This page is a collection of pointers to information that will help departmental and individual users improve the security of their UNIX systems.

If you believe your system may have been broken into, please review the following information for actions to take:

• Intruder Detection Checklist -- CERT's suggested steps for determining if your system has been compromised
• Steps for Recovering from a UNIX Root Compromise -- from CERT
• Responding to Security and Abuse Incidents -- from the Georgia Tech Computer and Network Usage Policy

• UNIX Configuration Guidelines -- from CERT
• Password Protection Guidelines -- from CERT
• Blocking mailed spam -- how to configure your system to prevent abuse as a spam relay. See also: Anti-Spam Provisions in Sendmail 8.8.
• Security Recommendations: Solaris 2.6. Prepared by GTRI. (On-campus access only.)

One key element of system security is to be sure that your system has the latest vendor patches applied, particularly those that correct security problems.

Your system manufacturer provides these patches (and installation instructions), likely via an anonymous ftp or web site (see Vendor Security Support Sites).

1. CA-94:01 Ongoing Network Monitoring Attacks
2. CA-94:15 NFS Vulnerabilities
3. CA-95:01 IP Spoofing and Hijacked Terminal Connections
   • IP Spoofing and .rhosts Files
4. CERT Summaries -- periodic update on current security problems and solutions

See also Security Advisory Information about receiving and reviewing other computer security alerts.

If you administer particular vendor(s) systems, you may find helpful security advisory information and/or patches at a vendor site. We keep links to these at: our vendor support site.

Some tools are available to help you administer a secure system. We especially recommend the following, although not all will be useful in all situations.

• cops and tiger

  cops is a UNIX security toolkit that analyzes your system security. You may get cops from ftp://coast.cs.purdue.edu/pub/tools/unix/cops.

  tiger is a set of scripts that scan a UNIX system looking for security problems. Its function is similar to cops; we recommend using either cops or tiger but not necessarily both. Of the two, tiger is perhaps easier to install. Tiger is available at ftp://coast.cs.purdue.edu/pub/tools/unix/tiger.

• shadow passwords

  This is a feature distributed with some systems that you should enable--consult your system documentation. (It is part of the "C2 security package" in SunOS.) It protects the encrypted passwords in the system password file, which would otherwise be accessible by anyone and thus subject to Crack (see below).

• Crack

  This program checks your users' passwords for "guessable" values. It works by encrypting a list of likely passwords and seeing if the result matches any of your user's encrypted passwords (which must be provided to it--see shadow passwords above). It is surprisingly effective. You may get Crack at ftp://coast.cs.purdue.edu/pub/tools/unix/crack/.

• npasswd and passwd+

  These are two similar packages that force users to choose good passwords (thus reducing vulnerability to Crack--see above). However, note that they are generally incompatible with shadow passwords (also see above). You may get npasswd at ftp://coast.cs.purdue.edu/pub/tools/unix/password/.

• tcp_wrappers (also known as tcpd) will log network connections to your machine and optionally allows you to control what hosts and users are permitted to connect. It also logs remote user identification from remote hosts running identd (see below). You may get the tcp_wrappers from ftp://ftp.porcupine.org/pub/security/index.html.

• identd will permit other hosts to identify the user account used on your machine to connect to them. This will help you identify compromised accounts when reported by the administrator of another system. You may get identd from ftp://coast.cs.purdue.edu/pub/tools/unix/ident/servers. For most systems, the latest version of pidentd (the portable ident daemon) is appropriate.

• Tripwire

  Tripwire will checksum your system files, and later detect if an intruder has made any modifications. This is somewhat resource-intensive, but the alternative (re-installing your system from scratch) is quite costly. You may get Tripwire from http://www.tripwiresecurity.com/.

• ssh (secure shell) is a replacement for rlogin, rsh, rcp, etc. that provides complete encryption of telnet-like interactive sessions. It also includes a more secure .rhosts-like feature based on RSA public key cryptography. For further information, see the Ssh (Secure Shell) Home Page.

Further Information

• CERT Technical Tips Library