 6000 q See /etc/services for an exhaustive list. q Close unused ports/terminate unwanted services.

Services / Daemons n n n Services : Special applications that start before any login q Web server (httpd or Apache) q File services (samba, NFS, ftpd) q Print services (lpd, CUPS) q Remote access (telnetd, sshd, vncserver) q Management tools (crond, rhnsd) Why can services be dangerous? q Many services offer themselves to local & remote m/c s q If a flaw exists in the program providing the service, an attacker can exploit this flaw and break into the machine q RULE: don't run any services you don't need. q RULE: if you're running a service, restrict access possible.

Handling Services n n n How services work ? q 1 -- single user mode q 2 -- multi-user without networking q 3 -- normal multi-user text mode q 4 -- custom runlevel, not normally used q 5 -- normal multi-user, graphical desktop Default level is chosen in /etc/inittab How are Services started ? q /etc/inittab (startup configuration file) q /etc/rc. d/rc. sysinit (configuration file) q /etc/rc. d/rc. N. d xinetd (service that starts network services as u need) Identify running services using redhat config services OR /usr/sbin/ntsysv OR /sbin/chkconfig list

Restricting Services n What services are unnecessary & how to stop ? q Use ssh instead of the r* services (rlogin, rsh, etc. ) q telnet, ftp, NFS related services (portlock, nfslock, netfs) q Substitute for ftp -- use scp and sftp q sendmail – can use SMTP server (mailhost. tifr. res. in) q redhat config services Highlight service & Stop : q Uncheck the service not required for each run level. q Use /usr/sbin/ntsysv OR q /etc/rc. d/init. d/servicename stop OR q /sbin/chkconfig service off commands. q Secure each service using its configuration files.

Adding Security to Desktop n n Prevent remote root login. q Login as a real user and then su to root. q /etc/securetty has no entry starting "ttyp" / "pts". q /etc/sshd_config change Permit. Root. Login "no". q Insert Strict. Host. Keycheck in /etc/sshd_config. Turn off / uninstall unwanted services q chkconfig --list | grep on Turn off boot time “ON” of unwanted services q e. g. : exec, finger, ftp, httpd, login, lpd, nfs, ntalk, rexd, sendmail, shell, talk, telnet, tftp, uucp etc q chkconfig uucp off Use SSH rather than the "r*" commands q ssh -l id remotehost : secure remote login (rlogin / telnet). q ssh -l id remotehost command : issue remote command (rsh). q scp localfile id@remotehost: remotefile : secure copy (rcp).

Adding Security to Desktop (Contd. . ) n Disable unwanted suid and sgid files q find -type -perm -04000 -o perm 02000. q Eg. : gpasswd, wall, and traceroute q Install sxid to keep an eye on suid and sgid scripts. n n http: //linux. cudeso. be/linuxdoc/sxid. php Install libsafe q Protects against Buffer Overflow Attacks in Process stacks Install tmpwatch to delete the unused files from /tmp Check for unwanted scripts in /root, /usr/local, /var/spool/mbox.

Adding Security to Desktop (Contd. . ) n n n n Check your machine's uptime: uptime q Linux doesn't crash or reboot under normal conditions. q If rebooted, try to find out the actual reason behind it Take regular backups Use rpm -Va to find out if an rpm is modified. Apply security patches / upgrade vulnerable software q patch -p 1 < patch file Check system logs (eg: /var/log/messages, /var/log/secure) Detect Intrusions with proper tools q Use Tripwire / aide to detect unauthorized changes to files. q System logs should be checked regularly for any trouble. q Install a log-checking tool. Freeware: webalizer, awstats Do penetration test with tools like nessus, nikto, and nmap and see how well your machine is secured.

System up 2 date n n n n Install system updates as soon as they become available. Register system with Red. Hat N/w: /usr/sbin/rhn_register Config up 2 date : : up 2 date-config update up 2 date itself : : up 2 date u up 2 date Update a package using up 2 date u “packagename” Updating Everything : : up 2 date update Create a cron job to run up 2 date every night. # mkdir /redhat to mount the Red Hat mirror. Automount redhat mirror at boot in /etc/fstab linuxserver: /redhat nfs intr, bg 0 0 Run script /usr/sbin/getupdates in crontab Monday midnight 0 0 * * 1 /usr/sbin/getupdates 0 min 0 hr All months