3270

A family of IBM mainframe terminals and related protocols (includes 3278 mono and 3279 color terminal).


Admind or Sadmind

A distributed system administration daemon that carries out security tasks when administrative tasks are performed across the network. SunOS 5.4 and below use admind, and SunOS 5.5 and above use sadmind.

The daemon is started automatically by inetd whenever a request is received, or it can be started from the command line. Before the request is acted upon, the daemon must authenticate the client to the server. Once the client identity is verified, the daemon uses this identity to allow authorization.

The default security level for admind is SYS. You can use the more secure DES security level by specifying the -S 2 option when invoking the daemon, after first making sure that all servers in the domain are properly set up to use DES security.


alis


ALU

The Arithmetic Logic Unit is a high-speed CPU circuit that does calculating and comparing. Numbers are transferred from memory into the ALU for calculation, and the results are sent back into memory. Alphanumeric data is sent from memory into the ALU for comparing.


AUSCERT

The Australian Computer Emergency Response Team, AUSCERT, provides a single trusted point of contact in Australia for the computer community to deal with computer security incidents and their prevention. AUSCERT aims to reduce the probability of successful attack, to reduce the direct costs of security to organizations, and to minimize the risk of damage caused by successful attacks.

AUSCERT is a member of the Forum of Incident Response and Security Teams (FIRST) and has close ties with the CERT Coordination Center (CCC), with other international Incident Response Teams (IRTs) and with the Australian Federal Police.

AUSCERT maintains an anonymous FTP service that is found at ftp://ftp.auscert.org.au/pub/. This archive contains past SERT and AUSCERT Advisories, and other computer security information. AUSCERT also maintains a World Wide Web service that is found at http://www.auscert.org.au/.


BIND

Berkeley Internet Name Domain is a public domain DNS server that is available for most versions of Unix.


Bit

Short for BInary digiT. The smallest element of computer storage, it is a single digit in a binary number (0 or 1). The bit is physically a transistor or capacitor in a memory cell, a magnetic spot on disk or tape, or a high or low voltage pulsing through a circuit.

Groups of bits make up storage units in the computer, called characters, bytes, or words, which are manipulated as a group. The most common is the byte, made up of eight bits and equivalent to one alphanumeric character.


Bootparam

Bootparam (or the bootparamd daemon) is a server process that provides information to diskless clients necessary for booting. It first consults the local bootparams file for a client entry. If the local bootparams file does not exist, bootparamd consults the corresponding Network Information Service (NIS) map.

bootparamd can be invoked either by inetd or by the user.


Bridge

A device that connects two LAN segments together, which may be of similar or dissimilar types, such as Ethernet and Token Ring Bridges are inserted into a network to improve performance by keeping traffic contained within smaller segments.

Bridges work at the data link layer (OSI layer 2), whereas routers work at the network layer (OSI layer 3). Bridges are protocol independent; routers are protocol dependent. Bridges are faster than routers because they do not have to read the protocol to glean routing information.


Brute force

Refers to a repetitive method or procedure that does not include any shortcuts to improve performance, but instead relies on computing power to try all possibilities until the solution is found.


Byte

Short for BinarY TablE. A common unit of computer storage made up of eight binary digits (bits). A ninth bit may be used in the memory circuits as a parity bit for error checking.

A byte holds the equivalent of a single character, such as the letter A, a dollar sign, or decimal point. For numbers, a byte can hold a single decimal digit (0 to 9), two numeric digits (packed decimal), or a number from 0 to 255 (binary numbers).


Cache

Memory caches and disk caches are used to speed up computer system performance. A browser cache speeds up downloading Web pages.

The cache is a temporary storage area for instructions and data that is closer to the CPU’s speed. The larger the cache, the faster the performance, since there is a greater chance that the instruction or data required next is already in the cache.


CERT

The CERT Coordination Center studies Internet security vulnerabilities, provides incident response services to sites that have been the victims of attack, publishes a variety of security alerts, researches security and survivability in wide-area-networked computing, and develops information to help you improve network and computer security at your site.


Check

Checks are located in the GUI and are used when creating or modifying policies to run scans on your system.


Core dump

A display or printout of the contents of memory. When a program abnormally ends, a memory dump can be taken in order to examine the status of the program at the time of the crash. The programmer examines the information to see which tasks were being worked on when it failed. Counters, variables, switches, flags, and sometimes program data (such as passwords) are also included in the dump.

Unix environments often create a core file to hold this information. Windows NT environments display a blue screen, and optionally write the information to a file of your choosing. This file is typically called MEMORY.DMP, and is controlled by the System control panel, on the Startup/Shutdown tab.


CPU

The Central Processing Unit (also called the processor) is the computing part of the computer. It is made up of the control unit and Arithmetic Logic Unit (ALU). Today, the CPUs of almost all computers are contained on a single chip.


Daemon

Pronounced “demon.” A Unix program that executes in the background, ready to perform an operation when required. Functioning like an extension to the operating system, a daemon is usually an unattended process that is initiated at startup. Typical daemons are print spoolers, e-mail handlers, or a scheduler that starts another process at a designated time. The term comes from Greek mythology meaning “guardian spirit.”

In the Windows NT environment, a service is analogous to a daemon.


Data Segments

Data segments are reserved areas or pieces of a larger data structure within a communications protocol.


Database service (database_svc)


Denial of Service

A denial of service (DoS) is an attack in which an intruder severely limits or crashes your system by sending an abundance of packets containing oversized data segments, incorrect header information, or overloaded service requests.

Some reasons attackers use DoS attacks include the following:

  • A reboot is required to activate a newly installed Trojan horse.

  • An attacker wants to cover their tracks, or conceal CPU activity with a random crash.

Reasons that an administrator might use a DoS attack:

  • To ensure that their computers are not vulnerable by testing the latest patch.

  • To stop a computer that cannot be physically accessed, such as a computer running a runaway process and causing problems.


DES

The Data Encryption Standard is a NIST standard secret key cryptography method that uses a 56-bit key. DES is based on an IBM algorithm that was further developed by the U.S. National Security Agency (NSA). It uses the block cipher method that breaks the text into 64-bit blocks before encrypting them. There are several DES encryption modes. The most popular mode exclusive ORs each plaintext block with the previous encrypted block.

DES decryption is very fast and widely used. The secret key may be kept a total secret and used over again. Or, a key can be randomly generated for each session, in which case the new key is transmitted to the recipient using a public key cryptography method such as RSA.

