Network Security Hacks, 2nd Edition

Network Security Hacks, 2nd Edition

by Andrew Lockhart
Released October 2006
Publisher(s): O'Reilly Media, Inc.
ISBN: 9780596527631

Read it now on the O’Reilly learning platform with a 10-day free trial.

O’Reilly members get unlimited access to books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.

Buy on Amazon Buy on ebooks.com
Start your free trial

Book description

In the fast-moving world of computers, things are always changing. Since the first edition of this strong-selling book appeared two years ago, network security techniques and tools have evolved rapidly to meet new and more sophisticated threats that pop up with alarming regularity. The second edition offers both new and thoroughly updated hacks for Linux, Windows, OpenBSD, and Mac OS X servers that not only enable readers to secure TCP/IP-based services, but helps them implement a good deal of clever host-based security techniques as well.

This second edition of Network Security Hacks offers 125 concise and practical hacks, including more information for Windows administrators, hacks for wireless networking (such as setting up a captive portal and securing against rogue hotspots), and techniques to ensure privacy and anonymity, including ways to evade network traffic analysis, encrypt email and files, and protect against phishing attacks. System administrators looking for reliable answers will also find concise examples of applied encryption, intrusion detection, logging, trending and incident response.

In fact, this "roll up your sleeves and get busy" security book features updated tips, tricks & techniques across the board to ensure that it provides the most current information for all of the major server software packages. These hacks are quick, clever, and devilishly effective.

