Linux system build SNORT Intrusion detection system

5. install snort tarzxvfsnort-(version number) into the extracted directory.

/Configure — with-mysql =/usr/local/mysql make makeinstall 6, install snort rules library tarzxvfsnortrules-(version number) to generate etc, doc, rules, so.rules four directory mkdir/etc/snort mkdir/etc/snort/rules mkdir/var/log/snort/etc/snort/cpetc cp-Rrules/*/*/etc/snort vi/etc/snort/snort.con 46 line should read: varHOME_NETXXX.XXX.XXX.0/24 111 line should read: varRules_PATH/etc/snort/rules 764 line should read: outputdatabase: log, mysql, password, user = root = XXXX (password, ibid.), dbname = snort host = localost 863-874 lines removed # 7, create snort database. Createdatabasesnort/mysql-uroot-pmysql >; > grantINSERT, SELECTonroot. * to snort @ localhost >/mydql-uroot-pusesnortmysql > showtables exit. 8, installing adodb tarzxvfadodb-(version number) cpadodb/usr/local/apache/htdocs 9, install jpgrap tarzxvfjpgraph-(version number) to move the extracted directory to/usr/local/apache/htdocs and renamed jpgrap 10, install acid tarzxvfacid-(version number) to move the extracted directory, and renamed the/usr/local/apache/htdocs acid vi/acid/acid_conf.pp $/usr/local/apache/htdocs/adodb DBlib_Path = ' '; $ alert_dbname = "snort"; $ alert_host = "localhost"; $ alert_port = ""; $ alert_user = "root"; $ alert_password = "xxxxx (ibid.)"; $ archive_dbname = "snort"; $ archive_host = "localhost"; $ archive_port = ""; $ archive_user = "root"; $ archive_password = "xxxxx (ibid.)"; $/usr/local/apache/htdocs/jpgraph/src charlLib_path = ""; $ charl_file_format = "png"; 11, http://xxx.xxx.xxx.xxx/acid test Note: before installation will compile tools installed.

Use the LiveCD restore compromised systems

Mayank's previous article "use LinuxLiveCD assessment system security" describes the LiveCD, also describes some can help you evaluate your computer system security tools.

But if the system is facing threats to security and is used for illegal or unauthorized activities, and what to do? option is a request for help computer security experts. You can download the tool used by the experts, learn how to use these tools to become integrity protection and data recovery expert. Totally don't have to worry about the tools installation – this is a LiveCD! on LiveCDLiveCD is stored on a bootable operating system on the CD-ROM (and other software), this CD-ROM to perform OS without the need for lengthy installation process. Most LiveCD are based on the Linux kernel (but there are also some LiveCD for other operating systems). LiveCD works is to place the file to the RAM disk (this reduces the application can use the RAM, so performance may degrade). Once you remove the LiveCD and restart the system after the system is restored. Some LiveCD also provides an installation tool, allowing you to mount the system hard disk or USB disk; most LiveCD can access internal/external hard drive, disk or Flash memory. Syslinux is used to boot the LiveCD based on Linux, as well as the Linux floppy disk. For PC, the bootable CD are usually comply with the specifications, will be ElTorito disk for a file on a (possibly hidden) as one of the floppy disk images. Many LiveCD uses compressed file system image, which normally use the cloop compressed loopback driver effectively double the storage capacity utilization. There are many emulators can be used to try out LiveCD, without the need to burn it into CD or started on the computer. Supports the most extensive i386 emulator is VMware. There are other emulator Qemu, Bochs, PearPC and they can be used to simulate the x 86 and PowerPC ® platform or both; but because of the use of simulation methods, therefore faster than some commercial Simulator. Another commercial Simulator is VirtualPC. Investigation of computer intrusion into computer and computer network and under cover for serious illegal activities is a very common behavior, even common to many people who have achieved such conduct necessary skill. However, the detection and the ability to capture the intruder is not as common. Great (although imaginary) detective Sherlock Holmes once said: "in the collection of all the evidence before it that reasoning is a great mistake. This will let the judge biased. "From the encounter security threats in the system to collect evidence is the computer" forensics "expert (digital era of Sherlock Holmes). They use specialized tools to gather, study and analysis of information about the system. For this kind of work, the best tool is open source tool, this is not surprising. TheCoroner'sToolkit (TCT), SleuthKit, AutopsyForensicBrowser and FLAG (ForensicsLogAnalysisGUI) are very popular tool that not only security experts like to use these tools, many computer security course lecturers are all like this tool. Helix and many specialized LiveCD, Helix is also produced on demand. AndrewFahey is e-fenseInc. a cooperative security expert, he to Knoppix as a basis, and add a lot of daily work in the use of tools. "Helix user very sense of participation. The world has a Helix of users who continue to provide feedback. Because the people are in different environments using Helix, therefore to ensure that all components in all cases to complete the work is an ongoing, time-consuming tasks. So I rely on the user feedback to improve and fix their Helix, finds fault. I would also like to rely on user complete language translation. "Andrew said. Helix has a Windows ® Terminal activity interface that allows image a LiveWindows system. This interface has been translated into German and will soon have a Portuguese version. In addition, many events/response tool was originally formed the idea of a design. Many organizations, educational institutions have begun to use Helix, including NationalWhiteCollarCrimeCenter (NW3C), SystemAdministratorNetworkSecurity Institute (SANS) and NationalConsortiumforJusticeInformationandStatistics. Helix is not installed on your hard disk, but future versions may have this feature. "I want to be able to have a similar to Fedora uses the hardware recognition hardware abstraction layer. Until recently, we've just added the union-fs module, this is what we need to overcome a major obstacle. "Andrew said. Although most of the tools in the Helix is Andrew himself chose, but some of the tools recommended by the community. Andrew face the biggest problems is that some of the tools requires a license. The next version will offer some update tool, the new Adepto programs, Retriever and Andrew had been using the program and provide SleuthKit and PyFLAG. Plan-BJeremyMcDaniel developed by Plan-B is a forensics LiveCD, inspiration comes from PeterAnVin SuperRescueCD. It is based in RedHat9, run BlackboxWindowManager, and use the zisofs filesystem will be about 1.4GB data compression to a CD. There are some forensic analysis tools, such as the Autopsy, TheSleuthKit, BCWipe, etc, there are many other daily use tools, such as e-mail client software, browsers, chat clients software and text editor. According to the project's Web site: (the next version of) the biggest change is the most current software (if not all) are updated, and also will add 2.6 Fedora kernel, roll back to. The master database to MySQL, to add a new application server. Create the eServer ™ based Security/Auditing/PlanningModule plans are already in operation. It ultimately as a standalone application for publishing. Plan-B will be used only as a mobile test solutions. This tool will be used to audit based on the team and have the ability to penetrate the report to create the test interface. Closing imagine, we can use a bootable LinuxCD directly to experienced computer forensic expert skills. This is not a dream. This article describes the LiveCD making dreams a reality. I wish your detective road! original link: http://www-128.ibm.com/developerworks/cn/linux/l-livecddiag/