Triple DES is an enhancement to DES that provides considerably more security than standard DES, which uses only one 56-bit key. There are several Triple DES methods. EEE3 uses 3 keys and encrypts 3 times. EDE3 uses 3 keys to encrypt, decrypt, and encrypt again. EEE2 and EDE2 are similar to EEE3 and EDE3, except that only 2 keys are used, and the first and third operations use the same key.


Dialog box

A small, on-screen window displayed in response to some request. It provides the options currently available to the user. A dialog is a viewing area on your screen that is not scalable.


Diskless client

A workstation without a hard disk or other disk drive. Programs and data are retrieved from the network server. The network computer (NC) is an example of a diskless client.


DLL

A DLL is a dynamic link library file type. Among their many uses, DLLs can be used to implement micro-updates.


DNS

Domain Name System software lets users locate computers on the Internet by domain name. The DNS server maintains a database of domain names (host names) and their corresponding IP addresses. For example, if www.example.com were presented to a DNS server, the IP address 102.10.7.123 would be returned. DNS has replaced the manual task of updating HOSTS files.


DTP (Data Transfer Process)

Defined in RFC 959, “File Transfer Protocol (FTP)” at http://www.cis.ohio-state.edu/htbin/rfc/rfc959.html the data transfer process establishes and manages the data connection. The DTP can be passive (PASV) or active.


Ethernet

A local area network (LAN) developed by Xerox, Digital and Intel (IEEE 802.3). It is the most widely used LAN access method. Token Ring is next. Ethernet is normally a shared media LAN. All stations on the segment share the total bandwidth, which is either 10 Mbps (Ethernet), 100 Mbps (Fast Ethernet), or 1000 Mbps (Gigabit Ethernet).


etherstatd

A commonly used Remote Procedure Call (RPC) service that is typically identified by the RPC portmapper service as defined in the etc/rpc file. This service’s alias name is etherstat.

The etherstatd service puts a specified ethernet interface into promiscuous mode and provides traffic statistics to remote programs. This program registers itself with the RPC portmapper as program 100010.


Exploit

A security hole or an instance of taking advantage of a security hole.

An exploit is a method that tries to find vulnerabilities on your system. ISS products such as System Scanner and Internet Scanner may run exploits on your system during a scan.


External Service

In the Unix environment, it is a separate program controlled by inetd and executes in the background. Unlike internal services, these programs are not internal to inetd. Some examples are ftp, telnet, login, and finger.

In the /etc/inetd.conf file, external services contain the command name and arguments (such as /usr/etc/ftpd ftpd for the FTP daemon) as the last entries on the line.

See also Internal Service.


File handle

A temporary reference assigned by the operating system to a file or resource that has been opened. The handle is used to access the file throughout the application session.


Finger

A Unix command used to find information about a particular user, such as an affiliation, a telephone number, whether the user is currently logged on, or the last time the user logged on. The person being fingered must have entered a profile on the system. Profiles can serve as a method of social introduction or to state particular job responsibilities.


Fix

A fix is information provided for correcting vulnerabilities found during a scan.


Frame

In communications, a fixed block of data transmitted as a single entity. In local area networks (LANs) the terms frame and packet are used interchangeably.


fsirand

In the SunOS operating environment, fsirand is a system administration command that installs random inode generation numbers on all the inodes on a specified device. It also installs a file system ID in the superblock. This helps increase the security of file systems exported by NFS.

The man page for this command is available from docs.sun.com at http://docs.sun.com/ab2/@LegacyPageView?toc=SUNWab_40_2:/safedir/space4/pkgs/oldversioncol/ab1/SUNWaman/toc/REFMAN1M:0084_fsirand.1m;bt=man+Pages(1M)%3A+System+Administration+Commands;ps=ps/SUNWab_40_2/REFMAN1M/0084_fsirand.1m.


FTP

File Transfer Protocol allows a user on one host to access and to transfer files to and from another host over a TCP/IP network. It includes functions to log on to the network, list directories, and copy files. FTP operations can be performed by typing commands at a command prompt or via an FTP utility running under a graphical interface, such as Windows. FTP transfers can also be initiated from within a Web browser by entering the URL preceded with ftp://.


GUI

A Graphical User Interface is a graphics-based user interface that incorporates icons, pulldown menus, and a mouse. The GUI has become the standard way users interact with a computer. Some major GUIs are Windows, Macintosh, X Windows, and Motif. In a client/server environment, the GUI resides in the user’s client machine.


Header

The header is the first part in a communications protocol that contains controlling data, such as originating and destination stations, message type, and priority.


Host

An individual computer, device, or machine in a network. A host is a computer with an IP address.

In the context of Internet Scanner, a host refers to the device that is being scanned.


HTML

HTML (HyperText Markup Language) is the document format used on the World Wide Web. Web pages are built with HTML tags, or codes, embedded in the text. HTML defines the page layout, fonts, and graphic elements, as well as the hypertext links to other documents on the Web.


ICMP

Internet Control Message Protocol is a TCP/IP protocol used to send error and control messages. For example, a router uses ICMP to notify the sender that its destination node is not available. A ping utility sends ICMP echo requests to verify the existence of an IP address.

See also ICMP redirect.


ICMP Redirect

An ICMP redirect instructs the recipient machine to override a value in its routing table. Redirect messages are used to tell systems to route data to its destination using a different path, which could imply that someone is trying to intercept information. If you can forge ICMP redirect packets, and if your target host pays attention to them, you can alter the routing tables on the host and possibly subvert security by causing traffic to flow via a path the network manager did not intend.


IMAP

Internet Messaging Access Protocol. A standard mail server used on the Internet. It provides a message store that holds incoming e-mail until users log on and download it. IMAP4 is the latest version.

IMAP is more sophisticated than the Post Office Protocol (POP3) mail server. Messages can be archived in folders, mailboxes can be shared, and a user can access multiple mail servers. There is also better integration with MIME, which is used to attach files. For example, users can read only the headers in the message without having to automatically accept and wait for attached files to download that they do not want.


IMAPD

The daemon or process for the Internet Messaging Access Protocol (IMAP) server.


Inetd

The INternET Daemon is a Unix program (daemon) that manages many common TCP or UDP services. It is activated at startup, waits for various connection requests (FTP, Telnet, etc.), and launches the appropriate server components.


