Network Security Hacks [Electronic resources] نسخه متنی

How This Book Is Organized

Although each hack is designed to stand on its own, this book makes
extensive use of cross-referencing between hacks. If you find a
reference to something you're interested in while
reading a particular hack, feel free to skip around and follow it
(much as you might while browsing the Web). The book itself is
divided into several chapters, organized by subject:

Chapter 1, Unix Host Security

As the old saying goes, Unix was designed to share information, not
to protect it. This old saw is no longer true with modern operating
systems, where security is an integral component to any server. Many
new programs and kernel features have been developed that provide a
much higher degree of control over what Unix-like operating systems
can do. Chapter 1 demonstrates advanced techniques for hardening your
Linux, FreeBSD, or OpenBSD server.

Chapter 2, Windows Host Security

Microsoft Windows is used as a server platform in many organizations.
As the Windows platform is a common target for various attacks,
administering these systems can be challenging. This chapter covers
many important steps that are often overlooked by Windows
administrators, including tightening down permissions, auditing all
system activity, and eliminating security holes that are present in
the default Windows installation.

Chapter 3, Network Security

Regardless of the operating system used by your servers, if your
network is connected to the Internet, it uses TCP/IP for
communications. Networking protocols can be subverted in a number of
powerful and surprising ways, leading to attacks that can range from
simple denial of service to unauthorized access with full privileges.
This chapter demonstrates some tools and techniques used to attack
servers using the network itself, as well as methods for preventing
these attacks.

Chapter 4, Logging

Network security administrators live and die by the quality of their
logs. If too little information is tracked, intrusions can slip by
unnoticed. If too much is logged, attacks can be lost in the deluge
of irrelevant information. Chapter 4 shows you how to balance the
need for information with the need for brevity by automatically
collecting, processing, and protecting your system logs.

Chapter 5, Monitoring and Trending

As useful as system logs and network scans can be, they represent
only a single data point of information, relevant only to the instant
that the events were recorded. Without a history of activity on your
network, you have no way to establish a baseline for what is
"normal," nor any real way to
determine if something fishy is going on. This chapter presents a
number of tools and methods for watching your network and services
over time, allowing you to recognize trends that will aid in future
planning and enable you to tell at a glance when something just
isn't right.

Chapter 6, Secure Tunnels

How is it possible to maintain secure communications over networks as
untrustworthy as the Internet? The answer nearly always involves
powerful encryption and authentication techniques. Chapter 6 shows
you how to implement powerful VPN technologies, including IPSec,
PPTP, and OpenVPN. You will also find techniques for protecting
services, using SSL, SSH, and other strong encryption tools

Chapter 7, Network Intrusion Detection

How do you know when your network is under attack? While logs and
historical statistics can show you if something is out of sorts,
there are tools designed to notify you (or otherwise take action)
immediately when common attacks are detected. This chapter centers on
the tremendously popular NIDS tool Snort and presents many techniques
and add-ons that unleash this powerful tool's full
potential. Also presented are methods for setting up your own
"honeypot" network to attract and
confuse would-be system crackers.

Chapter 8, Recovery and Response

Even the most competent and careful network administrator will
eventually have to deal with successful security incidents. This
chapter contains suggestions on how to verify your
system's integrity, preserve evidence for later
analysis, and track down the human being at the other end of
undesirable network traffic.