Linux Server Security

CHRIS BINNIE is a Technical Consultant with 20 years of experience working with Linux systems, and a writer for Linux Magazine and Admin Magazine. He built an Autonomous System Network in 2005, and served HD video to 77 countries via a media streaming platform that he architected and built. Over the course of his career, he has deployed many servers in the cloud and on banking and government server estates.

• Preface xiii Introduction xvChapter 1: Invisibility Cloak 1Background 1Probing Ports 1Confusing a Port Scanner 2Installing knockd 2Packages 3Changing Default Settings 3Altering Filesystem Locations 4Some Config Options 5Starting the Service 5Changing the Default Network Interface 5Packet Types and Timing 5Testing Your Install 6Port Knocking Clients 7Making Your Server Invisible 7Testing Your iptables 8Saving iptables Rules 9Further Considerations 10Smartphone Client 10Troubleshooting 10Security Considerations 10Ephemeral Sequences 11Summary 12Chapter 2: Digitally Fingerprint Your Files 13Filesystem Integrity 13Whole Filesystem 16Rootkits 17Confi guration 19False Positives 21Well Designed 22Summary 23Chapter 3: Twenty-First-Century Netcat 25History 25Installation Packages 27Getting Started 27Transferring Files 29Chatting Example 30Chaining Commands Together 30Secure Communications 31Executables 33Access Control Lists 34Miscellaneous Options 34Summary 35Chapter 4: Denying Service 37NTP Infrastructure 37NTP Reflection Attacks 38Attack Reporting 40Preventing SNMP Reflection 41DNS Resolvers 42Complicity 43Bringing a Nation to Its Knees 44Mapping Attacks 45Summary 46Chapter 5: Nping 49Functionality 49TCP 50Interpreter 51UDP 52ICMP 52ARP 53Payload Options 53Echo Mode 54Other Nping Options 57Summary 58Chapter 6: Logging Reconnoiters 59ICMP Misconceptions 59tcpdump 60Iptables 61Multipart Rules 64Log Everything for Forensic Analysis 64Hardening 65Summary 67Chapter 7: Nmap’s Prodigious NSE 69Basic Port Scanning 69The Nmap Scripting Engine 71Timing Templates 73Categorizing Scripts 74Contributing Factors 75Security Holes 75Authentication Checks 77Discovery 78Updating Scripts 79Script Type 80Regular Expressions 80Graphical User Interfaces 81Zenmap 81Summary 82Chapter 8: Malware Detection 85Getting Started 85Definition Update Frequency 85Malware Hash Registry 86Prevalent Threats 86LMD Features 86Monitoring Filesystems 88Installation 88Monitoring Modes 90Configuration 91Exclusions 91Running from the CLI 92Reporting 92Quarantining and Cleaning 93Updating LMD 94Scanning and Stopping Scans 94Cron Job 96Reporting Malware 96Apache Integration 96Summary 97Chapter 9: Password Cracking with Hashcat 99History 99Understanding Passwords 99Keyspace 100Hashes101Using Hashcat 103Hashcat Capabilities 103Installation 103Hash Identifi cation104Choosing Attack Mode 106Downloading a Wordlist 106Rainbow Tables 107Running Hashcat 107oclHashcat 110Hashcat-Utils 111Summary 111Chapter 10: SQL Injection Attacks 113History 113Basic SQLi 114Mitigating SQLi in PHP 115Exploiting SQL Flaws 117Launching an Attack 118Trying SQLi Legally 120Summary 121Index 123