INND

Innd, the InterNetNews daemon, handles all incoming NNTP feeds. InterNetNews is a complete Usenet system. INN separates hosts that feed you news from those that have users reading news.


Inode

An Identification NODE is an individual entry in a directory system that contains the name of and pointer to a file or other object.


Internal Service

In the Unix environment, it is a program handled internally by inetd and executes in the background. Services such as echo, time, and discard are fairly trivial, but are useful for testing. They should be disabled when tests are not in progress, since attackers could use internal services for denial of service attacks.

In the /etc/inetd.conf file, internal services contain the term internal as the last entry on the line.

See also External Service.


Internet

Used as “internet” (lowercase), refers to a network made up of a number of smaller networks.

Used as “Internet” (uppercase), the Internet is made up of a multitude of interconnected networks in over 100 countries, comprised of commercial, academic, and government networks. Originally developed for the military, the Internet became widely used for academic and commercial research. Today, the Internet has become commercialized into a worldwide information highway, providing information on every subject known to humankind.


Internet Explorer

See Microsoft Internet Explorer.


IP (Internet Protocol) Address

An IP address is the physical address of a computer attached to a TCP/IP network. Every computer on the network must have a unique IP address. IP addresses use four sets of numbers (from 0 to 255) separated by periods; for example, 204.171.64.2.


IPX/SPX

The Internetwork Packet Exchange is a NetWare communications protocol used to route messages from one node to another. IPX packets include network addresses and can be routed from one network to another. An IPX packet can occasionally get lost when crossing networks, thus IPX does not guarantee delivery of a complete message. Either the application has to provide that control or NetWare’s SPX protocol must be used. IPX provides services at layers 3 and 4 of the OSI model (network and transport layers).

The Sequenced Packet Exchange is the NetWare communications protocol used to control the transport of messages across a network. SPX ensures that an entire message arrives intact and uses NetWare’s IPX protocol as its delivery mechanism. Application programs use SPX to provide client/server and peer-to-peer interaction between network nodes. SPX provides services at layer 4 of the OSI model.


IRC

Internet Relay Chat provides near-real-time computer conferencing on the Internet. There are hundreds of IRC channels on numerous subjects that are hosted on IRC servers around the world. After joining a channel, your messages are broadcast to everyone listening to that channel. IRC client programs provide a graphical interface for all functions, including logging on to popular servers and obtaining a list of their active channels.


KDC

The Key Distribution Centers (KDCs) issue Kerberos tickets. Each KDC contains a copy of the Kerberos database. The master KDC contains the master copy of the database, which it propagates to the slave KDCs at regular intervals. All database changes (such as password changes) are made on the master KDC. Slave KDCs provide Kerberos ticket-granting services, but not database access. This ability allows clients to continue to obtain tickets when the master KDC is unavailable.


Kerberos

A security system developed at the Massachusetts Institute of Technology (MIT) that authenticates users. It establishes identity at logon, which is used throughout the session. It does not provide authorization to services or databases.


keyserv

The keyserv service stores the private encryption keys of all logged in users for use with network services with integrated security, like secure NFS and NIS+.


LAN

A Local Area Network is a communications network that serves users within a confined geographical area, such as in the same building or campus.


Linux

A version of Unix that runs on Intel x86, DEC Alpha, and IBM PowerPC machines. Linux is freeware, and the full distribution of Linux is available on CD-ROM, which includes the complete source code, as well as hundreds of tools, applets, and utilities.

In 1990, Finnish computer science student Linus Torvalds turned Minix, a popular classroom teaching tool, into Linux, which is closer to the real Unix. Torvalds created the kernel and most of the supporting applications. Utilities came from the GNU project of the Free Software Foundation.


llockmgr

The llockmgr is part of the file locking manager system for NFS. It generates local file locking operations in response to requests from client lock managers. The llockmgr service registers with the RPC portmapper as program 100020. This service should be disabled if your system is not acting as either an NFS client or server.


Lockd

Lockd is a daemon that provides record-level locking services in an NFS environment.

Lockd processes lock requests that are either sent locally by the kernel, or remotely by another lock daemon. Lockd forwards lock requests for remote data to the server site’s lock daemon through RPC/XDR. Lockd then requests the status monitor daemon, statd, for monitor service. The reply to the lock request will not be sent to the kernel until the status daemon and the server site’s lock daemon have replied.

When a server recovers, it waits for a grace period for all client-site lock daemons to submit reclaim requests. Client-site lock daemons, on the other hand, are notified by the status monitor daemon of the server recovery and promptly resubmits previously granted lock requests. If a lock daemon fails to secure a previously granted lock at the server site, then it sends SIGLOST to a process.


Locking

To make a file or other piece of data inaccessible. File locking is a critical component of all multi-user computer systems, including local area networks. When users share files, the operating system must ensure that two or more users do not attempt to simultaneously modify the same file. The operating system prevents simultaneous write operations by locking the file as soon as the first user opens it. All subsequent users may read the file, but they cannot write to it until the first user releases the file.


Lynx

A text-based Web browser created at the University of Kansas. Though largely supplanted by graphical browsers such as Netscape Navigator and Microsoft Internet Explorer, Lynx is still popular among people with visual disabilities and those with very slow modem connections.


Mask

A pattern of bits used to accept or reject bit patterns in another set of data. For example, the Boolean AND operation can be used to match a mask of 0s and 1s with a string of data bits. When a 1 occurs in both the mask and the data, the resulting bit will contain a 1 in that position.


Microsoft Corporation

Microsoft Corporation, Redmond, WA, http://www.microsoft.com. The world’s largest independent software company, Microsoft was founded by Bill Gates and Paul Allen in 1975. Microsoft has become a leader in microcomputer programming languages and operating systems, where Windows has become the dominant environment on desktops, and Windows NT is a major contender in the server market. Microsoft has also become the leader in the applications market, which includes Excel, Word, PowerPoint, and Access.


MIME

Multipurpose Internet Mail Extensions. A common method for transmitting non-text files via Internet e-mail, which was originally designed for text. MIME encodes the files using one of two encoding methods and decodes it back to its original format at the receiving end. A MIME header is added to the file, which includes the type of data contained and the encoding method used.


Motif

The graphical user interface (GUI) endorsed by the Open Software Foundation. It has become the standard graphical interface for Unix.


Mountd

Mountd is an RPC server that answers file system mount requests. It determines which file systems are available for mounting by which machines, and provides information as to what file systems are mounted by which clients.

