🚀 go-pugleaf

 
 
 
In comp.security.misc I wrote:
 
>I thought that the best way to make the Iris secure and still allow network
>access would be to disable telnetd and ftpd, leaving inetd and smtpd working
>for mail to be available.  This would allow telnet and ftp *from* our Iris,
>but not *to*.
 
 
Many thanks to all who replied to my posting.  Your help is very much
appreciated.  I have compiled a summary of the replies.
 
Most people reminded me that there are many daemons to disable: telnetd,
ftpd, tftpd, rshd, rexecd, rlogind, rexd.  The 'r' programs are the
ones which are especially vulnerable to attack.
 
Three especially interesting points were made:
 
rob@wzv.win.tue.nl (Rob J. Nauta) writes:
 
    Besides, real hackers don't telnet in like beginners. They steal your
    password file via NIS (YP), mount your disks remotely via NFS, all
    things you can't control.
 
Brian Cartmell <brc@halcyon.halcyon.com> writes:
 
    If you are looking to secure your machine I would do all the security
    from the CISCO or whatever you are using as a router to do your FIRE
    WALLING!
 
and  I.Sparry@sunlab1.bath.ac.uk writes:
 
  Yes. If you are forced to have PC's on your network, then you can not
consider
  the network to be secure at all, so you are wasting your time worrying about
  security. With a PC anyone there could turn a PC into an ethernet monitor
  and so can grab the passwords as they flow past.
 
  This ignores any risk of someone running a program like 'pc-anywhere' etc
 
  If you are serious about security, you want to buy several routers, so you
  can implement policy in them, rather than on the separate machine.
 
 
scott@prism.gatech.edu mentioned that there is no protection against
IP spoofing (a machine pretending to have another's address.)  No-one
else mentioned this.  How serious a threat is it?  Are routers told
which machines are on the 'inside' and which are on the 'outside' of
a subnet?
 
 
I was also directed to read decuac.dec.com:pub/docs/firewall/*.ps, the
alt.security.FAQ and the unix.security document.  I have read the last
two.
 
It was pointed out that PC's are probably the biggest security hole.  That's
OK, as no sensitive material will be on them, and they won't be running
NFS.  As for PC's being used as ethernet monitors to catch passwords,
by refusing telnet, rlogin, ftp etc access to the Iris, there would be
no passwords of importance to catch, as the passwords would never appear
on the ethernet.  That is, not until we get another Iris!
 
So the upshot is: -
 
* Don't run PC-NFS
* Don't run YP or NFS
* disable telnetd, ftpd, tftpd and r*d daemons and any others not needed
* get the router set up to disallow any packets for the Iris from outside
  the subnet to reach it.
 
and the system will be as secure as the lock on the door of its room.
 
 
Many people also suggested the installation of tcp-wrappers to monitor
login attempts etc.  This will most certainly be necessary if and when
a new Iris is added to further boost our massive computer power.
We would then want telnetd and NFS available.
 
A step-by-step walk through the check-list in the "How to
Improve the security of your Unix System" document would help.
Combined with proper setting up of the router and tcp-wrapping just to
make sure the router is doing its job, and the only apparent hole is
the ethernet packet monitoring PC, which would have to be located
within our subnet.
 
 
Have I missed anything?
 
Danny