YoLinux: List of Linux Security Audit and Hacker Software Tools
It is important for Linux users and System administrators to be aware of
the tools hackers employ and the software used to monitor and
counter such activity. I actually like to use many of the following tools
to test the integrity of my servers.
checkps - detect rootkits by detecting falsified output and similar anomalies. The ps check should work on anything with /proc. Also uses netstat.
Rootkit hunter - scans for rootkits, back doors and local exploits
Rkdet - root kit detector daemon. Intended to catch someone installing a rootkit or running a packet sniffer.
fsaudit - Perl script to scan filesystems and search for suspicious looking directories
COPS: Computer Oracle and Password System - UNIX security checks. Programs and shell scripts which perform security checks. Checks include file and directory permissions, passwords, system scripts, SUID files, ftp configuration check, ...
SARA - Security Auditor's Research Assistant - network security vulnerability scanner for SQL injections, remote scans, etc. (follow-on to the SATAN analysis tool)
Argus - IP network
transaction auditing tool. This daemon promiscuously reads network
datagrams from a specified interface, and generates network traffic
status records Argus 2
SAINT - Finds computers on the network, port scans and does a vulnerability check and outputs a report. - Commercial product.
VOMIT - Voice Over Misconfigured Internet Telephones - Use TCP dump of VOIP stream and convert to WAV file.
Cisco Call Manager depends on MS/SQL server and are thus vulnerable to SQL Slammer attacks.
DISCO - Passive IP discovery and fingerprinting tool. Sits on a segment of a network to discover unique IPs and identify them.
Yersina - Framework for analyzing and testing the deployed networks and systems. Designed to take advantage of some weakness in different Layer 2 protocols: Spanning Tree Protocol (STP), Cisco Discovery Protocol (CDP), Dynamic Trunking Protocol (DTP), Dynamic Host Configuration Protocol (DHCP), Hot Standby Router Protocol (HSRP), IEEE 802.1q, Inter-Switch Link Protocol (ISL), VLAN Trunking Protocol (VTP).
hping - command line TCP/IP packet assembler/analyzer. Supports TCP, UDP, ICMP and RAW-IP protocols, has a traceroute mode, the ability to send files between a covered channel, ...
hping2 - Can be used to performs a lot of tasks, like testing of firewall rules, (spoofed) port scanning, ...
CryptoHeaven -
Secure online storage, file sharing and distribution, email, instant
messaging. Free Linux client but it is a commercial for fee service.
(less than 2MB storage is free)
GIIS ext3/ext2FS file undelete tool.User can recover files by it's name or type or by its owner. Can't recover the files deleted before installation of giis.
This has typically been the domain of the Microsoft Windows and Outlook products
and NOT Linux but Linux administrators running SAMBA file servers often must
be aware of these viruses. There are according to Symantec 68 Linux specific
viruses and worms including the Ramen worm which attempts to attack unpatched
rpc.statd, wuftpd, and LPRng.
DoD/DoE NISPOM Chapter 8 computer security configuration for Linux:
NISPOM (National Industry Security Program Operating Manual)
chapter 8 is a computer security requirement developed by the US DoD
(Department of Defense - US)
and DoE (Department of Energy) and published by the
DSS (Defense Security Service) which US defense contractors
are required to meet when processing classified data on computers in a
classified environment.
Linux as issued by major distros defaults do not meet this requirement.
Use the following software packages/configurations:
Meet reporting requirements: This auditing and reporting requirement
can be met using Snare. This requires a kernel patch (or use of one
of the kernels [RHEL3 or RHEL4] downloaded from the Snare home page.) and the running of a
Snare audit daemon. It meets C-2 reporting requirements and records
logins/logoffs, file and directory access, access denial, ...
Newer Linux distributions running auditd (RHEL4, FC3+) can get compliant results.
Snare home page.
For more aggressive reporting requirements, see
Computer Associates eTrust Security Information Management.
Grant admin privileges without giving root password. Granular delegation of root privileges. File and directory access control.
Symark.com: PowerBroker
"Hacking Linux Exposed"
by Brian Hatch, James B. Lee, George Kurtz
ISBN #0072225645, McGraw-Hill (2nd edition)
From the same authors of "Hacking Exposed".
"Maximum Linux Security: A Hacker's Guide to Protecting Your Linux Server and Workstation"
by Anonymous and John Ray
ISBN #0672321343, Sams
Covers not only audit and protection methods but also investigates and
explains the attacks and how they work.
"Network Intrusion Detection: An Analyst's Handbook"
by Stephen Northcutt, Donald McLachlan, Judy Novak
ISBN #0735710082, New Riders Publishing
"SSH, the Secure Shell : The Definitive Guide"
by Daniel J. Barrett, Richard Silverman
ISBN #0596000111, O'Reilly & Associates
"Computer Security Incident Handling Step by Step"
by Stephen Northcutt
ISBN #0967299217
"Snort 2.1 Intrusion Detection, Second Edition"
by Jay Beale, Caswell
ISBN #1931836043, Syngress
"Ethereal Packet Sniffing"
by Angela D. Orebaugh, Gilbert Ramirez, Ethereal.com
ISBN #1932266828, Syngress
"Nessus Network Auditing (Jay Beale's Open Source Security)"
by Renaud Deraison, Noam Rathaus, HD Moore, Raven Alder, George Theall, Andy Johnston, Jimmy Alderson
ISBN #1931836086, Syngress
"Security Assessment: Case Studies for Implementing the NSA IAM"
by Russ Rogers, Greg Miles, Ed Fuller, Ted Dykstra
ISBN #1932266968, Syngress
"Network Security Assessment"
by Chris McNab
ISBN #059600611X, O'Reilly
"A Practical Guide to Security Assessment"
by Sudhanshu Kairab
ISBN #0849317061, Auerbach Publications
Security Source Magazine
Security Source Magazine's cover story is about
keeping the network secure, from the gateway to the desktop. Subscribe
now and continue to learn about valuable security topics and strategies
in each quarterly issue.
Business and management of information security. It
is an international magazine, with an European focus. It is published
in both print and digital editions, the latter containing the full
content of the print publication, accessible via the web. Its
experienced editorial team delivers stories that deal with the big
picture issues of information security. Our sources and columnists are
the expert security researchers and practitioners who define, drive,
and lead the field. And our journalists are in demand by the IT trade
and broadsheet press.
Books:
