Server security is as important as network security because
servers often hold a great deal of an organization's vital
information. If a server is compromised, all of its contents may
become available for the cracker to steal or manipulate at will.
The following sections detail some of the main issues.
A full installation of Red Hat Enterprise Linux contains 1000+
application and library packages. However, most server
administrators do not opt to install every single package in the
distribution, preferring instead to install a base installation of
packages, including several server applications.
A common occurrence among system administrators is to install
the operating system without paying attention to what programs are
actually being installed. This can be problematic because unneeded
services may be installed, configured with the default settings,
and possibly turned on. This can cause unwanted services, such as
Telnet, DHCP, or DNS, to run on a server or workstation without the
administrator realizing it, which in turn can cause unwanted
traffic to the server, or even, a potential pathway into the system
for crackers. Refer To Chapter 5 Server
Security for information on closing ports and disabling
unused services.
Most server applications that are included in a default
installation are solid, thoroughly tested pieces of software.
Having been in use in production environments for many years, their
code has been thoroughly refined and many of the bugs have been
found and fixed.
However, there is no such thing as perfect software and there is
always room for further refinement. Moreover, newer software is
often not as rigorously tested as one might expect, because of its
recent arrival to production environments or because it may not be
as popular as other server software.
Developers and system administrators often find exploitable bugs
in server applications and publish the information on bug tracking
and security-related websites such as the Bugtraq mailing list
(https://www.securityfocus.com) or the Computer Emergency
Response Team (CERT) website (https://www.cert.org). Although these mechanisms are an
effective way of alerting the community to security
vulnerabilities, it is up to system administrators to patch their
systems promptly. This is particularly true because crackers have
access to these same vulnerability tracking services and will use
the information to crack unpatched systems whenever they can. Good
system administration requires vigilance, constant bug tracking,
and proper system maintenance to ensure a more secure computing
environment.
Refer to Chapter 3
Security Updates for more information about keeping a
system up-to-date.
Administrators who fail to patch their systems are one of the
greatest threats to server security. According to the System Administration Network and Security
Institute (SANS), the primary cause of
computer security vulnerability is to "assign untrained people to
maintain security and provide neither the training nor the time to
make it possible to do the job." This applies as
much to inexperienced administrators as it does to overconfident or
amotivated administrators.
Some administrators fail to patch their servers and
workstations, while others fail to watch log messages from the
system kernel or network traffic. Another common error is when
default passwords or keys to services are left unchanged. For
example, some databases have default administration passwords
because the database developers assume that the system
administrator changes these passwords immediately after
installation. If a database administrator fails to change this
password, even an inexperienced cracker can use a widely-known
default password to gain administrative privileges to the database.
These are only a few examples of how inattentive administration can
lead to compromised servers.
Even the most vigilant organization can fall victim to
vulnerabilities if the network services they choose are inherently
insecure. For instance, there are many services developed under the
assumption that they are used over trusted networks; however, this
assumption fails as soon as the service becomes available over the
Internet — which is itself inherently untrusted.
One category of insecure network services are those that require
unencrypted usernames and passwords for authentication. Telnet and
FTP are two such services. If packet sniffing software is
monitoring traffic between the remote user and such a service
usernames and passwords can be easily intercepted.
Inherently, such services can also more easily fall prey to what
the security industry terms the man-in-the-middle attack. In this type of attack, a
cracker redirects network traffic by tricking a cracked name server
on the network to point to his machine instead of the intended
server. Once someone opens a remote session to the server, the
attacker's machine acts as an invisible conduit, sitting quietly
between the remote service and the unsuspecting user capturing
information. In this way a cracker can gather administrative
passwords and raw data without the server or the user realizing
it.
Another category of insecure services include network file
systems and information services such as NFS or NIS, which are
developed explicitly for LAN usage but are, unfortunately, extended
to include WANs (for remote users). NFS does not, by default, have
any authentication or security mechanisms configured to prevent a
cracker from mounting the NFS share and accessing anything
contained therein. NIS, as well, has vital information that must be
known by every computer on a network, including passwords and file
permissions, within a plain text ACSII or DBM (ASCII-derived)
database. A cracker who gains access to this database can then
access every user account on a network, including the
administrator's account.
By default, Red Hat Enterprise Linux is released with all such
services turned off. However, since administrators often find
themselves forced to use these services, careful configuration is
critical. Refer to Chapter 5 Server
Security for more information about setting up services in
a safe manner.
