YoLinux: Internet Server Security and Configuration Tutorial

Any computer connected to the internet will require steps and precautions to be taken to reduce the exposure to hacker threats. Web, mail and DNS servers are especially vulnerable. Large operations will hide behind a CISCO firewall for most of their protection. The server must also be made secure. This tutorial covers steps and tools which can be used to monitor and counteract hacker threats.

This tutorial will cover basic installation and configuration for: Performing A Security audit:
  • Chkrootkit: Hunt for trojan commands, worms and known exploits
  • NESSUS: Performing a network vulnerability scan/security audit of your system.
Also on this page:

Prerequisites: This tutorial assumes that a computer has Linux installed and running. See RedHat Installation for the basics. A connection to the internet is also assumed. The tasks must also be performed with the root user login and password.

The computer is most vulnerable to attack through network exploits. This tutorial covers detection and protection.

Basic Security Steps / Overview:

Perform the following steps to secure your web site:

SSH: (Secure Shell)

SSH protocol suite of network connectivity tools are used to encrypt connections accross the internet. SSH encrypts all traffic including logins and passwords to effectively eliminate network sniffing, connection hijacking, and other network-level attacks. In a regular telnet session the password is transmitted across the Internet unencrypted.

SSH is a commercial product but available freely for non-commercial use from SSH Communications Security at http://www.ssh.com/. Two versions are available, SSH1 and SSH2. The newer SSH2 supports FTP and has more options than SSH1. SSH2 can be purchased and/or downloaded from their web site. Note that SSH1 does have a major vulnerability issues. The "woot-project" web site cracking and defacing gang uses this vulnerability. DO NOT USE SSH1 PROTOCOL!!!!! Summary of SSH1 issues and what to avoid. ("woot-project" exploit/attack description/recovery)

OpenSSH was developed by the the OpenBSD Project and is freely available. OpenSSH is compatable with SSH1 and SSH2. OpenSSH relies on the OpenSSL project for the encrypted communications layer. Current releases of Linux come with OpenSSH/OpenSSL. (Comes with Red Hat Linux 7.x+)

Links:

OpenSSH:

OpenSSH Man Pages:

Other OpenSSH Links:

SSH for MS/Windows Links:

SSH Notes:

Man pages:

Documentation:

Test:

The network sniffer Ethereal was used to sniff network transmissions between the client and server for both telnet and ssh with the following results:

PortSentry:

This tool will monitor the network probes and attacks against your server. It can be configured to log and counter these probes and attacks. PortSentry can modify your /etc/hosts.deny (PAM module) file and issue IP firewall commands automatically to block hackers.

PortSentry can be loaded as an RPM but this tutorial covers compiling PortSentry from source to configure a more preferable system logging.

Note: Version 1.1 of portsentry can issue iptables, ipchains or route commands to thwart attacks. Linux Kernel 2.2 (Red Hat 6.x and 7.0) uses ipchains. Linux kernel 2.4 (Red Hat 7.1) uses iptables but can also use ipchains but NOT both. Route commands can be used by any Unix system.

Steps to install and configure portsentry:

  1. Download and unzip source code
  2. Edit include file and compile
  3. Start PortSentry
  4. Read logs

  1. Download and unzip source code:

  2. Edit include file and compile:
    cd portsentry-1.1/
    Read file README.install. It details the following:

  3. Run PortSentry for advanced UDP/TCP stealth scan detection: OR use init scripts below in next section.

  4. Check logfile for hacker attacks. See: /var/log/messages or /var/log/portsentry.log if you are logging to a dedicated file.
    Also check /etc/hosts.deny to see a list of IP addresses that PortSentry has deamed attackers.
    Check the "HISTORY_FILE" /opt/portsentry/portsentry.history

Note: Is is possible to have all logging sent to a logging daemon on a single server. This will allow the administrator to check the logs on only one server rather than individually on many.