Publisher resources

View/Submit Errata

Table of contents

  1. Copyright
  2. Credits
    1. About the Author
    2. Contributors
    3. Acknowledgments
  3. Preface
    1. Why Network Security Hacks?
    2. How This Book Is Organized
    3. Conventions Used in This Book
    4. Safari Enabled
    5. Using Code Examples
    6. How to Contact Us
    7. Got a Hack?
  4. 1. Unix Host Security
    1. 1. Secure Mount Points
    2. 2. Scan for SUID and SGID Programs
    3. 3. Scan for World- and Group-Writable Directories
    4. 4. Create Flexible Permissions Hierarchies with POSIX ACLs
      1. Enabling ACLs
      2. Managing ACLs
    5. 5. Protect Your Logs from Tampering
    6. 6. Delegate Administrative Roles
    7. 7. Automate Cryptographic Signature Verification
    8. 8. Check for Listening Services
    9. 9. Prevent Services from Binding to an Interface
    10. 10. Restrict Services with Sandboxed Environments
      1. Using chroot()
      2. Using FreeBSD’s jail()
    11. 11. Use proftpd with a MySQL Authentication Source
      1. See Also
    12. 12. Prevent Stack-Smashing Attacks
    13. 13. Lock Down Your Kernel with grsecurity
      1. Patching the Kernel
      2. Configuring Kernel Options
        1. Low security
        2. Medium security
        3. High security
        4. Customized security settings
    14. 14. Restrict Applications with grsecurity
    15. 15. Restrict System Calls with systrace
    16. 16. Create systrace Policies Automatically
    17. 17. Control Login Access with PAM
      1. Limiting Access by Origin
      2. Restricting Access by Time
    18. 18. Restrict Users to SCP and SFTP
      1. Setting Up rssh
      2. Configuring chroot()
    19. 19. Use Single-Use Passwords for Authentication
      1. OPIE Under FreeBSD
      2. S/Key Under OpenBSD
    20. 20. Restrict Shell Environments
    21. 21. Enforce User and Group Resource Limits
    22. 22. Automate System Updates
  5. 2. Windows Host Security
    1. 23. Check Servers for Applied Patches
      1. Using HFNetChk
      2. See Also
    2. 24. Use Group Policy to Configure Automatic Updates
      1. Some Recommendations
      2. Digging Deeper
    3. 25. List Open Files and Their Owning Processes
    4. 26. List Running Services and Open Ports
    5. 27. Enable Auditing
    6. 28. Enumerate Automatically Executed Programs
    7. 29. Secure Your Event Logs
    8. 30. Change Your Maximum Log File Sizes
    9. 31. Back Up and Clear the Event Logs
      1. The Code
      2. Running the Hack
    10. 32. Disable Default Shares
    11. 33. Encrypt Your Temp Folder
    12. 34. Back Up EFS
      1. Backing Up Encrypted Data and EFS Keys
      2. Restoring EFS Keys
      3. Backing Up Recovery Agent Keys
    13. 35. Clear the Paging File at Shutdown
    14. 36. Check for Passwords That Never Expire
      1. The Code
      2. Running the Hack
  6. 3. Privacy and Anonymity
    1. 37. Evade Traffic Analysis
      1. Onion Routing
      2. Installing Tor
      3. Installing Privoxy
      4. Configuring Privoxy for Tor
      5. See Also
    2. 38. Tunnel SSH Through Tor
      1. See Also
    3. 39. Encrypt Your Files Seamlessly
    4. 40. Guard Against Phishing
      1. SpoofGuard
      2. Installing SpoofGuard
      3. How SpoofGuard Works
    5. 41. Use the Web with Fewer Passwords
      1. PwdHash
      2. Remote PwdHash
    6. 42. Encrypt Your Email with Thunderbird
      1. Setting Up Thunderbird
      2. Providing a Public/Private Key Pair
        1. Importing an existing key pair
        2. Generating a new key pair
      3. Sending and Receiving Encrypted Email
    7. 43. Encrypt Your Email in Mac OS X
      1. Installing GPG
      2. Creating a GPG Key
      3. Installing GPGMail
      4. Sending and Receiving Encrypted Email
  7. 4. Firewalling
    1. 44. Firewall with Netfilter
      1. Setting the Filtering Policy
      2. Rule Examples
      3. A Word About Stateful Inspection
      4. Ordering Rules
    2. 45. Firewall with OpenBSD’s PacketFilter
      1. Configuring PF
      2. Global Options
      3. Traffic Normalization Rules
      4. Filtering Rules
    3. 46. Protect Your Computer with the Windows Firewall
      1. Allow Programs to Bypass the Firewall
      2. Tracking Firewall Activity with a Windows Firewall Log
      3. Problems with Email and the Windows Firewall
      4. Hacking the Hack
      5. See Also
    4. 47. Close Down Open Ports and Block Protocols
    5. 48. Replace the Windows Firewall
      1. Installing CORE FORCE
      2. The Configuration Wizard
      3. Manual Configuration
    6. 49. Create an Authenticated Gateway
    7. 50. Keep Your Network Self-Contained
    8. 51. Test Your Firewall
    9. 52. MAC Filter with Netfilter
    10. 53. Block Tor
  8. 5. Encrypting and Securing Services
    1. 54. Encrypt IMAP and POP with SSL
    2. 55. Use TLS-Enabled SMTP with Sendmail
    3. 56. Use TLS-Enabled SMTP with Qmail
    4. 57. Install Apache with SSL and suEXEC
      1. Apache 1.x
      2. Apache 2.x
    5. 58. Secure BIND
      1. See Also
    6. 59. Set Up a Minimal and Secure DNS Server
      1. Installing daemontools
      2. Installing Djbdns
      3. Adding Records
    7. 60. Secure MySQL
    8. 61. Share Files Securely in Unix
  9. 6. Network Security
    1. 62. Detect ARP Spoofing
    2. 63. Create a Static ARP Table
    3. 64. Protect Against SSH Brute-Force Attacks
      1. Changing the Port
      2. Disabling Password Authentication
      3. Firewalling the SSH Daemon
        1. Limiting connections to your sshd
        2. Parsing logs and blocking an IP
        3. Rate-limiting SYN packets
    4. 65. Fool Remote Operating System Detection Software
    5. 66. Keep an Inventory of Your Network
    6. 67. Scan Your Network for Vulnerabilities
      1. Nessus 2.x
      2. Nessus 3.x
    7. 68. Keep Server Clocks Synchronized
    8. 69. Create Your Own Certificate Authority
      1. Creating the CA
      2. Signing Certificates
    9. 70. Distribute Your CA to Clients
    10. 71. Back Up and Restore a Certificate Authority with Certificate Services
      1. Backing Up a CA
      2. The Certification Authority Backup Wizard
      3. Restoring a CA to a Working Server
