home
***
CD-ROM
|
disk
|
FTP
|
other
***
search
/
Forum of Incident Response & Security Teams
/
Forum_of_Incident_Response_and_Security_Teams_FIRST_October_1994.iso
/
teaminfo
/
first
/
resource
/
tools.txt
< prev
Wrap
Text File
|
1994-07-08
|
11KB
|
269 lines
Incident Handling Security Tools
Last Update: August 3, 1993
There are a number of software security tools for use in incident
handling, and a large number more that are of peripheral use but
are intended mainly for system and network security. This document
categorizes and provides access information for a subset of the
tools considered most useful for incident handling.
The vast majority of these tools are for Unix and all have
something to do with the Internet and the TCP/IP protocol suite.
The tools are divided into four categories:
1 - tracing and tracking tools - for tracing connections and
examining raw TCP/IP data
2 - security assessment tools - for examining host security,
passwords, configuration
3 - security enhancement - for improving host security
4 - encryption - useful utilities for storing and exchanging
encrypted data
This list will be updated periodically; the information contained
herein is not intended to be definitive. For tools-related
information, one should subscribe to the following e-mail lists and
news groups:
cert-tools - send e-mail to cert-tools-request@cert.org
comp.security.misc
sci.crypt
comp.sources.binaries
Tracing/Tracking Tools
Tool: traceroute
Description: For tracing routes between the current host and
other Internet sites. Useful for examining hops,
detecting sites that are down, or sites that do not
resolve properly.
Availability: in comp.sources.unix archives, ftp from many sites
including ftp.uu.net
Tool: tcpdump
Description: For monitoring TCP/IP packets for BSD-based UNIX
systems.
Availability: anonymous ftp from ftp.ee.lbl.gov
Tool: dig
Description: For querying Domain Name Service servers in a more
flexible, convenient manner than nslookup.
Availability: anonymous ftp from venera.isi.edu
Security Assessment Tools
Tool: COPS (Computer Oracle and Password System)
Description: A collection of programs that each attempt to
tackle a different problem area of UNIX security.
Following is a list of the areas checked:
- file, directory, and device permissions/modes
- poor passwords
- content, format, and security of password and
group files
- the programs and files run in /etc/rc* and
cron(tab) files
- existence of root-SUID files
- a CRC check against important binaries or key
files
- writability of users home directories and startup
files (.profile, .cshrc, etc.)
- anonymous ftp setup.
- unrestricted tftp, decode alias in sendmail, SUID
uudecode problems, hidden shells inside inetd.conf,
rexd running in inetd.conf
- miscellaneous root checks
Availability: ftp anonymous from cert.org
Tool: SPI
Description: SPI is a screen-based administrator's tool that,
similar to COPS, checks configuration options,
includes a file-change (integrity) checker to
monitor for backdoors and viruses, and various
other security checks. It is not available to the
general public, but it is available to US
Department of Energy contractors and sites and to
some US military sites.
Availability: contact DOE CIAC
Tool: CRACK
Description: Crack is a fast UNIX password cracking program
designed to assist site administrators in ensuring
that user's use effective passwords. It is
approximately eight times faster than standard DES
routines, enabling one to check more passwords in a
given time. Crack is widely available and presumed
to be used by intruders.
Availability: ftp anonymous from cert.org
Tool: TAMU Suite of Tools
Description: This package includes three coordinated sets of
tools: "drawbridge", a powerful bridging filter
package; "tiger", a set of machine checking
programs; and "netlog", a set of intrusion
detection network monitoring programs.
Availability: ftp anonymous from sc.tamu.edu
Security Enhancement Tools
Tool: TCP Wrapper
Description: With this package you can monitor incoming
connections to the SYSTAT, FINGER, FTP, TELNET,
RLOGIN, RSH, EXEC, TFTP, TALK, and other IP network
services. Connections are reported through the
syslog daemon. Requirements are that network
daemons are started by the inetd program or
something similar, and the availability of a
syslog(3) library. Optional features are: access
control that limits the number of hosts that can
connect to your network daemons, remote user name
lookups with the RFC 931 protocol, and protection
against hosts that pretend to have someone else's
host name.
