FIREWALLS AND INTERNET SECURITY
CONTENTS GETTING STARTED 1 INTRODUCTION 3 1 1 SECURITY TRUISMS 3 1 2 PICKING A SECURITY POLICY 7 1 3 HOST BASED SECURITY 10 1 4 PERIMETER SECURITY 10 1 5 STRATEGIES FOR A SECURE NETWORK 11 1 6 THE ETHICS OF COMPUTER SECURITY 16 1 7 WARNING 18 2 A SECURITY REVIEW OF PROTOCOLS LOWER LAYERS 19 2 1 BASIC PROTOCOLS 19 2 2 MANAGING ADDRESSES AND NAMES 28 2 3 IP VERSION 6 34 2 4 NETWORK ADDRESS TRANSLATORS 37 2 5 WIRELESS SECURITY 38 3 SECURITY REVIEW THE UPPER LAYERS 41 3 1 MESSAGING 41 3 2 INTERNET TELEPHONY 46 3 3 RPC BASED PROTOCOLS 47 3 4 FILE TRANSFER PROTOCOLS 52 3 5 REMOTE LOGIN 58 3 6 SIMPLE NETWORK MANAGEMENT PROTOCOL SNMP 62 3 7 THE NETWORK TIME PROTOCOL 63 3 8 INFORMATION SERVICES 64 PART I 1 3 9 PROPRIETARY PROTOCOLS 68 3 10 PEER TO PEER NETWORKING 69 3 11 THEX11 WINDOW SYSTEM 70 3 12 THE SMALL SERVICES 71 4 THE WEB THREAT OR MENACE 73 4 1 THE WEB PROTOCOLS 74 4 2 RISKS TO THE CLIENTS 79 4 3 RISKS TO THE SERVER 85 4 4 WEB SERVERS VS FIREWALLS 89 4 5 THE WEB AND DATABASES 91 4 6 PARTING THOUGHTS 91 II THE THREATS 93 5 CLASSES OF ATTACKS 95 5 1 STEALING PASSWORDS 95 5 2 SOCIAL ENGINEERING 98 5 3 BUGS AND BACK DOORS 100 5 4 AUTHENTICATION FAILURES 103 5 5 PROTOCOL FAILURES 104 5 6 INFORMATION LEAKAGE 105 5 7 EXPONENTIAL ATTACKS VIRUSES AND WORMS 106 5 8 DENIAL OF SERVICE ATTACKS 107 5 9 BOTNETS 117 5 10 ACTIVE ATTACKS 117 6 THE HACKER S WORKBENCH AND OTHER MUNITIONS 119 6 1 INTRODUCTION 119 6 2 HACKING GOALS 121 6 3 SCANNING A NETWORK 121 6 4 BREAKING INTO THE HOST 122 6 5 THE BATTLE FOR THE HOST 123 6 6 COVERING TRACKS 126 6 7 METASTASIS 127 6 8 HACKING TOOLS 128 6 9 TIGER TEAMS 132 III SAFER TOOLS AND SERVICES 135 7 AUTHENTICATION 137 7 1 REMEMBERING PASSWORDS 138 PART PART 7 2 TIME BASED ONE TIME PASSWORDS 144 7 3 CHALLENGE RESPONSE ONE TIME PASSWORDS 145 7 4 LAMPORT S ONE TIME PASSWORD ALGORITHM 146 7 5 SMART CARDS 147 7 6 BIOMETRICS 147 7 7 RADIUS 148 7 8 SASL AN AUTHENTICATION FRAMEWORK 149 7 9 HOST TO HOST AUTHENTICATION 149 7 10 PKI 150 8 USING SOME TOOLS AND SERVICES 153 8 1 INETD NETWORK SERVICES 153 8 2 SSH TERMINAL AND FILE ACCESS 154 8 3 SYSLOG 158 8 4 NETWORK ADMINISTRATION TOOLS 159 8 5 CHROOT CAGING SUSPECT SOFTWARE 162 8 6 JAILING THE APACHE WEB SERVER 165 8 7 AFTPD A SIMPLE