Goals
In this session you will:
- verify software from a public source
- see how SSL fits into the public key model
- lock down server daemons
- lock down inetd services
POST
- import the keys of everyone in the room: gpg --import
- when should you sign someone's key?
- sign the keys of everyone in the room: gpg --sign-key
- check the signatures on your keys: gpg --check-sigs
Now down to practical uses....
- make two text files: crypto1.txt and crypto2.txt
- clearsign crypto1.txt
gpg --clearsign
- make a detached signature for crypto2.txt
gpg --detach-sign --armor
- encrypt a note to yourself
gpg --encrypt
be sure of your binaries
- roll your own when possible
- check detached signatures
- make a detached signature of a system file:
gpg --detach-sign --armor --output here.asc /usr/sbin/sendmail
related: SSL
SSL is a public key cryptosystem (as above). The main differences are that:
- the web of trust is replaced with a certifying (and commercial!) entity
- the process is automated
SSL runs on port 443. The object of the game is to get a secure channel by through which the server/client can
exchange a session key, usually to do straight RSA (or some other form of) encryption. The order of events is as follows:
- Browser asks for an https URL.
- Server returns a signatory certificate (verisign, etc) and a public key.
- Browser checks the certificate, may prompt the user.
- Browser produces a session key, encrypts it to the server's public key and returns it to the server.
- The socket continues on, using the session key and RSA (or other) encryption).
shut down unnecessary services
The problem is how to shut down services when you don't know what they do. The tools at hand: man, google groups search.
Safest to do from the terminal.
- start with inetd
- wrap inetd services with a wrapper like
tcpd
/etc/hosts.allow
/etc/hosts.deny
enforce stronger services
- use ssh2 instead of telnet, ftp, rlogin
finding problematic files
- files from old users
- files that have been altered recently
- files that are setuid, etc
A brief discussion about network vulnerabilities
- port scanners are readily available
- netstat
- buffer overflows and the like
Homework
software to scan
http://www.mousetrap.net/syllabus/unix_security/day3.html
$Id: day3.orb,v 1.8 2002/04/09 21:21:43 mouse Exp $
Remember, your login is based on your machine's hostname, not on any other number.
~/[initials] refers to the subdirectory under your homedir, named after your initials. Everything except for .dotfiles will be stored in your ~/[initials] directory.
