1
00:00:12,730 --> 00:00:17,270
Anyone who has a voice after Saturday night at DEF CON?

2
00:00:17,270 --> 00:00:19,690
It wasn't really Saturday night at DEF CON, right?

3
00:00:20,710 --> 00:00:23,650
Okay, so, anyway, we'll start now.

4
00:00:23,650 --> 00:00:24,870
My name is Jay Beal.

5
00:00:25,210 --> 00:00:30,810
I'm here to talk about Bastille Linux, and we've done a lot more with the tool now, and I want

6
00:00:36,600 --> 00:00:37,140
to...

7
00:00:37,140 --> 00:00:38,540
What's that, louder?

8
00:00:39,920 --> 00:00:40,800
Yeah.

9
00:00:40,880 --> 00:00:42,020
How's that?

10
00:00:42,360 --> 00:00:43,300
Pick up any better?

11
00:00:43,300 --> 00:00:44,080
No.

12
00:00:44,600 --> 00:00:45,480
Okay.

13
00:00:46,120 --> 00:00:48,560
Try and type while I do this.

14
00:00:49,320 --> 00:00:50,760
Move closer.

15
00:00:52,580 --> 00:00:53,860
Like this?

16
00:00:54,320 --> 00:00:56,540
I will eat the microphone.

17
00:00:57,440 --> 00:00:59,320
I stole that from Raven.

18
00:00:59,520 --> 00:01:00,240
Okay.

19
00:01:01,560 --> 00:01:03,840
So I'm here to talk about Bastille Linux.

20
00:01:03,840 --> 00:01:13,140
My name is Jay Beal, and we've done lots of new stuff, or one major new thing, and a lot of little things, and I'll show you what we're doing.

21
00:01:15,660 --> 00:01:19,680
By the way, if you've got the slide putter on the CD, these are slightly updated.

22
00:01:19,680 --> 00:01:21,120
They're only minor updates.

23
00:01:21,460 --> 00:01:23,420
The stuff on the CD is pretty comprehensive.

24
00:01:23,420 --> 00:01:25,100
These just look a little bit nicer.

25
00:01:25,380 --> 00:01:26,900
So you can grab them from here.

26
00:01:27,880 --> 00:01:29,300
I'll let you write down the URL.

27
00:01:35,440 --> 00:01:37,400
I will let you stop writing down the URL.

28
00:01:38,320 --> 00:01:39,300
Okay, so let me...

29
00:01:39,300 --> 00:01:40,080
I'm going to talk to you...

30
00:01:40,080 --> 00:01:43,920
I'm going to tell you about what Bastille did before and what it does now.

31
00:01:43,920 --> 00:01:51,400
We'll take a pretty in-depth look, and I'll even tell you a little bit about how you can extend it yourself, because, well, it's open source, and we could always use the help.

32
00:01:51,820 --> 00:01:56,760
And heck, if you want to do it yourself back home and not share, we'll be okay with that, too.

33
00:01:57,880 --> 00:02:01,800
So Bastille Linux is a hardening program for Linux.

34
00:02:01,800 --> 00:02:03,880
That's a whole bunch of distributions.

35
00:02:03,880 --> 00:02:12,720
That's Red Hat and Mandrake and Sousa and Debian and Ubuntu and Gen2 and TurboLinux, and there's probably one or two others, but I'm not sure.

36
00:02:13,520 --> 00:02:15,260
Not yet Slack.

37
00:02:16,620 --> 00:02:17,960
I'm so sorry.

38
00:02:17,960 --> 00:02:20,460
I know, I keep promising Slack one day.

39
00:02:20,820 --> 00:02:23,640
Okay, well, Slack once I get a Slack VM, right?

40
00:02:24,200 --> 00:02:37,540
But it also works in HP-UX, because Hewlett Packard put in some programmers, and they've been helping a whole lot, and it works in OSX, except not 10.4, because Cisco's VPN client didn't work on 10.4 in my first install, so I had to blow that away.

41
00:02:37,540 --> 00:02:38,300
Thank you.

42
00:02:39,040 --> 00:02:53,580
But, yeah, so it works on plenty of Unixes, the biggest thing that differentiated Bastille from other hardening scripts before was that, well, first, that we shared it, right?

43
00:02:53,580 --> 00:02:59,580
And that, you know, instead of us all using our one-offs, but also that it educated the administrator about the process.

44
00:02:59,580 --> 00:03:02,940
It educated the administrator about hardening and about what they could harden.

45
00:03:02,940 --> 00:03:05,600
It tried to get people to stop using Telnet, for example.

46
00:03:05,600 --> 00:03:10,260
Tried to stop getting people, tried to stop getting, get people to stop using cleartext protocols.

47
00:03:10,300 --> 00:03:12,200
Who's seen The Wall of Sheep?

48
00:03:12,920 --> 00:03:15,160
I can't believe that wall's still scrolling.

49
00:03:15,160 --> 00:03:21,040
I just, I mean, how could you walk by there, see your picture there, and not start telling everybody, oh my God, you know, cleartext, bad.

50
00:03:21,460 --> 00:03:22,060
Okay.

51
00:03:23,620 --> 00:03:29,200
Anyway, the new news is that Bastille now does, now has a kind of audit or assessment function.

52
00:03:29,200 --> 00:03:33,600
And what it's doing is, it can actually tell you how well-hardened the box is so far.

53
00:03:33,760 --> 00:03:39,980
Okay, it can say, these are all, these are all the hardening steps I know about, these are the ones that you've done, these are the ones that you haven't done.

54
00:03:40,340 --> 00:03:58,060
And the idea of well-hardened, it can also compute a score, so you can say, this is how well-hardened this box is, and well-hardened is something that you can define personally, you can kind of take the Bastille team's advice, or you can get a, or you can get a definitions file that talks about how well-hardened the box should be from your organization,

55
00:03:58,060 --> 00:04:02,000
whatever that organization is, employer or auditing board or whatever.

56
00:04:03,300 --> 00:04:12,160
So, let me just show you how the, show you how the two of them interact, and, and hopefully I'll be able to keep this mic close enough to my throat, you guys can still hear me.

57
00:04:12,160 --> 00:04:17,000
But let me just demo and show you how it works, so I don't keep just talking about it.

58
00:04:20,650 --> 00:04:23,330
Attempting to keep mic, can you guys hear me in the back still?

59
00:04:24,030 --> 00:04:25,090
Oh, man.

60
00:04:30,260 --> 00:04:31,720
Choked on a microphone.

61
00:04:31,720 --> 00:04:32,480
What's that?

62
00:04:38,620 --> 00:04:39,780
How's that?

63
00:04:39,780 --> 00:04:40,560
Better?

64
00:04:41,700 --> 00:04:42,780
Tip it up.

65
00:04:43,540 --> 00:04:45,140
Slightly in front of me.

66
00:04:46,820 --> 00:04:48,620
Stand on one foot.

67
00:04:50,480 --> 00:04:51,480
Start typing.

68
00:04:51,480 --> 00:04:53,520
Okay, I can do that, that's easy.

69
00:04:54,280 --> 00:04:56,340
So, let's see.

70
00:04:58,460 --> 00:05:02,880
I'm SSH'd right now into a Fedora Core 4 system.

71
00:05:03,080 --> 00:05:06,220
So what I'm going to do is, Bastille, can you guys see the bottom of the screen?

72
00:05:06,600 --> 00:05:08,040
Oh yeah, these are great screens.

73
00:05:08,040 --> 00:05:11,500
Okay, so, I'm typing Bastille minus A for audit.

74
00:05:12,520 --> 00:05:14,740
And it's gone and it's just finished the audit.

75
00:05:15,520 --> 00:05:17,000
It's kind of a fast process.

76
00:05:17,000 --> 00:05:19,660
And this is what our initial audit report looks like.

77
00:05:19,840 --> 00:05:25,500
What you've got here is a score out of 10, and I'll tell you more about that score over time.

78
00:05:25,500 --> 00:05:28,200
And this thing right here says how we got that score.

79
00:05:28,260 --> 00:05:29,300
What weights file we used.

80
00:05:29,300 --> 00:05:34,140
I'll talk about weights files tomorrow, but basically, who decided how your system should be scored is in that.

81
00:05:34,560 --> 00:05:38,040
Okay, so, there are items here that don't have a weight.

82
00:05:38,140 --> 00:05:39,000
There are items here...

83
00:05:40,100 --> 00:05:41,420
Here, let's see.

84
00:05:42,460 --> 00:05:44,840
So, I'll show you basically the way this works.

85
00:05:44,840 --> 00:05:47,180
Bastille's a whole bunch of modules, and you're going to see these modules.

86
00:05:47,180 --> 00:05:49,260
I just want you to see the structure of the report.

87
00:05:49,340 --> 00:05:51,140
Okay, Bastille's a whole bunch of modules.

88
00:05:51,140 --> 00:05:55,620
So, one of them's called file permissions, or we'll page down a little bit.

89
00:05:56,980 --> 00:06:01,320
Okay, one of them's a send mail module here.

90
00:06:01,660 --> 00:06:05,520
So, here's the DNS module here, just at the top of the screen.

91
00:06:05,520 --> 00:06:10,420
And this basically is an item called chroot bind, and that labels something you can redefine if you like.

92
00:06:10,420 --> 00:06:12,940
It can be item 4.3 if you like.

93
00:06:13,560 --> 00:06:14,760
Here's a question.

94
00:06:15,680 --> 00:06:17,300
Is bind in a chroot jail?

95
00:06:17,300 --> 00:06:18,780
Is it set to run non-root?

96
00:06:19,100 --> 00:06:20,500
Here's your current state.

97
00:06:20,500 --> 00:06:21,680
Yes, it is.

98
00:06:22,400 --> 00:06:23,940
Here's the weight of that question.