Note: Some routines that compare hostnames use case-sensitive string comparisons; some do not. If an incoming request fails, verify that the case of the hostname in the file to be parsed matches the case of the hostname called for, and attempt the request again.


NetBIOS

The Network Basic Input/Output System is a network protocol for PC local area networks. NetBIOS is commonly used within a network segment or corporation, but cannot be transmitted across a router without the use of another protocol. NetBIOS addresses are typically the computer name, thereby simplifying the networking details and addressing from the users.

NetBIOS provides session and transport services (layers 4 and 5 of the OSI model), but does not provide a standard format for transmission over the network. Different implementations of NetBIOS were later formalized into NetBEUI, which is used in all Windows operating systems that support networking.


Netgroup

In NFS, a combination of hosts and usernames specified in the /etc/netgroup file. These entries provide a method for tuning the access. The file also contains information about whether the directory is to be exported as read-only, read-write, and whether superuser access is allowed from clients that mount that directory.


Netscape Navigator

A Web browser for Windows, Apple Macintosh, and X Windows from Netscape. It provides secure transmission over the Internet, and Netscape server software provides encryption based on the RSA method. As of Version 2.0, Navigator supports Java applications and provides a formal method for hosting plug-in applications from third parties.


netstat

Some systems are configured to run the netstat program as a network service. This allows remote users to view the networking status, including running services and connected clients, of the machine by connecting to the netstat port, generally TCP port 15.


NetWare

A family of network operating systems from Novell that support DOS, Microsoft Windows, IBM OS/2, and Apple Macintosh clients. Unix client support is available from third parties. NetWare is one of the most widely used LAN control programs.


NFS

Network File System is the Unix networking protocol that allows files and printers to be shared across the network. This de facto Unix standard, which is widely known as a distributed file system, was developed by Sun Microsystems, and defined in RFC 1094 (RFC 1813 defines Version 3). NFS services are also available on Windows NT servers, which enables Unix workstations to gain access to its files and printers.

The counterpart of NFS in DOS, Windows, and OS/2 environments is SMB (Server Message Block), and in NetWare is NCP (NetWare Core Protocol). NFS, SMB, and NCP are all high-level protocols (OSI layers 5 to 7) that provide open and close file and read and write functions, as well as access control. They ride on top of the transport protocols (TCP/IP, NetBIOS, NetBEUI, IPX/SPX), which manage the transfer.

If I need to use NFS, how can I make it more secure?

  • Any filesystems listed in /etc/dfs/dfstab will be exported to the world, by default. Include a list of NFS clients (or a netgroup) with the “-o rw” or “-o ro” options.

  • Include the “nosuid” option to disable setuid programs on that mount where applicable

  • Do not run nfs mount through rpcbind—the mount daemon will see the request as being local and allow it. This is the source of known rpcbind vulnerabilities as reported by CERT. Use a rpcbind replacement that does not forward mount requests through.

  • Use secure-RPC if possible. If not, you’re using “AUTH_UNIX” authentication, which simply depends on the IP address of the client for identification. Any machine using the IP address of the ones in your access list can gain access to NFS.

  • Disable NFS if possible. NFS traffic flows in clear-text (even when using “AUTH_DES” or “AUTH_KERB” for authentication) so any files transported via NFS are susceptible to snooping.

  • Programs can guess the file handle of the root mount point and get any file from an NFS server, regardless of any access rights. Use fsirand to randomize inode numbers on NFS servers.


nfsd

The nfsd daemon services NFS requests from client machines. Each daemon process listens for service requests at the port indicated in the NFS server specification (see Network File System Protocol Specification, RFC 1094).


NIS

Network Information Services. A naming service that allows resources to be easily added, deleted, or relocated. Formerly called Yellow Pages (yp), NIS is a de facto Unix standard. NIS+ is a redesigned NIS for Solaris 2.0 products. The combination of TCP/IP, NFS, and NIS comprise the primary networking components of Unix.

NIS contains data, such as host files, password files, and e-mail aliases for entire networks. It allows a remote user to obtain copies of the NIS password map information. An attacker who possesses the NIS domain name (often set up as a derivative of the public domain name) can steal information helpful in guessing passwords and gaining unauthorized access.


NIST

National Institute of Standards & Technology, Washington, DC, http://www.nist.gov is the standards-defining agency of the U.S. government. NIST was formerly called the National Bureau of Standards.


nlockmgr

The nlockmgr is part of the file locking manager system for NFS. It forwards local file locking requests to the lock manager on the server system. The nlockmgr service registers with the RPC portmapper as program 100021. This service should be disabled if your system is not acting as either an NFS client or server.


NNTP

Network News Transfer Protocol connects to Usenet groups on the Internet. Usenet newsreaders support the NNTP protocol.


Non-trivial password

A term or phrase that conforms to certain security guidelines, making it effective against unauthorized access to systems or data. Non-trivial passwords make use of the following guidelines:

SUFFICIENT PASSWORD LENGTH – Passwords with six characters or longer serve as good protection.

USE TERMS THAT CANNOT BE DERIVED – Avoid words, names, and places that can either be associated with you or looked up in a dictionary lookup attack.

ADD NONSENSICAL PATTERNS TO PASSWORDS – Mixing numbers, uppercase, lowercase, and transposing characters can decrease the probability of a compromised password.


nsed


nsemntd


Open Look

An X Windows-based graphical user interface for Unix developed by Sun. It has been widely used by Sun and was defined and distributed by AT&T when it was still involved with Unix. OPEN LOOK has given way to Motif, which has become the standard user interface in the Unix world.


OSI model

The Open System Interconnection is an ISO standard for worldwide communications that defines a framework for implementing protocols in seven layers. Control is passed from one layer to the next, down and back up the hierarchy from station to station. There are seven layers as defined in the OSI model:

Application - Layer 7: The top layer defines the language and syntax that programs use to communicate with other programs. For example, a client program uses commands to request data from a server program. Common functions at this layer are opening, closing, reading files, writing files, transferring files, e-mail messages, executing remote jobs, and obtaining directory information about network resources.

Presentation - Layer 6: When data is transmitted between different types of computer systems, this layer negotiates and manages how data is represented and encoded. For example, it provides a common reference between ASCII and EBCDIC machines, as well as between different floating point and binary formats. Sun’s XDR and OSI’s ASN.1 are two protocols used for this purpose. This layer is also used for encryption and decryption.

