464 Technique 60: Securing the Fort with Bastille

If you choose to deny the traffic, the connection is dropped without a reply to the visiting system. This gives you a bit of camouflage — potential intruders don’t know you’re there.

As a rule, we recommend accepting the default of DENY. Click OK to continue.

Interfaces for DHCP queries:

If you don’t assign static IP addresses to your network interfaces (and most people don’t), your computer uses DHCP (Dynamic Host Configuration Protocol) to configure the network. Enter the names of the interfaces that require DHCP configuration (you can leave the field blank if you’re using a regular PPP modem connection for dial-up service). Click OK to continue.

NTP servers to query:

If you’re using NTP (Network Time Protocol) to synchronize your network clocks, enter the host name of the NTP server in the Answer field. If not, leave the field blank and click OK to continue.

ICMP types to disallow outbound:

Disabling outbound ICMP types can help mask your system from unwanted system probes. Accept the default entries and click OK to continue.

Should Bastille run the firewall and enable it at boot time?

If you’re not sitting in front of your computer’s console, choose No; otherwise, you may lock yourself out of your own network. If you feel that your answers to the firewall configuration questions are accurate (and you’re logged in to the console), choose Yes to start the firewall and enable it at boot time. Click OK to continue.

The configuration file for your firewall is in

/etc/Bastille/bastille-firewall.cfg. You can modify it later.

Port scanning with Bastille

If you have enabled the Bastille firewall, you can use PSAD (the Port Scan Attack Detector) to find out if someone is scanning your machines. To set up PSAD, check the Yes box and click OK.

psad check interval:

This interval (in seconds) is how often psad checks for denied packets. Accept the default of 15 seconds and click OK.

Port range scan threshold:

This setting determines the sensitivity of the psad setup. A setting of 1 allows one port to be scanned without triggering an alert. If a second scan occurs (within the psad check interval), an alert is sent. If you want psad to be fairly sensitive to scanning, accept the default of 1 and click OK.

Enable scan persistence?

If you choose Yes, psad keeps a listing of scanned ports in memory: An attacker trying to avoid detection by scanning your ports over a long period of time will trigger an alert. In most cases, accepting the default of No is adequate to catch intruders. Choose the level of security you’re comfortable with and click OK to continue.

Scan timeout:

This is the length of time (in seconds) that psad keeps the data about a port scan. The default is 3600 seconds (or one hour). Enter a new value or accept the default, and then click OK.

Show all scan signatures?

When PSAD sends you a scan-alert e-mail, it includes a list of the scan signatures that it found. A scan signature is a pattern that PSAD finds in the attack. PSAD is preconfigured to recognize a number of well-known attach patterns.

If you answer Yes to this question, PSAD includes all signature matches in every e-mail. If you answer No

Hardening Your Hat with Bastille

465

to this question, PSAD e-mails only the signatures that triggered the scan alert. Make your choice and click OK to continue.

Danger Levels:

If PSAD detects a scan signature, it assigns a danger level based on the number of packets received. The higher the danger level, the higher the risk the intruder poses. The default values are reasonable, so we recommend that you just click OK to continue.

Email addresses:

Enter the e-mail address (or addresses) that should be notified if a problem occurs. If you enter more than one recipient, leave a single space between the addresses. Click OK to continue.

Email alert danger level:

By default, PSAD notifies you (via e-mail) when an attack of danger level 1 is detected. You can change the danger level to a higher number if you don’t want to know about all the scans that are aimed at your system. Click OK to continue.

Alert on all new packets?

Accept the default of Yes to be informed of any new packets that are sent to your machine during the course of a reported scan. Click OK to continue.

Enable automatic blocking of scanning IP’s?

This security feature actually poses some security threats. An intruder can pose as another computer and block your system from accessing that system by tripping the automatic blocking threshold.

If you’re configuring a personal workstation, we recommend changing the answer to Yes (the default is No). If you’re configuring a computer that provides network access to a number of users, accept the default of No and click OK.

Should Bastille enable psad at boot time?

If you’re confident of your answers, click the Yes box before clicking OK.

To manually start psad, enter # /etc/rc.d/ init.d/psad start.