99
00:06:23,940 --> 00:06:25,780
Ah, sorry, you didn't really get anything for it.

100
00:06:25,780 --> 00:06:26,580
It was weighted zero.

101
00:06:26,580 --> 00:06:30,960
That wasn't something that you were required to do, or it wasn't something that you were considering as all that important.

102
00:06:31,320 --> 00:06:33,720
And then here's the score contribution based on that weight.

103
00:06:33,740 --> 00:06:34,660
Does that make sense?

104
00:06:34,860 --> 00:06:35,920
So, the idea is...

105
00:06:35,920 --> 00:06:40,940
Oh, and if we go to that question, you know it'll pop up if you've got JavaScript on in this browser.

106
00:06:40,940 --> 00:06:44,720
This is all running locally, so we want to talk about JavaScript issues and all that.

107
00:06:45,280 --> 00:06:46,720
Just trust me for now.

108
00:06:46,720 --> 00:06:47,980
This is running locally.

109
00:06:47,980 --> 00:06:48,620
You're not...

110
00:06:48,620 --> 00:06:51,060
The idea is that the browser isn't off doing other things.

111
00:06:51,060 --> 00:06:53,020
This browser popped up by best deal.

112
00:06:53,020 --> 00:06:54,460
You can have another browser hanging around.

113
00:06:54,460 --> 00:06:56,040
This is your separate one.

114
00:06:56,740 --> 00:06:57,940
So, we've got a pop-up.

115
00:06:57,940 --> 00:07:02,160
If you don't like pop-ups, you can turn off JavaScript in it, and you can just click on the question.

116
00:07:02,340 --> 00:07:03,760
And the question will give you...

117
00:07:03,760 --> 00:07:04,880
Can you guys see that?

118
00:07:05,240 --> 00:07:05,880
No?

119
00:07:06,040 --> 00:07:06,760
Okay.

120
00:07:07,680 --> 00:07:08,660
How's that?

121
00:07:08,920 --> 00:07:12,360
Okay, so this question is named in a chroot jail.

122
00:07:12,360 --> 00:07:22,580
This is the thing that's being checked, and it's also an item that can be hardened in best deal, and this explanation here basically says, this is why you should do this.

123
00:07:22,720 --> 00:07:27,780
And I'll show you that some more, but one of the best deal's things is it says, listen, here's why you should chroot name D.

124
00:07:27,900 --> 00:07:29,380
Because you could be a total newbie.

125
00:07:29,380 --> 00:07:31,560
You could be like, what does chroot mean?

126
00:07:32,180 --> 00:07:33,440
What's name D?

127
00:07:33,460 --> 00:07:35,480
And so we'll try to give you a feel for it.

128
00:07:35,480 --> 00:07:36,940
We'll say, okay, this is what you should know.

129
00:07:36,940 --> 00:07:38,480
This is why you should do this.

130
00:07:38,500 --> 00:07:40,160
Maybe this is when you shouldn't.

131
00:07:40,160 --> 00:07:42,340
This is when...

132
00:07:42,340 --> 00:07:42,580
Oh , it's hardening.

133
00:07:42,580 --> 00:07:43,940
What if that's gonna break something?

134
00:07:43,940 --> 00:07:45,440
Oh, it's gonna break something, right?

135
00:07:45,440 --> 00:07:48,480
So the idea is, okay, I understand that risk.

136
00:07:48,480 --> 00:07:53,480
Let us tell you when it would break something, when it wouldn't break something, and let you make an informed decision.

137
00:07:53,520 --> 00:07:54,580
Does that make sense?

138
00:07:54,960 --> 00:08:01,900
So here's my report thing, and it goes on for pages.

139
00:08:01,900 --> 00:08:05,620
You can print it out if you like, but there's also something where you can just contract all the modules.

140
00:08:06,000 --> 00:08:11,560
We're working on a cooler looking version of this, and I'll tell you a little bit about that as we go on.

141
00:08:11,560 --> 00:08:15,460
But you can contract all the modules and say just see one of them.

142
00:08:15,700 --> 00:08:17,500
So it's a fun little interface.

143
00:08:17,500 --> 00:08:20,380
It's a simple little interface, but it does the job.

144
00:08:20,620 --> 00:08:25,220
There are, of course, people who are really into, who are really saying, listen, why can't I run this in text mode?

145
00:08:25,220 --> 00:08:27,000
I'm not really an X person.

146
00:08:27,740 --> 00:08:32,540
If Bastille finds that you haven't, that you're not actually doing X forwarding, it'll pop up its own text browser.

147
00:08:32,540 --> 00:08:37,720
It'll pop up links or W3M or links 2 or the other links, you know, or whatever it is.

148
00:08:37,720 --> 00:08:46,100
And then there's two other things here There's also a text version of that.

149
00:08:47,300 --> 00:08:49,120
So you can see it like that.

150
00:08:49,520 --> 00:08:55,500
And then the other piece, which I'm going to refer to later, is that there's something that's machine parsable.

151
00:08:56,480 --> 00:09:02,080
And by machine parsable, the weird thing is this thing looks a whole lot like a Bastille config file.

152
00:09:02,080 --> 00:09:03,360
This will come up later.

153
00:09:03,360 --> 00:09:09,060
This thing looks, we can give you a version that says for each module, for each item number in there, what your current state is.

154
00:09:09,060 --> 00:09:10,580
Whether you're hardened, whether you're not hardened.

155
00:09:10,580 --> 00:09:14,440
The Y and N's or whatever are basically the answers that it found on the system.

156
00:09:14,480 --> 00:09:15,660
Does that make sense?

157
00:09:15,980 --> 00:09:18,240
So, I'll show you.

158
00:09:18,420 --> 00:09:21,460
Let's take this and run Bastille normally.

159
00:09:21,880 --> 00:09:24,560
I'm running Bastille minus X to show it in X.

160
00:09:24,560 --> 00:09:26,880
Oh, there's something everybody should know.

161
00:09:27,620 --> 00:09:33,320
Remember when we all used to tell that into systems and you'd type Xclock, you'd type Netscape and you'd see things pop up graphically?

162
00:09:33,320 --> 00:09:34,280
And that was good?

163
00:09:34,280 --> 00:09:36,400
And then we did that with SSH and that was good?

164
00:09:36,460 --> 00:09:38,060
And then it stopped working?

165
00:09:38,060 --> 00:09:41,080
Like all of a sudden you SSH'd into something and there was no X anymore?

166
00:09:41,420 --> 00:09:42,940
Anybody have that?

167
00:09:43,060 --> 00:09:44,640
Raise your hand if you had that happen.

168
00:09:45,120 --> 00:09:48,460
Maybe only a few people have had that happen.

169
00:09:48,460 --> 00:09:50,660
Just SSH minus capital X.

170
00:09:50,660 --> 00:09:51,840
And it's like it used to be.

171
00:09:51,840 --> 00:09:54,140
It's a security thing, almost, sort of, kind of.

172
00:09:54,340 --> 00:09:55,060
Anyway.

173
00:09:55,260 --> 00:10:00,160
So I've started up Bastille and, I don't know, can you guys read this?

174
00:10:00,540 --> 00:10:02,220
I can't see from over here.

175
00:10:02,820 --> 00:10:03,460
Okay.

176
00:10:03,600 --> 00:10:05,320
Well, anyway.

177
00:10:05,360 --> 00:10:06,520
Why don't I just...

178
00:10:07,280 --> 00:10:07,920
Fine.

179
00:10:08,600 --> 00:10:10,680
What this basically is, is it's a bunch of...

180
00:10:10,680 --> 00:10:12,980
What this basically is, is it's just a bunch of...

181
00:10:12,980 --> 00:10:18,120
There's a bunch of modules on the left side and I'll show you a screenshot later on that will be a little bit easier to see.

182
00:10:18,120 --> 00:10:20,120
But there's a bunch of modules on the left side.

183
00:10:20,160 --> 00:10:23,440
There's a question up here that says, would you like to do this thing?

184
00:10:23,600 --> 00:10:28,220
There's an explanation here that says, here's why you would want to and here's why you wouldn't want to.

185
00:10:28,220 --> 00:10:30,060
It's the same one you saw on the auditing side.

186
00:10:30,100 --> 00:10:31,640
And then there's like a yes or no.

187
00:10:31,840 --> 00:10:37,620
So we can kind of go through and just tell it we want to harden the system.

188
00:10:40,800 --> 00:10:44,000
And I'm basically just choosing the defaults for now.

189
00:10:44,260 --> 00:10:47,400
The defaults for Bastille are basically chosen so that you won't get...

190
00:10:47,400 --> 00:10:53,040
so that you won't screw things up too badly if you just go through and never make a decision if you always click yes or click no.

191
00:10:53,040 --> 00:10:59,620
You're losing a lot of the benefit if you do that the first time because we probably got something to tell you about.

192
00:11:00,540 --> 00:11:01,360
Okay.

193
00:11:01,360 --> 00:11:05,360
Bastille's got a firewall that I'm skipping for anybody watching and...

194
00:11:07,000 --> 00:11:09,400
another tool that I'm skipping that I'll talk about later.

195
00:11:09,540 --> 00:11:13,800
So Bastille will go and it'll basically just go and say these are the things I did.

196
00:11:13,900 --> 00:11:20,020
And there's an error in here because it's trying to work on inetd.conf and there isn't one on the system and there's no exinetd either.

197
00:11:20,820 --> 00:11:22,840
But that's not something to really worry about.

198
00:11:23,000 --> 00:11:26,380
So what I've got right now is if I were to look at...

199
00:11:27,060 --> 00:11:30,220
if I were to look at the number of things that are still running...

200
00:11:30,220 --> 00:11:30,880
Okay.

201
00:11:34,380 --> 00:11:35,740
Wow, that should be all.

202
00:11:35,980 --> 00:11:37,680
Okay, well...

