Security

Software Vulnerabilities

Question
What can you do from a sysadmin perspective to linux these vulerabilities?

Answer
Reduce the privileges that your applications run with to minimize the impact of security bugs.
A process running as an unprivileged user can do less damage than one that runs as root.

Unecessary services

Stock systems come with lots of services running by default.

Disable (and possibly remove) those that are unnecessary, especially if they are network daemons.

Clean up services

Identify the network exposed services

netstat # older, being phased out for ss but still works
ss      # socket stats

ss example:

sudo ss --tcp --udp --listening --processes --ipv4 --numeric
tcp   LISTEN 0 4096 127.0.0.1:631 0.0.0.0:* users:(("cupsd",pid=58694,fd=7))               

# Breakdown
LISTEN # (State) this is a networking socket in the LISTEN state

# Essentially kernel packet queue rules
0    # (Recv-Q) Number of connections established and waiting to be accepted by the application
4096 # (Send-Q) Maximum size of backlog of requests, queue up to 4096 pending accept connections

# LocalAddress:Port - this just checks the inverse, when a packet comes in
# does it match these destinations, if so send it to this process
127.0.0.1 # (Local Address) 
Port # (Port)
# This is secure because theres basically no way for another machine can send a packet
# with the destination of 127.0.0.1 unless it's coming from the location machine

# Peer Address:Port
# This means there no connected peers (which is always for a LISTEN), this field is not
# relevant to LISTEN sockets
0.0.0.0:*

Note

While I have no firewall on this system ss reveals something important, no one be able to connect to this machine, purely because I have no sockets listening on ports an external machine could reach.

 Netid      State       Recv-Q       Send-Q             Local Address:Port              Peer Address:Port 
udp        UNCONN      0            0                     127.0.0.54:53                     0.0.0.0:*     
udp        UNCONN      0            0                  127.0.0.53%lo:53                     0.0.0.0:*     
tcp        LISTEN      0            4096                  127.0.0.54:53                     0.0.0.0:*     
tcp        LISTEN      0            4096               127.0.0.53%lo:53                     0.0.0.0:*     
tcp        LISTEN      0            4096                   127.0.0.1:631                    0.0.0.0:*

Drill deeper down into the services exposed on the network

Once you’ve picked a service to investigate theres a number of tools to decide what to do

tcp LISTEN 0 4096 127.0.0.1:631 0.0.0.0:* users:(("cupsd",pid=58694,fd=7))               

# ps - process stats
ps -p 58694 -o pid,ppid,user,etime,cmd
58694       1 root        01:34:21 /usr/sbin/cupsd -l

# systemctl - very useful if managed by systemctl which is likely for daemons
systemctl status 58694
#    ● cups.service - CUPS Scheduler
#    Loaded: loaded (/usr/lib/systemd/system/cups.service; enabled; preset: enabled)
#   ...
systemctl cat cups #  read the unit file

# dpkg - find out which package installed this (another create reason to use apt)
sudo dpkg --search /usr/sbin/cupsd
#   cups-daemon: /usr/sbin/cupsd  # the package that installed the daemon

# lsof - list open files
sudo lsof -p 59694 # very verbose all the open fds
sudo lsof -i:631 # less verbose just open fds on this port

# fuser - file user
fuser # terse cousin of lsof
sudo fuser 631/tcp # prints pid
sudo fuser /var/log/cups/access_log  # slightly different but the process by a file
    /var/log/cups/access_log: 58694

Security Tools

John the Ripper

sudo john /etc/shadow

Zeek (formally bro)

Zeek is network intrusion detection system (NIDS) that monitors network traffic and looks for suspicious activity. Bro inspects all traffic flowing into and out of a network. It can listen only or take action.

Snort

Snort (Cisco) is an open source network intrusion prevention and detection system. Snort is free, Cisco’s rules are paid.

Similar to Zeek but less powerful but way simplier.

Snort captures raw packets off the network wire and compares them with a set of rules, aka signatures. When Snort detects an event that’s been defined as interesting, it can alert a system administrator or contact a network device to block the undesired traffic, among other actions.

Fail2Ban

Fail2Ban is a Python script that monitors log files such as /var/log/auth.log and /var/log/apache2/error.log.
It looks for suspicious occurrences such as multiple failed login attempts or queries to unusually long URLs. Fail2Ban then takes action to address the threat

Random numbers

Kernel developers have put in lots work into recording subtle variations in system behavior and using these as sources of randomness.
Sources include timing of packets, timing of hardware interrupts to communication with hardware devices such as disk drives.

/dev/random
/dev/urandom # use this one

Nothing that runs in user space can compete with the quality of the kernel’s random number generator. Always use these.

Openssl

openssl s_client -connect google.com:443 # Get server cert

# Generate a x509 cert
openssl req -new -newkey rsa:2048 -nodes \
    -keyout stag.key -out stag.csr \
    -subj "/CN=server.com" \
    -addext "subjectAltName=DNS:server.com,DNS:hello.server.com"

PGP

PGP’s file formats and protocols are standardized as OpenPGP. The main unix implementation is GNU Privacy Guard (GPG).

PGP is really just glue over existing primatives:

condfidentiality: symmetric cipher, which use public key to wrap the session key
integrity/authencation: digita signatures over hash
compression before encrypt
key management: keyrings
base64 encoding for email

Cryptography

Definitions

TODO:

Cryptography applying math to secure communications
A cryptographic algorithm, called a cipher, is the set of mathematical steps taken to secure a message
Encryption is the process of using a cipher to convert plain text messages to unreadable ciphertext
Decryption is the reverse of that process

Edit this page