Protec8ng'Host'from'Net'
|
|
|
- Ann Harrington
- 5 years ago
- Views:
Transcription
1 Protec8ng'Host'from'Net' Host'Hardening,'Default'Services,'Host'Based' Firewall,'Patching,'Backup' Fakrul'(pappu)'Alam'
2 Acknowledgement' Original'slides'prepared'by'Patrick'Okui
3 Protec8ng'Host'from'Net' Host'/'OS'Hardening'
4 OS'Hardening:'General'Considera8on' Differs'per'opera8ng'system'' OS'X':'make'things'work'magically'for'users.'Try'to' handle'security'issues'in'the'background' Windows:'users'can'not'be'trusted'to'make'security' related'decisions'in'almost'all'cases.' Linux:'varies'by'distribu8on:' Ubuntu:'try'like'OS'X'to'make'things'just'work.' RedHat:'include'very'useful'tools'but'turned'off'by'default' Slackware:'users'are'experts' 'they ll'figure'it'out.' Changes'with'8me'
5 OS'Hardening:'General'Considera8on' Define'a'personal'usage'profile'and'policy.' What'hardware'do'you'use?' What'soXware'tasks'do'you'do'on'your' computer?' Do'the'first'two'change'when'you'travel?' What'habits'from'the'above'two'do'you'need'to' change'to'be'more'secure?' Decide'if'you'really'need'VPN'access'to'your' network'while'travelling.'
6 OS'Hardening:'General'Considera8on' Install'only'the'services'and'soXware'you'actually' need.' Uninstall'or'disable'all'soXware'and'services'you'do' not'use'or'need.' Periodically'ac8vely'scan'your'machine'for' vulnerabili8es.' Have'as'few'user'accounts'on'your'systems'as'possible' Protect'your'administra8ve'account.'Have'a'strong' password,'do'not'permit'remote'password'based' logins'and'do'not'log'in'as'an'administrator'unless'you' need'to'do'an'administra8ve'task.'
7 Hardening:'hardware'and'firmware' Rule'1:'all'bets'are'off'with'physical'access'to' your'devices.' Consider'removing'(from'laptops'mostly)' hardware'you'never'use' 'say'bluetooth.' Disable'in'BIOS'or'EFI'or'your'opera8ng'system' the'hardware'or'features'you'can'not'remove' physically.' wake]on]lan' Bluetooth'discoverability' USB'ports?'
8 Hardening:'hardware'and'firmware' Cau8ously'turn'on'features'that'may'be'useful' to'you.' Fingerprint'scanners' BIOS'passwords'not'that'useful' BIOS'level'encryp8on/locking'of'hard'disks'may' not'be'portable' Privacy'screens' Trusted'aka'Treacherous'Compu8ng?'
9 Host'Hardening' Windows'
10 All'Windows'Lover'
11 Host'Hardening':'Windows' Which'Windows'opera8ng'system'should'I'use' What'is'a'workgroup?' What'is'Ac8ve'Directory?' What'are'local'users'and'groups?' What'is'Group'Policy,'and'why'is'it'so' important?'
12 Securing'Windows:'Best'Prac8ces' Disable'Guest'Account' Start]>Control'Panel]>UserAccounts' Configure'an'update'method'to'install'patches' Start]>Control'Panel]>System'>'Automa8c' Updates'tab' Disable'unused'system'services' Start]>Control'Panel]>Administra8ve'Tools] >Services'
13 Securing'Windows:'Best'Prac8ces' Verify'the'appropriate'Local'Security'Se_ngs' Start]>Control'Panel]>Administra8ve'Tools]>Local' Security'Se_ngs' Check'the'Windows'Firewall'se_ngs' Start]>Control'Panel]>Network'Connec8ons'and' choose'the'network'connec8on'that'corresponds' to'your'internet'connec8on'
14 Securing'Windows:'Best'Prac8ces' Install'an'an8virus'applica8on' Lot'of'op8ons.'But'watch'out'for'fake'one'
15 Securing'Windows:'Best'Prac8ces' Disable'hiding'of'file'extensions' Start]>Control'Panel]>Appearance'and' Personaliza8on]>Folder'Op8ons]>View]>Advance' Se_ngs'
16 Securing'Windows:'Best'Prac8ces' Install'more'secure'default'applica8ons:' Firefox'or'Chrome'rather'than'Internet'Explorer' Thunderbird'or'Claws'instead'of'Outlook'(unless' you'need'exchange'access)' A'different'MTA'rather'than'Exchange'for'servers' (unless'you'really'need'the'groupware'features)' Configure'applica8ons'to'at'minimum'warn'when' VBA'extensions'or'macros'want'to'run'
17 Securing'Windows:'Best'Prac8ces' For'more' hbp://
18 Host'Hardening' Linux'
19 Securing'Linux' Available'features'differ'by'distribu8on.' Use'as'few'different'distribu8ons'in'your' environment'as'possible.' Some'distribu8ons'have'op8onal'scripts'to' harden 'your'system'e.g.'suse,'redhat' Using'security'distro'like'Kali'Linux/Backtrack' doesn t'mean'you'are'secure.'
20 Securing'Linux' UNIX'security'model'is'based'on'permissions' ' ensure'they'are'sane:'' check'for'suid/sgid'applica8ons' Some'distros'will'include'a'nightly'check'for'such' applica8ons.' Many'distros'have'permission'profiles'that'range' from'permissive'to'paranoid'that'essen8ally'limit' or'permit'people'from/to'run(ning)'par8cular' applica8ons'or'accessing'par8cular'files'like'logs.' Run'the'periodic'scripts'that'reset'these'permissions.'
21 Securing'Linux' For'servers,'always'pick'the' minimal ' installa8on'to'ensure'as'few'packages'as' possible'end'up'on'the'system'by'default.' Use'system'tools'to'disable'services'that'are' required'by'other'packages'but'do'not'need' to'be'running.'e.g'some'packages'will'not' install'if'you'do'not'have'an'smtp'server.'
22 Securing'Linux' Periodic'security'checks:' Checksums'of'system'files'kept'offline'and'checked' against'the'running'system' tripwire'' fcheck' Periodic'scans'of'the'system.' nmap' Openvas' Real8me'checks' incrond'/ino8fy' 'kernel'feature'to'no8fy'you'as'soon' as'a'specified'watchlist'of'inodes'are'changed.'
