Authors: Adam Gray cism
|
|  Yüklə 279 Kb.
|
Host Based Intrusion DetectionA Host Based Intrusion Detection System (HIDS) can mean different things to different people. Some consider a HIDS to mean a file hashing system such as tripwire; others consider HIDS to denote a daemon detecting unusual or unauthorized events running on the system. When it comes to the term HIDS, both types can be referenced as HIDS. We’ll be discussing the local daemon type here, and covering the file hashing type below. Most HIDS that can currently be run on OS X fall in the File checksum category. OSSSEC http://www.ossec.net
File Checksum generation and ComparisonWhile it is possible to create your own file integrity system with OS X, it comes with OpenSSL installed by default. Using the OpenSSL command to run a checksum of individual files is one way of establishing a file integrity system. A shell script can then be used to compare checksums of known good versions of the file with the current checksums and either log changes into syslog or alert an administrator of changes to the filesystem. An example of using this includes:
Most organizations will want a polished product when managing multiple systems. One solution to accomplish this is to use Tripwire. The open source version of tripwire is available at the following locations: http://sourceforge.net/projects/tripwire
Network Intrusion DetectionA Network Intrusion Detection System (NIDS) reads patterns of network traffic and typically looks for patterns known to represent attacks on the system. The most common Network Intrusion Detection System in use on a Mac is Snort. Snort is available at http://www.snort.org/ and a good HOW-TO for it can be found at http://homepage.mac.com/duling/halfdozen/Snort-Howto.html. BastilleBastille Linux is a hardening suite for Unix-like operating systems. Bastille automates many of the steps recommended by this guide, and is an excellent choice for hardening any supported OS. Support for Bastille for OS X has now reached ‘stable’ status. It may be downloaded here: http://www.bastille-unix.org/running_bastille_on.htm HenWen is a GUI application available for Mac OS X that can be used to control Snort. This puts advanced network signature scanning capabilies without the need to have in depth knowledge of what is being scanned. HenWen comes with a script that will automatically update the firewall configuration to block IP addresses suspected of violating Snort rules. This turns HenWen into a Network Intrusion Prevention System. HenWen is available at http://seiryu.home.comcast.net/henwen.html There are many that will tell you that Antivirus software is not required for OS X, for various reasons like “it's secure” or “viruses don't work on a Mac”. Many will point out that there are no known viruses for Mac OS X. However, this is not true for Trojans. There are many documented Trojans available for the Mac. While OS X has a secure design, and there is less malware for OS X, not having Antivirus software is never a good idea. As Mac OS X gains in popularity, it continues to become a larger target for malware authors. Products like Microsoft Office are available on the Mac platform, and some Office macro viruses work on OS X and can infect the Normal template as is the case in Windows environments. For viruses and Trojans that cannot infect the Mac, they may be responsible for sharing these threats to users of other platforms by receiving and passing on documents and binaries. There are several commercial Antivirus products for the OS X platform: McAfee's Virex, Symantec's Norton AntiVirus, Sopho'sAntiVirus, and Intego’sVirusBarrier. There is also an Open Source antivirus product, ClamAV. ClamXav is a GUI tool that can be used to run ClamAV. ClamXav is lacking in many basic features like having a resident daemon to scan files as they're manipulated, it does a find and quarantine infected files. The use of ClamXav should be restricted to environments where it is used as an early warning sign of infections. ClamXav is available at http://www.clamxav.com. Norton Antivirus is available at http://www.symantec.com. Many organizations already have an enterprise package for virus scanning. Sophos, Intego and McAfee can all be used in conjunction with their corporate/Enterprise counterparts. This allows for a centralized administration console. Norton Antivirus also has this capability, but only when used in a “command-line only” mode. Note: At this time Norton AntiVirus is the only product available that is capable of cleaning infected files. Other products will simply quarantine infected files. In many outbreaks there will be hundreds of infected files, representing a large quantity of data to have quarantined Mac OS X Server Specific Security Checklist OS X has a built-in firewall for limiting access to network services. This can be used to limit access to server resources based on subnets. You can also reduce your server’s attack surface even further by running as few services as possible. Simple configuration of services is done using the Server Admin tool (located in the /Applications/Server folder). Before you begin configuring a specific service for a more secure setup (or make any alterations to it for that matter) you should backup the settings for the service. To do this:
sudo serveradmin settings afp > ~/afpsettings.txt
|