WinSCP Freeware SFTP and SCP client for Windows

WinSCP is a full featured GUI SCP client. This means that communication between the server and the client is encrypted well, unlike FTP or Explorer. WinSCP also includes synchronization options that will help minimize the amount of traffic needed to mirror filesystems. We installed all of the options: Here you can see the array of […]

Customizing the AFICK File Integrity Checker

In this article, we set up AFICK. Let’s adapt AFICK to use a particular directory tree and a different database. This way, we can fingerprint the OS on one run, and fingerprint more dynamic content with a different job. Here is our configuration file: [root@ids afick]# cat /etc/afickweb.conf database:=/var/lib/afickweb/afick history := /var/lib/afickweb/history archive := /var/lib/afickweb/archive […]

Using the AFICK File Integrity Checker

One important component of securing a system is to use a file integrity checker.There are multiple tools out there that can do this, including AIDE, and Tripwire. One project that does what we need, has few installation requirements, is fairly easy to install, and is multi platform is AFICK. In this article we will install […]

Spike in Port 12345 Traffic

We have noticed a surge in traffic on port 12345. This could be NetBus, or a variant. We suspect that some trojan backdoor is in the wild tacked on to a new worm. The worm is looking for other friendly hosts listening on port 12345. To see a historical chart of activity on this port, […]

Setting Up a Windows Server 2003 Host Based Firewall

There is a false sense of security when you envision your network as inside and outside, with a firewall protecting you from hostile users on the outside. One particularly nasty problem is when users bring their laptops home, surf, read email, and then plug it right back in to the corporate LAN on Monday morning. […]

Securing PHP

The first step to secure PHP is from the system perspective. Only provide what you have to. Of course, the code needs to be secure as well by using proper input validation, encryption, etc., but as systems administrators, we can head off some problems. First off, you can view a complete rundown of your current […]

Running a Quick Ping Scan using NMAP

Nmap can make quick of work of doing a ping sweep of your network: [usr-1@srv-1 ~]$ nmap -sP 10.50.100.1-255 Starting nmap 3.70 ( http://www.insecure.org/nmap/ ) at 2005-06-13 15:50 PDT Host 10.50.100.1 appears to be up. Host 10.50.100.2 appears to be up. Host 10.50.100.22 appears to be up. Host mondo (10.50.100.72) appears to be up. Host […]

Configuring the Red Hat Enterprise Firewall

First off, let’s test ssh access: host user $ ssh x.y.z.w ssh: connect to host x.y.z.w port 22: Connection timed out host user $ Let’s add ssh access. Go to Applications->System Settings->Security Level: If you are not root, you will get a prompt to enter the root password: Be default nothing is enabled as trusted. […]

Automating Secure FTP Downloads With Kermit

If you need to automate FTP downloads, and want lots of flexibility, an oldie but goodie is Kermit. I know what you’re thinking: “Hey, isn’t Kermit an old DOS comms program?”. Yes, it is a very old program. The cool thing about this, though, is that if you need to automate file transfers, it has […]

Linux Kernel Exploit

There is a local user privilege exploit for the Linux kernel. Details are here: http://isec.pl/vulnerabilities/isec-0021-uselib.txt One thing to remember is that a local user does not mean that the user has to have access to the physical machine. It means that any user that can run code on the machine can gain root access.