1. Securing your network But still be able to access it Hugh Mahon

2. How dangerous is the 'net? ● A 'grep' of /var/log/messages for 'failure' found 10474 failed ssh login attempts over a two day period ● Attempts on root, and just about every 'standard' account name. ● Even with 'good' passwords how many script kiddie attacks can a site take?

3. Problem ● Ports for access (e.g., ssh) are well known ● How to allow access but stop, or at least slow down, the bad guys?

4. Protect ssh ● /etc/ssh/sshd_config – Remove root login ability: PermitRootLogin no – Do not allow passwords (require certificates): PasswordAuthentication no – Only allow specific users: AllowUsers tom dick harry ● Use /etc/hosts.allow or /etc/hosts.deny – In /etc/hosts.allow: sshd: 1.2.3.0/255.255.255.0 – Then in /etc/hosts.deny: sshd: ALL

5. iptables ● You can also use iptables to restrict access – Restrict ssh connections to those from specific hosts: ● iptables -A INPUT -p tcp -m state --state NEW --source 1.2.3.4 --dport 22 -j ACCEPT ● # Deny all other SSH connections ● iptables -A INPUT -p tcp --dport 22 -j DROP

6. More with iptables ● Restrict rate of connections from a host: ● iptables -I INPUT -p tcp --dport 22 -i eth0 \ -m state --state NEW -m recent --set ● iptables -I INPUT -p tcp --dport 22 -i eth0 \ - m state --state NEW -m recent --update \ -- seconds 60 --hitcount 4 -j DROP

7. Port knocking ● A server can allow access without making services easy to see with tools such as nmap ● A client 'knocks' on ports on the server to get the server to 'open up' a port for a service – The server offers no response during the 'knock' – After a correct 'knock' the server responds by opening the related port.

8. Types of Knocks ● Port knocks can be of several different types: – SYN packets sent to a sequence of ports – ICMP echo request (ping) packets with encrypted payloads – Sniff packets on specified ports listening for encrypted data.

9. Resources ● This presentation: anerd.org ● http://www.portknocking.org http://www.portknocking.org ● http://www.debian-administration.org/articles/187