Use aide to monitor core system configuration files

AIDE (Advanced Intrusion Detection Environment) can be used to help track file integrity by comparing a 'snapshot' of the system's files prior to and after a suspected incident. It is a freeware version of Tripwire, AIDE uses a database to accumulate key file attributes like permissions, mtime, ctime, and number of links for a system. The idea is to build the database before 2 things occur:

1. before the snapshot image of these files is taken prior to the system being placed on a network; and,
2. before the snapshot image is taken prior to a system compromise.

For further protection, a checksum of each file in its current state can be used with a choice of several hash methods.

The idea behind AIDE and other host-based IDSs is for the snapshot to be taken and then periodically updated as the system is updated. Patches, hardware and other software installs tend to change the size and nature of files, so it is always a good idea to re-run AIDE after making changes. If the administrator then suspects that a system has been compromised, running AIDE and then comparing the two snapshots will assist the admin in honing in on what happened. Doing so without this original snapshot can be difficult at best.

aide is included in many distributions of Linux. to begin using it you must review the /etc/aide.conf file and ensure that it has the correct information for your environment- then initialize the database using the command

aide –i

once the database is created you run a comparison using the –-check switch; i set this up as a cron job to run daily (although you can do this more or less often as you feel necessary) the command is

aide –-check >/tmp/aide.log

then i have the aide.log mailed to me for review. If nothing is changed it is a simple comparison. over time the system will have changes made, you can use this log file to review changes as they occur. periodically; as the volumes of change from the initial snapshot grows you can update your snapshot using the following command

aide -u

 

IBM Linux Security RedBook

IBM Redbook - Securing Linux on System Z

NSA Guide to Securing RedHat Linux

this is nearly a year old - I just happened to run across it

http://www.nsa.gov/ia/_files/os/redhat/rhel5-guide-i731.pdf

Novell's Guide to SUSE Linux Security

Novell's Best Practices for SUSE Linux Security

Linux Security Tools

 

System Auditing

• Chkrootkit (YoLinux tutorial) - Scan system for trojans, worms and exploits.
• checkps - detect rootkits by detecting falsified output and similar anomalies. The ps check should work on anything with /proc. Also uses netstat.
• Rootkit hunter - scans for rootkits, back doors and local exploits
• Rkdet - root kit detector daemon. Intended to catch someone installing a rootkit or running a packet sniffer.
• Tripwire : The grand-daddy of file integrity checkers
• RKHunter : An Unix Rootkit Detector
• chkrootkit : Locally checks for signs of a rootkit
• fsaudit - Perl script to scan file systems and search for suspicious looking directories
• - UNIX security checks. Programs and shell scripts which perform security checks. Checks include file and directory permissions, passwords, system scripts, SUID files, ftp configuration check, ...
• SARA - Security Auditor's Research Assistant - network security vulnerability scanner for SQL injections, remote scans, etc. (follow-on to the SATAN analysis tool)
• - Texas A&M University developed tools
• Tiger - Scan a Unix system looking for security problems (Similar to COPS) -
• Tiger Analytical Research Assistant (TARA Pro) - Commercial support
• Netlog - TCP and UDP suspicious traffic logging system
• Drawbridge - Firewall package (Free BSD)
• Dsniff : A suite of powerful network auditing and penetration-testing tools
• P0f : A versatile passive OS fingerprinting tool
• BASE : The Basic Analysis and Security Engine

Network Vulnerability Audits

• Nessus - Remote security scanner - This is my favorite security audit tool!! Checks service exploits and vulnerabilities.
• ISIC - IP Stack Integrity Checker
• Argus - IP network transaction auditing tool. This daemon promiscuously reads network datagrams from a specified interface, and generates network traffic status records
• Argus 2
• SAINT - Finds computers on the network, port scans and does a vulnerability check and outputs a report. - Commercial product.
• InterSect Alliance - Intrusion analysis. Identifies malicious or unauthorized access attempts.
• Linuxforce: AdminForce CGI Auto Audit - CGI script analyzer to find security deficiencies.
• Core Impact : An automated, comprehensive penetration testing product
• Canvas : A Comprehensive Exploitation Framework
• SolarWinds : A plethora of network discovery/monitoring/attack tools
• Yersinia : A multi-protocol low-level attack tool