Session - Layer 5: Provides communication coordination. Determines one-way or two-way communications and manages the dialogue; for example, verifying that the previous request has been fulfilled before sending the next. It can also provide fast recovery in the event of a connection failure. This layer is often not used, or its services are sometimes incorporated into the transport layer.

Transport - Layer 4: Responsible for end to end validity and integrity of the transmission. If a packet gets lost in a router somewhere in the enterprise internet, the transport layer will detect the error. It ensures that if an 8 MB file is sent, the full 8 MB is received. “OSI transport services” include layers 1 through 4, and are collectively responsible for delivering a error-free and complete message or file from sending to receiving station.

Network - Layer 3: Establishes the route between the sending and receiving stations. The node to node function of the data link layer (layer 2) is extended across the entire internetwork, because a routable protocol contains a network address in addition to a station addresses. This layer is the switching function of the dial-up telephone system, as well as the functions performed by routable protocols such as IP, IPX, SNA, and AppleTalk. If all stations are contained within a single network segment (that is, they are not separated by a router), then the routing capability in this layer is not required.

Data Link - Layer 2: Responsible for node to node validity and integrity of the transmission. The transmitted bits are divided into frames; for example, an Ethernet, Token Ring, or FDDI frame in local area networks (LANs). Layers 1 and 2 are required for every type of communications.

Physical - Layer 1: Responsible for passing bits onto and receiving them from the connecting medium. This layer has no understanding of the meaning of the bits, but deals with the electrical and mechanical characteristics of the signals and signaling methods. For example, it includes the RTS and CTS signals in an RS-232 environment, as well as TDM and FDM techniques for multiplexing data on a line.


OSPF

Open Shortest Path First is a routing protocol that determines the best path for routing IP traffic over a TCP/IP network. OSPF is an interior gateway protocol (IGP), which is designed to work within an autonomous system. It is also a link state protocol that provides less router-to-router update traffic than the RIP protocol (distance vector protocol) that it was designed to replace.


OSR2

OEM Service Release 2. Also known as Win95B, a version of Windows 95 released to PC vendors in late 1996 that included bug fixes, as well as support for enhanced power management, FAT32, IDE bus mastering, 32-bit CardBus, and DMI Version 1.1.

To determine the Windows 95 version, right-click My Computer, click Properties, and click the General tab. The first version of Windows 95 was 4.00.950. The second release known as OEM Service Release 2 (OSR2) or Win95B, is identified as 4.00.950 B.


Packet

A block of data (a frame) used for transmission in LANs and packet switching systems. In Ethernet LANs, the terms packets and frames are used interchangeably.


Password

A term or phrase used as security against unauthorized access to systems or data. When choosing a password, keep these tips in mind:

CHANGE PASSWORD FREQUENTLY - The longer you use a password, the higher the risk of losing it.

USE GOOD PASSWORDS – Do not use the names of people, places, or things that can be identified with you.

DO NOT DISCLOSE YOUR PASSWORD - Your password is as valuable as the information it protects.

INSPECT YOUR DATA - If you suspect someone has tampered with your files, report it immediately.

NEVER LEAVE AN ACTIVE TERMINAL UNATTENDED - Always log off or lock your terminal before leaving it.

REPORT SUSPECTED COMPUTER ABUSE - Whether directed against you or not, abuse or misuse of your computer resources only hinders the timely completion of your tasks.


Password file

In Unix environments, the /etc/passwd file traditionally contains user information and the corresponding encrypted passwords. A password file’s permissions are read-only for all users except the password command. Current Unix systems should minimize the chances of an attacker obtaining passwords by storing passwords in a Trusted Computing Base (TCB) or a shadow password file.

Windows 95 systems use a .pwl password list file to store network and dial-in passwords. The contents of the password list file are weakly encrypted, and could provide password information when cracked.

Microsoft Knowledge Base article Q140557 “Microsoft Windows 95 Password List Security Issue” at http://support.microsoft.com/support/kb/articles/q140/5/57.asp recommends that you either upgrade using the Mspwlupd.exe enhanced security patch or disable password caching for maximum security.

The Mspwlupd.exe patch is described in Microsoft Knowledge Base article Q132807 “Enhanced Encryption for Windows 95 Password Cache” at http://support.microsoft.com/support/kb/articles/Q132/8/07.asp. The patch itself is available at http://support.microsoft.com/download/support/mslfiles/Mspwlupd.exe (326304 bytes).


PASV (Passive) command

Defined in RFC 959, “File Transfer Protocol (FTP)” at http://www.cis.ohio-state.edu/htbin/rfc/rfc959.html this command requests the server-DTP to “listen” on a data port (which is not its default data port) and to wait for a connection rather than initiate one upon receipt of a transfer command. The response to this command includes the host and port address this server is listening on.


PC-NFS

Sun Microsystem’s PC-NFS is the main networking software used on IBM PC compatible computers running Windows NT, DOS, or Windows 3.1x. PC-NFS can be used to access remote drives and printers. This ability can access a Unix home directory, which appears on the PC as another disk drive (normally drive N:).


pcnfsd

The pcnfsd program (also called rpc.pcnfsd) is an authentication and printing program that runs on a Unix server. There are many publicly available versions, and several vendors supply their own version.

pcnfsd supports a printing model that uses NFS to transfer files from a client to the pcnfsd server. (Note: pcnfsd does not provide NFS services.) When a client wants to print a file, pcnfsd requests the path to a spool directory from the server. The client then writes the necessary files for printing using NFS, and informs the pcnfsd server that the files are ready for printing. pcnfsd creates a subdirectory for each of its clients using the client’s hostname, then returns this path name to the client. The NFS server must export the returned path name to its clients. The NFS server and the pcnfsd server may be two separate machines.


Ping bomb

Continuously pinging another user, primarily in IRC with the intent of flooding that user off the network or crashing their machine.


Plaintext

Normal text that has not been encrypted and is readable by text editors and word processors.


POP3

Post Office Protocol 3. A mail server standard commonly used on the Internet. It provides a message store that holds incoming e-mail until users log on and download it. POP3 is a simple system with little selectivity. All pending messages and attachments are downloaded at the same time. POP3 uses the SMTP messaging protocol.


POPD

The daemon or process for the Post Office Protocol (POP3) server.


Portmapper

Portmapper is a program that registers RPC server programs.