Availability: ftp anonymous from ftp.win.tue.nl
Tool: passwd+
Description: Passwd+ is a proactive password checker that
replaces /bin/passwd on your system. It is
rule-based and easily configurable. It prevents
users from selecting a weak password so that
programs like "CRACK" can't guess it, and it
provides enhanced syslog logging.
Availability: ftp anonymous from dartmouth.edu
Tool: secure_lib
Description: Securelib contains replacement routines for three
SunOS kernel calls: accept(), recvfrom(),
recvmsg(). These replacements are compatible with
the originals, with the additional functionality
that they check the Internet address of the machine
initiating the connection to make sure that it is
"allowed" to connect. A configuration file defines
what hosts are allowed for a given program. Once
these replacement routines are compiled, they can
be used when building a new shared libc library.
The resulting libc.so can then be put in a special
place. Any program that should be protected can
then be started with an alternate LD_LIBRARY_PATH.
Availability: ftp anonymous from eecs.nwu.edu
Tool: socks
Description: The "sockd" and "SOCKS Library" provide another way
to implement a "TCP Wrapper." It is not intended
to make the system it runs on secure, but rather to
centralize ("firewall") all external internet
services. The sockd process is started by inetd
whenever a connection is requested for certain
services, and then only allows connections from
approved hosts (listed in a configuration file).
The sockd also will LOG information about the
connection. You can use the Socks Library to
modify the client software to directly utilize the
sockd for outgoing connections also, but this is
described as very tedious and of course requires
you to have the source to those client programs.
Availability: ftp anonymous from s1.gov
Tool: npasswd
Description: Like passwd+, npasswd is a replacement for the
standard "passwd" command that prevents users from
selecting easily-guessable passwords.
Availability: anonymous ftp from emx.utexas.edu
Encryption/Authentication Tools
Tool: DES
Description: An implementation of DES suitable for use with
Kerberos and compatible with DES packages offered
my several UNIX vendors. Because this
implementation was not created in the U.S., export
restrictions do not apply.
Availability: anonymous ftp from kampi.hut.fi
Tool: DES - KA9Q
Description: A U.S.-written implementation of DES as part of the
KA9Q packet radio implementation. This version is
not exportable.
Availability: ftp anonymous from ucsd.edu
Tool: PEM
Description: PEM is a RSA-based encryption scheme that encrypts
sensitive information, but more than that it checks
for message integrity and non-repudiation of
origin, so that the originator cannot deny having
sent the message. PEM is actually a protocol that
is designed to allow use of symmetric (private-key)
and asymmetric (public-key) cryptography methods.
In this example, Trusted Information Systems, Inc.
(TIS) has implemented a PEM package using the
public-key technique together with the Rand MH
Message Handling System. TIS/PEM libraries can be
adapted for implementation of non-mail applications
as well.
Availability: send e-mail to (pem-info@tis.com).
Tool: rsaref
Description: RSAREF is a cryptographic toolkit designed to
facilitate rapid deployment of Internet
Privacy-Enhanced Mail (PEM) implementations.
RSAREF represents the fruits of RSA Data Security's
commitment to the U.S. Department of Defense's
Advanced Research Projects Agency (DARPA) to
provide free cryptographic source code in support
of a PEM standard.
Availability: ftp anonymous from rsa.com
Tool: snefru
Description: A message-digest function developed by Ralph C.
Merkle, produces a 128 or 256 bit fixed-size
output.
Availability: ftp anonymous from arisia.xerox.com
Tool: MD4/MD5
Description: MD4 is another message-digest function proposed by
Ron Rivest, similar to Snefru but implemented
differently, produces a fixed 128 bit output. MD5
is newer and slightly more secure in the face of
certain cryptographic attacks.
Availability: ftp anonymous from rsa.com
Tool: kerberos
Description: Kerberos is a DES-based encryption scheme that
encrypts sensitive information, such as passwords,
sent via the network from client software to the
server daemon process. The network services will
automatically make requests to the Kerberos server
for permission "tickets." You will need to have
the source to your client/server programs so that
you can use the Kerberos libraries to build new
applications.
Availability: ftp anonymous from athena-dist.mit.edu