23 Securing'Linux:'Best'Prac8ces' 1. Minimize)So,ware)to)Minimize)Vulnerability) CentOS/Fedora' # yum list installed! # yum list packagename! # yum remove packagename! FreeBSD/Ubuntu' # dpkg --list! # dpkg --info packagename! # apt-get remove packagename!
24 Securing'Linux:'Best'Prac8ces' 2. Keep)Linux)Kernel)and)So,ware)Up)to)Date) CentOS/Fedora' # yum update! FreeBSD/Ubuntu' # apt-get update && apt-get upgrade!
25 Securing'Linux:'Best'Prac8ces' 3. Use)Linux)Security)Extensions) SELinux' SELinux'is'an'acronym'for'Security]enhanced'Linux.'It'is' a'security'feature'of'the'linux'kernel.' It' is' designed' to' protect' the' server' against' misconfigura8ons' and/or' compromised' daemons.' It' put' limits' and' instructs' server' daemons' or' programs' what' files' they' can' access' and' what' ac8ons' they' can' take'by'defining'a'security'policy.' Check'hbp://selinuxproject.org/'for'details.'
26 Securing'Linux:'Best'Prac8ces' 4. User)Accounts)and)Strong)Password)Policy) A' good' password' includes' at' least' 8' characters' long' and' mixture' of' alphabets,' number,' special' character,' upper' &' lower' alphabets' etc.' Most' important'pick'a'password'you'can'remember' Verify'No'Accounts'Have'Empty'Passwords?' # awk -F: '($2 == "") {print}' /etc/ shadow! Lock'all'empty'password'account' # passwd -l accountname!
27 Securing'Linux:'Best'Prac8ces' 5. Disable)root)Login) Never'ever'login'as'root'user.'You'should'use'sudo' to' execute' root' level' commands' as' and' when' required.' # vi /etc/ssh/sshd_config! -> PermitRootLogin no! # /etc/init.d/sshd restart!
28 Securing'Linux:'Best'Prac8ces' 6. Physical)Server)Security) Configure' the' BIOS' and' disable' the' boo8ng' from' external' devices' such' as' DVDs' /' CDs' /' USB' pen.' Set' BIOS' and' grub' boot' loader' password' to' protect'these'se_ngs.'
29 Securing'Linux:'Best'Prac8ces' 7. Disable)Unwanted)Services) Disable' all' unnecessary' services' and' daemons' (services'that'runs'in'the'background).' # chkconfig --list grep '3:on! To'disable'service,'enter:' # service servicename stop! # chkconfig servicename off!
30 Securing'Linux:'Best'Prac8ces' 8. Separate)Disk)ParMMons) Separa8on'of'the'opera8ng'system'files'from'user' files' may' result' into' a' beber' and' secure' system.' Make'sure'the'following'filesystems'are'mounted' on'separate'par88ons:' /usr! /home! /var and /var/tmp! /tmp!
31 Securing'Linux:'Best'Prac8ces' 9. Secure)OpenSSH)Server) Change'SSH'Port' # /etc/ssh/sshd_config! -> Port 420 #default port is 22' '
32 Securing'Linux:'Best'Prac8ces' 10.)TCP)Wrappers) # vi /etc/hosts.allow! sshd:[2405:7600:0:6::250]/128, ! # vi /etc/hosts.deny! ALL:ALL! ' '
33 Securing'Linux:'Best'Prac8ces' 11.)Check)Listening)Network)Ports) # netstat tulpn!! Active Internet connections (only servers)! Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name! tcp : :* LISTEN 1073/mongod! tcp : :* LISTEN 1094/mysqld! tcp : :* LISTEN 1770/nginx! tcp : :* LISTEN 1073/mongod! tcp6 0 0 :::420 :::* LISTEN 952/sshd! udp : :* 18720/radiusd! udp : :* 18721/radiusd!! ' '
34 Securing'Linux:'Best'Prac8ces' 12.)SSH)Banner) # vi /etc/issue.net' ' ' ' ' #'vi'/etc/ssh/sshd_config' 'Banner'/etc/issue.net' '!!!!''WARNING'!!!!' You'have'accessed'a'restricted'device.'' 'All'access'is'being'logged'and'any'unauthorized'access' will'be'prosecuted'to'the'full'extent'of'the'law.'
35 Securing'Linux:'Best'Prac8ces' 13.)Review)Log) /var/log/message' ' Where' whole' system' logs' or' current' ac8vity'logs'are'available' /var/log/auth.log' 'Authen8ca8on'logs' /var/log/kern.log' 'Kernel'logs' /var/log/cron.log' 'Crond'logs'(cron'job)' /var/log/maillog' 'Mail'server'logs' /var/log/boot.log' 'System'boot'log' /var/log/mysqld.log' 'MySQL'database'server'log'file' /var/log/secure' 'Authen8ca8on'log' /var/log/utmp'or'/var/log/wtmp':'login'records'file' /var/log/yum.log:'yum'log'files'
36 Host'Hardening' Mac'OSX'
37 Securing'Mac'OSX:'Best'Prac8ces' Allow'apps'installa8on'from' Mac'App'Store'and' iden8fied'developers '
38 Securing'Mac'OSX:'Best'Prac8ces' Enable'Firewall'
39 Securing'Mac'OSX:'Best'Prac8ces' Disable'unused'services'
40 Securing'Mac'OSX:'Best'Prac8ces' Read'and'understand'security'guides'at' hbp:// guides/'(not'updated'for'lion'or'mountain'lion)'
41 Protec8ng'Host'from'Net' Patch'&'Updates'/Security'Updates'
42 Patch' ' A'patch'is'a'small'piece'of'soXware'that'is'used' to'correct'a'problem'with'a'soxware'program'or' an'opera8ng'system.'patches'are'oxen'called' "fixes."'service'packs'usually'contain'many' different'patches. '
43 Security'Updates' MicrosoX'Security'Updates' hbp:// ' Apple'Security'Updates' ' hbp://support.apple.com/kb/ht1222'
44 Ge_ng'Security'Updates' Subscribe'to'applica8on/host'specific'security' updates.' RSS'Feed!!!' Twiber'Feedback!!!!' Subscribe'US]CERT'Cyber'Awareness'System.' hbp://
45 Ge_ng'Security'Updates'
46 Protec8ng'Host'from'Net' Host'Based'Firewall'
47 Protec8ng'Host'from'Net' Host'Based'Firewall' Windows'
48 Host'Based'Firewall:'Windows'
49 Host'Based'Firewall:'Windows'
50 Host'Based'Firewall:'Windows' The'Windows'firewall'offers'four'types'of' rules:' Program' 'Block'or'allow'a'program.' Port' 'Block'or'a'allow'a'port,'port'range,'or' protocol.' Predefined' 'Use'a'predefined'firewall'rule' included'with'windows.' Custom' 'Specify'a'combina8on'of'program,'port,' and'ip'address'to'block'or'allow.'
51 Host'Based'Firewall:'Windows'
52 Protec8ng'Host'from'Net' Host'Based'Firewall' Linux'
53 Host'Based'Firewall:'IPTABLES' IPTABLES)Structure) ' IPTABLES' >TABLES' >CHAINS' >RULES' TABLE'1' CHAIN'1' RULE'1' RULE'2' RULE'3' CHAIN'2' RULE'1' RULE'2' RULE'3' TABLE'2' CHAIN'1' RULE'1' RULE'2' RULE'3' CHAIN'2' RULE'1' RULE'2' RULE'3'
54 Host'Based'Firewall:'IPTABLES' IPTABLES)table)&)chains) FILTER'TABLE' NAT'TABLE' MANGLE'TABLE' INPUT'CHAIN' OUTPUT'CHAIN' FORWARD'CHAIN' OUTPUT'CHAIN' PREROUTING'CHAIN' POSTROUTING'CHAIN' INPUT'CHAIN' OUTPUT'CHAIN' FORWARD'CHAIN' PREROUTING'CHAIN' POSTROUTING'CHAIN'
55 Host'Based'Firewall:'IPTABLES' IPTABLES)Rules) Rules'contain'a'criteria'and'a'target.' If' the' criteria' is' matched,' it' goes' to' the' rules' specified' in' the' target' (or)' executes' the' special' values'men8oned'in'the'target.' If'the'criteria'is'not'matched,'it'moves'on'to'the' next'rule.'
56 Host'Based'Firewall:'IPTABLES' Displaying)the)Status)of)Your)Firewall)! /h/fakrul# iptables -L -n -v --line-numbers!! Chain INPUT (policy ACCEPT 1885K packets, 417M bytes)! num pkts bytes target prot opt in out source destination! ACCEPT udp -- virbr0 * / /0 udp dpt:53! ACCEPT tcp -- virbr0 * / /0 tcp dpt:53! ACCEPT udp -- virbr0 * / /0 udp dpt:67! ACCEPT tcp -- virbr0 * / /0 tcp dpt:67!! Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)! num pkts bytes target prot opt in out source destination! ACCEPT RELATED,ESTABLISHED! all -- * virbr / /24 state ACCEPT all -- virbr0 * / /0! ACCEPT all -- virbr0 virbr / /0! REJECT icmp-port-unreachable! all -- * virbr / /0 reject-with REJECT icmp-port-unreachable! all -- virbr0 * / /0 reject-with! Chain OUTPUT (policy ACCEPT 1843K packets, 147M bytes)! num pkts bytes target prot opt in out source destination'
57 Host'Based'Firewall:'IPTABLES' Displaying)the)Status)of)NAT)Table)! /h/fakrul# iptables -t nat -L -n -v!! Chain PREROUTING (policy ACCEPT 867 packets, 146K bytes)! pkts bytes target prot opt in out source destination! 0 0 DROP all -- vlan2 * / /24!! Chain POSTROUTING (policy ACCEPT 99 packets, 6875 bytes)! pkts bytes target prot opt in out source destination! 0 0 MASQUERADE all -- * vlan / /0!! Chain OUTPUT (policy ACCEPT 99 packets, 6875 bytes)! pkts bytes target prot opt in out source destination!
58 Host'Based'Firewall:'IPTABLES' Stop)/)Start)/)Restart)Firewall) CentOS'/'RHEL'/'Fedora'Linux:' # service iptables stop! # service iptables start! # service iptables restart!! Delete'Firewall'Rules' # iptables -L INPUT -n --line-numbers! # iptables -L OUTPUT -n --line-numbers! # iptables -L OUTPUT -n --line-numbers less! # iptables -L OUTPUT -n --line-numbers grep !
59 Host'Based'Firewall:'IPTABLES' Save)Firewall)Rules) CentOS'/'RHEL'/'Fedora'Linux:' # service iptables save! For'other'distro:' # iptables-save > /root/iptables_rules! Restore'Firewall'Rules:' # iptables-restore < /root/iptables_rules!!
60 Host'Based'Firewall:'IPTABLES' Sample)Rules) # iptables -A INPUT -i eth1 -s /24 -j DROP! # iptables -A INPUT -i eth1 -s /8 -j DROP!! # iptables -A INPUT -i eth1 -p tcp --dport 80 -j ACCEPT!! # iptables -A OUTPUT -d j DROP!! # iptables -A INPUT -i eth1 -s /8 -j LOG --logprefix "IP_SPOOF A:»! # iptables -A INPUT -i eth1 -s /8 -j DROP!
61 Host'Based'Firewall:'IPTABLES' Block)or)Allow)ICMP)Ping)Request) # iptables -A INPUT -p icmp --icmp-type echo-request -j DROP! # iptables -A INPUT -i eth1 -p icmp --icmp-type echorequest -j DROP!
62 Host'Based'Firewall:'IPTABLES' # iptables -L! Chain INPUT (policy ACCEPT)! Chain FORWARD (policy ACCEPT)! Chain OUTPUT (policy ACCEPT)!! # iptables -P INPUT DROP! # iptables -P OUTPUT DROP! # iptables -P FORWARD DROP!
63 Host'Based'Firewall:'IPTABLES'(Bogon' Filter)' # iptables -A INPUT -i eth0 -s /8 -j LOG --log-prefix "IP DROP SPOOF "! # iptables -A INPUT -i eth0 -s /12 -j LOG --log-prefix "IP DROP SPOOF "! # iptables -A INPUT -i eth0 -s /16 -j LOG --log-prefix "IP DROP SPOOF "! # iptables -A INPUT -i eth0 -s /4 -j LOG --log-prefix "IP DROP MULTICAST "! # iptables -A INPUT -i eth0 -s /5 -j LOG --log-prefix "IP DROP SPOOF "! # iptables -A INPUT -i eth0 -d /8 -j LOG --log-prefix "IP DROP LOOPBACK "! # iptables -A INPUT -i eth0 -s /16 -j LOG --log-prefix "IP DROP MULTICAST "!! # iptables -A INPUT -m tcp -p tcp --dport 80 -j ACCEPT! # iptables -A INPUT -s /24 -m state --state NEW -p tcp -- dport 22 -j ACCEPT! # iptables -D INPUT -s /22 -m state --state NEW -p udp -- dport 123 -j ACCEPT!
64 Protec8ng'Host'from'Net' Backups'
65 Backups'General' Know'what'you'are'going'to'backup.' For'servers,'this'needs'to'be'centralized'where' as'for'end'user'devices'this'will'usually'need' to'be'individual'systems.' Test'recovery'procedure.' Incremental'VS'full'backups.' For'personal'backups,'consider'what'happens' when'you'travel.'
66 Backups'General' Automate'the'backups'as'much'as'possible'to' avoid'people'forge_ng.' Consider'encrypted'contents:'your'backups' must'have'at'minimum'the'same'encryp8on' level'as'the'source'data.' For'personal'backups,'the'backup'disks'will' need'to'be'kept'separate'from'the'machine' ' or'you'may'lose'both.'
67 Backups:'Windows' Inbuilt'windows'backup.' Needs'to'be'setup' 'does'not'seem'to'exist'on'starter' or'home'edi8ons.' Control'Panel]>System'and'Security']>Backup'and'Restore' Recovery'is'non'trivial.' NTFS'has'the'ability'to'create'snapshots'on'an'external' drive.' Other'op8on'is'things'like'dropbox/Google'Drive!!!' SoXware'on'some'external'drives'comes'with' one' touch 'backups.' Some'with'hardware'encryp8on'on'the'external'drive.'
68 Backups:'Linux' Host'based'backups'are'more'or'less'same' soxware'op8ons'as'server'based'network' backups.' Some'distribu8ons'automate'backups'to' external'drives' hbps://wiki.ubuntu.com/homeuserbackup'' You'can'also'use'home'made'scripts'to'use' SSH'to'copy'cri8cal'data'to'a'remote'server'
69 Backups:'OS'X' System'events'make'it'easy'to'automa8cally' launch'backups'as'soon'as'a'par8cular'disk'is' plugged'in.' Op8ons'for'remote'backup'are'the'same'as' for'linux/unix' From'10.5'all'systems'come'with' 8me' machine ' Mixes'full'and'incremental'backups.'
70 Backups:'OS'X' Dead'easy'to'setup'and'comes'with'the'OS.' Issues'with'encrypted'home'directories'et'al.' Carbon'Copy'Cloner' Can'create'a'bootable'copy.' Can'also'do'both'incremental'and'full'backups'
Eaton Intelligent Power Manager as a Virtual Appliance Deployment s Guide
Eaton Intelligent Power Manager as a Virtual Appliance Deployment s Guide Table of Contents 1 Introduction... 3 2 Free Version Limitation... 3 3 Virtualization Platform Supported... 3 4 Requirements...
Linux. Sirindhorn International Institute of Technology Thammasat University. Linux. Firewalls with iptables. Concepts. Examples
Linux Sirindhorn International Institute of Technology Thammasat University Prepared by Steven Gordon on 14 October 2013 Common/Reports/-introduction.tex, r715 1/14 Contents 2/14 Linux, netfilter and netfilter:
Linux Firewalls. Frank Kuse, AfNOG / 30
Linux Firewalls Frank Kuse, AfNOG 2017 1 / 30 About this presentation Based on a previous talk by Kevin Chege and Chris Wilson, with thanks! You can access this presentation at: Online: http://afnog.github.io/sse/firewalls/
Università Ca Foscari Venezia
Firewalls Security 1 2018-19 Università Ca Foscari Venezia www.dais.unive.it/~focardi secgroup.dais.unive.it Networks are complex (image from https://netcube.ru) 2 Example: traversal control Three subnetworks:
RHCSA BOOT CAMP. Network Security
RHCSA BOOT CAMP Network Security TCP WRAPPERS TCP Wrappers was originally written to provide host based access control for services which did not already include it. It was one of the first firewalls of
Certification. Securing Networks
Certification Securing Networks UNIT 9 Securing Networks 1 Objectives Explain packet filtering architecture Explain primary filtering command syntax Explain Network Address Translation Provide examples
This material is based on work supported by the National Science Foundation under Grant No
Source: http://en.wikipedia.org/wiki/file:firewall.png This material is based on work supported by the National Science Foundation under Grant No. 0802551 Any opinions, findings, and conclusions or recommendations
iptables and ip6tables An introduction to LINUX firewall
7 19-22 November, 2017 Dhaka, Bangladesh iptables and ip6tables An introduction to LINUX firewall Imtiaz Rahman SBAC Bank Ltd AGENDA iptables and ip6tables Structure Policy (DROP/ACCEPT) Syntax Hands on
Netfilter. Fedora Core 5 setting up firewall for NIS and NFS labs. June 2006
Netfilter Fedora Core 5 setting up firewall for NIS and NFS labs June 2006 Netfilter Features Address Translation S NAT, D NAT IP Accounting and Mangling IP Packet filtering (Firewall) Stateful packet
HOW TO SECURELY CONFIGURE A LINUX HOST TO RUN CONTAINERS
HOW TO SECURELY CONFIGURE A LINUX HOST TO RUN CONTAINERS How To Securely Configure a Linux Host to Run Containers To run containers securely, one must go through a multitude of steps to ensure that a)
PXC loves firewalls (and System Admins loves iptables) Written by Marco Tusa Monday, 18 June :00 - Last Updated Wednesday, 18 July :25
Let them stay together. In the last YEARS, I have seen quite often that users, when installing a product such as PXC, instead of spending five minutes to understand what to do just run iptable s -F and
Linux Kung Fu. Stephen James UBNetDef, Spring 2017
Linux Kung Fu Stephen James UBNetDef, Spring 2017 Introduction What is Linux? What is the difference between a client and a server? What is Linux? Linux generally refers to a group of Unix-like free and
Web Server ( ): FTP, SSH, HTTP, HTTPS, SMTP, POP3, IMAP, POP3S, IMAPS, MySQL (for some local services[qmail/vpopmail])
![Web Server ( ): FTP, SSH, HTTP, HTTPS, SMTP, POP3, IMAP, POP3S, IMAPS, MySQL (for some local services[qmail/vpopmail])](/thumbs/72/66962801.jpg "Web Server ( ): FTP, SSH, HTTP, HTTPS, SMTP, POP3, IMAP, POP3S, IMAPS, MySQL (for some local services[qmail/vpopmail])")
The following firewall scripts will help you secure your web and db servers placed on the internet. The scenario is such that the MySQL db server is desired to receive db connections / traffic only from
Quick Note 05. Configuring Port Forwarding to access an IP camera user interface on a TransPort LR54. 7 November 2017
Quick Note 05 Configuring Port Forwarding to access an IP camera user interface on a TransPort LR54 7 November 2017 Contents 1 Introduction... 3 1.1 Outline... 3 1.2 Assumptions... 3 1.3 Corrections...
