book

Network Security Hacks, 2nd Edition

Name: Network Security Hacks, 2nd Edition
Author: Andrew Lockhart
ISBN: 9780596527631

by Andrew Lockhart

October 2006

Intermediate to advanced

478 pages

12h 11m

English

O'Reilly Media, Inc.

Read now

Unlock full access

Copyright
Credits
About the AuthorContributorsAcknowledgments
Preface
Why Network Security Hacks?How This Book Is OrganizedConventions Used in This BookSafari EnabledUsing Code ExamplesHow to Contact UsGot a Hack?
1. Unix Host Security
1. Secure Mount Points2. Scan for SUID and SGID Programs3. Scan for World- and Group-Writable Directories4. Create Flexible Permissions Hierarchies with POSIX ACLsEnabling ACLsManaging ACLs5. Protect Your Logs from Tampering6. Delegate Administrative Roles7. Automate Cryptographic Signature Verification8. Check for Listening Services9. Prevent Services from Binding to an Interface10. Restrict Services with Sandboxed EnvironmentsUsing chroot()Using FreeBSD’s jail()11. Use proftpd with a MySQL Authentication SourceSee Also12. Prevent Stack-Smashing Attacks13. Lock Down Your Kernel with grsecurityPatching the KernelConfiguring Kernel OptionsLow securityMedium securityHigh securityCustomized security settings14. Restrict Applications with grsecurity15. Restrict System Calls with systrace16. Create systrace Policies Automatically17. Control Login Access with PAMLimiting Access by OriginRestricting Access by Time18. Restrict Users to SCP and SFTPSetting Up rsshConfiguring chroot()19. Use Single-Use Passwords for AuthenticationOPIE Under FreeBSDS/Key Under OpenBSD20. Restrict Shell Environments21. Enforce User and Group Resource Limits22. Automate System Updates
2. Windows Host Security
23. Check Servers for Applied PatchesUsing HFNetChkSee Also24. Use Group Policy to Configure Automatic UpdatesSome RecommendationsDigging Deeper25. List Open Files and Their Owning Processes26. List Running Services and Open Ports27. Enable Auditing28. Enumerate Automatically Executed Programs29. Secure Your Event Logs30. Change Your Maximum Log File Sizes31. Back Up and Clear the Event LogsThe CodeRunning the Hack32. Disable Default Shares33. Encrypt Your Temp Folder34. Back Up EFSBacking Up Encrypted Data and EFS KeysRestoring EFS KeysBacking Up Recovery Agent Keys35. Clear the Paging File at Shutdown36. Check for Passwords That Never ExpireThe CodeRunning the Hack
3. Privacy and Anonymity
37. Evade Traffic AnalysisOnion RoutingInstalling TorInstalling PrivoxyConfiguring Privoxy for TorSee Also38. Tunnel SSH Through TorSee Also39. Encrypt Your Files Seamlessly40. Guard Against PhishingSpoofGuardInstalling SpoofGuardHow SpoofGuard Works41. Use the Web with Fewer PasswordsPwdHashRemote PwdHash42. Encrypt Your Email with ThunderbirdSetting Up ThunderbirdProviding a Public/Private Key PairImporting an existing key pairGenerating a new key pairSending and Receiving Encrypted Email43. Encrypt Your Email in Mac OS XInstalling GPGCreating a GPG KeyInstalling GPGMailSending and Receiving Encrypted Email
4. Firewalling
44. Firewall with NetfilterSetting the Filtering PolicyRule ExamplesA Word About Stateful InspectionOrdering Rules45. Firewall with OpenBSD’s PacketFilterConfiguring PFGlobal OptionsTraffic Normalization RulesFiltering Rules46. Protect Your Computer with the Windows FirewallAllow Programs to Bypass the FirewallTracking Firewall Activity with a Windows Firewall LogProblems with Email and the Windows FirewallHacking the HackSee Also47. Close Down Open Ports and Block Protocols48. Replace the Windows FirewallInstalling CORE FORCEThe Configuration WizardManual Configuration49. Create an Authenticated Gateway50. Keep Your Network Self-Contained51. Test Your Firewall52. MAC Filter with Netfilter53. Block Tor
5. Encrypting and Securing Services
54. Encrypt IMAP and POP with SSL55. Use TLS-Enabled SMTP with Sendmail56. Use TLS-Enabled SMTP with Qmail57. Install Apache with SSL and suEXECApache 1.xApache 2.x58. Secure BINDSee Also59. Set Up a Minimal and Secure DNS ServerInstalling daemontoolsInstalling DjbdnsAdding Records60. Secure MySQL61. Share Files Securely in Unix
6. Network Security
62. Detect ARP Spoofing63. Create a Static ARP Table64. Protect Against SSH Brute-Force AttacksChanging the PortDisabling Password AuthenticationFirewalling the SSH DaemonLimiting connections to your sshdParsing logs and blocking an IPRate-limiting SYN packets65. Fool Remote Operating System Detection Software66. Keep an Inventory of Your Network67. Scan Your Network for VulnerabilitiesNessus 2.xNessus 3.x68. Keep Server Clocks Synchronized69. Create Your Own Certificate AuthorityCreating the CASigning Certificates70. Distribute Your CA to Clients71. Back Up and Restore a Certificate Authority with Certificate ServicesBacking Up a CAThe Certification Authority Backup WizardRestoring a CA to a Working ServerRestoring a CA to a Different ServerDecommissioning the Old CA72. Detect Ethernet Sniffers RemotelySniffing Shared MediumsSniffing in Switched EnvironmentsInstalling SniffDetTesting with ARP Queries73. Help Track Attackers74. Scan for Viruses on Your Unix ServersInstalling ClamAVConfiguring clamd75. Track VulnerabilitiesMailing ListsRSS FeedsCassandraSummary
7. Wireless Security
76. Turn Your Commodity Wireless Routers into a Sophisticated Security Platform77. Use Fine-Grained Authentication for Your Wireless NetworkDeploying the RADIUS ServerConfiguring Your AP78. Deploy a Captive PortalThe Authentication ServerInstalling the Gateway