To manually stop psad, enter # /etc/rc.d/init.d/psad stop.

You’re almost done!

When you reach the End Screen module, you’re asked to confirm that you’re finished making changes to the Bastille configuration (see Figure 60-3).

• Figure 60-3: You’re almost finished.

1. If you’re satisfied with the configuration, check the Yes box and click OK.

Double-click any of the module names to return to previous sections of the configuration to make changes.

A dialog opens, asking if you’d like to save the configuration changes (see Figure 60-4).

• Figure 60-4: Save your configuration changes.

466 Technique 60: Securing the Fort with Bastille

2. Click the Save Configuration button.

The Finishing Up dialog opens, as shown in Figure 60-5.

•Figure 60-5: The Finishing Up dialog.

3.Click the Apply Configuration to System button.

A window opens displaying programmer credits, as shown in Figure 60-6.

• Figure 60-6: These people worked hard to bring you Bastille.

4. Pause for a moment to appreciate the work done by these dedicated developers and then click the Close button.

A series of changes are made to your system as Bastille executes the changes to your configuration files.

If errors occur while Bastille applies your configuration choices, they’re listed in the file

/var/log/Bastille/error-log.

5. Reboot your system to make the changes take effect.

After rebooting, your system should be sturdier than ever before.

Keeping Abreast

of Security Issues

Knowing about security problems before they strike is a great way to protect your system. The sooner you know about the vulnerabilities, the sooner you can take steps to block intruders from exploiting weaknesses.

The news media is pretty good about keeping the public informed of mainstream viruses and Trojan horses that are traveling through the Internet, but a few agencies are at the forefront of security. You can sign up for mailing lists or monitor their Web sites to stay informed of the most recent (and most obscure) security issues. Here are a few sites you may want to visit:

CERT Coordination Center at Carnegie Mellon University (www.cert.org): This center created the first computer security incident response team. The advisories page is a great place to find the latest information on security issues affecting computer users.

U.S. Computer Emergency Readiness Team (www.us-cert.gov): You can read about or report new vulnerabilities, or sign up to receive security information via e-mail.

U.S. Department of Energy Computer Incident Advisory Capability (CIAC) (www.ciac.org/ ciac): Watch its security listings for issues that could affect the well-being of your system.

Red Hat’s listing of security alerts and advisories specific to Red Hat Linux (www.redhat. com/solutions/security/news): Cruise through the lists online, or sign up for e-mail notification of problems that are specific to Red Hat products.

61	Creating a Second
	Line of Defense
Technique	with LIDS

Save Time By

Controlling superuser privileges with LIDS

Preventing damage from a rogue superuser

Testing LIDS configurations in UML

Using LIDS to hide processes

In a standard Linux distribution, either you’re a superuser or you’re not; there is no middle ground. You have all the privileges, powers, and responsibilities, or you have none of them. That’s a pretty dangerous

way to run a computer. Your users might need superuser privileges to mount a CD, perform server maintenance, or run a debugger, but you don’t want the average Joe taking down your system with the reboot command or bypassing file permissions willy-nilly.

The Linux kernel picks apart the superuser’s powers into individually named capabilities. With a normal Linux kernel, a superuser capability is enabled for all programs, or it’s disabled for all programs — again, no middle ground. In this technique, we introduce you to LIDS (the Linux Intrusion Detection System). With LIDS, you can take away the privileges of the superuser, but grant access for individual programs so the power is there when you need it. Granting a capability to a program does not grant the capability to all users; you still have to be a superuser to use the capability. LIDS also lets you protect important data files and programs. When you protect a program (or data file) with LIDS, even the superuser can’t touch it.

This technique is like carrying around a little piece of Kryptonite; an intruder who somehow gains superuser privileges on your computer magically loses his villainous powers. With LIDS, you can control, privilege-by- privilege what the superuser can do. Good passwords, strong firewalls, and an effective backup strategy are still important, but LIDS provides a second line of defense against intruders who somehow get a password they shouldn’t have.

Turning LIDS On and Off

In a standard Linux kernel, you can disable individual capabilities, but any capability that you disable is completely unavailable. There’s no way to let some programs use a capability and disable it for others. LIDS gives you the power to pick and choose.