NETWORK CONFIGURATION AND SERVICES. route add default gw /etc/init.d/apache restart
NETWORK CONFIGURATION AND SERVICES route add default gw 192.168.0.1 /etc/init.d/apache restart NETWORK CONFIGURATION There are two main approaches to configuring a machine for network access: Static configuration
Lecture 18: Packet Filtering Firewalls (Linux) Lecture Notes on Computer and Network Security. by Avi Kak
Lecture 18: Packet Filtering Firewalls (Linux) Lecture Notes on Computer and Network Security by Avi Kak (kak@purdue.edu) March 20, 2017 11:49pm c 2017 Avinash Kak, Purdue University Goals: Packet-filtering
Assignment 3 Firewalls
LEIC/MEIC - IST Alameda LEIC/MEIC IST Taguspark Network and Computer Security 2013/2014 Assignment 3 Firewalls Goal: Configure a firewall using iptables and fwbuilder. 1 Introduction This lab assignment
Linux+ Guide to Linux Certification, Third Edition
Linux+ Guide to Linux Certification, Third Edition Chapter 14 Troubleshooting, Performance, and Security Objectives Describe and outline good troubleshooting practices Effectively troubleshoot common hardware-
IPv6 NAT. Open Source Days 9th-10th March 2013 Copenhagen, Denmark. Patrick McHardy
IPv6 NAT Open Source Days 9th-10th March 2013 Copenhagen, Denmark Patrick McHardy Netfilter and IPv6 NAT historically http://lists.netfilter.org/pipermail/netfilter/2005-march/059463.html
Introduction. What is Linux? What is the difference between a client and a server?
Linux Kung Fu Introduction What is Linux? What is the difference between a client and a server? What is Linux? Linux generally refers to a group of Unix-like free and open-source operating system distributions
Network and Filesystem Security
Network and Filesystem Security Powell Molleti powell@in.ibm.com 1 Agenda Netfilter and TCP Wrappers for Network Security including SNORT for NIDS and tools for checking network vulnerabilities Filesystem
grub-md5-crypt --help Usage: grub-md5-crypt [OPTION] Encrypt a password in MD5 format.
![grub-md5-crypt --help Usage: grub-md5-crypt [OPTION] Encrypt a password in MD5 format.](/thumbs/78/77295437.jpg "grub-md5-crypt --help Usage: grub-md5-crypt [OPTION] Encrypt a password in MD5 format.")
(OS Hardening). Minimal.1. grub.2..3. DVD Update.4. root ssh.5 kernel grub kernel.6. comment vi /etc/grub.conf # grub.conf generated by anaconda # # Note that you do not have to rerun grub after making
Linux Security & Firewall
Linux Security & Firewall Linux is not secure No computer system can ever be "completely secure". make it increasingly difficult for someone to compromise your system. The more secure your system, the
Contents. Preventing Brute Force Attacks. The First Method: Basic Protection. Introduction. Prerequisites
Contents 1 Preventing Brute Force Attacks 1.1 Introduction 1.2 Prerequisites 2 The First Method: Basic Protection 2.1 Implementing Basic Protection for SSH (outdated) 2.2 Protecting Telnet in Addition
python-iptables Documentation
python-iptables Documentation Release 0.4.0-dev Vilmos Nebehaj Oct 05, 2017 Contents 1 Introduction 3 1.1 About python-iptables.......................................... 3 1.2 Installing via pip.............................................