Wireless Vulnerability Audit Tools

• AirSnort - wireless LAN (WLAN) tool that recovers encryption keys.
• WEPCrack
• Kismet - Wireless Sniffer
• Aircrack : The fastest available WEP/WPA cracking tool

Port Scanners/Network Discovery Tools

• nmap - Port scanner and security scanning and investigation tool
• NmapFe - GUI front-end to NMAP
• KNmap - KDE front-end
• pbnj - Diff nmap scans to find changes to systems on the network.
• nmap3d - nmap post processing to 3-d VRML
• nmap-sql - log scans to database
• portscan - C++ Port Scanner will try to connect on every port you define for a particular host.
• pof - passive OS fingerprinting.
• NetCat - This simple utility reads and writes data across TCP or UDP network connections. It is designed to be a reliable back-end tool that can be used directly or easily driven by other programs and scripts. At the same time, it is a feature-rich network debugging and exploration tool, since it can create almost any kind of connection you would need, including port binding to accept incoming connections
• Scanrand : An unusually fast stateless network service and topology discovery system
• Web/http scan:
• Nikto - web server scanner. CGI, vulnerability checks. Not a stealthy tool. For security tests.
• Paros Proxy - A web application vulnerability assessment proxy
• Web Scarab - A framework for analyzing applications that communicate using the HTTP and HTTPS protocols
• Whisker/libwhisker : Rain.Forest.Puppy's CGI vulnerability scanner and library
• Burpsuite : An integrated platform for attacking web applications
• SPIKE Proxy : HTTP Hacking

Network Sniffers

• DSniff - network tools for auditing and penetration testing.
• Wireshark - full network protocol sniffer/analyzer
• (Ethereal - legacy. Now Wireshark)
• IPTraf - curses based IP LAN monitor
• TcpDump - network monitor and data acquisition
• VOMIT - Voice Over Misconfigured Internet Telephones - Use TCP dump of VOIP stream and convert to WAV file.
• Cisco Call Manager depends on MS/SQL server and are thus vulnerable to SQL Slammer attacks.
• KISMET - 802.11a/b/g wireless network detector, sniffer and intrusion detection system.
• DISCO - Passive IP discovery and fingerprinting tool. Sits on a segment of a network to discover unique IPs and identify them.
• Yersina - Framework for analyzing and testing the deployed networks and systems. Designed to take advantage of some weakness in different Layer 2 protocols: Spanning Tree Protocol (STP), Cisco Discovery Protocol (CDP), Dynamic Trunking Protocol (DTP), Dynamic Host Configuration Protocol (DHCP), Hot Standby Router Protocol (HSRP), IEEE 802.1q, Inter-Switch Link Protocol (ISL), VLAN Trunking Protocol (VTP).
• EtterCap - Ettercap is a terminal-based network sniffer/interceptor/logger for ethernet LANs. It supports active and passive dissection of many protocols (even ciphered ones, like ssh and https). Data injection in an established connection and filtering on the fly is also possible, keeping the connection synchronized. Many sniffing modes were implemented to give you a powerful and complete sniffing suite. Plugins are supported. It has the ability to check whether you are in a switched LAN or not, and to use OS fingerprints (active or passive) to let you know the geometry of the LAN.
• Ntop : A network traffic usage monitor
• Ngrep : Convenient packet matching & display
• EtherApe : EtherApe is a graphical network monitor for Unix modeled after etherman
• Argus : A generic IP network transaction auditing tool
• Ike-scan : VPN detector/scanner
• Arpwatch : Keeps track of ethernet/IP address pairings and can detect certain monkey business

Password crackers

• John the Ripper - weak password detection. crypt, Kerberos AFS, MS/Windows LM, ...
• lCRACK - password hacker, dictionary, brute force incremental, ...
• THC Hydra : A Fast network authentication cracker which supports many different services
• Aircrack : The fastest available WEP/WPA cracking tool
• Airsnort : 802.11 WEP Encryption Cracking Tool
• RainbowCrack : An Innovative Password Hash Cracker

Honeypots

• Honeyd : Your own personal honeynet

Exploits:

• bobkit
• woot-project

• MetaSploit - Exploit launcher, test and development tool

Intrusion Detection Systems

• SNORT - This lightweight network intrusion detection and prevention system excels at traffic analysis and packet logging on IP networks. Through protocol analysis, content searching, and various pre-processors, Snort detects thousands of worms, vulnerability exploit attempts, port scans, and other suspicious behavior. Snort uses a flexible rule-based language to describe traffic that it should collect or pass, and a modular detection engine
• OSSEC HIDS : An Open Source Host-based Intrusion Detection System
• Fragroute/Fragrouter : A network intrusion detection evasion toolkit
• BASE : The Basic Analysis and Security Engine
• Sguil : The Analyst Console for Network Security Monitoring

Encryption Tools

• GnuPG / PGP : Secure your files and communication w/advanced encryption
• OpenSSL : The premier SSL/TLS encryption library
• Tor : An anonymous Internet communication system
• Stunnel : A general-purpose SSL cryptographic wrapper
• OpenVPN : A full-featured SSL VPN solution
• TrueCrypt : Open-Source Disk Encryption Software for Windows and Linux

Log Analysis

• AWStats
• Webalyzer
• Calamaris - parses logfiles from Squid, NetCache, Inktomi Traffic Server, Oops! proxy server, Novell Internet Caching System, Compaq Tasksmart or Netscape/iplanet Web Proxy Server and generates a report
• fwlogwatch - fwlogwatch is a packet filter / firewall / IDS log analyzer written by Boris Wesslowski originally for RUS-CERT. It supports a lot of log formats and has many analysis options. It also features incident report and realtime response capabilities, an interactive web interface and internationalization.
• LogCheck - Logcheck is a simple utility which is designed to allow a system administrator to view the logfiles which are produced upon hosts under their control.
• Logwatch - Logwatch analyzes and reports on system logs. It is a customizable and pluggable log-monitoring system and will go through the logs for a given period of time and make a customizable report. It should work right out of the package on most systems.
• syslog-ng is a flexible and highly scalable system logging application that is ideal for creating centralized and trusted logging solutions.
• LogAnalysis.org has multiple application specific log analyzers
• Swatch can assist with logfile analysis, providing immediate notification if log entries matching a regular expression are spotted, or to review logfiles for unknown data.

Network Monitoring and Management

• Nagios : An open source host, service and network monitoring program
• Argus : A generic IP network transaction auditing tool
• Sguil : The Analyst Console for Network Security Monitoring

AntiVirus

• ClamAV : A GPL anti-virus toolkit for UNIX
• AVG- AVG Internet Security for Linux
• F-PROT AntiVirus for Linux
• Avast!
• McAfee
• Avira AntiVir Personal

Other (no category)

• Bastille : Security hardening script for Linux, Mac OS X, and HP-UX

Novell owns the Unix Copyrights

I'm surprised that I haven't seen much about this in the Linux and Open Source blogs that I follow. I know most of us have realized for a long time that SCO had no legitimate claims to the Copyrights on Linux but the recent ruling in the SCO v Novell case is very important to those of us that love Linux. Thanks largely to Novell for not backing down to SCO and to Groklaw for their fantastic coverage of all of the trials.

http://www.groklaw.net/index.php

http://www.novell.com/news/press/utah-jury-confirms-novell-has-ownership-of-unix-copyrights/

http://www.pcworld.com/article/192955/jury_sides_with_novell_in_longrunning_sco_battle.html
(good job doing your homework there pcworld. the trial was in Utah, not Nevada)

http://www.ciol.com/Developer/Open-Source/News-Reports/Novell-owns-UNIX-copyright/134456/0/

http://news.cnet.com/8301-11424_3-20001527-90.html

http://www.sltrib.com/business/ci_14786202

Fedora 13 Alpha Release

Below is the press release from RedHat

F13 Alpha release announcement
From FedoraProject
Jump to: navigation, search

The Fedora 13 "Goddard" Alpha release is available! What's next for the free operating system that shows off the best new technology of tomorrow? You can see the future now at:

http://fedoraproject.org/get-prerelease
What is the Alpha release?

The Alpha release contains all the features of Fedora 13 in a form that anyone can help test. This testing, guided by the Fedora QA team, helps us target and identify bugs. When these bugs are fixed, we make a Beta release available. A Beta release is code-complete, and bears a very strong resemblance to the third and final release. The final release of Fedora 13 is due in May.