      4. Restoring a CA to a Different Server
      5. Decommissioning the Old CA
    11. 72. Detect Ethernet Sniffers Remotely
      1. Sniffing Shared Mediums
      2. Sniffing in Switched Environments
      3. Installing SniffDet
      4. Testing with ARP Queries
    12. 73. Help Track Attackers
    13. 74. Scan for Viruses on Your Unix Servers
      1. Installing ClamAV
      2. Configuring clamd
    14. 75. Track Vulnerabilities
      1. Mailing Lists
      2. RSS Feeds
      3. Cassandra
      4. Summary
  10. 7. Wireless Security
    1. 76. Turn Your Commodity Wireless Routers into a Sophisticated Security Platform
    2. 77. Use Fine-Grained Authentication for Your Wireless Network
      1. Deploying the RADIUS Server
      2. Configuring Your AP
    3. 78. Deploy a Captive Portal
      1. The Authentication Server
      2. Installing the Gateway
  11. 8. Logging
    1. 79. Run a Central Syslog Server
    2. 80. Steer Syslog
    3. 81. Integrate Windows into Your Syslog Infrastructure
      1. Using NTsyslog
      2. Using Eventlog to Syslog
    4. 82. Summarize Your Logs Automatically
    5. 83. Monitor Your Logs Automatically
      1. Installing swatch
      2. Configuration Syntax
    6. 84. Aggregate Logs from Remote Sites
      1. Compiling syslog-ng
      2. Configuring syslog-ng
      3. Translating Your syslog.conf
    7. 85. Log User Activity with Process Accounting
    8. 86. Centrally Monitor the Security Posture of Your Servers
      1. Installation
      2. Adding Agents
      3. Installing a Windows Agent
      4. Configuration
      5. Active Responses
      6. See Also
  12. 9. Monitoring and Trending
    1. 87. Monitor Availability
      1. Installing Nagios
      2. Installing Plug-ins
      3. Configuring Nagios
        1. Adding hosts to monitor
        2. Creating host groups
        3. Creating contacts and contact groups
        4. Configuring services to monitor
        5. Defining time periods
    2. 88. Graph Trends
    3. 89. Get Real-Time Network Stats
    4. 90. Collect Statistics with Firewall Rules
    5. 91. Sniff the Ether Remotely
  13. 10. Secure Tunnels
    1. 92. Set Up IPsec Under Linux
    2. 93. Set Up IPsec Under FreeBSD
      1. Client Configuration
      2. Gateway Configuration
      3. Using x.509 Certificates
    3. 94. Set Up IPsec in OpenBSD
      1. Password Authentication
      2. Certificate Authentication
    4. 95. Encrypt Traffic Automatically with Openswan
    5. 96. Forward and Encrypt Traffic with SSH
    6. 97. Automate Logins with SSH Client Keys
    7. 98. Use a Squid Proxy over SSH
    8. 99. Use SSH As a SOCKS Proxy
    9. 100. Encrypt and Tunnel Traffic with SSL
      1. Building Stunnel
      2. Configuring stunnel
      3. Encrypting Services
    10. 101. Tunnel Connections Inside HTTP
    11. 102. Tunnel with VTun and SSH
      1. Configuring VTun
      2. Testing VTun
      3. Encrypting the Tunnel
    12. 103. Generate VTun Configurations Automatically
      1. The Code
      2. Running the Hack
    13. 104. Create a Cross-Platform VPN
      1. Installing OpenVPN
      2. Testing OpenVPN
      3. Creating Your Configuration
      4. Using OpenVPN and Windows
      5. Using OpenVPN with Mac OS X
    14. 105. Tunnel PPP
      1. See Also
  14. 11. Network Intrusion Detection
    1. 106. Detect Intrusions with Snort
      1. Installing Snort
      2. Testing Snort
      3. Configuring Snort
      4. See Also
    2. 107. Keep Track of Alerts
    3. 108. Monitor Your IDS in Real Time
      1. Creating the Database
      2. Setting Up the Server
      3. Installing a Sensor
        1. Patching Snort
        2. Patching Barnyard
      4. Finishing Up
    4. 109. Manage a Sensor Network
      1. Installing the Prerequisites
      2. Setting Up the Console
      3. Setting Up an Agent
      4. Adding an Agent to the Console
    5. 110. Write Your Own Snort Rules
      1. Rule Basics
        1. Actions
        2. Protocols
        3. IP addresses
        4. Ports
      2. Options
        1. Adding human-readable messages
        2. Inspecting packet content
        3. Matching TCP flags
      3. Thresholding
        1. Thresholding by signature ID
        2. Thresholding with rule options
      4. Suppression
    6. 111. Prevent and Contain Intrusions with Snort_inline
    7. 112. Automatically Firewall Attackers with SnortSam
      1. Installing SnortSam
      2. Configuring SnortSam
      3. See Also
    8. 113. Detect Anomalous Behavior
    9. 114. Automatically Update Snort’s Rules
    10. 115. Create a Distributed Stealth Sensor Network
    11. 116. Use Snort in High-Performance Environments with Barnyard
      1. Installation
      2. Configuring Snort
      3. Configuring Barnyard
      4. Testing Barnyard
    12. 117. Detect and Prevent Web Application Intrusions
      1. Installing mod_security
      2. Enabling and Configuring mod_security
      3. Creating Filters
      4. See Also
    13. 118. Scan Network Traffic for Viruses
      1. Patching Snort
      2. Configuring the Preprocessor
        1. Ports to scan
        2. Direction to scan
        3. Blocking propagation
        4. Miscellaneous options
      3. Trying It Out
    14. 119. Simulate a Network of Vulnerable Hosts
      1. Compiling honeyd
      2. Configuring honeyd
      3. Running honeyd
      4. Testing honeyd
    15. 120. Record Honeypot Activity
      1. Installing the Linux Client
      2. Setting Up the Server
      3. Installing the Windows Client
  15. 12. Recovery and Response
    1. 121. Image Mounted Filesystems
    2. 122. Verify File Integrity and Find Compromised Files
      1. Building and Installing Tripwire
      2. Configuring Tripwire
      3. Day-to-Day Use
      4. See Also
    3. 123. Find Compromised Packages
      1. Using RPM
      2. Using Other Package Managers
    4. 124. Scan for Rootkits
    5. 125. Find the Owner of a Network
      1. Getting DNS Information
      2. Getting Netblock Information
  16. About the Author
  17. Colophon
  18. Copyright

Product information

  • Title: Network Security Hacks, 2nd Edition
  • Author(s): Andrew Lockhart
  • Release date: October 2006
  • Publisher(s): O'Reilly Media, Inc.
  • ISBN: 9780596527631