To find all files on your file system that have the SUID or SGID bit set, execute:
File System Security Checks There are certain files whose presence in the Linux file system can present a security risk and should be remedied as soon as possible. When the SUID (set user ID) or SGID (set
Formal Analysis of Firewalls
Formal Analysis of Firewalls Robert Marmorstein Dissertation Committee Advisor: Dr. Phil Kearns Dr. Weizhen Mao Dr. David Coppit Dr. Haining Wang Dr. Jean Mayo April 10, 2008 Some useful definitions Firewall
Definition of firewall
Internet Firewalls Definitions: firewall, policy, router, gateway, proxy NAT: Network Address Translation Source NAT, Destination NAT, Port forwarding NAT firewall compromise via UPnP/IGD Packet filtering
Lockdown & support access guide
Lockdown & support access guide How to lock down your cloud, and enable the OnApp support team to help you with troubleshooting and ticket resolution. Document version 1.4 Document release date 21 st February
Purpose. Target Audience. Install SNMP On The Remote Linux Machine. Nagios XI. Monitoring Linux Using SNMP
Purpose This document describes how to monitor Linux machines with using SNMP. SNMP is an agentless method of monitoring network devices and servers, and is often preferable to installing dedicated agents
UNIVERSITY OF BOLTON SCHOOL OF CREATIVE TECHNOLOGIES COMPUTER AND NETWORK SECURITY SEMESTER TWO EXAMINATIONS 2016/2017 NETWORK SECURITY
[CRT03] UNIVERSITY OF BOLTON SCHOOL OF CREATIVE TECHNOLOGIES COMPUTER AND NETWORK SECURITY SEMESTER TWO EXAMINATIONS 2016/2017 NETWORK SECURITY MODULE NO: CPU6004 Date: Tuesday 16 th May 2017 Time: 14:00-16:00
Network Address Translation
Claudio Cicconetti International Master on Communication Networks Engineering 2006/2007 Network Address Translation (NAT) basically provides a mapping between internal (i.e.,
Meet the Anti-Nmap: PSAD (EnGarde Secure Linux)
By Ryan Published: 2008-02-18 17:16 Meet the Anti-Nmap: PSAD (EnGarde Secure Linux) (by Eckie S. from Linuxsecurity.com) The Port Scan Attack Detector (psad) is an excellent tool for detecting various
TP5 Sécurité IPTABLE. * :sunrpc, localhost :domain,* :ssh, localhost :smtp, localhost:953,*: Tous sont des protocoles TCP
TP5 Sécurité IPTABLE Routage classique Q1) Sur la machiine FIREWALL, les services actifs sont : Netstat -a * :sunrpc, localhost :domain,* :ssh, localhost :smtp, localhost:953,*:53856. Tous sont des protocoles
:13 1/10 Traffic counting on the CCGX
2017-08-18 15:13 1/10 Traffic counting on the CCGX Traffic counting on the CCGX There are situation in which it is interesting to know the traffic usage of the color control. This can be done on the CCGX
Communication protocols and services
This chapter describes various protocols and that may be enabled on Modberry. SSH Connection SSH service is started up on boot and already preinstalled and configured. You may access your device through
Introduction to Firewalls using IPTables
Introduction to Firewalls using IPTables The goal of this lab is to implement a firewall solution using IPTables, and to write and to customize new rules to achieve security. You will need to turn in your
Firewalls. IT443 Network Security Administration Slides courtesy of Bo Sheng
Firewalls IT443 Network Security Administration Slides courtesy of Bo Sheng 1 Internet Security Mechanisms Prevent: Firewall, IPsec, SSL Detect: Intrusion Detection Survive/ Response: Recovery, Forensics
FUJITSU Software ServerView Mission Critical Option
FUJITSU Server PRIMEQUEST2000 Series FUJITSU Software ServerView Mission Critical Option User Manual Version 1.2 Copyright Fujitsu Limited 2014 All hardware and software names used are trademarks of their
Hardened Virtual Appliance Operations Guide
Hardened Virtual Appliance Operations Guide Securing the Appliance Base Platform to Meet High Governance Requirements VMWARE WHITEPAPER Table of Contents Introduction... 3 Purpose... 4 Root password...
Basic Linux Desktop Security. Konrad Rosenbaum this presentation is protected by the GNU General Public License version 2 or any newer
Basic Linux Desktop Security Konrad Rosenbaum this presentation is protected by the GNU General Public License version 2 or any newer Think Security: 5Q 1)What is the problem? 2)What is the proposed solution?
Securing Linux. John Kristoff DePaul University Chicago, IL 60604
Securing Linux John Kristoff jtk@depaul.edu http://condor.depaul.edu/~jkristof/ +1 312 362-5878 DePaul University Chicago, IL 60604 NWU Security Day John Kristoff - DePaul University 1 Starting comments
Written by Muhammad Kamran Azeem Wednesday, 02 July :48 - Last Updated Saturday, 25 December :45
Assalam-u-alaikum, I have been receiving many mails for few years now to provide with a firewall script. Lately I received one such mail and I decided to publish, what I replied him with. The names and
Firewalls. Firewall types. Packet filter. Proxy server. linux, iptables-based Windows XP s built-in router device built-ins single TCP conversation
Firewalls Firewall types Packet filter linux, iptables-based Windows XP s built-in router device built-ins single TCP conversation Proxy server specialized server program on internal machine client talks
11 aid sheets., A non-programmable calculator.
UNIVERSITY OF TORONTO MISSISSAUGA DECEMBER 2008 FINAL EXAMINATION CSC 347H5F Introduction to Information Security Arnold Rosenbloom Duration 3 hours Aids: Two double sided 8 1 2 11 aid sheets., A non-programmable
NCS490 Date Assigned: 11/03/14 Ronny L. Bull Due Date: 11/15/14
DNS Lab Write-up Craig T. Ciulla NCS490 Date Assigned: 11/03/14 Ronny L. Bull Due Date: 11/15/14 Setup on Primary VM In this section, I installed and configured all necessary packages on my primary VM
Services and Security
Services and Security Find out what's listening to the net Find out what services are running Find out what they do Disable or remove any that you don't need References http://techrepublic.com.com/5100-6270-1053043.html
IPtables and Netfilter
in tables rely on IPtables and Netfilter Comp Sci 3600 Security Outline in tables rely on 1 2 in tables rely on 3 Linux firewall: IPtables in tables rely on Iptables is the userspace module, the bit that
Worksheet 8. Linux as a router, packet filtering, traffic shaping
Worksheet 8 Linux as a router, packet filtering, traffic shaping Linux as a router Capable of acting as a router, firewall, traffic shaper (so are most other modern operating systems) Tools: netfilter/iptables
Server virtualiza,on and security. CSCI 470: Web Science Keith Vertanen
Server virtualiza,on and security CSCI 470: Web Science Keith Vertanen Mo*va*on Virtualiza*on Overview Setup process (DigitalOcean) Securing a new Ubuntu VM So
Network security Exercise 9 How to build a wall of fire Linux Netfilter
Network security Exercise 9 How to build a wall of fire Linux Netfilter Tobias Limmer Computer Networks and Communication Systems Dept. of Computer Sciences, University of Erlangen-Nuremberg, Germany 2.2.
