Professional Documents
Culture Documents
RiskAssessment
Determinehowimportantyour computeristoyourgroup
Security
PhysicalSecurity
Security
PhysicalSecurity
Security
PhysicalSecurity
Story:ChristmasHolidayinBritain
Security
BIOS
YourBIOSdeterminesfromwhich deviceyourcomputerboots Theorderofwhichdevicefromwhich tobootcanbesetinmostBIOSes
Security
BIOS
ReformattingyourdriveisonlyaCD orfloppyaway MostCDdrivesarebootableand severaldistributionscannowexistona CD So,whatisstoppingsomeonefrom insertingadiskinyourcomputer, bootingfromit,andstartinganattack?
BIOSPASSWORD
Security
Booting
Nowyou'veblockedaccesstothe devicesandtheBIOS.Soyouaresafe...
WRONG!
Anyonecanstillaccessyoursystem asROOT! Howdotheydothis?!?!?
Security
Booting
Simple: Whengrubstarts,justeditthe configurationfileandaddtheword singleattheendofthekernelline andboot Thesystemwillbootintosingleuser modeandnowyourareroot!
Security
Booting
Exercise:SingleUserMode
AtGRUBscreen,selectkernel Typeetoedit Selectlinewithwordkernelinit Typeetoedit Addthewordsingleattheend PressENTER AtGRUBscreentypeb
Security
Booting
HowcanIpreventthis?!?!?! Addabootpasswordtothegrubconfig file: (1)Createtheencryptedpassword: /sbin/grubmd5crypt Thiswillreturnanpasswordencrypted inanMD5hash
Security
Booting
(2)Editthegrubconfigfile /boot/grub/grub.confandaddthe passworddirectiveandthepassword: passwordmd5<passwordhash> Where<passwordhash>isthe encryptedpasswordyouweregiven fromgrubmd5crypt. Thenexttimeyouboot,youmustuse thepcommandandenterapasswordin ordertoaccessthegrubenvironment
Security
Booting Exercise
#/sbin/grubmd5crypt #nano/boot/grub/grub.conf Add passwordmd5<passwordhash> tothetopofthefile Rebootandtrytoeditthegrubconfig file RemembertouseptogetGrubto promptyouforthepassword
Security
Passwords
Thenextlayerofsecurityisgood passwords. Simplepasswordsareeasytocrack withpackagessuchascrackandJohn theRipper Exercise:JohntheRipper #cd/opt/exercises/Security #john1.6/run/john/etc/passwd #john1.6/run/john/etc/shadow
Security
Passwords
Theseprogramsneedaccesstothe actualpasswords Thisisagoodreasonforusingshadow passwordsonlyroothasaccess
Security
Passwords
Neveruseawordfoundinadictionary asapassword.Crackingprogramsare evensmartenoughtotrychanged characterclassesthatstillspellwords Neveruseyouraccountnameasyour password.
Security
Passwords
Goodpasswordsshouldhavemixed casesandmixedcharactersets. Pickaphrasethatiseasytoremember andusethefirstletterofeachword: IowaStateRulesButUofISucks ISR3UoIS orbetteryet,withmixedcharactersets I$R3UoI$
Security
RootAccess
Whoneedstoberoot? Asfewpeopleaspossible Howshouldrootaccessthecomputer? Themostsecurewayspossiblewith theleastchanceofinterceptingthe password Howdoweaccomplishthis? /etc/securetty su sudo
Security
RootAccess /etc/securetty
rootshouldNEVERloginremotely Forcerootuserstoaccessthesystem viasecureterminals:
Whichterminalsareallowedis specifiedinthefile/etc/securetty
RootAccess /etc/securetty
console vc/1 vc/2... tty1 tty2... actualdisplay virtualconsoles
Security
ttyS0 ttyS1...
Security
RootAccess suandsudo
Ifyoumust,loginoverasecure connection Usesutoaccessroot YouMUSTuseasecureconnectionto avoidpasswordsniffing Abetterwayistoimplementsudo sudoisapackagewhichpermitssetsof userstoexecutecommandsasroot withouttherootpassword
Security
RootAccess sudo
sudohasmanypossibleconfiguration options. Modifythesudoconfigfile /etc/sudoerstocontrolwhohasaccess andwhattheymayaccess Accessmustbedonebyrootwiththe commandvisudo See!youDONEEDtolearnvi :+D
Security
RootAccess sudo
#Userprivilegespecification rootALL=(ALL)ALL linuxedALL=(ALL)ALL #Uncommenttoallowpeopleingroupwheeltorun allcommands #%wheelALL=(ALL)ALL #Samethingwithoutapassword #%wheelALL=(ALL)NOPASSWD:ALL #Samples #%userslocalhost=/sbin/shutdownhnow
Security
RootAccess sudo
sudoisinvokedwiththesudo commandandthecommandtoberun sudo<command> TheuseristhenpromptedforTHEIR password:
[linuxed@counter]$sudocat/etc/sudoers Password: #sudoersfile. # #ThisfileMUSTbeeditedwiththe'visudo' commandasroot. ...