book

Firewalls and Internet Security: Repelling the Wily Hacker, Second Edition

Name: Firewalls and Internet Security: Repelling the Wily Hacker, Second Edition
ISBN: 020163466X

by William R. Cheswick, Steven M. Bellovin, Aviel D. Rubin

February 2003

Intermediate to advanced

464 pages

12h 50m

English

Addison-Wesley Professional

Read now

Unlock full access

Copyright
Dedication
Addison-Wesley Professional Computing Series
Preface to the Second Edition
Crystal Ball or Bowling Ball?Our ApproachErrata and UpdatesAcknowledgments
Preface to the First Edition
AudienceTerminologyAcknowledgments
I. Getting Started
1. Introduction
1.1. Security Truisms1.2. Picking a Security Policy1.2.1. Policy Questions1.2.2. Stance1.3. Host-Based Security1.4. Perimeter Security1.5. Strategies for a Secure Network1.5.1. Host Security1.5.2. Gateways and Firewalls1.5.3. DMZs1.5.4. Encryption—Communications Security1.6. The Ethics of Computer Security1.7. WARNING
2. A Security Review of Protocols: Lower Layers
2.1. Basic Protocols2.1.1. IPIP Addresses2.1.2. ARP2.1.3. TCPTCP OpenTCP Sessions2.1.4. SCTP2.1.5. UDP2.1.6. ICMP2.2. Managing Addresses and Names2.2.1. Routers and Routing ProtocolsBGP2.2.2. The Domain Name SystemDNSsec2.2.3. BOOTP and DHCP2.3. IP version 62.3.1. IPv6 Address Formats2.3.2. Neighbor Discovery2.3.3. DHCPv62.3.4. Filtering IPv62.4. Network Address Translators2.5. Wireless Security2.5.1. Fixing WEP
3. Security Review: The Upper Layers
3.1. Messaging3.1.1. SMTP3.1.2. MIME3.1.3. POP version 33.1.4. IMAP Version 43.1.5. Instant Messaging3.2. Internet Telephony3.2.1. H.3233.2.2. SIP3.3. RPC-Based Protocols3.3.1. RPC and Rpcbind3.3.2. NIS3.3.3. NFS3.3.4. Andrew3.4. File Transfer Protocols3.4.1. TFTP3.4.2. FTP3.4.3. SMB Protocol3.5. Remote Login3.5.1. Telnet3.5.2. The “r” Commands3.5.3. Ssh3.6. Simple Network Management Protocol—SNMP3.7. The Network Time Protocol3.8. Information Services3.8.1. Finger: Looking Up People3.8.2. Whois—Database Lookup Service3.8.3. LDAP3.8.4. World Wide Web3.8.5. NNTP—Network News Transfer Protocol3.8.6. Multicasting and the MBone3.9. Proprietary Protocols3.9.1. RealAudio3.9.2. Oracle’s SQL*Net3.9.3. Other Proprietary Services3.10. Peer-to-Peer Networking3.11. The X11 Window System3.11.1. xdm3.12. The Small Services
4. The Web: Threat or Menace?
4.1. The Web Protocols4.1.1. HTTPMaintaining Connection State4.1.2. SSL4.1.3. FTP4.1.4. URLs4.2. Risks to the Clients4.2.1. ActiveX4.2.2. Java and Applets4.2.3. JavaScript4.2.4. Browsers4.3. Risks to the Server4.3.1. Access Controls4.3.2. Server-Side Scripts4.3.3. Securing the Server Host4.3.4. Choice of Server4.4. Web Servers vs. Firewalls4.5. The Web and Databases4.6. Parting Thoughts
II. The Threats