203
00:11:37,680 --> 00:11:41,120
what I can do right now, let me just rerun in audit mode and show you.

204
00:11:41,120 --> 00:11:42,960
I just went through and hardened the system.

205
00:11:44,460 --> 00:11:49,520
And I hardened the system with pretty significant speed because I wasn't trying to so much demo the tool.

206
00:11:49,520 --> 00:11:53,960
What we just did was we went from a score of 5 point something to a score of 8 point something.

207
00:11:53,960 --> 00:11:54,640
Almost 9.

208
00:11:54,640 --> 00:12:00,080
And if I'd chosen the non- if I'd chosen something stricter than the defaults all along we'd actually have a higher score.

209
00:12:00,080 --> 00:12:05,300
And we can see and we can look at basically each question and say, okay, what got turned off and what got turned on.

210
00:12:05,360 --> 00:12:06,380
Does that make sense?

211
00:12:06,700 --> 00:12:07,920
Is that kind of...

212
00:12:07,920 --> 00:12:15,900
The idea is there are tools that have been auditing... there are tools that have been auditing before and there are tools that have been hardening before and now we're kind of doing both.

213
00:12:15,900 --> 00:12:17,840
And that's got a certain advantage.

214
00:12:17,840 --> 00:12:23,900
And one of the advantages is that you can motivate people to harden more because they're like, wow, hey, look, I can see my score.

215
00:12:23,900 --> 00:12:25,520
Or you can... well, I've got slides.

216
00:12:25,520 --> 00:12:26,340
I'll show you.

217
00:12:26,340 --> 00:12:31,500
But the idea is that it's a pretty useful thing to be able to even have tools line up.

218
00:12:32,400 --> 00:12:33,120
Let me show you.

219
00:12:33,120 --> 00:12:34,440
Let me show you slides.

220
00:12:35,320 --> 00:12:35,860
Okay.

221
00:12:36,800 --> 00:12:38,900
Here, now I can probably be heard a whole lot better.

222
00:12:40,160 --> 00:12:44,580
So, in essence, the first question is kind of, why do you do assessment at all?

223
00:12:44,580 --> 00:12:44,760
Right?

224
00:12:44,820 --> 00:12:48,960
I just showed you, hey, we built an audit tool and you're like, wow, gee, I'm not an auditor.

225
00:12:48,960 --> 00:12:50,200
Why do I care?

226
00:12:50,200 --> 00:12:50,600
Right?

227
00:12:50,800 --> 00:12:51,840
Maybe you're not thinking that.

228
00:12:51,840 --> 00:12:54,200
Maybe you're thinking this is really cool and that's what I hope you're thinking.

229
00:12:54,200 --> 00:12:57,140
But if you're not, maybe I can tell you why it's useful.

230
00:12:57,260 --> 00:13:01,260
Can you hear me or am I still not eating the mic sufficiently well?

231
00:13:01,500 --> 00:13:02,180
Okay.

232
00:13:02,200 --> 00:13:04,500
I will keep trying to eat the microphone.

233
00:13:05,500 --> 00:13:14,080
Okay, so in terms of why you do assessment in the first place, the first reason you do assessment is because it teaches the system about things they could harden.

234
00:13:14,080 --> 00:13:17,900
It teaches them about hardening settings they could apply they might not have known about before.

235
00:13:17,980 --> 00:13:25,460
And one of the weird things in the Unix world is we kind of all feel like we know everything and it's hard to find out that there's something you don't know if you feel like you know everything.

236
00:13:26,340 --> 00:13:33,320
And so it's kind of a, you know, and so the idea of this is to show you what you might not know or at least what hasn't been done to the system yet.

237
00:13:33,500 --> 00:13:36,220
Bastille's always had this education thing as a second purpose.

238
00:13:36,660 --> 00:13:38,500
This is a normal screenshot.

239
00:13:38,500 --> 00:13:42,240
This is what I was going through but a little more blown up before.

240
00:13:42,420 --> 00:13:46,780
If we look at this, what we're doing is this goes and says, hey, do you want to turn on stack protection in the kernel?

241
00:13:47,420 --> 00:13:48,620
Here's the reason you want to do this.

242
00:13:48,620 --> 00:13:51,780
It turns out you can break tons of buffer overflow exploits.

243
00:13:51,820 --> 00:13:54,120
You can break lots of buffer overflows.

244
00:13:54,200 --> 00:13:57,960
One of the major kinds of exploits out there if you just turn on the stack protection.

245
00:13:57,960 --> 00:13:59,320
Here's when you don't want to.

246
00:13:59,560 --> 00:14:02,460
GDB is a mode that it doesn't work with if you turn on stack protection .

247
00:14:02,460 --> 00:14:02,880
What else?

248
00:14:02,880 --> 00:14:04,100
Well, not much else.

249
00:14:04,400 --> 00:14:08,940
Okay , so we can tell you here's what we'd like to do and find out if you want to do it.

250
00:14:09,100 --> 00:14:10,500
Why else do you do assessment?

251
00:14:11,140 --> 00:14:12,420
Triage , right?

252
00:14:12,420 --> 00:14:13,960
You basically take each of your systems.

253
00:14:13,960 --> 00:14:15,840
You're like I'd like to harden my systems.

254
00:14:15,840 --> 00:14:16,780
I don't know where to start.

255
00:14:16,780 --> 00:14:18,060
I can start at my workstation.

256
00:14:18,060 --> 00:14:18,940
Yeah, that's good.

257
00:14:19,140 --> 00:14:20,160
Right, but I don't know where to start.

258
00:14:20,160 --> 00:14:21,420
I can go with the most vital servers.

259
00:14:21,420 --> 00:14:22,940
How about which one's worse?

260
00:14:23,280 --> 00:14:25,200
How about pick the one that's least hardened?

261
00:14:25,200 --> 00:14:27,500
Pick the one that's in worst need.

262
00:14:27,560 --> 00:14:33,320
So you can basically go and take best deal and generate that score or look at that config file and look at what things matter.

263
00:14:33,320 --> 00:14:38,240
If you know what things matter you can set weights according to these are the things that matter and then score your systems.

264
00:14:38,720 --> 00:14:45,060
Right, the score thing lets you start the user configurable score thing lets you start saying, okay, these systems are worse.

265
00:14:45,060 --> 00:14:46,760
I'm going to take care of them first.

266
00:14:46,760 --> 00:14:47,720
Or these systems are worse.

267
00:14:47,720 --> 00:14:50,520
I'm going to maybe do a little bit of incident response because they're so bad, right?

268
00:14:50,520 --> 00:14:51,560
Does that make sense?

269
00:14:51,820 --> 00:14:55,720
Or maybe I'll start with, you know, running my NMAP scans, running my Nessus scans.

270
00:14:55,720 --> 00:14:57,040
I'll look for vulnerabilities in the system.

271
00:14:57,040 --> 00:14:59,900
I'll look for backdoors on the system is really what I care about here.

272
00:15:00,140 --> 00:15:01,780
Okay, what else?

273
00:15:01,840 --> 00:15:05,500
Another reason to do assessment is that auditing happens.

274
00:15:05,620 --> 00:15:06,540
You will be audited.

275
00:15:06,540 --> 00:15:07,980
We all get audited at some point.

276
00:15:07,980 --> 00:15:09,920
Maybe you don't, but a lot of us do.

277
00:15:09,920 --> 00:15:11,580
A lot of my clients do, right?

278
00:15:11,580 --> 00:15:14,940
So the idea is, okay, you know you're going to get audited.

279
00:15:14,940 --> 00:15:16,860
It'd be nice to find out what's going to show up.

280
00:15:16,860 --> 00:15:19,040
What's going to happen to be able to work on it proactively?

281
00:15:19,220 --> 00:15:23,180
And so the idea here is to give you a tool that's equivalent to your auditor's tools.

282
00:15:23,180 --> 00:15:27,920
And you can use a waits file again that's basically defined the same way your auditor's is.

283
00:15:28,340 --> 00:15:29,600
And that's our hope.

284
00:15:29,600 --> 00:15:33,280
If anybody is with any of the major auditing organizations, I've worked with CIS.

285
00:15:33,320 --> 00:15:40,080
If you're with ISACA, if you're with one of the other organizations and you want to contribute something, I would love it if you would help contribute work on waits files.

286
00:15:40,100 --> 00:15:43,560
Just help us tell, okay, what are auditors looking for?

287
00:15:43,620 --> 00:15:46,440
But I mean, we've got a framework now where we can do that.

288
00:15:46,900 --> 00:15:47,740
What else?

289
00:15:47,880 --> 00:15:49,980
Bestial could be helpful here with compliance.

290
00:15:51,060 --> 00:15:59,240
If you've just gotten hit over the head in the last year with new legislation that says, okay, we've got to care about security now, or we're going to get measured on it.

291
00:15:59,240 --> 00:16:00,900
We always cared about it.

292
00:16:00,940 --> 00:16:05,320
Well, maybe Bestial will help you in figuring out how well you are in compliance.

293
00:16:05,320 --> 00:16:08,820
The weird thing is that some of these compliances are actually really fuzzy.

294
00:16:09,060 --> 00:16:12,100
They say that you've got to do due diligence, that you've got to do a pretty good job.

295
00:16:12,100 --> 00:16:13,340
Well, what's that mean?

296
00:16:13,400 --> 00:16:22,580
Well, if we've got an idea, if we've got an idea how systems scored, and we can show, okay, well we went from here to here, or we can say listen, most of our industry does this.

297
00:16:22,580 --> 00:16:24,820
They score at this on this waits file.

298
00:16:24,820 --> 00:16:29,420
Well, then you start being able to say that you're basically keeping up with your peers, which is what due diligence means.

299
00:16:29,420 --> 00:16:31,760
It doesn't mean that you did everything possible.