Since there are many more RPC programs than TCP or UDP ports; the portmapper maps between them. From the ports, portmapper advertises the program and version numbers, but not the procedures. Each time a client calls an RPC program, portmapper returns the TCP or UDP port the program is listening to.


Private key

The private part of a two-part, public key cryptography system, such as RSA. The private key is kept secret and never transmitted over a network.


Public key

The published part of a two-part, public key cryptography system, such as RSA. The private part is known only to the owner.


Report

A report provides you with rapid, formatted summaries of vulnerabilities detected on your system.


rexd

The rexd service and the on client program provide remote command execution on a network. It allows remote users to run RPC programs on a host. To the extent that it is possible, the complete client environment, including working directory and environment variables, is made available on the remote system.

By default, the rexd server believes everything that the client sends it. It is highly insecure because it can be used to run an arbitrary shell on the host. An attacker can exploit the service and execute commands as almost any user. The standard rexd server has no provision for access control, nor does it require that the client use a privileged network port.


Rexec

Rexec is a network service that offers a remote command interpreter. Rexec uses password authentication to qualify authorized users. A vulnerability exploited by attackers is the likelihood that a remote machine that has an account for a local user will have the same password as the local account, allowing penetration through rexec.


RIP

Routing Information Protocol determines the best path for routing traffic over a network by analyzing hop counts. RIP protocols continuously announce themselves on the network and are known to waste bandwidth. RIP-2 and OSPF provide secure and less wasteful alternatives to RIP.


rje_mapper

The rje_mapper is part of many Remote Job Entry (RJE) implementations. RJE is a system for batch-oriented connectivity between a host and downstream devices, such as printers. The rje_mapper service registers with the RPC portmapper as program 100014. This service should be disabled if RJE is not implemented on your network.


Rlogin

The rlogin command establishes a remote login session from your terminal to a remote host.

Host names are listed in the host’s database, which may be contained in the /etc/hosts file, the Network Information Service (NIS) hosts map, the Internet domain name server, or a combination of these. Each host has one official name (the first name in the database entry), and optionally one or more nicknames.


Router

A device that transfers data packets from one local area network (LAN) or wide area network (WAN) to another. Routers see the network as addresses and all the possible paths between them. They read the address in each transmitted frame and decide how to send it based on the most expedient route (traffic load, line costs, speed, bad lines, etc.). Because routers have to inspect the network address in the protocol, they do more processing and add more overhead than a bridge or switch. Routers work at the network layer (OSI layer 3), whereas bridges and switches work at the data link layer (OSI layer 2).

Routers are also used to segment LANs to balance traffic, filtering traffic for security purposes, and controlling broadcast storms. Routers often serve as an internet backbone, interconnecting all networks in the enterprise.


RPC

A Remote Procedure Call is a programming interface that allows one program to use the services of another program on a remote machine. The calling program sends a message and data to the remote program, which is then executed, and results are passed to the calling program. This type of interface allows programs to communicate with each another while freeing the programmer from the low-level details.

An RPC server consists of a collection of procedures that a client may call by sending an RPC request to the server, along with the procedure parameters. The server will invoke the indicated procedure on behalf of the client, handing back the return value, if there is any. In order to be machine-independent, all data exchanged between client and server is converted to a so-called External Data Representation format (XDR) by the sender, and converted back to the machine-local representation by the receiver.

RPC was developed by Sun Microsystems, Inc. Important applications built on top of RPC are NFS, the Network File System, and NIS, the Network Information System.


rpc.statd

rpc.statd, also called statd, is the NFS file-locking status monitor. It interacts with rpc.lockd (also called lockd) to provide the crash and recovery functions for file locking across NFS. rpc.lockd and rpc.statd work together; so if either is running, both must run. rpc.lockd and rpc.statd can be safely and permanently turned off if the machine is neither an NFS client nor an NFS server. If a machine where rpc.lockd and rpc.statd have been disabled becomes either an NFS server or an NFS client, then both rpc.lockd and rpc.statd should be turned back on.

NFS is stateless, which means that NFS clients and servers can be rebooted without a loss of file integrity due to NFS. In contrast, NFS file locking is stateful. To achieve this stateful nature in a stateless environment, rpc.lockd must work with rpc.statd to add state to file locking.

To understand what rpc.statd does, it is first necessary to understand what rpc.lockd does. rpc.lockd processes lock requests that are sent either locally by the kernel or remotely by another lock daemon. rpc.lockd forwards lock requests for remote NFS files to the NFS server’s lock daemon using Remote Procedure Calls (RPC). rpc.lockd then requests monitoring service from the status monitor daemon, rpc.statd, running on the NFS server. Monitoring services are needed because file locks are maintained in the NFS server kernel.

In the event of a system crash or reboot, all NFS locks would normally be lost. It is rpc.statd that adds stateful file locking. When an NFS server reboots, rpc.statd causes the previously held locks to be recovered by notifying the NFS client lock daemons to resubmit previously granted lock requests. If a lock daemon fails to secure a previously granted lock on the NFS server, it sends SIGLOST to the process that originally requested the file lock.

The vulnerability in rpc.statd is its lack of validation of the information it receives from what is presumed to be the remote rpc.lockd. Because rpc.statd normally runs as root and because it does not validate this information, rpc.statd can be made to remove or create any file that the root user can remove or create on the NFS server.


Rpcinfo

Rpcinfo makes an RPC call to an RPC server and reports what it finds. It can display a list of RPC programs, show which programs are active and using a specific network protocol (such as UDP or TCP), or delete the registration for a specified RPC program.


rquotad

rquotad is an RPC server that returns quotas for a user of a local file system mounted by a remote machine over the NFS. The rquotad daemon is normally invoked by inetd.


RSA

Rivest-Shamir-Adleman is a highly secure cryptography method by RSA Data Security, Inc., Redwood City, CA, at http://www.rsa.com. It uses a two-part key. The owner keeps the private key; the public key is published.

Data is encrypted by using the recipient’s public key, which can only be decrypted by the recipient’s private key. RSA is very computation intensive, thus it is often used to create a digital envelope, which holds an RSA-encrypted DES key and DES-encrypted data. This method encrypts the secret DES key so that it can be transmitted over the network, but encrypts and decrypts the actual message using the much faster DES algorithm.


