Network Security Hacks

Anton Chuvakin writes "When I first got this little book called Network Security Hacks, I was unimpressed by its idea: a seemingly random collection of network security tips combined under the same cover. However, when I started reading, more and more often I exclaimed "Ah, that's how it is done!" as well as found better ways of doing what I was doing." Read on for the rest of Chuvakin's review. Network Security Hacks author Andrew Lockhart pages 312 publisher O'Reilly rating 8 reviewer Anton Chuvakin ISBN 0596006438 summary Surprisingly good; packs a lot of network security knowledge into a small book.

The book is structured around many security subjects. These are: UNIX, Windows, Network Security, Logging (covering collecting, summarizing and analyzing log files), Monitoring, (covering system and network monitoring and collecting various statistics), Tunnels (covering various kind of VPNs and encrypted communication), Intrusion Detection, and Recovery and Response (short section covering very basic forensics).

Each section has a dozen or more tips, each taking from a page to several pages. For example, looking for SUID and SGID files takes just half a page, while installing and configuring Snort NIDS takes several pages. As a result, the style is understandably terse and to-the point.

The book ended up being one cool collection of tips, ranging from mundane ('how to configure iptables on Linux') to fairly esoteric ('how to use MySQL as an authenticating backend for an FTP server'). If you've always wanted to use 'grsecurity' or 'systrace,' but thought they were too complicated - grab the book and give it a shot. If you want to set up a fancy encrypted tunnel between two networks, it covers that too. Admittedly, a lot of advice given in the book can be found on Google, but it is nice to find it in one place. Network Security Hacks covers selected topics in host security, SSH and VPNs, IDS, monitoring and even touches upon forensics. I also liked its multi-platform coverage, with a slight but unmistakable UNIX/Linux bias.

Overall, Network Security Hacks is a great book, provided you don't try to find in it something it isn't; it is a neat collection of simple network security tips. I somewhat disliked that many tips don't go beyond 'how to install a tool' and so stop short of discussing how to use it best. Another gripe: I'd rather some of the tips skipped the obvious (such as "./configure; make; make install") and focused on little known and cool ways to use technology for security. Network Security Hacks will be useful for people involved with system and network management, those starting up in the security field, as well as for more advanced professionals (as a way to check their knowledge and skills). Also, it helps folks to jump straight to effective ways of doing things in the areas where their skills are less developed.

For example, I knew it was possible to use SSH to create a makeshift VPN, but this books is the first I've seen with a really good description of doing so. Similarly, I found some neat MySQL hardening tips in the book. Overall, there is a lot in the book for most people who are somehow involved in computer security, particularly if they're also running UNIX or Linux.

Anton Chuvakin, Ph.D., GCIA, GCIH is a Senior Security Analyst with a major security information management company, author of Security Warrior (and contributor to Know Your Enemy II), and maintainer of security portal info-secure.org You can purchase Network Security Hacks from bn.com. Slashdot welcomes readers' book reviews. To see your own review here, carefully read the book review guidelines, then visit the submission page.

Comments

Good book

[xOleanderx]

Its a very good reference book. If anyones looking for a good beginners book thats similar tho this one then check out Steal This Computer Book 3: What They Won't Tell You About the Internet

Beginner's book

[Zorilla]

From what I read in the review, it looks more like a beginner's guide to network security. It could prove to be quite useful for someone fairly new to it. In the Air Force, quite a few people who deal with IT are pretty new to this stuff (a lot of people are straight out of high school), and even though most stuff we deal with is Windows-centric, we still need to know Unix for things such as firewalls. Looks like the book could be handy for both.

Re:Beginner's book

[0racle]

In the Air Force, quite a few people who deal with IT are pretty new to this stuff.
Anyone else more then a little bothered by this statement?

Re:Beginner's book

[lylonius]

I have an O'Reilly Safari account and checked out several recent "security" titles:
- Network Security Hacks
- Network Security Assessment
- Security Warrior

and I have to say that all of them have weak content.

I don't proclaim to be an expert by any means, but security cannot be administered in such small nuggets of mostly outdated tricks/hacks.

Example: Hack 40: Block OS Fingerprinting. It briefly mentions nmap's -O option and then immediately demonstrates a fairly complex pf filter on OpenBSD. Does the author explain _any_ of the valid and invalid TCP flags that nmap uses? no. Does the author explain any adverse affects of silently dropping _all_ traffic that is satisfied by this complex ruleset? no. Does the author ever mention passive OS fingerprinting? Does it even mention the simplest/non-intrusive methods used to fool active OS fingerprinters like changing the IP default TTL or manipulating the TCP initial sequence number generation parameters? How do we port these rulesets to ipfw? netfilter? PIX conduits? In short, for this rule to be the slightest bit useful, we must assume that it works perfectly (does not drop a single legitimate frame/packet/segment) and simply cut-and-paste this solution in to our bastion host and hope it works.

In that sense, you might as well be dealing with the Windows-centric mindset of cut-and-paste and hope it works.

You could just google the table of contents

[Fiz Ocelot]

You could probably just look at the table of contents of this book and do a search on each section/topic. Actually I might try just that, might turn up some interesting stuff.

Haven't finished it yet...

[atomic-penguin]

I was lucky enough to get a review copy from O'reilly. One of the first things I tried was faking your OS signature for port scans. It was interesting to try it out, but I had to downgrade my Linux Kernel to 2.4.18 *gasp*. So after a recompile, and configuring iptables for IP Personalities, nmap detected "Sega DreamCast Console" on aforementioned machine. There are other signatures, I just wanted to try out the most amusing one. The problem is the patch is deprecated, buggy, not being developed, and the sparse documentation mentions it can make your TCP sequences less secure. Hey, it was amusing to try it, but too much hassle, and maybe it is not the most secure solution. Don't know what this one was doing in a security book, considering it could cause your system to be less secure. Nmap detects the faked signature about 90% of the time, depends on how the network is routed and such.

Most of the Windows hacks are a matter of downloading 3rd party software, however there was one registry hack to turn off Default SMB shares (C$ and ADMIN$), this was the only Win Hack.

I have enjoyed reading so far, and will get around to finishing it...eventually. Much like the other hack books there are hacks in here for beginners, intermediates, and wizards.

BOFH hack -- restricted shell

[atomic-penguin]

bash-2.05b$ bash -r

bash: SHELL: readonly variable

bash: PATH: readonly variable

bash-2.05b$ ls

bash: ls: No such file or directory

bash-2.05b$

Now users cannot run anything that is not symlinked to their home directory.

snort setup

[AmishSlayer]

I've just finished a setup with snort, apf, logsurfer and a custom program to create a live repsone firewall.

snort will detect the offensive network traffic and put it into the alert log file. Logsurfer will then trigger and email me with a notice, it will run a program I wrote to blacklist the attacking IP (my program checks to make sure the IP is not already banned and makes sure the IP is not my own so I do not get locked out). Finally, my program updates the firewall to block the bastard.

The only hole I see in this setup is a DoS by attacking with different spoofed "from IPs" until the firewall rules are too big, or too many legit servers are banned.

Re:First tip: Secure mountpoints

[Anonymous Coward]

Wow this I didnt know, I always thought this was the worsed:

#!/usr/local/bin/tcc -run
#include
int main(int argc, char **argv)
{ /* place your C Code here */
return EXIT_SUCCESS;
}

But the Tiny C Compiler arent in the default installs.. and this doesnt even come close to yours