300
00:16:31,760 --> 00:16:35,400
It just basically means you did what most everybody else who's doing a good job is doing.

301
00:16:35,620 --> 00:16:38,620
That's kind of fuzzy, but we'll try to help you with that anyway.

302
00:16:38,860 --> 00:16:39,860
What else?

303
00:16:39,860 --> 00:16:43,480
You could go and say, this is another thing that comes up in universities, network protection.

304
00:16:43,560 --> 00:16:52,280
It's saying, listen, I'd like to make sure that before a system's put on my network, before a Unix system's put on my network, I want to make sure that it's well patched, and I want to make sure that it's well hardened.

305
00:16:52,280 --> 00:16:56,300
And if it's well hardened to basically these standards, then I'll let it on the network.

306
00:16:56,500 --> 00:17:00,020
And if it's not, well, I'm sorry, you know, just come back in a day when you're done.

307
00:17:00,060 --> 00:17:03,760
Or actually, since hardening's pretty fast, as you guys saw, you know, come back in five minutes.

308
00:17:04,900 --> 00:17:06,040
Does that make sense?

309
00:17:06,280 --> 00:17:07,940
Is this kind of interesting to you guys?

310
00:17:08,740 --> 00:17:09,380
Useful?

311
00:17:09,520 --> 00:17:10,700
Okay, cool.

312
00:17:11,560 --> 00:17:14,860
The other thing is, scoring has this awesome psychological power.

313
00:17:15,080 --> 00:17:21,500
Okay, I worked on another tool like this, and I remember when we were developing it, it was the CIS Unix scoring tool.

314
00:17:21,640 --> 00:17:24,220
And when we were developing it, they said, we're going to give you a score.

315
00:17:24,300 --> 00:17:26,840
You know, you want to compute a score, and I'm like, a score?

316
00:17:27,340 --> 00:17:28,280
One number?

317
00:17:28,460 --> 00:17:30,200
I mean, I studied mathematics, okay?

318
00:17:30,200 --> 00:17:31,640
You know, like, I did physics too.

319
00:17:31,640 --> 00:17:33,060
We don't have one number.

320
00:17:33,060 --> 00:17:41,480
I was like, oh god, at worst, like, make it a ten element vector, and then like, you know, compute some kind of a mean of that, or whatever, you know, compute a metric based on, like, weights of that.

321
00:17:41,480 --> 00:17:42,960
And someone's like, no, no, no, no, one number.

322
00:17:42,960 --> 00:17:44,160
And I'm like, one number.

323
00:17:44,160 --> 00:17:46,560
Okay, fine, management folks will like one number.

324
00:17:46,560 --> 00:17:47,600
That was my first thought.

325
00:17:47,600 --> 00:17:49,780
It turns out, geeks like one number too.

326
00:17:49,780 --> 00:17:52,200
One number is really kind of useful, okay?

327
00:17:52,620 --> 00:18:00,380
The score thing is really nice because people are naturally competitive, and geeks are naturally competitive, and hackers are really naturally competitive, right?

328
00:18:00,400 --> 00:18:04,820
So, so the idea is that first, people get around to hardening sooner.

329
00:18:04,820 --> 00:18:07,120
People are like, you know, I'm meaning to harden that system.

330
00:18:07,120 --> 00:18:08,220
I'll get around to it later on.

331
00:18:08,220 --> 00:18:13,280
All of a sudden, when they're like confronted with, you know, a score that says mediocre, they're like, wait, I'm not mediocre.

332
00:18:13,280 --> 00:18:14,440
I kick ass.

333
00:18:14,640 --> 00:18:15,180
You know?

334
00:18:15,280 --> 00:18:16,960
That's not the way this should be.

335
00:18:16,960 --> 00:18:18,340
I shouldn't have a score of four.

336
00:18:18,340 --> 00:18:19,480
I'm not getting around to that later.

337
00:18:19,480 --> 00:18:21,300
I'm doing it right freaking now.

338
00:18:21,400 --> 00:18:22,040
Okay?

339
00:18:22,560 --> 00:18:24,320
So, I'll give you an example.

340
00:18:24,520 --> 00:18:27,480
We had a, we had a security instructor who was a SANS instructor.

341
00:18:27,480 --> 00:18:30,260
He, you know, was an instructor teaching lots of people things.

342
00:18:30,260 --> 00:18:32,820
He thought a lot of himself, of course, as we all do.

343
00:18:32,820 --> 00:18:33,400
Right?

344
00:18:33,620 --> 00:18:38,180
And he said, okay, I'll, you know, I'll beta test your software.

345
00:18:38,180 --> 00:18:40,820
So he was beta testing and he ran this thing on his workstation.

346
00:18:40,820 --> 00:18:43,340
And his workstation came up at about a six out of ten.

347
00:18:43,560 --> 00:18:45,580
And he got peeved.

348
00:18:45,580 --> 00:18:46,820
He's like, what are you saying?

349
00:18:46,820 --> 00:18:47,940
This is the mediocre issue.

350
00:18:47,940 --> 00:18:50,220
He said, I'm not a six out of ten.

351
00:18:50,340 --> 00:18:50,920
Screw that.

352
00:18:50,920 --> 00:18:51,600
And he sat down.

353
00:18:51,600 --> 00:18:52,260
He didn't even talk to us.

354
00:18:52,260 --> 00:18:54,320
He just sat down and started hardening his system.

355
00:18:54,400 --> 00:18:57,000
And ten minutes later, he ran the tool again and they gave him an eight.

356
00:18:57,000 --> 00:18:59,000
And he's like, ah, that's more like it.

357
00:18:59,000 --> 00:18:59,860
I'm not a six.

358
00:18:59,860 --> 00:19:01,380
A six is like, you know, 60%.

359
00:19:01,380 --> 00:19:02,300
That's like a D.

360
00:19:02,300 --> 00:19:02,860
No, no.

361
00:19:02,860 --> 00:19:04,220
I'm much better than that.

362
00:19:04,220 --> 00:19:04,800
It's nice.

363
00:19:04,800 --> 00:19:06,160
Play against people's ego.

364
00:19:06,200 --> 00:19:09,060
He didn't see himself as a six out of ten kind of guy.

365
00:19:09,300 --> 00:19:09,960
Fine by me.

366
00:19:09,960 --> 00:19:12,860
Whatever gets him to take proactive security measures is good.

367
00:19:13,260 --> 00:19:13,660
Okay .

368
00:19:14,480 --> 00:19:16,100
This has happened lots of times.

369
00:19:16,100 --> 00:19:19,280
When we were developing this previous scoring tool, we talked to a bank.

370
00:19:19,280 --> 00:19:21,600
And the bank had set up a scoring tool they'd created.

371
00:19:21,600 --> 00:19:26,760
Their security folks had, you know, like many security folks in organizations had no power whatsoever.

372
00:19:26,760 --> 00:19:28,880
We couldn't, you know, it wasn't like, hand of God.

373
00:19:28,880 --> 00:19:30,680
You know, you will harden.

374
00:19:30,720 --> 00:19:31,520
It's not like that.

375
00:19:31,520 --> 00:19:33,720
They were like, uh, we'd like to help.

376
00:19:33,720 --> 00:19:34,680
How can we help?

377
00:19:34,680 --> 00:19:37,660
And that's what a lot of security folks in organizations are like.

378
00:19:37,660 --> 00:19:38,720
So they went to their sysadmins.

379
00:19:38,720 --> 00:19:40,120
They said, here's this tool.

380
00:19:40,120 --> 00:19:41,660
Why don't you try and run it once?

381
00:19:41,740 --> 00:19:42,040
Okay.

382
00:19:42,040 --> 00:19:42,900
And so they ran it once.

383
00:19:42,900 --> 00:19:44,420
They didn't have any mandated high score.

384
00:19:44,420 --> 00:19:45,520
They didn't have any mandated anything.

385
00:19:45,520 --> 00:19:47,800
The only thing was, can you try this tool once?

386
00:19:47,800 --> 00:19:49,140
Let us know how it goes.

387
00:19:49,200 --> 00:19:50,600
And so they did start using it.

388
00:19:50,600 --> 00:19:53,300
And different groups of sysadmins had different reactions.

389
00:19:53,300 --> 00:19:54,700
They're basically all positive.

390
00:19:54,820 --> 00:19:59,240
But there were some sysadmins who started voluntarily posting their scores up on a cork board.

391
00:19:59,240 --> 00:20:00,800
Like, outside their cube.

392
00:20:00,940 --> 00:20:03,220
Okay, I know, that sounds really, really nerdy.

393
00:20:03,220 --> 00:20:06,080
But, you know, okay, we're all really nerds here, right?

394
00:20:06,080 --> 00:20:07,400
We're just pretending to be cool.

395
00:20:07,940 --> 00:20:08,920
Okay, maybe you all are cool.

396
00:20:08,920 --> 00:20:09,740
I'm just not.

397
00:20:11,140 --> 00:20:15,080
Right, but the idea is, like, okay, it'd be really great if we got people competing.

398
00:20:15,080 --> 00:20:16,160
And they do.

399
00:20:16,160 --> 00:20:19,080
Okay, the start Linux system scores around a 5.

400
00:20:19,200 --> 00:20:24,640
This doesn't work on Solaris yet, but I wouldn't be surprised if, like, a Solaris 8 system scored around a 3.

401
00:20:24,700 --> 00:20:24,940
Right?

402
00:20:24,940 --> 00:20:27,720
Solaris has got freaking everything on by default.

403
00:20:27,940 --> 00:20:30,500
We will get around to porting Bastille to Solaris.

404
00:20:30,500 --> 00:20:32,900
It's just a whole lot of work.

405
00:20:34,040 --> 00:20:37,940
Anybody wants to help, we've got two people who are working on it already and would love the help.

