Introduction to Linux Internet Security Vulnerabilities and Preventive Measures

Introduction to Linux Internet Security Vulnerabilities and preventive measures-Linux Enterprise applications-Linux server applications. The following is a detailed description. LINUX is a free operating system widely used in the world today. It is fully compatible with UNIX, but with its open platform, it attracts countless students and researchers from colleges and universities to take it as the object of study and research. These programming experts are constantly improving the network security functions in LINUX. Next we will introduce Linux's Internet Security Vulnerabilities and preventive measures, hoping to help you.

LINUX Internet security mainly includes FTP security, Email Security, Telnet security, Web server security, and secure Web protocol.

FTP Security

It is very important for a LINUX network to realize file transfer. Therefore, the most common tool and protocol is the file transfer protocol (FTP ). Here is a brief introduction to FTP security. The file transfer protocol is a standard method for transferring files from one system to another. Its purpose is:

① Promote file sharing (including computer programs and data );

② Remote computers are encouraged to be used indirectly or implicitly through programs;

③ The differences between file storage systems on hosts are invisible to users;

④ Reliable and efficient data transmission.

However, FTP has several key security defects:

FTP uses the standard user name/password authentication method. This makes it impossible for the server to reliably determine whether a user is the one he claims.

By default, passwords are transmitted in plaintext. This allows attackers to obtain passwords through electronic eavesdropping.

FTP sessions are not encrypted, so they are not concealed.

FTP is vulnerable to the following attacks:

FTP "(bounce)" attack.

File Permission error.

Site exec vulnerability.

The FTP "Hop" attack is targeted at a host configured to reject connections from a specified IP address (or IP address mask. Generally, an attacker's IP address is in the restricted area, so he cannot access the directory of the FTP server. To overcome this restriction, intruders use another machine to access the target machine.

To achieve this, intruders write a file to the intermediate FTP directory, which contains commands to connect to the target machine and obtain some files. When the intermediary connects to the target host, it uses its own address (instead of the attacker's address ). Therefore, the target host trusts the connection request and returns the required file.

A permission error occurs when an attacker discovers the wrong file and directory permissions on the target host to gain privileges or even

Root User Access to achieve intrusion.

In earlier versions of wu-ftpd, the site exec vulnerability allows remote users to obtain shell by initiating a telnet session to port 21. To check whether the vulnerability exists, start a telnet conversation with port 21 and issue the command site exec. If a shell is obtained, the vulnerability exists.

FTP security measures are sufficient for small, closed networks that are not connected to the Internet (and are not connected to other LAN environments. However, for the WAN environment (especially the network environment connected to the Internet), normal FTP is really insecure and SSLftp should be used. SSLftp implements FTP clients and servers with SSL. SSL is a layer-3 protocol and API function that uses RSA and DES authentication and encryption and MD5 session integrity check.

Like telnet, FTP (or FTP-like services) is the most widely used in LINUX networks, but FTP is not truly secure, as specified. If you want to use common FTP in a small scope, you should strictly set access permissions and record everything as much as possible. This can at least ensure that you can control which host can access your FTP service and have the latest audit trail when a problem occurs.

Email Security

Today, the most widely used E-mail transmission protocol is simple mail Transmission Protocol (SMTP ). Every day, SMTP is used to transmit thousands of e-mail messages to all parts of the world.

Few SMTP server procedures:

Received message.

Check the Message Address.

If the message address is a local address, save the message for retrieval.

If it is a remote address, forward the message.

The SMTP server functions the same as the package router, except for the SMTP service for mail. Most SMTP servers can store and forward messages as needed.

The SMTP server puts forward security requirements on two different tasks:

Protect the server against attacks. You must add protective armor to the server to prevent external attacks. If an external attack succeeds, the attacker will be able to access your system without authorization.

Protect the SMTP service to avoid improper use. For example, outsiders use your email server to send fake emails and spam.

The second problem is even more terrible. Some may use unprotected SMTP servers to forward thousands of ads to Internet mail accounts without thinking about them. If they use your machine, it will overload the network.

Unless otherwise specified, LINUX will use sendmail as your email transmission proxy during installation. Telnet to port 25 to determine the sendmail version. An example of the output result is as follows:

[Jray @ pointy jray] $ telent virtuontooth.com 25
Trying 24.93.119.226...
Conneted to ontooth.com.
Escape character is
220 pointy. pythontooth.com ESMTP Sendmail 8.9.3/8.9.3
→ Sat, 10 Jul 1999 16:27:14-0400

Here we can see that pointy.onontooth.com is running sendmail/8.9.3.