The Wonderful World of Services VINCE
The Wonderful World of Services VINCE Agenda definitions services for Windows and Linux breaks? auditing Linux logs for Linux useful tools Goals develop a better understanding of Linux and Windows services
Cisco PCP-PNR Port Usage Information
Cisco PCP-PNR Port Usage Information Page 1 of 18 20-Sep-2013 Table of Contents 1 Introduction... 3 2 Prerequisites... 3 3 Glossary... 3 3.1 CISCO PCP Local Machine... 3 3.1.1 CISCO PCP Component... 4
Dual-stack Firewalling with husk
Dual-stack Firewalling with husk Phil Smith linux.conf.au Perth 2014 1 Phil Smith SysAdmin from Melbourne Personal Care Manufacturer Implemented complete Dual-stack Previous role in managed security 4WD'ing
securing a host Matsuzaki maz Yoshinobu
securing a host Matsuzaki maz Yoshinobu Hardening a host Differs per operating system Windows: users can not be trusted to make security related decisions in almost all cases OS X : make
Offloading NDO2DB To Remote Server
Purpose This document is meant to show a step-by-step guide for offloading the NDO2DB daemon from the central server to an external, remote server. NDO2DB is an acronym of "Nagios Data Output To Database"
The specifications and information in this document are subject to change without notice. Companies, names, and data used
HARDENING YOUR WEBADM SERVER The specifications and information in this document are subject to change without notice. Companies, names, and data used in examples herein are fictitious unless otherwise
Virtuozzo DevOps. Installation Guide
Virtuozzo DevOps Installation Guide May 03, 2017 Parallels International GmbH Vordergasse 59 8200 Schaffhausen Switzerland Tel: + 41 52 632 0411 Fax: + 41 52 672 2010 http://www.virtuozzo.com Copyright
There are separate firewall daemons for for IPv4 and IPv6 and hence there are separate commands which are provided below.
SNMP Trap - Firewall Rules Article Number: 87 Rating: 1/5 from 1 votes Last Updated: Tue, Dec 18, 2018 at 5:25 PM Fir e wa ll Rule s These steps explain how to check if the Operating System (OS) of the
Linux System Administration, level 2
Linux System Administration, level 2 IP Tables: the Linux firewall 2004 Ken Barber Some Rights Reserved This work is licensed under the Creative Commons Attribution-NonCommercial-ShareAlike License. To
Laboratory 2 Dynamic routing using RIP. Iptables. Part1. Dynamic Routing
Introduction Laboratory 2 Dynamic routing using RIP. Iptables. Part1. Dynamic Routing Static routing has the advantage that it is simple, requires no computing power in router for determining routes (this
Exam LFCS/Course 55187B Linux System Administration
Exam LFCS/Course 55187B Linux System Administration About this course This four-day instructor-led course is designed to provide students with the necessary skills and abilities to work as a professional
File System Hierarchy Standard (FHS)
File System Hierarchy Standard (FHS) Filesystem hierarchy standard describes directory structure and its content in Unix and Unix like operating system. It explains where files and directories should be
Firewalling. Alessandro Barenghi. May 19, Dipartimento di Elettronica e Informazione Politecnico di Milano barenghi - at - elet.polimi.
Firewalling Alessandro Barenghi Dipartimento di Elettronica e Informazione Politecnico di Milano barenghi - at - elet.polimi.it May 19, 2011 Recap By now, you should be familiar with... Programming with
The Basics of Linux Security
The Basics of Linux Security What every Linux user should know about security Presented at the 2007 Nebraska CERT Conference Adam Haeder Vice President of Information Technology AIM Institute Basic Linux
Michael Rash DEFCON 12 07/31/2004
Advanced Netfilter: Content Replacement (ala Snort_inline) and Combining Port Knocking with p0f Michael Rash DEFCON 12 07/31/2004 http://www.enterasys.com http://www.cipherdyne.org Introduction Port knocking
Dropping Packets in Ubuntu Linux using tc and iptables
Dropping Packets in Ubuntu Linux using tc and... 1 Dropping Packets in Ubuntu Linux using tc and iptables By Steven Gordon on Tue, 18/01/2011-8:13pm There are two simple ways to randomly drop packets on
sottotitolo A.A. 2016/17 Federico Reghenzani, Alessandro Barenghi
Titolo presentazione Piattaforme Software per la Rete sottotitolo Firewall and NAT Milano, XX mese 20XX A.A. 2016/17, Alessandro Barenghi Outline 1) Packet Filtering 2) Firewall management 3) NAT review
CIS 192 Linux Lab Exercise
CIS 192 Linux Lab Exercise Lab 5: Firewalls and Network Address Translation (NAT) Spring 2009 Lab 5: Firewalls and Network Address Translation (NAT) The purpose of this lab is to exercise the use of iptables
RG-MACC_2.0 Installation Manual
RG-MACC_2.0 Installation Manual Ruijie Networks Co., Ltd all rights reserved 1 Copyright Clarify Copyright ownership belongs to Ruijie, shall not be reproduced, copied, or used in other ways without permission.
Hardening servers for the modern internet
Hardening servers for the modern internet Philip Paeps The FreeBSD Foundation SANOG32 7 August 2018 Dhaka, Bangladesh Session 1 (09:00 11:00) 1. Presentation: Introduction to the FreeBSD project (30 minutes)
Course 55187B Linux System Administration
Course Outline Module 1: System Startup and Shutdown This module explains how to manage startup and shutdown processes in Linux. Understanding the Boot Sequence The Grand Unified Boot Loader GRUB Configuration
Linux Systems Security. Firewalls and Filters NETS1028 Fall 2016
Linux Systems Security Firewalls and Filters NETS1028 Fall 2016 Firewall A physical barrier designed to slow or prevent the spread of fire In computer networks, a mechanism to slow or prevent the passage
APNIC Network Security Workshop. February 5-7, 2014 Brisbane, Australia.
APNIC Network Security Workshop February 5-7, 2014 Brisbane, Australia. Presenters Champika Wijayatunga (Champ) Training Unit Manager, APNIC Champika is responsible for managing its training activities
Firewalls. October 13, 2017
Firewalls October 13, 2017 Administrative submittal instructions answer the lab assignment s questions in written report form, as a text, pdf, or Word document file (no obscure formats please) email to
Docker Networking: From One to Many. Don Mills
Docker Networking: From One to Many Don Mills What we are going to talk about Overview of traditional Docker networking Some demonstrations Questions New Docker features Some more demonstrations Questions
History Page. Barracuda NextGen Firewall F
The Firewall > History page is very useful for troubleshooting. It provides information for all traffic that has passed through the Barracuda NG Firewall. It also provides messages that state why traffic
based on the idc/isp/catv Servers Hands On Seminar on December 17 18, 2009, organized by
This material is translated and edited based on the idc/isp/catv Servers Hands On Seminar by Mr.Koichi Kunitake, BeaconNC Inc., on December 17 18, 2009, organized by Task Force for IPv4 Exhaustion, Japan
Configure. Version: Copyright ImageStream Internet Solutions, Inc., All rights Reserved.