Note on Red Hat 7.1: Red Hat Powertools 7.1 now includes portsentry 1.0. I reccomend using version 1.1 configured as above.
Powertools RPM layout:

Instead of using a firewall command (ipchains/iptables), a false route is used: /sbin/route add -host $TARGET$ gw 127.0.0.1.
My init script calls the portsentry executable twice with the apropriate command line arguments to monitor tcp and udp ports. The Red Hat 7.1 init script uses the file /etc/portsentry/portsentry.modes and a for loop in the init script to call portsentry the appropriate number of times. Their init script also recreates the portsentry.ignore file each time portsentry is started by including the IP addresses found with ifconfig and the addresses 0.0.0.0 and localhost. Persistent addresses must be placed above a line stating: Do NOT edit below this otherwise it is not included in the creation of the new file.
The Red Hat 7.1 Powertools portsentry version logs everything to /var/log/messages. My configuration avoids log clutter by logging to a separate file.

Notes on DOS (Denial of Service) possibility: If portsentry is configured to shut down an attack with firewall rules, an attacker may use this feature to slow down your machine over time by creating a huge set of firewall rules. It would require the hacker to use (or spoof) a new IP address each time. It is probably a good idea to monitor or even clear the firewall rules from time to time.

Clean-up script: /etc/cron.monthly/reset-chainrules
(-rwx------ 1 root root)
This script is run automatically once a week by cron. (The presence of this script in this directory for the Red Hat configuration makes it so) 

#!/bin/bash
# Purge and re-assign chain rules 
ipchains -F
ipchains -A input -p tcp -s 0/0 -d 0/0 2049 -y -j REJECT
ipchains -A input -p udp -s 0/0 -d 0/0 2049 -j REJECT
ipchains -A input -p tcp -s 0/0 -d 0/0 6000:6009 -y -j REJECT
ipchains -A input -p tcp -s 0/0 -d 0/0 7100 -y -j REJECT
ipchains -A input -p tcp -s 0/0 -d 0/0 515 -y -j REJECT
ipchains -A input -p udp -s 0/0 -d 0/0 515 -j REJECT
ipchains -A input -p tcp -s 0/0 -d 0/0 111 -y -j REJECT
ipchains -A input -p udp -s 0/0 -d 0/0 111 -j REJECT
ipchains -A input -j REJECT -p all -s localhost  -i eth0 -l

Also see:

Other tools to detect portscans and network based hacker attacks:

Using an init script to start and stop the portsentry program.

Init configuration: /etc/rc.d/init.d/portsentry
The init script needs to be executable: chmod a+x /etc/rc.d/init.d/portsentry
After adding the following script, enter it into the init process with the command: chkconfig --add portsentry or chkconfig --level 345 portsentry on
See YoLinux Init Tutorial for more information. 

#!/bin/bash
#
# Startup script for PortSentry
#
# chkconfig: 345 85 15
# description:  PortSentry monitors TCP and UDP ports for network attacks
#
# processname: portsentry
# pidfile: /var/run/portsentry.pid
# config: /opt/portsentry/portsentry.conf
# config: /opt/portsentry/portsentry.ignore 
# config: /opt/portsentry/portsentry.history
# config: /opt/portsentry/portsentry.blocked


# Source function library.
. /etc/rc.d/init.d/functions

# Source networking configuration.
. /etc/sysconfig/network

# Check that networking is up.
[ ${NETWORKING} = "no" ] && exit 0

# See how we were called.
case "$1" in
  start)
	echo -n "Starting portsentry: "
	daemon /opt/portsentry/portsentry -atcp 
	/opt/portsentry/portsentry -audp 
	echo
	touch /var/lock/subsys/portsentry
	;;
  stop)
	echo -n "Shutting down portsentry: "
	killproc portsentry
	echo
	rm -f /var/lock/subsys/portsentry
	rm -f /var/run/portsentry.pid
	;;
  status)
	status portsentry
	;;
  restart)
	$0 stop
	$0 start
	;;
  reload)
	echo -n "Reloading portsentry: "
	killproc portsentry -HUP
	echo
	;;
  *)
	echo "Usage: $0 {start|stop|restart|reload|status}"
	exit 1
esac

exit 0

Logrotate Configuration:

Create the following file to have your logs rotate.
File: /etc/logrotate.d/portsentry 
/var/log/portsentry.log {
    rotate 12
    monthly
    errors root@localhost
    missingok
    postrotate
        /usr/bin/killall -HUP portsentry 2> /dev/null || true
    endscript
}

Also see the YoLinux Sys Admin tutorial covering logrotate.