We need your help to make Fedora 13 the best release yet, so please take a moment of your time to download and try out the Alpha and make sure the things that are important to you are working. If you find a bug, please report it -- every bug you uncover is a chance to improve the experience for millions of Fedora users worldwide. Together, we can make Fedora a rock-solid distribution. (Read down to the end of the announcement for more information on how to help.)
Features

Among the top features for end users, we have:

* Automatic print driver installation. We're using RPM and PackageKit for automatic installation of printer drivers, so when you plug in a USB printer, Fedora will automatically offer to install drivers for it if needed.

* Automatic installation of language packs. Yum language packs plugin support makes software installation smarter and easier for everyone worldwide, by automatically downloading language support for large suites of Fedora software when the user's environment requires it.

* Redesigned user management interface. The user account tool has been completely redesigned, and the accountsdialog and accountsservice test packages are available to make it easy to configure personal information, make a personal profile picture or icon, generate a strong passphrase, and set up login options for your Fedora system.

* Color management. Color Management allows you to better set and control your colors for displays, printers, and scanners, through the gnome-color-manager package.

* NetworkManager improvements include CLI. NetworkManager is now a one stop shop for all of your networking needs in Fedora, be it dial-up, broadband, wifi, or even Bluetooth. And now it can all be done in the command line, if you're into that sort of thing.

* Experimental 3D extended to free Nouveau driver for NVidia cards. In this release we are one step closer to having 3D supported on completely free and open source software (FOSS) drivers. In Fedora 12 we got a lot of ATI chips working, and this time we've added a wide range of NVidia cards. You can install the mesa-dri-drivers-experimental package to try out the work in progress.

For developers there are all sorts of additional goodies:

* SystemTap static probes. SystemTap now has expanded capabilities to monitor higher-level language runtimes like Java, Python and Tcl, and also user space applications starting with PostgreSQL. In the future Fedora will add support for even more user space applications, greatly increasing the scope and power of monitoring for application developers.

* Easier Python debugging. We've added new support that allows developers working with mixed libraries (Python and C/C++) in Fedora to get more complete information when debugging with gdb, making Fedora an exceptional platform for powerful, rapid application development.

* Parallel-installable Python 3 stack. The parallel-installable Python 3 stack will will help programmers write and test code for use in both Python 2.6 and Python 3 environments, so you can future-proof your applications now using Fedora.

* NetBeans 6.8 first IDE to support entire Java 6 EE spec. NetBeans IDE 6.8 is the first IDE to offer complete support for the entire Java EE 6 specification.

And don't think we forgot the system administrators:

* boot.fedoraproject.org. (BFO) allows users to download a single, tiny image (could fit on a floppy) and install current and future versions of Fedora without having to download additional images.

* System Security Services Daemon (SSSD). SSSD provides expanded features for logging into managed domains, including caching for offline authentication. This means that, for example, users on laptops can still login when disconnected from the company's managed network. The authentication configuration tool in Fedora has already been updated to support SSSD, and work is underway to make it even more attractive and functional.

* Pioneering NFS features. Fedora offers the latest version 4 of the NFS protocol for better performance, and in conjunction with recent kernel modifications includes IPv6 support for NFS as well.

* Zarafa Groupware. Zarafa now makes available a complete Open Source groupware suite that can be used as a drop-in Exchange replacement for Web-based mail, calendaring, collaboration and tasks. Features include IMAP/POP and iCal/CalDAV capabilities, native mobile phone support, the ability to integrate with existing Linux mail servers, a full set of programming interfaces, and a comfortable look and feel using modern Ajax technologies.

* Btrfs snapshots integration. Btrfs is capable of creating lightweight filesystem snapshots that can be mounted (and booted into) selectively. The created snapshots are copy-on-write snapshots, so there is no file duplication overhead involved for files that do not change between snapshots. It allows developers to feel comfortable experimenting with new software without fear of an unusable install, since automated snapshots allow them to easily revert to the previous day's filesystem.

And that's only the beginning. A more complete list and details of each new cited feature is available here:

http://fedoraproject.org/wiki/Releases/13/FeatureList

We have nightly composes of alternate spins available here:

http://alt.fedoraproject.org/pub/alt/nightly-composes/