8. Logging
79. Run a Central Syslog Server80. Steer Syslog81. Integrate Windows into Your Syslog InfrastructureUsing NTsyslogUsing Eventlog to Syslog82. Summarize Your Logs Automatically83. Monitor Your Logs AutomaticallyInstalling swatchConfiguration Syntax84. Aggregate Logs from Remote SitesCompiling syslog-ngConfiguring syslog-ngTranslating Your syslog.conf85. Log User Activity with Process Accounting86. Centrally Monitor the Security Posture of Your Servers InstallationAdding AgentsInstalling a Windows AgentConfigurationActive ResponsesSee Also
9. Monitoring and Trending
87. Monitor AvailabilityInstalling NagiosInstalling Plug-insConfiguring NagiosAdding hosts to monitorCreating host groupsCreating contacts and contact groupsConfiguring services to monitorDefining time periods88. Graph Trends89. Get Real-Time Network Stats90. Collect Statistics with Firewall Rules91. Sniff the Ether Remotely
10. Secure Tunnels
92. Set Up IPsec Under Linux93. Set Up IPsec Under FreeBSDClient ConfigurationGateway ConfigurationUsing x.509 Certificates94. Set Up IPsec in OpenBSDPassword AuthenticationCertificate Authentication95. Encrypt Traffic Automatically with Openswan96. Forward and Encrypt Traffic with SSH97. Automate Logins with SSH Client Keys98. Use a Squid Proxy over SSH99. Use SSH As a SOCKS Proxy100. Encrypt and Tunnel Traffic with SSLBuilding StunnelConfiguring stunnelEncrypting Services101. Tunnel Connections Inside HTTP102. Tunnel with VTun and SSHConfiguring VTunTesting VTunEncrypting the Tunnel103. Generate VTun Configurations AutomaticallyThe CodeRunning the Hack104. Create a Cross-Platform VPNInstalling OpenVPNTesting OpenVPNCreating Your ConfigurationUsing OpenVPN and WindowsUsing OpenVPN with Mac OS X105. Tunnel PPPSee Also
11. Network Intrusion Detection
106. Detect Intrusions with SnortInstalling SnortTesting SnortConfiguring SnortSee Also107. Keep Track of Alerts108. Monitor Your IDS in Real TimeCreating the DatabaseSetting Up the ServerInstalling a SensorPatching SnortPatching BarnyardFinishing Up109. Manage a Sensor NetworkInstalling the PrerequisitesSetting Up the ConsoleSetting Up an AgentAdding an Agent to the Console110. Write Your Own Snort RulesRule BasicsActionsProtocolsIP addressesPortsOptionsAdding human-readable messagesInspecting packet contentMatching TCP flagsThresholdingThresholding by signature IDThresholding with rule optionsSuppression111. Prevent and Contain Intrusions with Snort_inline112. Automatically Firewall Attackers with SnortSamInstalling SnortSamConfiguring SnortSamSee Also113. Detect Anomalous Behavior114. Automatically Update Snort’s Rules115. Create a Distributed Stealth Sensor Network116. Use Snort in High-Performance Environments with BarnyardInstallationConfiguring SnortConfiguring BarnyardTesting Barnyard117. Detect and Prevent Web Application IntrusionsInstalling mod_securityEnabling and Configuring mod_securityCreating FiltersSee Also118. Scan Network Traffic for VirusesPatching SnortConfiguring the PreprocessorPorts to scanDirection to scanBlocking propagationMiscellaneous optionsTrying It Out119. Simulate a Network of Vulnerable HostsCompiling honeydConfiguring honeydRunning honeydTesting honeyd120. Record Honeypot ActivityInstalling the Linux ClientSetting Up the ServerInstalling the Windows Client
12. Recovery and Response
121. Image Mounted Filesystems122. Verify File Integrity and Find Compromised FilesBuilding and Installing TripwireConfiguring TripwireDay-to-Day UseSee Also123. Find Compromised PackagesUsing RPMUsing Other Package Managers124. Scan for Rootkits125. Find the Owner of a NetworkGetting DNS InformationGetting Netblock Information
About the Author
Colophon
Copyright