5. Classes of Attacks
5.1. Stealing Passwords5.2. Social Engineering5.3. Bugs and Back Doors5.4. Authentication Failures5.4.1. Authentication Races5.5. Protocol Failures5.6. Information Leakage5.7. Exponential Attacks—Viruses and Worms5.8. Denial-of-Service Attacks5.8.1. Attacks on a Network Link5.8.2. Attacking the Network LayerKiller and ICMP PacketsSYN Packet AttacksApplication-Level Attacks—Spam5.8.3. DDoS5.8.4. What to Do About a Denial-of-Service AttackFilter Out the Bad PacketsImprove the Processing SoftwareHunt Them Down Like DogsIncrease the Capacity of the Target5.8.5. Backscatter5.9. Botnets5.10. Active Attacks
6. The Hacker’s Workbench, and Other Munitions
6.1. Introduction6.2. Hacking Goals6.3. Scanning a Network6.4. Breaking into the Host6.5. The Battle for the Host6.5.1. Setuid root Programs6.5.2. Rootkit6.6. Covering Tracks6.6.1. Back Doors6.7. Metastasis6.8. Hacking Tools6.8.1. Crack—Dictionary Attacks on Unix Passwords6.8.2. Dsniff—Password Sniffing Tool6.8.3. Nmap—Find and Identify Hosts6.8.4. Nbaudit—Check NetBIOS Share Information6.8.5. Juggernaut—TCP Hijack Tool6.8.6. Nessus—Port Scanning6.8.7. DDoS Attack Tools6.8.8. Ping of Death—Issuing Pathological Packets6.8.9. Virus Construction Kits6.8.10. Other Tools6.9. Tiger Teams
III. Safer Tools and Services
7. Authentication
7.1. Remembering Passwords7.1.1. Rolling the Dice7.1.2. The Real Cost of Passwords7.2. Time-Based One-Time Passwords7.3. Challenge/Response One-Time Passwords7.4. Lamport’s One-Time Password Algorithm7.5. Smart Cards7.6. Biometrics7.7. RADIUS7.8. SASL: An Authentication Framework7.9. Host-to-Host Authentication7.9.1. Network-Based Authentication7.9.2. Cryptographic Techniques7.10. PKI
8. Using Some Tools and Services
8.1. Inetd—Network Services8.2. Ssh—Terminal and File Access8.2.1. Single-Factor Authentication for ssh8.2.2. Two-Factor Authentication8.2.3. Authentication Shortcomings8.2.4. Server Authentication8.3. Syslog8.4. Network Administration Tools8.4.1. Network Monitoring8.4.2. Using Tcpdump8.4.3. Ping, Traceroute, and Dig8.5. Chroot—Caging Suspect Software8.6. Jailing the Apache Web Server8.6.1. CGI Wrappers8.6.2. Security of This Web Server8.7. Aftpd—A Simple Anonymous FTP Daemon8.8. Mail Transfer Agents8.8.1. Postfix8.9. POP3 and IMAP8.10. Samba: An SMB Implementation8.11. Taming Named8.12. Adding SSL Support with Sslwrap
IV. Firewalls and VPNs
9. Kinds of Firewalls
9.1. Packet Filters9.1.1. Network Topology and Address-Spoofing9.1.2. Routing Filters9.1.3. Sample Configurations9.1.4. Packet-Filtering Performance9.2. Application-Level Filtering9.3. Circuit-Level Gateways9.4. Dynamic Packet Filters9.4.1. Implementation Options9.4.2. Replication and Topology9.4.3. The Safety of Dynamic Packet Filters9.5. Distributed Firewalls9.6. What Firewalls Cannot Do
10. Filtering Services
10.1. Reasonable Services to Filter10.1.1. DNS10.1.2. Web10.1.3. FTP10.1.4. TCP10.1.5. NTP10.1.6. SMTP/Mail10.1.7. POP3/IMAP10.1.8. ssh10.2. Digging for Worms10.3. Services We Don’t Like10.3.1. UDP10.3.2. H.323 and SIP10.3.3. RealAudio10.3.4. SMB10.3.5. X Windows10.4. Other Services10.4.1. IPsec, GRE, and IP over IP10.4.2. ICMP10.5. Something New
11. Firewall Engineering
11.1. Rulesets11.2. Proxies11.3. Building a Firewall from Scratch11.3.1. Building a Simple, Personal Firewall11.3.2. Building a Firewall for an OrganizationIpftest11.3.3. Application-Based Filtering11.4. Firewall Problems11.4.1. Inadvertent Problems11.4.2. Intentional Subversions11.4.3. Handling IP Fragments11.4.4. The FTP Problem11.4.5. Firewalking11.4.6. Administration11.5. Testing Firewalls11.5.1. Tiger Teams11.5.2. Rule InspectionThe RulesManual InspectionComputer-Assisted Inspection
12. Tunneling and VPNs
12.1. Tunnels12.1.1. Tunnels Good and Bad12.2. Virtual Private Networks (VPNs)12.2.1. Remote Branch Offices12.2.2. Joint Ventures12.2.3. TelecommutingDirect Connection to a CompanyConnecting Through an ISPNetworking on the Road12.3. Software vs. Hardware12.3.1. VPN in Software12.3.2. VPN in Hardware
V. Protecting an Organization
13. Network Layout
13.1. Intranet Explorations13.2. Intranet Routing Tricks13.3. In Host We Trust13.4. Belt and Suspenders13.5. Placement Classes
14. Safe Hosts in a Hostile Environment
14.1. What Do We Mean by “Secure”?14.2. Properties of Secure Hosts14.2.1. Secure ClientsWindows and MacintoshesSingle-User, Unix-Like SystemsMulti-User Hosts14.2.2. Secure Servers14.2.3. Secure Routers and Other Network Elements14.3. Hardware Configuration14.4. Field-Stripping a Host14.5. Loading New Software14.6. Administering a Secure Host14.6.1. Access14.6.2. Console Access14.6.3. Logging14.6.4. Backup14.6.5. Software Updates14.6.6. Watching the Roost14.7. Skinny-Dipping: Life Without a Firewall
15. Intrusion Detection
15.1. Where to Monitor15.2. Types of IDSs15.3. Administering an IDS15.4. IDS Tools15.4.1. Snort
VI. Lessons Learned
16. An Evening with Berferd
16.1. Unfriendly Acts16.2. An Evening with Berferd16.3. The Day After16.4. The Jail16.5. Tracing Berferd16.6. Berferd Comes Home
17. The Taking of Clark
17.1. Prelude17.2. Clark17.3. Crude Forensics17.4. Examining Clark17.4.1. /usr/lib17.4.2. /usr/var/tmp17.5. The Password File17.6. How Did They Get In?17.6.1. How Did They Become Root?17.6.2. What Did They Get of Value?17.7. Better Forensics17.8. Lessons Learned
18. Secure Communications over Insecure Networks
18.1. The Kerberos Authentication System18.1.1. Limitations18.2. Link-Level Encryption18.3. Network-Level Encryption18.3.1. ESP and AH18.3.2. Key Management for IPsec18.4. Application-Level Encryption18.4.1. Remote Login: Ssh18.4.2. SSL—The Secure Socket LayerProtocol OverviewSecurity18.4.3. Authenticating SNMP18.4.4. Secure Electronic MailS/MIMEPGP18.4.5. Transmission Security vs. Object Security18.4.6. Generic Security Service Application Program Interface
19. Where Do We Go from Here?
19.1. IPv619.2. DNSsec19.3. Microsoft and Security19.4. Internet Ubiquity19.5. Internet Security19.6. Conclusion
VII. Appendixes
A. An Introduction to Cryptography
A.1. NotationA.2. Secret-Key CryptographyA.3. Modes of OperationA.3.1. Electronic Code Book ModeA.3.2. Cipher Block Chaining ModeA.3.3. Output Feedback ModeA.3.4. Cipher Feedback ModeA.3.5. Counter ModeA.3.6. One-Time PasswordsA.3.7. Master KeysA.4. Public Key CryptographyA.5. Exponential Key ExchangeA.6. Digital SignaturesA.7. Secure Hash FunctionsA.8. Timestamps
B. Keeping Up
B.1. Mailing ListsB.2. Web ResourcesB.3. Peoples’ PagesB.4. Vendor Security SitesB.5. Conferences
Bibliography
List of s
List of Acronyms