406
00:20:39,080 --> 00:20:43,180
But there's, but the nice, so that's why you do, that's why you do assessments.

407
00:20:43,180 --> 00:20:44,100
It's why you do audit.

408
00:20:44,100 --> 00:20:48,880
These are the useful things about pushing an auditing tool in your organization or pushing whatever.

409
00:20:49,100 --> 00:20:51,580
So, so why do you, why do you like the two together?

410
00:20:51,580 --> 00:20:56,820
Why did I, you know, why did we add auditing to Bastille instead of just creating a new auditing tool?

411
00:20:56,880 --> 00:20:57,060
Right?

412
00:20:57,060 --> 00:20:58,120
That would be kind of cool.

413
00:20:58,360 --> 00:21:04,840
Well, the idea is that when you are hardening a system, when you are hardening a system, it creates a policy file.

414
00:21:04,840 --> 00:21:09,840
When you go through this interactive yes, no, yes, no, yes, no, yes, no, you get a policy file whether you like it or not.

415
00:21:09,840 --> 00:21:10,680
It just gets saved.

416
00:21:10,680 --> 00:21:14,240
It gets saved in this given place and you can take that policy file and you can do something with it.

417
00:21:14,280 --> 00:21:21,180
Well, one of the things you can do with it is you can feed it back in, you can feed it back in and see how well you are doing against that policy file.

418
00:21:21,180 --> 00:21:23,700
You can say, okay, it's been three months.

419
00:21:23,700 --> 00:21:24,840
I've been patching.

420
00:21:24,840 --> 00:21:26,940
I have just, you know, ordinary system rot.

421
00:21:26,940 --> 00:21:29,380
I'd like to know how far off I am.

422
00:21:29,940 --> 00:21:36,280
The other thing in terms of that policy file is if you, since we created a policy file by default every time you harden, you harden, we create a policy file.

423
00:21:36,280 --> 00:21:39,960
You can take that policy file and say, this is my policy file for all my web servers.

424
00:21:40,140 --> 00:21:42,600
And now you don't have to run through the whole Bastille thing again, right?

425
00:21:42,600 --> 00:21:48,960
It's just, it's got a back end where you just feed it a policy file, it sucks it in, hardens the system and, you know, two minutes later you're ready.

426
00:21:48,960 --> 00:21:49,680
Right?

427
00:21:49,720 --> 00:21:51,880
You can take that policy file and reuse it.

428
00:21:51,920 --> 00:21:53,960
And there's a lot of, there's a lot of reuse.

429
00:21:54,700 --> 00:21:56,320
I was just talking about skew detection.

430
00:21:56,320 --> 00:21:59,260
If you take that policy file and you've said, this is my web server template.

431
00:21:59,480 --> 00:22:01,420
Suppose you've got a web server that's older.

432
00:22:01,700 --> 00:22:02,660
Maybe you can't harden it.

433
00:22:02,660 --> 00:22:06,400
Maybe the boss has said, listen, we don't want anyone making any substantial changes to this system.

434
00:22:06,400 --> 00:22:08,900
You can make changes one at a time by hand.

435
00:22:08,940 --> 00:22:09,360
Fine.

436
00:22:09,360 --> 00:22:11,320
You say, all our other web servers are here.

437
00:22:11,400 --> 00:22:13,420
I've got a policy file that says how they were hardened.

438
00:22:13,420 --> 00:22:15,420
Let's see how this one stacks up.

439
00:22:15,480 --> 00:22:24,780
So I take this one and I run the auditing tool on it and it says, okay, these are the four things that you normally do to all your other web servers that you haven't done to this one because it's older.

440
00:22:25,100 --> 00:22:25,820
Is that cool?

441
00:22:25,820 --> 00:22:26,720
Does that make sense?

442
00:22:26,840 --> 00:22:29,680
So it's called skew detection and it's a decent thing.

443
00:22:30,520 --> 00:22:33,140
There are some politics to this.

444
00:22:33,260 --> 00:22:34,040
There's a reason.

445
00:22:34,040 --> 00:22:35,980
I keep talking about psychological powers.

446
00:22:36,440 --> 00:22:40,000
Psychology is a really weird thing to be talking about with regard to hardening.

447
00:22:40,000 --> 00:22:41,480
Not necessarily with regard to DEF CON, right?

448
00:22:41,480 --> 00:22:43,020
You're all psyching each other out all the time.

449
00:22:43,020 --> 00:22:44,280
There's psychological games.

450
00:22:44,620 --> 00:22:45,100
Eh.

451
00:22:45,360 --> 00:22:46,520
This is the weird thing.

452
00:22:46,660 --> 00:22:48,460
Psychological games in the workplace.

453
00:22:48,680 --> 00:22:48,840
Right?

454
00:22:48,840 --> 00:22:51,000
We're all used to it if we're in the workplace.

455
00:22:51,420 --> 00:22:52,140
Politics.

456
00:22:52,500 --> 00:23:00,040
There are lots of times where you can't harden a system by hand or with a tool because someone says, oh no, I think that might break things.

457
00:23:00,040 --> 00:23:01,260
Or you can't touch that.

458
00:23:01,260 --> 00:23:02,340
That's my system.

459
00:23:02,340 --> 00:23:03,280
No changes.

460
00:23:03,560 --> 00:23:03,840
Right?

461
00:23:03,840 --> 00:23:09,120
The nice thing about this is that you can say we've taken, we've got all of our web servers.

462
00:23:09,120 --> 00:23:10,340
We've got four web servers that I built.

463
00:23:10,340 --> 00:23:13,040
We've got the one that, you know, that Mad Max is still maintaining.

464
00:23:13,040 --> 00:23:16,520
And Mad Max says anyone who touches his system gets his fingers chopped off.

465
00:23:16,780 --> 00:23:17,140
Okay ?

466
00:23:17,240 --> 00:23:22,780
Well, you know, listen, Mad Max's boss, my boss, can you just ask Mad Max if he'd run this tool for you once?

467
00:23:22,780 --> 00:23:23,560
Like, just run it.

468
00:23:23,560 --> 00:23:24,240
Just auditing.

469
00:23:24,240 --> 00:23:24,840
Read only.

470
00:23:24,840 --> 00:23:26,720
Won't modify a system in any way.

471
00:23:26,720 --> 00:23:30,460
And if you survive the encounter of requesting that he run it, what do we find out?

472
00:23:30,460 --> 00:23:35,900
Well, we find out Mad Max's system scores far worse than the rest of the systems that do the exact same thing.

473
00:23:36,140 --> 00:23:36,640
Oh, great.

474
00:23:36,640 --> 00:23:40,140
Now we've got another way to get, we've got another way to get the worst systems hardened.

475
00:23:40,600 --> 00:23:42,360
Why do I care about hardening so much?

476
00:23:42,360 --> 00:23:53,060
I care about hardening so much because while it's kind of, you know, one of the least exciting areas of computer security, right next to like policy and logging, you know, it's still, it's extremely effective.

477
00:23:53,060 --> 00:23:54,720
You don't get boxes rooted.

478
00:23:54,780 --> 00:23:57,080
It's really nice to not get boxes rooted.

479
00:23:57,220 --> 00:23:59,920
It's not a lot of work either if you're using a tool for it.

480
00:24:00,460 --> 00:24:09,360
So anyway, you can read, you can run Bastille and basically other auditing tools, read only, and the idea is okay, we'll learn something about the system without having to modify it.

481
00:24:10,280 --> 00:24:13,040
This really helps when you have a shop that does manual hardening.

482
00:24:13,080 --> 00:24:15,140
People say, okay, we only modify things by hand.

483
00:24:15,140 --> 00:24:16,560
We don't trust any tool whatsoever.

484
00:24:16,560 --> 00:24:25,180
We don't trust any tool that doesn't come with a million dollar warranty from the vendor and an OILA that says you know, we'll of course take care of any losses you incur from bugs in our product.

485
00:24:25,440 --> 00:24:29,140
If you can only do manual hardening, fine, we'll tell you what to do.

486
00:24:29,460 --> 00:24:31,740
Read only means you don't have to stop doing manual hardening.

487
00:24:31,820 --> 00:24:34,400
It just means we'll help you out and tell you what you should do.

488
00:24:34,840 --> 00:24:37,480
Toward that end we're working to create Bastillex.

489
00:24:37,480 --> 00:24:39,360
I don't know, we're going to have to call it something else.

490
00:24:39,360 --> 00:24:41,420
But basically, Nopix plus Bastille.

491
00:24:41,420 --> 00:24:49,160
So you've got a system you've got a system and we will, you've got a system we'll basically just let you.

492
00:24:49,160 --> 00:24:53,500
You shut it down, you bring it back up, booting Bastillex or whatever we call it.

493
00:24:53,840 --> 00:24:59,320
And it starts up it says okay, I'm not going to mount the drives read write.

494
00:24:59,400 --> 00:25:00,560
Mount them read only.

495
00:25:00,780 --> 00:25:01,680
Run Bastille.

496
00:25:01,680 --> 00:25:02,660
Here's your score.

497
00:25:02,660 --> 00:25:04,020
Here's your score report.

498
00:25:04,020 --> 00:25:05,480
No changes ever made to the system.

499
00:25:05,480 --> 00:25:09,560
You can do this to Mad Max's system while he's on his lunch break or taking a sick day.

500
00:25:09,720 --> 00:25:10,140
Right?

501
00:25:10,140 --> 00:25:13,420
As long as you have someone's permission or something.

502
00:25:14,020 --> 00:25:14,620
Okay.

503
00:25:15,240 --> 00:25:19,060
So I've been talking about trying to convince people to harden.

504
00:25:19,060 --> 00:25:20,680
I've been talking about the psychology.

505
00:25:20,680 --> 00:25:22,420
I've been talking about how it is you do it.

506
00:25:22,420 --> 00:25:23,660
You can use this tool to do it.