Tests:

Links:

Tripwire:

Tripwire monitors your file system for changes. Tripwire is used to create an initial database of information on all the system files then runs periodically (cron) to compare the system to the database.

I will cover Tripwire version 1.2-3 (Red Hat Powertools 6.2) and version 2.3.0-58 (Red Hat 7.1). Use the command tripwire --version or rpm -q tripwire to determine the version.

Red Hat 7.1 includes Tripwire as an optional package during install. Tripwire for earlier releases is available from the RedHat Powertools CD in RPM format. Upon installation it will proceed to scan your entire filesystem to create a default database of what your system looks like. (files and sizes etc) It took about ten minutes to run!

Tripwire configuration files:

Tripwire initialization:

If at any time you change the configuration file to monitor your system differently or install an upgrade (changes a whole lot of files which will "trip" tripwire into reporting all changes) you may want to generate a new database.

Cron and tripwire:

Cron runs tripwire:

Read tripwire report:

Interactive mode:

Default configuration file:

Man pages:

Tripwire 2.3.0-58:

Tripwire 1.2-3:

Also see:

CHKROOTKIT: Performing a trojan/worm/virus file scan.

Tripwire will monitor your filesystems for intrusion or addition of a file so you may determine what changes have occured on your system in sensitive areas. Chkrootkit will scan your system for known exploits, trojan commands, and worms used to compromise a system.

Download chkrootkit from http://www.chkrootkit.org. It is a shell script which should be run as root as well as a small collection of C programs.

See the README file for more info.

Note:

NESSUS: Performing a network vulnerability scan/security audit of your system.

Let me start by saying that this should only be performed on your own systems. It is considered and attack to run this against the systems of others and legal action may be taken against you for performing such an audit. This is not a scan like NMAP. NESSUS will search and locate vulnerabilities on your system by actively trying to perform known exploits against the system.

Nessus is amazingly complete and effective. In fact it is awesome!! It will identify services on your system and try to exploit them. If a vulnerability is found it will make recomendations about upgrades, configuration changes and where to find patches. It will also explain any causes for concern in detail and explain why your system is vulnerable. And that's not all! It can output reports in various formats including HTML with pie charts and bar charts!! The HTML reports will have hyperlinks to the security reports, upgrades and patches. (I'm impressed) It can scan Unix, Linux and Windows systems for vulnerabilities.

Note:

The NESSUS software is available from http://Nessus.org.
If compiling source:

It is also available in RPM form: (See http://freshrmps.net)

Running NESSUS:

Configuration file: /etc/nessus/nessusd.conf

Usefull links and resources:

Books:

"Linux Firewalls"
by Robert L. Ziegler, Carl Constaintine
ISBN #0735710996, New Riders 10/2001

This is the newer version. It includes updates on the Linux 2.4 kernel, VPN's and SSH.

Amazon.com
"Linux Firewalls"
Robert L. Ziegler
ISBN #0-7357-0900-9, New Riders 11/1999

Most complete Linux firewall/security book in publication. Covers ipchains, bind and a complete review of possible firewall configurations.

Amazon.com
"Hacking Linux Exposed"
by Brian Hatch, James B. Lee, George Kurtz
ISBN #0072127732, McGraw-Hill

From the same authors of "Hacking Exposed".

Amazon.com
"Maximum Linux Security: A Hacker's Guide to Protecting Your Linux Server and Workstation"
by Anonymous and John Ray
ISBN #0672321343, Sams

Covers not only audit and protection methods but also investigates and explains the attacks and how they work.

Amazon.com
"Network Intrusion Detection: An Analyst's Handbook"
by Stephen Northcutt, Donald McLachlan, Judy Novak
ISBN #0735710082, New Riders Publishing 		Amazon.com
"SSH, the Secure Shell : The Definitive Guide"
by Daniel J. Barrett, Richard Silverman
ISBN #0596000111, O'Reilly & Associates 		Amazon.com
"Computer Security Incident Handling Step by Step"
by Stephen Northcutt
ISBN #0967299217 		Amazon.com

Return to http://YoLinux.com home page
Return to YoLinux Tutorial Index

Copyright © 2001 by Greg Ippolito

Click Here