Configure Version: 2342 Copyright 2007-2010 ImageStream Internet Solutions, Inc., All rights Reserved. Table of Contents Squid/Configure...1 ImageStream's Default Squid Configuration...1 Transparent Proxy
Newsreader virtual machines Technical Report NWR
Newsreader virtual machines Technical Report NWR-2014-4 Version FINAL Aitor Soroa 1, Enrique Fernández 2 1 University of Basque Country Donostia, Basque Country a.soroa@ehu.es 2 University of Basque Country
"Charting the Course... MOC B: Linux System Administration. Course Summary
Description Course Summary This four-day instructor-led course is designed to provide students with the necessary skills and abilities to work as a professional Linux system administrator. The course covers
I Commands. iping, page 2 iping6, page 4 itraceroute, page 5 itraceroute6 vrf, page 6. itraceroute vrf encap vxlan, page 12
iping, page 2 iping6, page 4 itraceroute, page 5 itraceroute6 vrf, page 6 itraceroute6 vrf encap vlan, page 7 itraceroute6 vrf encap vxlan dst-mac, page 8 itraceroute vrf, page 9 itraceroute vrf encap
How to Restrict a Login Shell Using Linux Namespaces
How to Restrict a Login Shell Using Linux Namespaces Firejail is a SUID sandbox program that reduces the risk of security breaches by restricting the running environment of untrusted applications using
10 A Security Primer. Copyright 2011 by The McGraw-Hill Companies CERTIFICATION OBJECTIVES. Q&A Self Test
10 A Security Primer CERTIFICATION OBJECTIVES 10.01 The Layers of Linux Security 10.02 Firewalls and Network Address Translation 10.03 The Extended Internet Super-Server 10.04 TCP Wrappers 10.05 Pluggable
Network Security. Routing and Firewalls. Radboud University, The Netherlands. Spring 2018
Network Security Routing and Firewalls Radboud University, The Netherlands Spring 2018 The coming weeks... Monday, May 21: Whit Monday, no lecture Monday, May 28: Security in Times of Surveillance https://www.win.tue.nl/eipsi/surveillance.html
8/19/2010. Computer Forensics Network forensics. Data sources. Monitoring
Computer Forensics Network forensics Thomas Mundt thm@informatik.uni-rostock.de Data sources Assessment Monitoring Monitoring Software Logs and Log Analysis Incident Analysis External Assessment Hackers
Offloading MySQL to Remote Server
Purpose This document is meant to show a step-by-step guide for offloading the MySQL services from the central server to an external, remote server. Target Audience This document is intended for use by
THE INTERNET PROTOCOL/1
THE INTERNET PROTOCOL a (connectionless) network layer protocol designed for use in interconnected systems of packet-switched computer communication networks (store-and-forward paradigm) provides for transmitting
VCP-DCV5, OCP (DBA), MCSA, SUSE CLA, RHCSA-7]
![VCP-DCV5, OCP (DBA), MCSA, SUSE CLA, RHCSA-7]](/thumbs/78/78698562.jpg "VCP-DCV5, OCP (DBA), MCSA, SUSE CLA, RHCSA-7]")
Alternate Titles: APACHE V-HOST SETUP Author: Muhammad Zeeshan Bhatti [LPI, VCP-DCV5, OCP (DBA), MCSA, SUSE CLA, RHCSA-7] (http://zeeshanbhatti.com) (admin@zeeshanbhatti.com) APACHE V-HOST SETUP [root@zeeshanbhatti
Ubuntu Server Guide. Ubuntu Documentation Project
Ubuntu Server Guide Ubuntu Documentation Project Ubuntu Server Guide by Ubuntu Documentation Project Copyright 2004, 2005, 2006 Canonical Ltd.
Lesson Module Status Slides Whiteboard with 1st minute quiz
Lesson Module Status Slides Whiteboard with 1st minute quiz Flashcards Web Calendar summary Web book pages Commands Howtos Lab tested Lab template in depot Youtube Videos uploaded Backup slides, Confer
Paranoid Penguin Running Network Services under User-Mode Linux, Part III Mick Bauer Abstract Fine-tune and firewall your UML guest systems. In the last two Paranoid Penguin columns, I walked you through
THE INTERNET PROTOCOL INTERFACES
THE INTERNET PROTOCOL The Internet Protocol Stefan D. Bruda Winter 2018 A (connectionless) network protocol Designed for use in interconnected systems of packet-switched computer communication networks
The Internet Protocol
The Internet Protocol Stefan D. Bruda Winter 2018 THE INTERNET PROTOCOL A (connectionless) network layer protocol Designed for use in interconnected systems of packet-switched computer communication networks
Security, Meet Your New Roommate, The Dynamic Provisioning Environment
SESSION ID: CSV-W04 Security, Meet Your New Roommate, The Dynamic Provisioning Environment Jason Pappalexis Research Director NSS Labs, Inc. @jsnppp Chris Morales Principal Engineer HyTrust @MoralesATX
14. Configuring Telnet in Knoppix
14. Configuring Telnet in Knoppix Estimated Time: 45 Minutes Objective In this lab, the student will learn how to configure the Telnet service on a system so that the user can remotely administer a Knoppix
A Technique for improving the scheduling of network communicating processes in MOSIX
A Technique for improving the scheduling of network communicating processes in MOSIX Rengakrishnan Subramanian Masters Report, Final Defense Guidance by Prof. Dan Andresen Agenda MOSIX Network communicating
Introduction to Grid Computing!
Introduction to Grid Computing! Rocks-A-Palooza II! Lab Session! 2006 UC Regents! 1! Using The Grid Roll! Option 1! Reinstall! frontend upgrade! Option 2! Use kroll! 2006 UC Regents! 2! Option 1: Re-Installation
CHAPTER 7 DEMONSTRATE THE PAN IN LINUX
CHAPTER 7 DEMONSTRATE THE PAN IN LINUX SYSTEM The new model - Network Access Point Group Network 7.1 DEMONSTRATION Software: All machines are installed with Linux Redhat 8.0 Hardware list:- There are two
CIT 470: Advanced Network and System Administration. Topics. System Logs. Logging
CIT 470: Advanced Network and System Administration Logging CIT 470: Advanced Network and System Administration Slide #1 1. System logs 2. Logging policies 3. Finding logs 4. Syslog 5. Syslog servers 6.