Re-tooling?

Consider your to-do list, based on your
security plan. It should include one or more of the following steps:

1. Scan the system for known OS holes and fix them
   
   
   
   
2. Check for generic Unix problems and fix them
   
   
   
   
3. Check directory structure for proper permissions
   
   
   
   
4. Check for network-attack vulnerabilities
   
   
   
   
5. Check for bad user (and root) passwords
   
   
   
   
6. Determine who has the root password and if it isn't
   needed, take it away from them
   
   
   
   
7. Install tools to monitor the system and generate
   alerts when the system file is altered
   
   
   
   
8. Log all network connections
   
   
   
   
9. Limit access to network daemons
   
   
   
   
10. Prevent users from choosing easy-to-guess passwords
    

We'll address the first half of that list this month, and the rest next
month.

Scan the system for known OS holes and fix them

There are some holes that the available tools do not check for. These
include recent problems, under-publicized problems, and problems
specific to your site. For these, you need to keep alert to current
problems. Methods include the bug list in this
column, CERT advisories, and mailing lists like
"sneakers."

Check for generic Unix problems and fix them;

Check directory structure for proper permissions

The second and third step can be accomplished by two worthy and free
tools.
The tools are Tiger
and COPS.
Tiger is more up-to-date and more inclusive than COPS, so
it's the one I recommend.
(Note: the TAMU ftp server does not seem to respond well to WWW browser
HTML links, so you may need to step back in time and use ol'
ftp to grab Tiger.)

Running tiger (the executable for the Tiger package)
produces an extensive system scan. Depending on the size and speed of
the system, the check can take from 15 minutes to several hours. Also
note that it is CPU and disk intensive. Here is a snippet from the
beginning of its report:

Sign up for ITworld's Daily newsletter
Follow ITworld on Twitter @IT_world

• Email
• Print
• Share
  • Slashdot
  • Digg
  • Stumble
  • Reddit
  • Newsvine