ANONYMOUS FTP DAEMON 167 8 8 MAIL TRANSFER AGENTS 168 8 9 POP3 AND LMAP 168 8 10 SAMBA AN SMB IMPLEMENTATION 169 8 11 TAMING NAMED 170 8 12 ADDING SSL SUPPORT WITH SSLWRAP 170 IV FIREWALLS AND VPNS 173 9 KINDS OF FIREWALLS 175 9 1 PACKET FILTERS 176 9 2 APPLICATION LEVEL FILTERING 185 9 3 CIRCUIT LEVEL GATEWAYS 186 9 4 DYNAMIC PACKET FITTERS 188 9 5 DISTRIBUTED FIREWALLS 193 9 6 WHAT FIREWALLS CANNOT DO 194 10 FILTERING SERVICES 197 10 1 REASONABLE SERVICES TO FILTER 198 10 2 DIGGING FOR WORMS 206 10 3 SERVICES WE DON T LIKE 207 10 4 OTHER SERVICES 209 10 5 SOMETHING NEW 210 PART 11 FIREWALL ENGINEERING 211 11 1 RULESETS 212 11 2 PROXIES 214 11 3 BUILDING A FIREWALL FROM SCRATCH 215 11 4 FIREWALL PROBLEMS 227 11 5 TESTING FIREWALLS 230 12 TUNNELING AND VPNS 233 12 1 TUNNELS 234 12 2 VIRTUAL PRIVATE NETWORKS VPNS 236 12 3 SOFTWARE VS HARDWARE 242 V PROTECTING AN ORGANIZATION 245 13 NETWORK LAYOUT 247 13 1 INTRANET EXPLORATIONS 248 13 2 INTRANET ROUTING TRICKS 249 13 3 IN HOST WE TRUST 253 13 4 BELT AND SUSPENDERS 255 13 5 PLACEMENT CLASSES 257 14 SAFE HOSTS IN A HOSTILE ENVIRONMENT 259 14 1 WHAT DO WE MEAN BY SECURE 259 14 2 PROPERTIES OF SECURE HOSTS 260 14 3 HARDWARE CONFIGURATION 265 14 4 FIELD STRIPPING A HOST 266 14 5 LOADING NEW SOFTWARE 270 14 6 ADMINISTERING A SECURE HOST 271 14 7 SKINNY DIPPING LIFE WITHOUT A FIREWALL 277 15 INTRUSION DETECTION 279 15 1 WHERE TO MONITOR 280 15 2 TYPES OF IDSS 281 15 3 ADMINISTERING AN IDS 282 15 4 IDS TOOLS 282 VI LESSONS LEARNED 285 16 AN EVENING WITH BERFERD 287 16 1 UNFRIENDLY ACTS 287 16 2 AN EVENING WITH BERFERD 290 16 3 THE DAY AFTER 294 PART PART 16 4 THE JAIL 295 16 5 TRACING BERFERD 296 16 6 BERFERD COMES HOME 298 17 THE TAKING OF CLARK 301 17 1 PRELUDE 302 17 2 CLARK 302 17 3 CRUDE FORENSICS 303 17 4 EXAMINING CLARK 304 17 5 THE PASSWORD FILE 310 17 6 HOW DID THEY GET IN 310 17 7 BETTER FORENSICS 311 17 8 LESSONS LEARNED 312 18 SECURE COMMUNICATIONS OVER INSECURE NETWORKS 313 18 1 THE KERBEROS AUTHENTICATION SYSTEM 314 18 2 LINK LEVEL ENCRYPTION 318 18 3 NETWORK LEVEL ENCRYPTION 318 18 4 APPLICATION LEVEL ENCRYPTION 322 19 WHERE DO WE GO FROM HERE 329 19 1 IPV6 329 19 2 DNSSEC 330 19 3 MICROSOFT AND SECURITY 330 19 4 INTERNET UBIQUITY 331 19 5 INTERNET SECURITY 331 19 6 CONCLUSION 332