Advanced Bio-Linux

Dan Swan: Linux Security 101 Environmental Genomics Thematic Programme Data Centre http://envgen.nox.ac.uk Advanced Bio-Linux

Environmental Genomics Thematic Programme Data Centre http://envgen.nox.ac.uk Why care about security? • Any machine on the internet is vulnerable to attack from a malicious individual. • It doesn't matter what OS the machine is running, how fast the computer is, if it's a desktop or a mainframe, a good hacker will find a use for it. • Your data is stored on these machines. Work data and personal data. • You do not wish to compromise your personal security, nor jeapordise the integrity of your binary data. • Anyone attempting to hack your machine is already lacking scruples, so don't expect them to play nice if they get in.

Environmental Genomics Thematic Programme Data Centre http://envgen.nox.ac.uk Why do people hack? • There are three main types of hackers: • The 'elite' - a few individuals you simply are not going to stop. Fortunately for you they're probably more interested in banks, oil companies, governments and big business to worry about getting into your machine. They have a deep knowledge of network technologies and internet protocols. • The 'curious' - for who hacking machines is an intellectual challenge and the misappropriation of data is not a big pull. Many of these will be part of the 'white hat' community. • The 'script kiddies' - This is by far and away the largest and most active group of hackers. They leech from the curious and elite hackers and wantonly rip their way through the internet with little skill, and no idea exactly how they are doing it. They are most likely to be found on IRC bragging about their latest exploits. They are very dangerous simply because they are the most likely to cause data loss.

Environmental Genomics Thematic Programme Data Centre http://envgen.nox.ac.uk The sysadmin vs the hacker • Some hackers see the fight as a challenge. They pit their latest techniques in intrusion of computer systems against the latest preventative measures of the worlds sysadmins. It becomes a game. • There are some simple rules to follow to maintain the integrity of your machine. • We have tried to make Bio-Linux as secure as possible. • Any changes you make to the system have the potential to compromise the security of the machine. • Think about what you are doing when you use the machine. Try to develop some idea of what the hacker is thinking.

Environmental Genomics Thematic Programme Data Centre http://envgen.nox.ac.uk RULE 1 • PICK GOOD PASSWORDS! • Why? • Scenario 1: A computer hacker breaks into your machine and steals the password file (/etc/password and /etc/shadow) as well as a list of machines that you have recently accessed. • Using a dictionary based approach a hacker can test every word in a dictionary against your stolen password file. If your password is 'rainbow' - and being human, you re-use that password across multiple machines/accounts - you're technically 'owned'. • r4inb0w is not a good password, it is based on well known number/letter substitutions and does not mix case. • A good password is Ls1TmIl1L (Linux security 1s The most Important lesson 1Learned).

Environmental Genomics Thematic Programme Data Centre http://envgen.nox.ac.uk Rules 2 and 3 • Change your password frequently. Once a month should do it. Get into the habit of doing this on all systems you have accounts on, this is maximising your personal security. • Never write your password down or give your password out. No post-it notes with passwords stuck to your monitor, if a hacker was to visit your institution one day it might be the kind of thing they would pay attention to. You do not divulge it to your friends, family, colleagues. If you can't remain tight lipped about your passwords, you can't expect them to either.

Environmental Genomics Thematic Programme Data Centre http://envgen.nox.ac.uk Rule 4 • Don't run unnecessary services on your machine. • sudo /usr/sbin/setup • Services running are: atd (handles timed commands), autofs (so you can mount NFS at boot), crond (already discussed), gpm (mouse services), ip(chains|tables) (firewalls), keytable (loads local keyboard settings and default font), kudzu (hardware detection), lpd (printing), mysqld (database), network (network interface control), portsentry (anti-hacker measure), random (makes random numbers), rawdevices (for support of raw devices), rcd (red carpet updates), rhnsd (RedHat updates), sendmail (mail), sgi_fam (monitors file alterations), sshd (secure shell), syslog (logs system events), wine (windows compatibility layer), xfs (X windows font server).