507
00:25:23,660 --> 00:25:25,740
You can use this tool to find out how well you've hardened.

508
00:25:25,760 --> 00:25:27,600
But the big question always comes up.

509
00:25:27,600 --> 00:25:29,660
Why the heck do I harden in the first place?

510
00:25:29,800 --> 00:25:30,360
Okay?

511
00:25:31,000 --> 00:25:34,600
Basically if I haven't made it very clear what hardening is already.

512
00:25:34,600 --> 00:25:35,500
I'm about to.

513
00:25:35,500 --> 00:25:38,840
Hardening is just the process of trying to make a system harder to break into.

514
00:25:38,900 --> 00:25:41,860
And the idea is that you take any settings you can tweak and you tweak them.

515
00:25:41,860 --> 00:25:45,280
You turn things off and you configure stuff that you left on better.

516
00:25:45,540 --> 00:25:46,060
Okay?

517
00:25:46,060 --> 00:25:54,960
So the biggest, the first objection we always get to hardening hopefully not at Defcon is that people say my box isn't interesting enough.

518
00:25:54,960 --> 00:25:56,820
We're just a little K-12 school.

519
00:25:56,820 --> 00:25:59,180
Why is anyone going to attack us?

520
00:25:59,180 --> 00:26:01,760
We're just a paint thinner company.

521
00:26:01,760 --> 00:26:03,840
Why is anyone actually going to attack our computers?

522
00:26:03,840 --> 00:26:04,760
They're not interesting.

523
00:26:04,760 --> 00:26:06,840
You're not going to get any money out of attacking our computers.

524
00:26:06,840 --> 00:26:09,260
Worst case you might have some extra paint thinner shipped to you.

525
00:26:09,340 --> 00:26:10,960
What hacker wants that?

526
00:26:11,400 --> 00:26:13,800
Can you do anything with paint thinner that I don't know about?

527
00:26:14,080 --> 00:26:14,660
Okay.

528
00:26:14,900 --> 00:26:15,660
I don't know.

529
00:26:15,660 --> 00:26:16,340
Anyway.

530
00:26:16,620 --> 00:26:18,360
But everyone says I'm not interesting enough.

531
00:26:18,360 --> 00:26:19,480
I won't be targeted.

532
00:26:19,940 --> 00:26:22,660
Does anybody at Defcon still think this?

533
00:26:22,860 --> 00:26:23,240
Okay.

534
00:26:23,240 --> 00:26:24,640
Don't raise your hand.

535
00:26:24,800 --> 00:26:36,000
But if you think this and you put your laptop on the wireless network well try running an IDS for a few minutes or a packet capture program.

536
00:26:36,000 --> 00:26:38,300
You see some very interesting attacks coming your way.

537
00:26:38,300 --> 00:26:42,520
I wonder how many port scans everyone on the Defcon network sees per, I don't know, minute.

538
00:26:44,160 --> 00:26:45,000
Anyway.

539
00:26:45,240 --> 00:26:46,900
Low value targets aren't.

540
00:26:47,200 --> 00:26:47,660
Okay.

541
00:26:47,660 --> 00:26:49,340
Most targets aren't low value.

542
00:26:49,340 --> 00:26:50,860
This is something we should all understand.

543
00:26:50,860 --> 00:26:56,000
Your box is useful as the next hop on the way to the target just to make it a little bit tougher to track the attacker back.

544
00:26:56,000 --> 00:26:58,240
Your box is good as a peer -to-peer host.

545
00:26:58,340 --> 00:27:00,760
Your box is good as a wireless distribution site.

546
00:27:00,760 --> 00:27:01,980
Heck you could be low bandwidth.

547
00:27:01,980 --> 00:27:04,480
Your box would be useful as an IRC bot.

548
00:27:04,720 --> 00:27:04,840
Right?

549
00:27:04,840 --> 00:27:07,520
I mean your box will be useful to someone.

550
00:27:08,020 --> 00:27:11,080
The thing is that your box isn't usually targeted in any way.

551
00:27:11,080 --> 00:27:11,320
Right?

552
00:27:11,320 --> 00:27:15,200
Most of our attacks don't come from being targeted.

553
00:27:15,240 --> 00:27:21,000
And when they do, half the time, probably at least half the time, we don't know that we've even been compromised because people are that good.

554
00:27:21,180 --> 00:27:21,420
Right?

555
00:27:21,420 --> 00:27:25,180
But most of the attacks that we see are the script kitties coming after us.

556
00:27:25,180 --> 00:27:28,280
Most of the attacks that we see aren't targets of choice.

557
00:27:28,280 --> 00:27:29,680
They're targets of opportunity.

558
00:27:30,060 --> 00:27:30,220
Okay ?

559
00:27:30,220 --> 00:27:30,720
There's some...

560
00:27:30,720 --> 00:27:35,140
Your attacker had an exploit against say one particular version of PHP.

561
00:27:35,340 --> 00:27:37,380
So they go and they scan a large swath of the internet.

562
00:27:37,380 --> 00:27:39,780
They go and scan the entire Comcast at home network.

563
00:27:39,780 --> 00:27:42,880
And they find your box along with a hundred others.

564
00:27:43,060 --> 00:27:49,000
And they take those hundred systems and they take those hundred systems and they pwn them and these boxes now belong to them.

565
00:27:49,000 --> 00:27:51,480
But it's not because you were targeted.

566
00:27:51,480 --> 00:27:56,720
It's because you had an IP on Comcast that day and that was the guy attacking that day.

567
00:27:57,020 --> 00:27:57,140
Right?

568
00:27:57,140 --> 00:27:59,200
That was the network this guy was scanning.

569
00:27:59,280 --> 00:28:00,280
Does that make sense?

570
00:28:00,580 --> 00:28:01,060
Okay.

571
00:28:01,060 --> 00:28:02,800
I think that's kind of obvious at DEF CON.

572
00:28:03,360 --> 00:28:03,920
Okay.

573
00:28:03,920 --> 00:28:05,960
So we do tons of patching.

574
00:28:05,960 --> 00:28:06,100
Right?

575
00:28:06,100 --> 00:28:07,080
We do tons of patching.

576
00:28:07,080 --> 00:28:08,100
We're constantly patching.

577
00:28:08,100 --> 00:28:08,760
I mean we're all...

578
00:28:08,760 --> 00:28:12,560
I spent all of yesterday patching and all the day before that and every single day patching.

579
00:28:12,560 --> 00:28:14,460
We all patch and patch and patch and patch.

580
00:28:14,460 --> 00:28:14,900
Right?

581
00:28:15,080 --> 00:28:16,460
Well, okay, not really.

582
00:28:16,460 --> 00:28:18,180
But we do lots of patching.

583
00:28:18,180 --> 00:28:20,940
The problem is that if you patch you still get compromised.

584
00:28:20,940 --> 00:28:23,260
You're like wait, I patch every single day.

585
00:28:23,260 --> 00:28:26,580
Why do I get compromised if I patch every single day at midnight?

586
00:28:26,900 --> 00:28:29,780
Well you still get patched because you've still got these windows of vulnerability.

587
00:28:29,840 --> 00:28:38,320
A window of vulnerability is basically a time during which somebody's got a working exploit and the time when your systems are still vulnerable.

588
00:28:38,360 --> 00:28:40,780
It's the time when someone has a working exploit and your system is vulnerable.

589
00:28:40,780 --> 00:28:42,140
That's your window of vulnerability.

590
00:28:42,140 --> 00:28:44,100
It's broken apart into three parts.

591
00:28:44,260 --> 00:28:45,660
Two of which you have no control over.

592
00:28:45,660 --> 00:28:47,000
The first one is...

593
00:28:47,000 --> 00:28:49,700
Can you guys still hear me or am I not micing well enough?

594
00:28:50,300 --> 00:28:50,940
Sorry.

595
00:28:50,940 --> 00:28:57,100
The first one is the first part of your window of vulnerability is where the exploit exists but the vendor doesn't even know about the issue.

596
00:28:57,100 --> 00:28:58,260
Call this Oday.

597
00:28:58,320 --> 00:28:58,720
Right?

598
00:28:58,720 --> 00:29:00,540
You can do nothing about that.

599
00:29:00,680 --> 00:29:08,280
If nobody knows about the vulnerability except the people with the exploit and they're hitting you, well you're vulnerable whether you like it or not.

600
00:29:08,340 --> 00:29:09,400
We can do something about that.

601
00:29:09,400 --> 00:29:11,000
Hardening actually works on this.

602
00:29:11,000 --> 00:29:13,920
The next piece is an exploit exists and the vendor isn't creating a patch.

603
00:29:13,920 --> 00:29:15,080
They're not done creating a patch.

604
00:29:15,080 --> 00:29:16,340
It takes them a little while.

605
00:29:16,360 --> 00:29:17,800
Say it takes them, you know, a week.

606
00:29:17,800 --> 00:29:19,780
But really nowadays it's about a month.

607
00:29:20,220 --> 00:29:20,520
Okay?

608
00:29:20,520 --> 00:29:23,160
And then the third is patch exists and you haven't applied it yet.

609
00:29:23,160 --> 00:29:27,000
Most of us patch kind of closer to monthly or you know, weekly maybe.

610
00:29:27,000 --> 00:29:28,260
It would be nice if weekly.

611
00:29:28,400 --> 00:29:28,780
Right?

612
00:29:28,780 --> 00:29:33,660
But some people only patch quarterly and God, some people patch yearly and some people never patch at all.

613
00:29:34,180 --> 00:29:40,680
But the issue is that because you've got these first two parts of that window, even if you patch perfectly, you still end up with a vulnerable machine now and then.

614
00:29:40,700 --> 00:29:47,340
You still end up with a vulnerable machine and you're just kind of like rolling the dice, hoping that today your machine isn't vulnerable and attacked at the same time.

