CMS Security Handbook: The Comprehensive Guide for WordPress®, Joomla!®, Drupal™, and Plone®

Miscellaneous Hardening Tasks

Although this chapter provides information in many different areas about how to harden your server, some miscellaneous tasks still need attention, as discussed in the following sections.

Packet Sniffing

The term sniffing means to collect all the traffic (known as packets, as you learned earlier) going through a network interface card (NIC). Many tools can do this, and legitimate reasons exist for doing so. However, if a server in a production environment for which you have not authorized the use of a tool such as WireShark has a sniffer on it, bad things are happening.

Using WireShark, a person can access passwords, sensitive data, and more. Basically, anything that is travelling on the wire can be obtained. Figure 5-23 shows a sample capture (obtained from the WireShark website) that is decoding the traffic.

Figure 5-23: WireShark packet capture

In a capture such as this one, the traffic will allow the user sessions to be reconstructed, enabling a person with the right tools to learn what is being done. It will yield passwords, usernames, and more.

To check for sniffers, log in as the super user on your server and navigate to the following folder:

/proc/net/packet

You should see one header line looking something like this:

SK RefCnt Type Proto Iface R Rmem User Inode

If you see numbers appearing below this line, then you have a sniffer running. ...