|
UNIX Hints & Hacks |
 |
||||||||||||||||||||||||||
|
Chapter 3: Security |
|
||||||||||||||||||||||||||
|
Watch out! Certain key areas in the UNIX environment that are targets by hackers often are left vulnerable and probably always will be.
Poor system administration practices Treat every system as if an intruder is waiting at your doorstep. Don't be sloppy and leave holes open for intruders to take advantage of. Don't let yourself say, "I'll clean it up later." It usually doesn't take that much time. Here are some of the holes to which I am referring:
Empty passwords left open and blank in the password file. The same holds true for using the word test and setting the users' passwords to their user IDs.
Reusable/poor passwords There is no excuse to use recycled passwords or be caught with bad passwords. A lot of users are still ignorant about good passwords. If you must, recommend some to them. A little 10,000 word dictionary can still often crack many passwords. Educate users, enforce the use of good passwords, and use password-cracking software on a regular basis.
CGI applications One of the biggest holes in systems comes from CGIs. Most Web designers and programmers don't think that a system could be compromised through CGI when a Web site is designed. They are concerned about secure transactions for commerce on the Internet, but not how the computer system itself could be compromised. An insecure CGI can provide access to password files and any other system file if not locked down properly.
Email bombs and spamming Sending or receiving large quantities of unsolicited email can degrade network and host performance, fill up a disk, or waste users' time. The older versions of sendmail, prior to version 8.9, do not protect against many of the following vulnerabilities:
The sender does not need to specify a valid domain for any inbound mail to your mailserver.
Anonymous FTP server If an anonymous FTP server is not properly configured, users can gain unauthorized access to information or execute arbitrary commands on the server and compromise the system. Avoid using the vendor supplied FTP package that comes with the OS you installed. WU-FTP, from Washington University, is currently the most secure FTP out on the Internet, offering extended features that don't exist in the standard version of FTP. Some of these features include
Various classification rules can be placed on users to allow or deny access into certain areas. Restricted guest accounts can also be configured.
BIND and named There are three distinct problems in recent versions of BIND 4.9 and BIND 8 releases. ( BIND stands for Berkeley Internet Name Domain .) The problems can enable an intruder to gain root-level access to a nameserver or disrupt normal operations to a nameserver in the following ways:
An improper or maliciously formatted inverse query on a TCP stream can crash the server or enable an attacker to gain root privileges.
If you find that some of these problems exist in your environment, don't dive in and make hasty decisions in trying to correct these problems. Fixing one thing can break another. Evaluate each situation individually and take the appropriate steps to rectify the problem. Sometimes it isn't a configuration change but an entire upgrade to new software packages that's necessary.
In the early days of the UNIX Guru Universe (UGU), I knew every level of administrator would be using the Web site and there would be more than a few, like me, who would try to hack into it. UGU is driven by a single CGI. What better Web site to hack into? After 800,000 hits and 15,000 administrators, the site was never compromised. It wasn't until fatigue set in at 3:15 in the morning, when I put an upgraded version in place and forgot to add the security model into the CGI that trouble struck. It didn't take long, fewer than 500 impressions, before I got the email from another administrator informing me that he'd hacked UGU. It was really subtle, in the form of the password file. There was no malicious intent on his part; he wanted to see whether he could and let me know what needed patching. This reaffirms my belief that admins help admins, and don't destroy, punish, hurt, or abuse one another.
World Wide Web:
BIND (ISC)-- http://www.isc.org/new-bind.html
CERT Coordination Center-- http://www.cert.org
Sendmail Consortium-- http://www.sendmail.org
WU-FTP (Academ Consulting Services)-- http://www.academ.com/academ/wu-ftpd
|
UNIX Hints & Hacks |
|
||||||||||||||||||||||||||
|
Chapter 3: Security |
|
||||||||||||||||||||||||||
|
© Copyright Macmillan USA. All rights reserved.