615
00:29:47,400 --> 00:29:48,520
Does that make sense?

616
00:29:48,720 --> 00:29:52,140
So the idea is we like hardening because this is reactive.

617
00:29:52,140 --> 00:29:53,560
Reactive is going and patching.

618
00:29:53,560 --> 00:29:58,140
Reactive is going and saying, oh God, we just got attacked on this port or people are attacking on this port.

619
00:29:58,140 --> 00:30:02,300
Maybe I should set my firewall to start blocking to start blocking SQL server queries.

620
00:30:02,500 --> 00:30:02,760
Right?

621
00:30:02,760 --> 00:30:04,460
That's kind of the reactive process.

622
00:30:04,480 --> 00:30:12,420
The proactive process is configuring that firewall ahead of time and saying wait, there's no reason for anyone to do SQL queries from outside my network into my network.

623
00:30:12,420 --> 00:30:21,440
Or better yet, I don't allow you, these are the protocols I allow in and I don't allow the rest in so if SQL ends up being the worm tomorrow, not so much the worries.

624
00:30:22,340 --> 00:30:26,640
The other thing we do is we harden a host because if we harden a host, maybe it won't be vulnerable.

625
00:30:27,920 --> 00:30:31,280
Hardening is just the process of configuring a system for better security.

626
00:30:31,280 --> 00:30:33,200
It means you turn off things you're not using.

627
00:30:33,480 --> 00:30:36,280
It means you're better configuring the stuff you are using.

628
00:30:36,520 --> 00:30:43,920
It doesn't involve the kernel level modification of the system like SELinux or Pitbull or trusted BSD, Solaris or whatever, what have you.

629
00:30:43,960 --> 00:30:50,600
It does involve going and looking at permissions, access controls, and looking at whether the permissions are appropriate or too lax.

630
00:30:50,880 --> 00:31:01,520
You remember a couple releases ago, Apple, my trusty Apple, right, had a wonderful vulnerability to let any user on the system backdoor a bunch of third party applications because the permissions were world-writable.

631
00:31:01,900 --> 00:31:02,720
Anybody remember that?

632
00:31:02,720 --> 00:31:03,520
That was a really good one.

633
00:31:03,520 --> 00:31:05,640
Dave G found that, it was awesome.

634
00:31:06,120 --> 00:31:07,940
It was awesome in multi-user systems.

635
00:31:07,940 --> 00:31:11,480
I'm sure some people at universities had a really great time with the Apple XServes.

636
00:31:12,320 --> 00:31:13,440
What else?

637
00:31:13,440 --> 00:31:22,680
The other side of it is it involves basically tweaking settings in the system and in the applications to give users what access they need and not really anymore of it.

638
00:31:22,960 --> 00:31:24,620
It comes down to two principles.

639
00:31:24,620 --> 00:31:26,600
One is least privilege, the other is minimalism.

640
00:31:26,600 --> 00:31:36,260
Least privilege says basically each application or OS component or user or whatever only grants whatever privilege the other users need, that the users need to give it.

641
00:31:36,260 --> 00:31:38,620
The users only get what privilege we want to give them.

642
00:31:38,720 --> 00:31:41,920
Minimalism says we configure the system for fewer features.

643
00:31:41,920 --> 00:31:43,540
We say these are the features we're using.

644
00:31:43,540 --> 00:31:44,880
Let's better tune the system.

645
00:31:44,880 --> 00:31:46,560
You'll get some nice speed out of this, right?

646
00:31:46,560 --> 00:31:49,820
Because you won't be running 50 applications, you'll be running 5.

647
00:31:49,880 --> 00:31:52,200
Just the 5 that we're supposed to be running here.

648
00:31:53,600 --> 00:32:01,880
In essence ok this is, now there's one thing people ask well what about SELinux, what about the kernel level stuff?

649
00:32:01,880 --> 00:32:04,960
Kernel level stuff is basically complementary to hardening.

650
00:32:04,960 --> 00:32:06,980
You can basically do both.

651
00:32:06,980 --> 00:32:11,900
Fedora my Fedora core 4 system has SELinux turned on and I'm hardening it with Bastille.

652
00:32:12,400 --> 00:32:19,980
Ok The thing with kernel level is that sometimes is that kernel level can be really awesome because it can contain a lot you can't do with hardening.

653
00:32:19,980 --> 00:32:22,820
On the other hand, hardening can do some things that kernel level can't do.

654
00:32:22,820 --> 00:32:29,260
One is that one is that kernel level very often contains the attacker after they've taken down, after they've compromised bind.

655
00:32:29,260 --> 00:32:34,220
You know they compromise bind, bind falls down, they don't get their powerful root shell because they're SELinuxed.

656
00:32:34,220 --> 00:32:46,740
On the other hand, if we can configure the thing, the thing that was being attacked so the exploit doesn't work or the code the exploit was trying to hit isn't available at all, maybe it's turned off, maybe it's removed, well then we don't get compromised at all,

657
00:32:46,740 --> 00:32:48,680
the bind server never goes down.

658
00:32:48,760 --> 00:32:50,780
The best example I can give you is Apache.

659
00:32:50,860 --> 00:32:55,820
Most of Apache's real functionality comes in these Apache modules that you can turn off at start time.

660
00:32:55,820 --> 00:32:58,760
It's not a recompile , it's just like comment something out, it doesn't load.

661
00:32:58,760 --> 00:33:01,520
You have code that doesn't load because you configured it not to.

662
00:33:01,640 --> 00:33:11,120
Apache is a great example too because it comes with, Red Hat ships it with say 34 different Apache modules, of which you might need five, depending on what kind of site you're running.

663
00:33:11,160 --> 00:33:19,020
So if you can turn off the ones you're not using and a vulnerability comes out and one of the ones that was on before, congratulations, you don't get nailed by it.

664
00:33:19,360 --> 00:33:20,200
Is that cool?

665
00:33:20,200 --> 00:33:21,200
Does that make sense?

666
00:33:23,540 --> 00:33:26,700
The other side of kernel level hardening is that it's hard.

667
00:33:27,220 --> 00:33:30,180
Kernel level, I mean kernel level technologies are hard.

668
00:33:30,180 --> 00:33:41,860
Writing the profiles, saying this program needs to write to this, needs to read to this, it needs to be able to do this capability but not this capability, that takes a lot of, that takes understanding, it takes a whole bunch of training to learn how to do that.

669
00:33:41,980 --> 00:33:48,480
Red Hat's made that possible with SE Linux because they've said, okay, we'll write a really good profile for the users and not require them to do it.

670
00:33:48,500 --> 00:33:55,220
On the other hand, the profiles are a little looser than you'd want them to be because Red Hat has to make sure that whatever you're going to do with that web server, it still works.

671
00:33:55,740 --> 00:33:56,740
Does that make sense?

672
00:33:56,800 --> 00:33:57,860
Okay, cool.

673
00:33:58,820 --> 00:34:01,980
You can learn to make your own profiles, it just takes some real training.

674
00:34:02,320 --> 00:34:03,960
There's a book on SE Linux.

675
00:34:06,280 --> 00:34:09,000
Anyway, you should continue looking at kernel level solutions.

676
00:34:09,000 --> 00:34:09,480
They're nice.

677
00:34:09,480 --> 00:34:11,080
I really like GR security.

678
00:34:11,260 --> 00:34:12,260
I like SE Linux.

679
00:34:12,260 --> 00:34:13,120
These are good.

680
00:34:13,680 --> 00:34:14,780
They're complimentary.

681
00:34:14,780 --> 00:34:17,040
You can still harden and probably still should.

682
00:34:17,560 --> 00:34:19,580
It's not a difficult thing to do.

683
00:34:19,760 --> 00:34:24,780
It's a little bit, it can be a little tedious if you're doing it all by hand, but well, we've got a tool for that.

684
00:34:26,480 --> 00:34:27,560
It's not hard to do.

685
00:34:27,660 --> 00:34:35,020
CIS, the Center for Internet Security, writes guides and the guides are designed to be used by junior level sysadmins.

686
00:34:35,320 --> 00:34:40,200
You might not even know entirely how to work their favorite editor just yet.

687
00:34:41,400 --> 00:34:42,640
This stuff can still be done.

688
00:34:42,640 --> 00:34:48,920
Black Hat has a two day course, I teach it, and that two day course does Solaris and Linux and it's comprehensive.

689
00:34:49,200 --> 00:34:54,260
There are five day courses at other organizations, but the fact that you can learn it that quickly says something.

690
00:34:54,260 --> 00:34:58,060
I mean, I can teach you one operating system how to manually harden in a day.

691
00:34:58,180 --> 00:34:59,880
We do two in two days.

692
00:34:59,880 --> 00:35:01,000
This is not hard stuff.

693
00:35:01,000 --> 00:35:01,940
This isn't rocket science.

694
00:35:01,940 --> 00:35:04,100
This isn't anywhere near rocket science.

695
00:35:05,220 --> 00:35:07,280
Anyway, it's pretty easy to do.

696
00:35:07,280 --> 00:35:08,820
It's also really effective.

697
00:35:08,900 --> 00:35:10,440
And I'll tell you about two examples.

698
00:35:10,540 --> 00:35:12,600
The first is the CIS guide.

699
00:35:13,300 --> 00:35:22,320
NSA's IAD, the information assurance guys that are around to stop machines from being broken into, they basically took a benchmark and ran it against a Windows system.

700
00:35:22,320 --> 00:35:26,980
And when they were done, 90% of the vulnerabilities that were in that Windows system were mitigated.

701
00:35:26,980 --> 00:35:28,280
You couldn't hit them.

702
00:35:28,440 --> 00:35:32,280
You either couldn't use them or you couldn't get anywhere by using them.

703
00:35:33,100 --> 00:35:34,540
You can do the same thing with Linux.