Linux IPtables Wolf by and consultation to wine minds lease spectrum Choi Kyu Wei

Iptables.rule lv firewall de, praise and cut down sequence iptables.allow lv secret Conference so words and tone down Hui Lv iptables.deny Conference so words and iptables.allow and flag 鷹 ・ ・ #/bin/bas # Thisisanesayfirewall.

#theinsideinterface.ifyoudon'thavethisone　　#andyoumustletthisbeblackex>INIF=""　　INIF="et0"　　INNET="192.168.160.0/20"　　#2.0loadtherightmodule　　PATH=/sbin・/bin・/usr/sbin・/usr/bin　　exportPATHEXTIFINIFINNET　　modprobeip_tables>/dev/null2>&1　　modprobeiptable_nat>/dev/null2>&1　　modprobeip_nat_ftp>/dev/null2>&1　　modprobeip_nat_irc>/dev/null2>&1　　modprobeip_conntrack>/dev/null2>&1　　modprobeip_conntrack_ftp>/dev/null2>&1　　modprobeip_conntrack_irc>/dev/null2>&1　　#3.0cleariptablesrule　　/sbin/iptables- 　　/sbin/iptables-X　　/sbin/iptables-Z　　/sbin/iptables-F-tnat　　/sbin/iptables-X-tnat　　/sbin/iptables-Z-tnat　　/sbin/iptables-PINPUTDROP　　/sbin/iptables-POUTPUTACCEPT　　/sbin/iptables-PFORWARDACCEPT　　/sbin/iptables-tnat-PPREROUTINGACCEPT　　/sbin/iptables-tnat-PPOSTROUTINGACCEPT　　/sbin/iptables-tnat-POUTPUTACCEPT　　#4.0startloadingtrustedanddeniedfile. if[-f/usr/local/virus/iptables/iptables.allow]・ten　　sh/usr/local/virus/iptables/iptables.allow　　i　　if[-f/usr/local/virus/iptables/iptables.deny]・ten　　sh/usr/local/virus/iptables/iptables.deny　　i　　#5.0ifthefollowingfileexist・pleaseexecuted　　if[-f/usr/local/virus/httpd-err/iptables.http]・ten　　sh/usr/local/virus/httpd-err/iptables.ttp　　i　　#6.0allowicmpdatapacketandtheestablishddata　　/sbin/iptables-AINPUT-mstate！！stateESTABLISHED・RELATED-jACCEPT　　AICMP="033/441112141618"　　fortyicmpin$AICMP　　do　　/sbin/iptables-AINPUT-i$EXTIF="eth0"-picmp！！icmp-type$tyicmp-jACCEPT　　done