Rsh

A Unix command that lets a user remotely log in to a server on the network and pass commands to it. It is similar to the rlogin command, but provides passing of command-line arguments to the command interpreter on the server at the same time. Rsh can be used within programs, as well as from the keyboard.

Rsh allows users remote access without having to re-authenticate. Ssh was designed to be a replacement for the unsecure rsh protocols. The advantages of Ssh lay in its use of strong encryption techniques to establish secure communications between a server and a client machine.


rstatd

The rstat protocol is used to gather statistics from the remote kernel. Statistics will be available on items such as paging, swapping, and CPU utilization.


rusersd

rusersd is the network username server that returns a list of users on the host. The rpc.rusersd daemon may be started by inetd or listen.


Rwhod

The rwhod daemon gathers information from other machines, including the status of the machine and users on the machine.

The rwhod man page is available at http://www.rs6000.ibm.com/doc_link/en_US/a_doc_lib/cmds/aixcmds4/rwhod.htm or http://www.bsdi.com/bsdi-man?proto=1.1&query=rwhod&msection=8&apropos=0.


Sadmind

See Admind.


Scan

A scan runs policies, performing checks that detect weaknesses and vulnerabilities on your system.


Selection service


Service

  1. In the Windows NT environment, it is a program that executes in the background, ready to perform an operation when required. Functioning like an extension to the operating system, a service is usually an unattended process that is initiated at startup. Services are listed in the Services control panel. Typical services are network handlers, protocol managers, or a scheduler that starts another process at a designated time. A daemon in Unix is analogous to a service.

  2. In the Unix environment, refers to a background program


SMTP

Simple Mail Transfer Protocol. The standard e-mail protocol on the Internet. SMTP was originally designed for text, but MIME and other encoding methods enable program and multimedia files to be attached to e-mail messages.

SMTP servers route SMTP messages throughout the Internet to a mail server, such as POP3 or IMAP4, which provides a message store for incoming mail.

A protocol used to transfer electronic mail between computers. It is specified in RFC 821, with extensions specified in many other RFCs. It is a server to server protocol, so other protocols are used to access the messages. See also: Electronic Mail, Post Office Protocol, RFC 822.


Sniffing

Capturing information that was intended for other machines on a computer network. Sniffing is one of the most popular forms of attacks used by hackers.

For example, a machine in an Ethernet network can be configured to accept all packets, no matter what destination is in the packet header. Because account and password information is often transmitted in clear-text, it is not difficult for an intruder via sniffing to compromise all the machines on the net.


SNMP

The Simple Network Management Protocol is a widely used network monitoring and control protocol. Data is passed from SNMP agents, who report activity in each network device (hub, router, bridge, etc.) to the workstation console used to oversee the network. The agents return information contained in a MIB (Management Information Base), which is a data structure that defines what is obtainable from the device and what can be controlled (turned off, on, etc.). Originating in the Unix community, SNMP has become widely used on all major platforms.


Social Engineering

A technique for obtaining information that relies on human security weaknesses. The objective is to trick people into revealing passwords or other information that compromises a target system’s security. Classic scams include phoning up a person who has the required information and masquerading as a field service tech or a fellow employee with an urgent access problem.


Spoofing

Faking the sending address of a transmission in order to gain illegal entry into a secure system. Usurping or assuming the IP Address of another user often deprives the rightful owner the use of the IP address.


Ssh

Ssh (Secure Shell) is a program used to log into another computer over a network, execute commands in a remote machine, and move files from one machine to another. It provides strong authentication and secure communications over insecure channels. It listens for connections on port 22.

Ssh is intended as a complete replacement for rlogin, rsh, rcp, and rdist. It can also replace telnet in many cases.


Statd

Statd is a daemon that cooperates with statd daemons on other hosts to provide a host status monitoring service. The daemon accepts requests from programs running on the local host (typically, lockd(8), the NFS lock manager) to monitor the status of specified hosts. If a monitored host reboots, the remote daemon will notify the local daemon, which in turn will notify the local program(s) that requested the monitoring service. Conversely, if the local host reboots, when the statd restarts, it will notify the hosts that were being monitored at the time of the crash.

More information about this daemon’s operation can be found at rpc.statd.


Sun Microsystems

Sun Microsystems, Inc, Mountain View, CA, http://www.sun.com is a major manufacturer of Unix-based workstations and servers. In 1981, Bavarian-born Andreas Bechtolsheim was licensing rights to a computer he designed. Named Sun for Stanford University Network and using off-the-shelf parts, it was an affordable workstation for engineers and scientists. In that year, he met Vinod Khosla, a native of India, who convinced him to form a company and expand. Khosla, Bechtolsheim, and Scott McNeally, all Stanford MBAs, founded Sun in 1982.


Super block

Also spelled superblock. On Unix systems, the super block defines the file system. It contains an array of inodes that define the files in the file system, the actual file data blocks, and a collection of free blocks.


Superuser

A computer account with unlimited access privileges who can perform any and all operations on the computer.


SYN packet

The very small, standard “wake-up” messages that are part of the normal transfer of packets between machines on the Internet. The SYN attack consists of huge amounts of these packets, which cannot be processed efficiently because the attacker made them appear to come from sites that do not exist. Each fraudulent packet takes several seconds for a machine to give up an attempt to provide a normal response.


SYS

A level of authentication security for programs such as admind or sadmind.

At this security level, the server accepts the original user and group identities from the client system and uses them as the identities for the authorization checks. There is no checking to be sure that the UID of the user represents the same user on the server system. That is, it is assumed the administrator has made the UIDs and GIDs consistent on all systems in the network. Checks occur to verify that the user has permission to execute the request.


TCP

A reliable end-to-end data transfer service, typically used to complement TCP/IP. Equivalent to MIL-STD-1778, or the OSI layer 4 transport layer. When guaranteed delivery is not necessary, use UDP.


TCP/IP

Transmission Control Protocol/Internet Protocol. A communications protocol developed under contract from the U.S. Department of Defense to internetwork dissimilar systems. It is a de facto Unix standard that is the protocol of the Internet and widely supported on all platforms. It is also a common shorthand, which refers to the suite of transport and application protocols that run over IP.

The TCP part of TCP/IP provides transport functions, which ensures that the total amount of bytes sent is received correctly at the other end. The IP part of TCP/IP provides the routing mechanism. TCP/IP is a routable protocol, which means that the messages transmitted contain the address of a destination network, as well as a destination station. This allows TCP/IP messages to be sent to multiple networks within an organization or around the world, hence its use in the worldwide Internet.


