Xem mẫu

The ~/.rhosts file can be used to allow remote access to a system and is sometimes used by intruders to create easy backdoors into a system. If this file has recently been modified, examine it for evidence of tampering. Initially and periodically verify that the remote host and user names in the files are consistent with local user access requirements. View with extreme caution a “+” entry; this allows users from any host to access the local system. An older vulnerability is systems set up with a single “+” in the /etc/hosts.equiv file. This allows any other system to log in to your system. The “+” should be replaced with specific system names. Note, however, that an intruder cannot gain root access through /etc/rhosts entries. ~/ftp Files Directories which can be written to by anonymous FTP users are commonly used for storing and exchanging intruder files. Do not allow the user “ftp” to own any directories or files. System Executables in User Directories Copies of what may appear to be system executables in user directories may actually be an attempt to conceal malicious software. For example, recent attacks have made use of binaries called “vi” and “sed”, two commonly used Unix utilities. However, these particular binaries were actually renamed intrusion software files, designed to scan systems for weaknesses. System binaries found in unusual locations may be compared to the actual executable using the “cmp” command: Determining if System Executables Have Been Trojaned SPI or Tripwire must be set up before an exposure in order to determine if your system executables have been Trojaned. Use your CD-ROM to make sure you have a good copy of all your system executables, then run the above mentioned products according to the instructions that accompany them to create a basis for later comparison. Periodically, run SPI or Tripwire to detect any modification of the system executables. /etc/inetd.conf Print a baseline listing of this file for comparison. Look for new services. /etc/aliases Look for unusual aliases and those that redirect E-mail to unlikely places. Look for suspicious commands. cron Look for new entries in cron tab, especially root’s. Look at each user’s table. /etc/rc* Look for additions to install or reinstall backdoors or sniffer programs. Use SPI or Tripwire to detect changes to files. NFS Exports Use the “showmount -a” command to find users that have file systems mounted. 248 Check the /etc/exports (or equivalent) file for modifications. Run SPI or Tripwire to detect changes. Changes to Critical Binaries Run SPI or Tripwire initially and then periodically. Use the “ls -lc” command to determine if there have been inappropriate changes to these files. Note that the change time displayed by the “ls -lc” command can be changed and the command itself can be Trojaned. 249 Section References: Pichnarczyk, Karen, Weeber, Steve & Feingold, Richard. “Unix Incident Guide: How to Detect an Intrusion CIAC-2305 R.1”. C I A C Department of Energy. December, 1994. 250 Appendix A : How Most Firewalls are Configured All firewalls from any vendor that will be providing Internet firewall facilities require a routed connection to the Internet to provide traffic flow between the Internet and in-house network facilities. There are usually more than one router involved in such connections. With some effort, connections are successful but usually difficult to monitor and manage. A typical set-up with an Internet Service Provider where a firewall is configured in the network is set-up as follows: A B C D Ethernet/802.3 E Internet CSU/DSU IP Router Firewall System F Ethernet/802.3 G Trusted Network Hub In the above diagram, the network and firewall connection parts are as follows: a) Internet connection provided by an Internet Service Provider (ISP) b) A CSU/DSU interface to the telephone drop from the local equipment company (LEC) 251 c) A router system to connect to the ISP’s router connection to the Internet d) An Ethernet/802.3 or Token Ring/802.5 UTP connection from the router to the firewall e) A “dual-homed gateway” firewall system with two LAN controllers (in this diagram, two Ethernet/802.3 connections are provided) f) An Ethernet/802.3 UTP connection from the firewall to the internal network g) An internal network configuration. In this case, a simple stacked hub architecture (e.g. Cabletron Mini-MAC) The above is an illustration of a typical, but simple, network configuration between a customer network and the Internet where information provision (e.g. a Web Site) will not be used. Using a Router as a “Screen” One of the more popular configurations of a “firewall” is to use an external router as the singular security facility between an untrusted network (e.g. Internet) and the internal, trusted network. This configuration is called a “screening router” set-up. A typical configuration is as follows: A Internet B CSU/DSU C IP Router Ethernet/802.3 D E Trusted Network Hub The network configuration for a “screening router” is as follows: a) Internet connection provided by an Internet Service Provider (ISP) b) A CSU/DSU interface to the telephone drop from the local equipment company (LEC) c) A router system to connect to the ISP’s router connection to the Internet. On this router, there are a variety of “filter” rules, which provide some level of security between the trusted internal network and the untrusted Internet connection. d) An Ethernet/802.3 or Token Ring/802.5 UTP connection from the router to the internal network 252 ... - tailieumienphi.vn
nguon tai.lieu . vn