Intruders initiate attacks on sendmail mainly because:

Sendmail is a public service. Once it runs, anyone can connect to and use it.

Sendmail is usually run as root. Therefore, if an attacker discovers a vulnerability that can be exploited, the attacker can obtain the access permission with a higher priority.

Sendmail is very difficult to configure, And intruders assume that you have problems with the installation (usually successful ).

The following are some typical sendmail Attacks:

The first is the MIME Buffer Overflow Vulnerability. This attack does not affect sendmail itself, but the customer who sent the mail by sendmail. Here, sendmail is a tool rather than a target. The Computer Emergency Response Team described the attack as follows:

An attacker sends a specially crafted email message to a vulnerable system. In some cases, the Code selected by the attacker is executed on the system. In addition, attackers can cause a sudden collapse of vulnerable email programs. Attacks can crash the entire system based on the operating system that the email client is running and the user permissions of the problematic email client program. If a high-Permission user reads emails using an email user proxy that is vulnerable to attacks, attackers can gain management permissions to access the system.

Let's take a look at HELO Buffer Overflow. In versions earlier than sendmail8.9, attackers can use the HELO command to send strings with abnormal lengths to disguise their own initiated addresses. If an attacker sends at least 1024 bytes of abc after HELO, the message header is as follows:

From attacker@attack.place.net Web Feb 5 22 31: 51 1998
Received:
From
Abcabcabcabcabcabcabcabcabcabcabcabcabcabcabcabcabcabcabcab → abcabcabcabcabcabc
Date: Wed, 5 Feb 1998 12:32:22 + 0300
From attacker@attack.place.net

The abnormal string hides the information that the sender's IP address should be properly displayed. Although this attack method is not dangerous, attackers can use it to forward mail spam and create emails that are difficult to track.

There is also a password file/Root access, which is a more terrible attack, it affects sendmail8.8.4. Local users can use the link to obtain root access. This attack method relies on sendmail to save undelivered messages after/var/tmp/dead. letter.

1. See CA-98.10 site http://www.cert.org/advisories/ca-98.10.mime_buffer_overflows.htm.

All users can perform write operations on/var/tmp. Therefore, local attackers can create a hard link between/etc/passwd and/var/tmp/dead. letter. Then, send a message that cannot be delivered to the sendmail server. In the message body, attackers can insert a user account that can be added to the password file.

When the message is marked as undeliverable, it will be added to/var/tmp/dead. and in/var/tmp/dead. letter has a hard link with/etc/passwd. This leads to a new system account with Root permissions.

As a prominent and frequently accessed server, Sendmail is often the target of attacks. The latest attack method is concentrated on a vulnerability in the sendmail header parsing code. By creating a large number of TO: Header messages, the attacker can stop the server. This attack method is effective for sendmail8.9.2 and earlier versions, so even the recently installed sendmail is also affected.

The above is a common attack on sendmail, because sendmail itself is not easy to install, there are many security vulnerabilities, users can also choose a better tool Qmail.

Telnet Security

Unlike many other services, telnet (or a similar service) is absolutely required. Using telnet can easily complete a lot of work. If you do not need telnet, this work will be difficult to complete. Unless there is a better reason, public telnet or shell access should not be allowed.

Common telnet has many security issues. An attack that deserves attention from LINUX users is an attack that transmits environment variables. Over the past few years, security experts have recognized this as a problem. Therefore, developers have designed the setuid and setgid programs to ignore sensitive environment variables. For example, LD_LIBRARY_PATH.

Telnet is vulnerable to the following attacks:

In earlier versions of LINUX, attackers can use telnet to force a kernel dump, which exposes hidden passwords. [4]

In Red Hat Linux4.0, attackers can forcibly log on to the system to determine the valid user name. The telnet package in Red Hat Linux4.0 can be disconnected if an invalid user name is entered during connection. However, if the user name is valid and the password is incorrect, the server will return a logon prompt to log on again.

Although these attacks rarely occur, most telnet attacks have been strengthened to deal with such attacks

2. Accessible http://www.hoobie.net/security/exploits/hacking/telnet_core.txt

This means that we can use the standard telnet service without enhancing its security, Because telnet has several serious defects:

The password is not encrypted. A third party can use the sniffer to capture the password.

Telnet does not adopt strong user authentication.

Telnet does not perform session integrity check.

The Telnet session is not encrypted.

These are all vulnerabilities that may be exploited by malicious users.