Environmental Genomics Thematic Programme Data Centre http://envgen.nox.ac.uk Not all services face the internet • Some of the services are local to the machine. Not all of them present a danger from the point of view of an internet attacker. • How can you find out what is open to attack on your machine? • Use the same tools the hackers do! Run nmap against your machine. • Do not wield this tool in anger, or curiousity against any machine you do not have explicit permission to scan. You will likely breach the Computer Misuse Act and potentially anti-terrorist legislation too. • nmap -sT localhost

Environmental Genomics Thematic Programme Data Centre http://envgen.nox.ac.uk

Environmental Genomics Thematic Programme Data Centre http://envgen.nox.ac.uk Getting sneaky with nmap • With nmap we can do a lot more interesting things with machines that appear to be down, or are blocking our probes.

Environmental Genomics Thematic Programme Data Centre http://envgen.nox.ac.uk Take home message • To the casual observer Bio-Linux does not appear on the network. • To the determined hacker, the machine only shows an sshd port open. We will discuss sshd in more detail later. • The upshot of this is that your local MySQL database and your local installation of apache (the webserver) are only available to your local host (localhost/127.0.0.1). • The hiding of ports such as X-windows, printer, smtp etc means they are not available for exploitation by hackers. • The question is - how is this all done?

Environmental Genomics Thematic Programme Data Centre http://envgen.nox.ac.uk Narc firewalls • Bio-Linux has a built in firewall which allows fine grained control of who can access what on your system. • Currently the setup is (basically): • Deny all incoming connections. • Allow incoming ssh. • Firewall rules are set up using iptables (or ipchains for older versions of Linux). • We use Narc to make generating iptables rules simpler. • Narc configuration is in /etc/narc/narc.conf • Narc is run at boot to generate iptables rules based on the conf. • If you want to make firewall changes edit narc.conf.

Environmental Genomics Thematic Programme Data Centre http://envgen.nox.ac.uk Portsentry • If ever you can't connect to a machine that you can usuall access, and the machine is not down it may be that someone has run nmap against the machine from your own machine. • You have most likely been blocked by 'portsentry'. • If a machine scans you then further attempts to connect to it will be blocked. Permanently. • If this happens in error: • /sbin/route (any address with !H as a flag is blocked) • /sbin/route del <ipaddress> reject • This can also be checked in: • /etc/portsentry/portsentry.blocked.atcp

Environmental Genomics Thematic Programme Data Centre http://envgen.nox.ac.uk • Portsentry is

Environmental Genomics Thematic Programme Data Centre http://envgen.nox.ac.uk Rule 5 • You do not set up telnetd or ftpd on the machine. • In fact if you're really security concious you don't EVER use telnet or ftp to access ANYTHING! • FTP and telnet are from the days when the internet was a safer place. Importantly they transmit all their doings in plain text, across the network. • Example: You are sat on your Bio-Linux machine and you telnet/ftp to a machine in the USA. Each keystroke passes through dozens of machines, any one of which could be compromised by a hacker, who is monitoring all traffic. You have re-used your password on both machines. Hacker intercepts your username and password, sees where you are coming from, logs into your machine and you are owned. Simple.

Environmental Genomics Thematic Programme Data Centre http://envgen.nox.ac.uk Your alternative is SSH • SSH = secure shell • Replaces telnet with a secure, 2 way encrypted channel. No plain text is ever passed between the machines. • SSH also allows file transfer using scp. You can get 'ftp-like' scp clients if you really can't deal with the command line. • ssh <username>@host • scp <file> <username>@host: • ssh is even clever enough to tunnel X-Windows connections! • We use OpenSSH a non-commercial implementation of SSH. • sshd (the program which allows you to connect to Bio-Linux via ssh) is the only point of entry to the Bio-Linux system and is currently considered secure.

Environmental Genomics Thematic Programme Data Centre http://envgen.nox.ac.uk More security • To see who is logged onto your system and where from : w • To see what connections are currently being made to and from your machine : netstat | more • tail -f /var/log/messages • (hint try the above and then ssh localhost to see what happens) • Read: • http://www.ecst.csuchico.edu/LDP/HOWTO/Security-HOWTO/ • Don't forget to physically secure the machine. Padlock the case, chain it to a desk. Universities are soft targets for thieves. • Keep the machine patched and up to date. This, and not fiddling with the firewall is the best way to keep your machine secure.

Advanced Bio-Linux