Network Security Hacks : 100 Industrial-Strength Tips and Tools

by Lockhart, Andrew

• ISBN13: 9780596006433
• ISBN10: 0596006438
• Format: Paperback
• Copyright: 2004-04-01
• Publisher: Oreilly & Associates Inc

Summary

This information-packed book provides more than 100 quick, practical, and clever things to do to help make your Linux, Unix, or Windows networks more secure. Loaded with concise but powerful examples of applied encryption, intrusion detection, logging, trending, and incident response, Network Security Hacks demonstrates effective methods for defending your servers and networks from a variety of devious and subtle attacks.

Table of Contents

Credits	p. ix
Preface	p. xi
Unix Host Security	p. 1
Secure Mount Points	p. 2
Scan for SUID and SGID Programs	p. 3
Scan For World- and Group-Writable Directories	p. 5
Create Flexible Permissions Hierarchies with POSIX ACLs	p. 5
Protect Your Logs from Tampering	p. 8
Delegate Administrative Roles	p. 10
Automate Cryptographic Signature Verification	p. 12
Check for Listening Services	p. 14
Prevent Services from Binding to an Interface	p. 16
Restrict Services with Sandboxed Environments	p. 18
Use proftp with a MySQL Authentication Source	p. 21
Prevent Stack-Smashing Attacks	p. 23
Lock Down Your Kernel with grsecurity	p. 25
Restrict Applications with grsecurity	p. 30
Restrict System Calls with Systrace	p. 32
Automated Systrace Policy Creation	p. 35
Control Login Access with PAM	p. 38
Restricted Shell Environments	p. 42
Enforce User and Group Resource Limits	p. 44
Automate System Updates	p. 45
Windows Host Security	p. 47
Check Servers for Applied Patches	p. 47
Get a List of Open Files and Their Owning Processes	p. 53
List Running Services and Open Ports	p. 54
Enable Auditing	p. 55
Secure Your Event Logs	p. 56
Change Your Maximum Log File Sizes	p. 57
Disable Default Shares	p. 58
Encrypt Your Temp Folder	p. 60
Clear the Paging File at Shutdown	p. 62
Restrict Applications Available to Users	p. 63
Network Security	p. 66
Detect ARP Spoofing	p. 67
Create a Static ARP Table	p. 69
Firewall with Netfilter	p. 71
Firewall with OpenBSD's PacketFilter	p. 75
Create an Authenticated Gateway	p. 80
Firewall with Windows	p. 82
Keep Your Network Self-Contained	p. 86
Test Your Firewall	p. 87
MAC Filtering with Netfilter	p. 90
Block OS Fingerprinting	p. 91
Fool Remote Operating System Detection Software	p. 94
Keep an Inventory of Your Network	p. 98
Scan Your Network for Vulnerabilities	p. 100
Keep Server Clocks Synchronized	p. 106
Create Your Own Certificate Authority	p. 108
Distribute Your CA to Clients	p. 111
Encrypt IMAP and POP with SSL	p. 113
Set Up TLS-Enabled SMTP	p. 115
Detect Ethernet Sniffers Remotely	p. 117
Install Apache with SSL and suEXEC	p. 121
Secure BIND	p. 125
Secure MySQL	p. 128
Share Files Securely in Unix	p. 130
Logging	p. 134
Run a Central Syslog Server	p. 135
Steer Syslog	p. 136
Integrate Windows into Your Syslog Infrastructure	p. 138
Automatically Summarize Your Logs	p. 144
Monitor Your Logs Automatically	p. 146
Aggregate Logs from Remote Sites	p. 149
Log User Activity with Process Accounting	p. 154
Monitoring and Trending	p. 156
Monitor Availability	p. 157
Graph Trends	p. 164
Run ntop for Real-Time Network Stats	p. 166
Audit Network Traffic	p. 169
Collect Statistics with Firewall Rules	p. 171
Sniff the Ether Remotely	p. 172
Secure Tunnels	p. 176
Set Up IPsec Under Linux	p. 176
Set Up IPsec Under FreeBSD	p. 179
Set Up IPsec in OpenBSD	p. 182
PPTP Tunneling	p. 183
Opportunistic Encryption with FreeS/WAN	p. 188
Forward and Encrypt Traffic with SSH	p. 189
Quick Logins with SSH Client Keys	p. 191
Squid Proxy over SSH	p. 193
Use SSH as a SOCKS Proxy	p. 195
Encrypt and Tunnel Traffic with SSL	p. 198
Tunnel Connections Inside HTTP	p. 200
Tunnel with VTun and SSH	p. 202
Automatic vtund.conf Generator	p. 207
Create a Cross-Platform VPN	p. 211
Tunnel PPP	p. 216
Network Intrusion Detection	p. 219
Detect Intrusions with Snort	p. 220
Keep Track of Alerts	p. 224
Real-Time Monitoring	p. 227
Manage a Sensor Network	p. 233
Write Your Own Snort Rules	p. 239
Prevent and Contain Intrusions with Snort_inline	p. 244
Automated Dynamic Firewalling with SnortSam	p. 247
Detect Anomalous Behavior	p. 250
Automatically Update Snort's Rules	p. 252
Create a Distributed Stealth Sensor Network	p. 253
Use Snort in High-Performance Environments with Barnyard	p. 254
Detect and Prevent Web Application Intrusions	p. 257
Simulate a Network of Vulnerable Hosts	p. 261
Record Honeypot Activity	p. 265
Recovery and Response	p. 268
Image Mounted Filesystems	p. 268
Verify File Integrity and Find Compromised Files	p. 270
Find Compromised Packages with RPM	p. 274
Scan for Root Kits	p. 276
Find the Owner of a Network	p. 278
Index	p. 281
Table of Contents provided by Ingram. All Rights Reserved.