Linux IPtables firewall system that is simple to set method

# 7.0opentheotherserviceports/sbin/iptables-AINPUT-pTCP-i $ EXTIF = "eth0" — dport25-jACCEPT # SMTP/sbin/iptables-AINPUT-pTCP-i $ EXTIF = "eth0" — dport53-jACCEPT # DNS/sbin/iptables-AINPUT-pTCP-i $ EXTIF = "eth0" — dport80-jACCEPT # WWW/sbin/iptables-AINPUT-pTCP-i $ EXTIF = "eth0" — dport110-jACCEPT # POP3/sbin/iptables-AINPUT-pTCP-i $ EXTIF = "eth0" — dport113-jACCEPT # AUT/sbin/iptables-AINPUT-pTCP-i $ EXTIF = "eth0" — dport22222-jACCEPT # SS/sbin/iptables-AINPUT-pUDP-i $ EXTIF = "eth0" — dport138-jACCEPT # 138/sbin/iptables-AINPUT-pTCP-i $ EXTIF = "eth0" — dport139-jACCEPT # 139/sbin/iptables-AINPUT-pUDP-i $ EXTIF = "eth0" — dport137-jACCEPT # 137/sbin/iptables-AINPUT-pTCP-i $ EXTIF = "eth0" — dport445-jACCEPT # 445 iptables.allow code #!/bin/bas # thisprogramisusedtoallowsomeIPorhoststoaccessyourserver/sbin/iptables-AINPUT-i $ EXTIF = "eth0"-s192.168.161.242-jACCEPT/sbin/iptables-AINPUT-i $ EXTIF = "eth0"-s192.168.160.178-jACCEPT/sbin/iptables-AINPUT-i $ EXTIF = "eth0"-s192.168.160.218-jACCEPT iptables.deny code #!/bin/bas # ThisscriptwilldenysomeIPsthatIdon'twantinIN/sbin/iptables-AINPUT-i $ EXTIF = "eth0"-s192.168.160.242-jDROP above three files are placed in the directory, most/usr/local/virus/iptables in modifying this file/etc/rc.d/rc.local into the following code.

#！/bin/s 　　#　　#Thisscriptwillbeexecuted*after*alltheotherinitscripts. #Youcanputyourowninitializationstuffinhereifyoudon't　　#wanttodothefullSysVstyleinitstuf. Touch/var/lock/subsys/local # Startingfirewallsettings/usr/local/virus/iptables/iptables.rule above is a simple setting under linux firewall.

Use the Iptables firewall Linux

Linux's built-in firewall mechanism, through kernel netfilter modules in the implements (www.netfilter.ort).

Linuxkernel using netfilter packet to be filtered out, netfilter consists of three rules tables, each table also has many built-in chain. By using iptables command can watch for operations such as add, delete, and list the rules, etc. 1. Netfilter rule table — filter for routing filternatmangle network packets. Is the default, which means that if you do not specify the-t parameter, when you create a new rule, it will default to the table. INPUT OUTPUT network packets to the server from the server network packets flow out of the FORWARD network packets from the server routing table for nat, NAT .NAT (NetAddressTranslation) is an IP address translation method. PREROUTING network packet reaches the server OUTPUT can be modified by the server network packets flow out of the POSTROUTING network packets to be sent from the server can be modified when mangle, used to modify the network packets of sheets, such as TOS (TypeOfService), TTL (TimeToLive), and other INPUT network packets to the server OUTPUT network packets flow out of the server to FORWARD network packets from the server forwards the PREROUTING network packet reaches the server can be modified POSTROUTING network packets to be sent from the server can be modified when 1. configure Iptables when a packet enters the server, you will find the LinuxKernel chain until you find a rule matches with the packet. If the rule's target is to ACCEPT, you will skip the rest of the rules, the packet will be to continue to send. If the rule's target is to DROP the packets will be blocked off, the kernel does not refer to other rules. Note: If the beginning is not a rule and packet at the end of the match, but the table without dropall rules, then the packet will be accept. Cisco, on the contrary, the end of the table will contain denyall rules. 1.) Iptables command option iptables [-ttables] commandoptionparametertarget-add A tail in the chain rule-C add a rule to a user-defined chain before check-in from the chain D delete a rule-E to rename user-defined chain, does not change the chain itself-F flush chain, delete all of the rules on the chain-I in the chain into a rule-L to list a chain rules, such as iptables – LINPUT lists INPUT chain rule-n to create a new chain-P define a chain of default policy-R replace chain a rule-X delete a user-related chain-Z all tables of all chain of bytes and packets counters clear 2.) Iptables command parameters-p – protocol is applied to the packet's protocol type, can be TCPUDPICMP or ALL. ! You can also use. When you use-ptcp, also can use other options to allow further defined rules. Options include:-sport allows you to specify match the packet source port .port1: port, said port1 and all ports between port2--dport objectives port, and--the same sport. When you use the-p! udp, it also has special options for making include:--dport sport,-, and-the same, except for ptcp for UDP packets. When using the-picmp parameters, only one option available. — — Icmp-type, allows filtering icmp type specified in the rule. -S – source Specifies the source address for packets. This argument is followed by an IP address, a network address with sub-netmask, or a host name. (It is not recommended that you use hostname)-d,--destination destination address of packets, with-s. -J,--jump is used to specify a target, tell the matching rule will send the packet to the target. Target can be either ACCEPT, DROP, QUEUE, and RETURN without-j, you will not take any action on the packet, except that the counter is incremented. -I--in-interface, INPUTFORWARDPREROUTING chain, this parameter specifies the packet arrives at the server using the port. -O--out-interface, OUTPUTFORWARDPOSTROUTING chain, this parameter specifies the packet from the server using the port. 3.) the command target create Iptables rules the final step is to specify the action to the Iptables packet. As long as a certain rules match the packet, it will no longer have other rules of operation. Built-in target: ACCEPTDROPQUEUERETURN. ACCEPT: allows packets to pass through to reach their destination. DROP: reject packets to pass through, drop the package. QUEUE: packets sent back to the user application DepartmentReason. RETURN: no longer based on the current chain of other rules to check packets, but directly return, continue to be sent to their destination addresses, or the next chain.

