• Overview
• Turn In

Overview

1. Establishing physical connections.
2. Installing and configuration of networking protocols.
3. Installing and configuration of networking applications.
4. Installing and configuration of proxies and firewalls.

Equipment/Supplies/Time

• PCs located in LF-111A or LF-115.
• Removable hard disk with Windows and Linux installed.
• About 3 hours.

Instructions

• Security Evaluation
  • For both Windows and Linux - Probe each system for potential weaknesses.
    • telnet use - Command is: telnet <IP> <port>
      • Windows - Start | Accessories | Command Prompt | telnet ...
      • Linux - Open a command prompt and telnet <IP> <port>
    • telnet port probe - Using telnet determine whether the following service protocols can be accessed over the Internet:
      1. telnet - port 23
      2. SMTP - port 25
      3. HTTP - port 80. Make sure the Web server is running by browsing the site. On Linux you may need to enter (at the prompt):
         • service http restart
      4. FTP - port 21
    • Probe ports
      • To probe for potential security problems of  a host go to grc.com for Shields UP!
    • Run Test My Shields. Print the results, label as Windows or Linux and set aside.
    • Run Port Probe. Print the results, label as Windows or Linux and set aside.
  • Probe the Windows system with the Microsoft security check tool.
• Question 1. Analyze the results of the above tests on Windows and Linux. Which system is the more or less secure and why?
• Firewalls
  • Windows - firewall
    • Download and install ZoneAlarm, a free fire wall for personal use on Windows machines.
    • Probe for potential security problems of a host using grc.com for Shields UP!
    • Run Shields Up. Print the results, label as Fire Wall Windows and set aside.
    • From another machine attempt to hit the Web server. Note results.
    • From another machine attempt ftp to the Windows machine. Note results.
    • Allow ftp access through the firewall. Attempt to transfer a file to an account on the Windows server. Unless you have changed FTP security files cannot not be transferred.
    • Print out the firewall log file from \WINNT\Internet Logs\ZALog.txt
  • Linux - firewall
    • Go to Programs | System | and type firewall-config
      • Deactivate the firewall.
  • ftp - By default ftp services are disabled for security reasons. A configuration file must be hand edited to enable ftp.
  • Enable ftp by:
    • Go to command prompt
    • cd /etc/xinetd.d
    • gedit wu-ftpd
          disable     = no
    • File | Save
    • Restart by:
      service xinetd restart
    • Test your Linux system using ftp from a remote host such as Windows. Copy an HTML file to your personal (i.e. not root) user account subdirectory named public_html.
      1. ftp <IP>
      2. Enter your Linux user name and password.
      3. mkdir public_html
      4. cd public_html
      5. put <file.html> - Where file is the name of an HTML file on the remote host.
      6. The Apache server will be configured to access user directories later.
  • Go to Programs | System | firewall-config
    • Create a new firewall rule to Reject use of the ftp destination port 21 to the source IP of the remote host.
    • Log appearance so attempts will be logged. Print the rule used.
    • Create another rule but change only that Log appearance is checked.  
    • Be sure to Activate changes to firewall.
  • Test by probing your Linux system again using ftp from a remote host IP listed in the firewall rule. Print results.
  • Test by probing your Linux system again using a Web browser from the remote host IP listed in the firewall rule. Print results.
  • Print the last few lines of the logged entries in file /var/log/messages. It should contain the rejection of ftp access to the IP listed in the firewall rule and the HTTPD access.
    • Command prompt
    • tail /var/log/messages
  • It is advisable to delete the firewall rule that logs all accesses since the log can grow very large.
  • Run Test My Shields. Print the results, label as FireWall Linux and set aside.
• Question 2. Locate and  note which is which of the log line for the two remote accesses (i.e. the ftp and Web access) for Linux and Windows. Compare the results of Windows and Linux firewall tests. Comment upon the utility of the firewall software and its granularity (e.g. how fine of control does it provide?). Consider whether the firewalls are packet filters. See the text 410-412.
• Web Server Access
  • Configure Web Server to access user files.
  • Apache
    1. Configure Apache to access user accounts in the /home directory with a subdirectory of public_html.
       • Programs | System |  Apache Configuration
       • Click the Virtual Hosts tab | Edit Default Settings....
       • Select Directories | Add
       • Enter a directory of:
         /home/*/public_html
       • Click OK to save and exit.
    2. Linux will not allow Apached to access a user directory unless execute mode is permitted to the directory.
       • Login as root.
       • Command prompt
       • cd /home
       • chmod +x <user name>       For example: chmod +x jfdoyle
    3. Test by accessing a user file on the Linux Web server.
       • Login as a regular user.
       • Create the public_html subdirectory:
         mkdir public_html
       • Create a test.htm file in public_html
         cd public_html
         gedit test.htm
         Save file
       • Access from the Web. For example:
         http://149.160.25.207/~jfdoyle/test.htm
• Question 3. Allowing user files to be accessed over the Internet raises potential security problems such as access to user directories other than those designated (e.g. public_html) and execution of programs by the server (i.e. Common Gateway Interface). Examine at least one potential Web server security risk on either Windows or Linux and describe your attempt to exploit. Give printouts to support your descriptions.
• Question 4 - Run one of the receivers of a protocol written for Homework 5, perhaps receiver1. With the receiver running, start the grc.com tests on the computer running the receiver program.
  • What were the results?
  • What can you conclude about the completeness of these tests?
  • Since the protocols use datagrams (i.e. UDP) rather than connections (i.e. TCP), what can you say about sockets opened for datagrams being more secure than TCP-type connections?
• Question 5 - Download or execute the echoServer program on a Windows machine. With the echoServer running, start the grc.com tests on the computer running the receiver program.
  • What were the results?
  • The echoServer listens on port 889. Open a telnet session to the computer running echoServer by: telnet <IP address> 889
  • What can you conclude about the completeness of the grc.com tests?
• Question 6 - Read How Code Red revealed the perils of port 80 and comment on the problems and benefits of using a firewall to defend an HTTP server from attack. Consider attack from outside and inside the firewall.

Turn In

1. Cover Page - Your name, date, and Homework 4. Staple all pages together.
2. Answers to questions and supporting printouts.