Goals
In this session you will:
- look at NFS
- get an overview of tcpip security
POST
- In this url
http://www.somewhere.com/sales/texas/info.html
- what is the full path of the document being requested?
- what is the protocol?
- what is the domain name?
- what is the hostname?
- what is the name of the document being requested?
- what directory(s) is the document in?
- In this url
http://www.somewhere.com/ what document will be served?
- In this url
http://www.somewhere.com/email is the request for a file or directory?
- how might you find out the name of your ethernet device?
- what command might you use to take your ethernet device "offline"?
- ... and then put it back online?
NFS
- NFS is a networked filesystem for unix boxes; originally developed by Sun.
- used to share filesystem resources: NAS, NAS, traditional fileservers, etc.
- centralize disc resources - can have virtualized filesystems
- roughly equivilant to SMB (windows file sharing)
- control
/etc/fstab: remote directories this machine should attempt to mount
remote-host:remote-path local-mountpoint nfs options 0 0
/etc/exports: directories other machines should be allowed to mount
local-path option option
/sharethis yourbox otherbox
- who are the users? known users, nobody
- automounter
TCP security
Here are some starting points to consider:
- physically secure the box
- shut down all services, offer only what is necessary
- keep your distribution up to date
- firewall the box (hardware, software)
- run some form of intrusion detection (tripwire, etc)
some sample threats
- virus/worm threats
- DOS and other TCP attacks: spoofing, machine attack, network attack
- Denial of Service (aka nukes) v. load or bandwidth
- SYN flood; intentionally incomplete requests for service
- smurf: spoofed IP, ping broadcast of bignet
- teardrop: intentionally pre-fragmented invalid UDP packets cause memory leaks and lockup
- Distributed DOS: zombies (Stacheldraht (barbed wire) and upgrading!)
- smurf/packet of death
- automated overuse of the resource (eBay)
- email bombing
- login lockout attacks
- OS specific attacks: upgrade your OS
Conclusion
Where to go from here
- admin!
- build your own box
- continue to read the germane newsgroups
http://www.mousetrap.net/syllabus/tcpip/day4.html
$Id: day4.orb,v 1.3 2002/03/21 17:21:06 mouse Exp $
Remember, your login is based on your machine's hostname, not on any other number.
~/[initials] refers to the subdirectory under your homedir, named after your initials. Everything except for .dotfiles will be stored in your ~/[initials] directory.