Use the Iptables firewall Linux

2. application of rules for example allow WWW Iptables iptables – AINPUT – ptcp – dport80 – jACCEPT the rule is added to the filter table of INPUT chain that allows the destination port is 80.

On the internal interface allows DCP iptables – AINPUT – ieth0 – ptcp--sport68--dport67ACCEPT iptables – AINPUT – ieth0 – pucp--sport68--dport67ACCEPT above while allowing TCP and UDP protocols. 3. saving and restoring Iptables saved using Iptables iptables-save to existing iptables rules save that path to iptables-save > iptables-save, such as # iptables-save >/etc/iptables.up.rule recovery Iptables configuration using iptables-restore from iptables table to document the existing iptables table. Iptables-restore/etc/iptables.up.rule # restoretheiptablesrulewhenshutdowntheinterfaceet0 and then reactivate the eth0. In addition, you can make changes to the configuration file/etc/iptables.up.rule, to change the iptables rules. Iptables.up.rule format: # Generatedbyiptables-saveV1.3.3onTueJul3114: 18 442007 * filter: INPUTACCEPT [73: 8213]: FORWARDACCEPT [0: 0]: OUTPUTACCEPT [8: 825]-AINPUT – ilo – picmp – jDROP-AINPUT – ieth0 – picmp – jDROP COMMIT # CompletedonTueJul3114: 10 rows and rows between 442007 cannot have empty lines. Three .Summary iptables chain in each rule order is important, if the first is the acceptall, then all packets will be allowed through the firewall, so it should be appropriate arrangements for the rule. General rule is: deny all allow minority.

The depth of security hardening Linux system (2)

4. file system permissions to find out the system all the w s "bit of procedure, put unnecessary" s "bit removed, or never have to delete the direct, so you can prevent users from abuse and the possibility of an elevation of privilege, its commands are as follows: put the important file plus the immutable property: depending on the needs, some exploit overflow will write to the inetd.conf after one statement to bind shell in a port monitor, then this command will play a role, shallow intruder would think overflow was not successful.

Find out the system without the owner of the file: identify any has write permissions of files and directories: prevent intruders to write Trojans statement (such as a shell copy) or inherit owner permissions and illegal access; identify and reinforce those that have always been an intruder can use a file-such as .rhosts. Ftp upload directory cannot give execute permissions, such as the provision can run CGI Web hosting services, should do additional security configuration. preparation of etc/security/limits.conf, addition or change the following line: 5.Banner camouflaged intruders usually by operating system, service and application version to attack, leaking oil list and attack range is also classified according to this, so we need to make a point and to increase the difficulty of invasion. Change, because after reboot/etc/issue reload, so edit/etc/rc.d/rc.local: for Apache's configuration file, locate the ServerTokens and ServerSignature directive, both to modify their default attributes are as follows, using a non-echoing version: simultaneously modifying the uname file, search the source code, locate the uname.c as follows: be modified to: other services and programs to modify the configuration file can be viewed or source code, do not change too much, otherwise they will be to the system management in big trouble. Sit back and relax?