Content preview from Network Security Hacks, 2nd Edition

Copyright

Published by O’Reilly Media, Inc., 1005 Gravenstein Highway North, Sebastopol, CA 95472.

O’Reilly books may be purchased for educational, business, or sales promotional use. Online editions are also available for most titles (safari.oreilly.com). For more information, contact our corporate/institutional sales department: (800) 998-9938 or corporate@oreilly.com.

Editor: Brian Sawyer

Production Editor: Philip Dangler

Copyeditor: Rachel Wheeler

Indexer: Ellen Troutman-Zaig

Cover Designer: Karen Montgomery

Interior Designer: David Futato

Illustrators: Robert Romano and Jessamyn Read

Printing History:

April 2004: First Edition.

November 2006: Second Edition.

Nutshell Handbook, the Nutshell Handbook logo, and the O’Reilly logo are registered trademarks of O’Reilly Media, Inc. The Hacks series designations, Network Security Hacks, the image of barbed wire, and related trade dress are trademarks of O’Reilly Media, Inc.

Many of the designations used by manufacturers and sellers to distinguish their products are claimed as trademarks. Where those designations appear in this book, and O’Reilly Media, Inc. was aware of a trademark claim, the designations have been printed in caps or initial caps.

While every precaution has been taken in the preparation of this book, the publisher and author assume no responsibility for errors or omissions, or for damages resulting from the use of the information ...

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.

Julian F.

Head of Cybersecurity

I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.

Addison B.

Field Engineer

I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.

Amir M.

Data Platform Tech Lead

I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.

Mark W.

Embedded Software Engineer

Publisher Resources

ISBN: 0596527632Errata Page

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design

Business

Soft Skills

Network Security Hacks, 2nd Edition

by Andrew Lockhart

Copyright

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.