Content preview from Firewalls and Internet Security: Repelling the Wily Hacker, Second Edition

Chapter 15. Intrusion Detection

	Behold, the fool saith, “Put not all thine eggs in the one basket”—which is but a manner of saying, “Scatter your money and your attention”; but the wise man saith, “Put all your eggs in the one basket and—watch that basket!”
	--PUDDIN’HEAD WILSON’S CALENDAR

It is important to post sentries near things you wish to protect, and an intrusion detection system (IDS) helps perform this function. As commercial products, these security tools have been promoted as the ultimate solution to network intrusions, and many IT managers have proclaimed that their network was secure because they had installed the latest firewall and IDS. These can help, but they’re far from a panacea.

There are several types of intrusion detection ...

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

Firewalls Don't Stop Dragons: A Step-by-Step Guide to Computer Security and Privacy for Non-Techies

Integrated Security Technologies and Solutions - Volume II: Cisco Security Solutions for Network Access Control, Segmentation, Context Sharing, Secure Connectivity and Virtualization

Chad Mitchell, Jamie Sanbower, Aaron Woland, Vivek Santuka

Publisher Resources

ISBN: 020163466XPurchase book

Firewalls and Internet Security: Repelling the Wily Hacker, Second Edition

by William R. Cheswick, Steven M. Bellovin, Aviel D. Rubin

Chapter 15. Intrusion Detection

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

You might also like

Firewalls Don't Stop Dragons: A Step-by-Step Guide to Computer Security and Privacy for Non-Techies

Practical Cisco Unified Communications Security

Network Security First-Step, Second Edition

Integrated Security Technologies and Solutions - Volume II: Cisco Security Solutions for Network Access Control, Segmentation, Context Sharing, Secure Connectivity and Virtualization

Publisher Resources

Chapter 15. Intrusion Detection

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,and much more.

You might also like

Firewalls Don't Stop Dragons: A Step-by-Step Guide to Computer Security and Privacy for Non-Techies

Practical Cisco Unified Communications Security

Network Security First-Step, Second Edition

Integrated Security Technologies and Solutions - Volume II: Cisco Security Solutions for Network Access Control, Segmentation, Context Sharing, Secure Connectivity and Virtualization

Publisher Resources

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.