Telnet

A terminal emulation protocol commonly used on the Internet. It allows a user to log on to a remote machine and run a program from a remote terminal or computer.


Telnetd

The daemon, or process responsible for operating the Telnet system.


TFTP

Trivial File Transfer Protocol is a version of the TCP/IP FTP protocol that has no directory or password capability.


Token Ring

A local area network (LAN) developed by IBM (IEEE 802.5). It uses a token ring access method and connects up to 255 nodes in a star topology at 4 or 16 Mbps. All stations connect to a central wiring hub called the MAU (Multistation Access Unit) using a twisted wire cable. The central hub makes it easier to troubleshoot failures than a bus topology. This is a different type of hub than the one used in 10BaseT twisted pair Ethernet networks.

Token Ring is more deterministic than Ethernet. It ensures that all users get regular turns at transmitting their data. With Ethernet, all users compete to get onto the network.

Token Ring is a data link protocol (MAC layer protocol) and functions at layers 1 and 2 of the OSI model.


Traceroute

An Internet utility that traces the route from the client machine to the remote host being contacted. It reports the IP addresses of all the routers in between.


UDP

User Datagram Protocol is a protocol within the TCP/IP protocol suite that is used in place of TCP when a reliable delivery is not required. For example, UDP is used for real-time audio and video traffic where lost packets are simply ignored, because there is no time to retransmit. If UDP is used and a reliable delivery is required, packet sequence checking and error notification must be written into the applications.


UID

Short for User Identification. In NFS, UID (also spelled uid) is the user ID of the owner of a file.


Unix

A multiuser, multitasking operating system that is used in workstations and servers. There are many versions of Unix on the market, and, except for the PC world where Windows dominates, almost every hardware vendor offers it either as its primary or secondary operating system.


URL

A Uniform Resource Locator is the address that defines the route to a file on the Web or any other Internet facility. URLs are typed in to the browser to access Web pages, and URLs are embedded within the pages themselves to provide the hypertext links to other pages.


Usenet

Short for USEr NETwork. A public access network on the Internet that provides news and e-mail. It is a dispersed bulletin board maintained by volunteers who provide news and mail feeds to other nodes.


UUCP

Unix to Unix CoPy copies a file from one computer to another. It was widely used for mail transfer. Unlike TCP/IP, which is a routable communications protocol, UUCP provides a point-to-point transmission where a user at one Unix computer dials up and establishes a session with another Unix computer.


VAX

Virtual Address eXtension. A family of 32-bit computers introduced in 1977 from Digital Equipment Corporation. VAXes range from desktop personal computers to mainframes all running the same VMS operating system. Large models can be clustered in a multiprocessing environment to serve thousands of users. Software compatibility between models caused the VAX family to succeed during the 1980s.


VMS

The Virtual Memory System is a multiuser, multitasking, virtual memory operating system for the VAX series from Digital Equipment Corporation. VMS programs run on any VAX from the MicroVAX to the largest unit.


Vulnerability

A vulnerability is a security hole in a system, which could allow an intruder to gain information and lead to improper access.


WAN

A Wide Area Network is a communications network that covers a wide geographic area, such as state or country.


Web Browser

The program that accesses the World Wide Web on the Internet. In order to view a site, you type its address (URL) into the browser’s Location field; for example, www.iss.net, and the page of that site is downloaded to you. The home page is an index to other pages on that site that you can jump to by clicking a “click here” message or an icon. Links on that site may take you to other related sites.

A few popular Web browsers are Netscape Navigator and Microsoft Internet Explorer.


Windows

The most widely used operating system for personal computers. Windows provides a user interface and desktop environment similar to the Macintosh, in which applications are displayed in re-sizable, movable windows on screen. Developed and maintained by Microsoft Corporation, the most current versions of Windows include Windows 98 and Windows NT.


Wizard

A wizard is a program that guides you through a procedure.


WWW

World Wide Web. An Internet facility that links documents locally and remotely. The Web document is called a Web page, and links (hypertext) in the page let users jump from page to page whether the pages are stored on the same server or on servers around the world. The pages are accessed and read via a Web browser, such as Netscape Navigator or Microsoft Internet Explorer.


X Windows

Also called X and X Window, X Windows is a windowing system developed at the Massachusetts Institute of Technology (MIT), which runs under Unix and all major operating systems. It lets users run applications on other computers in the network and view the output on their own screen.

X Windows generates a rudimentary window that can be enhanced with GUIs, such as Open Look and Motif, but does not require applications to conform to a GUI standard. The window manager component of the GUI allows multiple resizable, relocatable X windows to be viewed on screen at the same time.

X client software resides in the computer that performs the processing and X server software resides in the computer that displays it. Both components can also be in the same machine. This seems opposite to today’s client/server terminology, but the concept is that the server is “serving up” the image.


Xauth

The xauth(1) program is used to edit and to display the authorization information used in connecting to the X server. This program is usually to extract authorization records from one machine and merge them in on another (as is the case when using remote logins or to grant access to other users). Commands may be entered interactively, on the xauth command line, or in scripts. Note that this program does not contact the X server.

The xauth(1) man page is available at http://cando.dwr.co.gov/cgi-bin/man2html/xauth(1) or http://www.bsd.com/bsdi-man?proto=1.1&query=xauth&msection=1&apropos=0.


XDR

EXternal Data Representation is a data format developed by Sun Microsystems that is part of its networking standards. It deals with integer size, byte ordering, data representation, etc. and is used as an interchange format. Different systems convert to XDR for sending and from XDR upon receipt.


Xhost

The xhost program is used to add and to delete host names or user names to the list allowed to make connections to the X server. In the case of hosts, this provides a rudimentary form of privacy control and security. It is only sufficient for a workstation (single user) environment, although it does limit the worst abuses. Environments that require more sophisticated measures should implement the user-based mechanism or use the hooks in the protocol for passing other authentication data to the server.

The xhost(1) man page is available at http://www.uni-bayreuth.de/cgi-bin/manpages/xhost/1 or http://www.bsdi.com/bsdi-man?proto=1.1&apropos=0&msection=ALL&query=xhost.


X-Press Update

An X-Press Update is a periodical software update between major software releases. An X-Press Update consists of the most recently developed checks that detect the latest vulnerabilities on your system. The online help system is automatically updated during an X-Press Update.