704
00:35:34,540 --> 00:35:38,900
If you basically do all the hardening guides, you don't have an extremely useful system.

705
00:35:38,900 --> 00:35:41,640
But 90-95% of your vulnerabilities are gone.

706
00:35:43,400 --> 00:35:45,900
Bastion Linux is just a way to do this programmatically.

707
00:35:46,380 --> 00:35:50,440
When we created it, we created it right when Red Hat 6.0 came out.

708
00:35:50,440 --> 00:35:52,560
We just did a normal audit of a Red Hat 6.0 system.

709
00:35:52,560 --> 00:35:53,780
Very, very standard.

710
00:35:53,780 --> 00:35:56,840
Just looked at it and said, what would you do if you're doing best practice hardening?

711
00:35:57,180 --> 00:35:58,900
We wrote a program to do it.

712
00:35:59,040 --> 00:36:03,620
It basically stopped or contained every major vulnerability that was in the system, which was really nice.

713
00:36:03,620 --> 00:36:05,220
Bind had a remote root hole.

714
00:36:06,500 --> 00:36:08,240
WooFTPD had a remote root hole.

715
00:36:08,340 --> 00:36:11,780
LPD plus SendMail, the combination of those two, got you another remote root.

716
00:36:11,780 --> 00:36:13,680
DumpRestore, local privilege escalation.

717
00:36:13,780 --> 00:36:17,780
GPM was a console-level privilege escalation.

718
00:36:17,780 --> 00:36:19,540
All of those things were stopped by Bastille.

719
00:36:19,540 --> 00:36:22,480
That's not because Bastille is just amazingly wonderful.

720
00:36:22,560 --> 00:36:31,580
I'd like to think it is, but that's because if you do this standard, normal stuff that we've got in books, that we've got on documentation, we've got on websites or whatever, this is what happens.

721
00:36:31,700 --> 00:36:42,200
There were only two we didn't nail, and they were just little commands that if root ran them and somebody had created, and somebody had been able to like, say, create a hostile man page, well, that's not anything we can really do anything about.

722
00:36:42,200 --> 00:36:44,300
That's one of those things that hardening won't get ya.

723
00:36:44,520 --> 00:36:45,620
But that's okay.

724
00:36:45,700 --> 00:36:46,880
So Bastille can kind of lock down.

725
00:36:46,880 --> 00:36:49,420
This is our complete list of what Bastille locks down right now.

726
00:36:49,440 --> 00:36:55,400
It does Red Hat, all the old ones, and Enterprise, and FedoraCore, and I'll release FedoraCore 4 tomorrow.

727
00:36:56,000 --> 00:36:57,700
Support's only in CVS for that.

728
00:36:57,960 --> 00:37:03,240
HPUX, Mandrake, or Mandrever, whatever you call it, Debian, Sousa, Gen 2, Mac OSX, Solaris soon.

729
00:37:03,920 --> 00:37:04,900
Need help.

730
00:37:05,600 --> 00:37:08,860
Again, one of the differences with Bastille was that it educated the SysAdmin.

731
00:37:09,220 --> 00:37:14,320
Educating the SysAdmin is really good if you, say, want the SysAdmin to not end up on the wall of sheep.

732
00:37:14,820 --> 00:37:18,300
If you want the SysAdmin to stop using Telnet, you have to tell them Telnet's bad.

733
00:37:18,340 --> 00:37:20,860
Because otherwise they'll say, I've been using Telnet for 10 years.

734
00:37:20,940 --> 00:37:21,880
What's wrong with Telnet?

735
00:37:21,880 --> 00:37:23,560
And you say, well, I can take it over.

736
00:37:23,560 --> 00:37:24,220
I can sniff it.

737
00:37:24,220 --> 00:37:25,340
I can sniff it or take it over.

738
00:37:25,340 --> 00:37:27,140
And when you've got switches, don't use it.

739
00:37:27,140 --> 00:37:28,320
Use SSH instead.

740
00:37:28,320 --> 00:37:31,000
And your SysAdmin says, okay, I'll let you turn off Telnet.

741
00:37:31,100 --> 00:37:32,080
Does that make sense?

742
00:37:32,340 --> 00:37:32,780
Yeah.

743
00:37:32,780 --> 00:37:35,540
Okay, so people have found it very educational.

744
00:37:35,540 --> 00:37:41,300
There are organizations that use Bastille entirely for the educational component and don't actually have it hard in the system because they want to do it manually.

745
00:37:41,400 --> 00:37:44,080
Hopefully the assessment mode makes things easier for that.

746
00:37:45,000 --> 00:37:46,840
Okay, it's really easy to automate.

747
00:37:46,840 --> 00:37:49,120
You create a config, two commands.

748
00:37:49,120 --> 00:37:54,480
You SCP a config over to another system and run Bastille over an SSH pipe and you can apply it to another system.

749
00:37:54,480 --> 00:38:02,020
If you're using one of those mass SSHers that lets you SSH to a thousand systems at once, congratulations, this gets really scalable.

750
00:38:02,020 --> 00:38:05,620
Okay, the whole thing is written so that it's very easy to script around Bastille.

751
00:38:05,620 --> 00:38:08,260
It's very easy to add on to it without having to know any Perl.

752
00:38:09,140 --> 00:38:12,720
The nice thing is, so why do you use Bastille or why do you use an automated system?

753
00:38:12,720 --> 00:38:15,360
Well, one of the reasons you do it is for consistency.

754
00:38:15,360 --> 00:38:19,960
If you don't have a thousand systems, fine, you like to do one the same way every time.

755
00:38:20,180 --> 00:38:22,400
Maybe you create a standard build config file.

756
00:38:22,400 --> 00:38:25,340
Maybe you make this part of your build process.

757
00:38:25,920 --> 00:38:32,640
All you have to do is every time you, basically you only have to update these config files when you get a new distro or when you get a new release of the distro.

758
00:38:32,940 --> 00:38:34,740
HPUX makes this really easy.

759
00:38:34,740 --> 00:38:35,580
There are four different ways.

760
00:38:35,580 --> 00:38:39,160
Part of their install process, they're shipping with Bastille with the operating system.

761
00:38:40,000 --> 00:38:44,100
What I want to do is, let's see, we're running a little low on time.

762
00:38:44,100 --> 00:38:47,760
What I've got is a list of modules and kind of what they do.

763
00:38:48,760 --> 00:38:54,200
Would you guys rather see a list of modules and what they do or would you rather kind of see how you add on to this?

764
00:38:54,820 --> 00:38:57,100
Add on, okay, works for me.

765
00:38:58,200 --> 00:39:00,280
Skip, skip, skip.

766
00:39:00,280 --> 00:39:02,420
Skip, skip.

767
00:39:03,620 --> 00:39:05,620
Bastille's actually really easy to add on to.

768
00:39:05,620 --> 00:39:10,320
We wrote it and then like so many open source projects, six months later we rewrote it entirely.

769
00:39:10,640 --> 00:39:13,760
And the rewrite is just to make it, was just to make it easier to maintain.

770
00:39:13,760 --> 00:39:15,860
And that happens on a lot of open source projects.

771
00:39:15,860 --> 00:39:17,800
Probably happens on a lot of commercial software.

772
00:39:17,840 --> 00:39:20,800
Because once you've written it once, you understand how to make it a lot better.

773
00:39:22,360 --> 00:39:28,500
So what we did is, the whole thing's in Perl, but if you don't know Perl, we actually worked to make it really understandable.

774
00:39:30,640 --> 00:39:33,720
So that you could work on this even if you don't know Perl.

775
00:39:33,720 --> 00:39:38,100
And I'll show you an example of how you kind of add something to turn off a set UID bit.

776
00:39:39,040 --> 00:39:43,600
So if you wanted to add an item, the first major thing you have to do is create a question for that item.

777
00:39:43,620 --> 00:39:50,600
Basically that text, the explanation, here's why you should do this, here's why you shouldn't, what the question is, what the default answer could be.

778
00:39:50,820 --> 00:39:56,900
You could add modules, and we've had people contribute modules before, and it's pretty easy.

779
00:39:57,880 --> 00:39:59,520
Here's just the question type stuff.

780
00:39:59,520 --> 00:40:02,800
This first one is just every item gets its own name.

781
00:40:02,800 --> 00:40:06,440
There's a short explanation, you can have a long explanation so you can give the user more detail.

782
00:40:06,440 --> 00:40:08,260
There's a little explain less, explain more.

783
00:40:08,280 --> 00:40:11,860
So that lets them granularly decide, I know a lot about this kind of stuff, so tell me less.

784
00:40:12,540 --> 00:40:22,700
There's a question, there's what distributions it works on, there's a default answer, there's a regular expression, answers have to match, if you don't know what that means, don't worry about it, you can skip that part.

785
00:40:22,800 --> 00:40:28,200
And there's some stuff that says what the next question is and what the previous question is, and you can actually skip that part if you want to.

786
00:40:28,760 --> 00:40:34,500
If I wanted to create a new thing that turned off setUid for dump and restore, this is the dump and restore action.

787
00:40:34,860 --> 00:40:41,160
I've got this if getGlobalConfig, the module name, the question name, you could copy paste that, equals yes.

788
00:40:41,160 --> 00:40:49,160
If they answered yes to this question, then I run b remove suid, remove setUid, it's one line, from dump.

789
00:40:49,160 --> 00:40:56,820
And this is a path name, but you can also, if that path differs from operating system to operating system, you can put in one of our getGlobal things, it says this is in a table somewhere.

790
00:40:56,820 --> 00:40:59,140
But you could just put user sbin dump.

791
00:40:59,740 --> 00:41:01,100
Does that make sense?

792
00:41:02,820 --> 00:41:05,500
This is really easy, I'll show you the API.

793
00:41:05,740 --> 00:41:07,500
The API is really simple.

794
00:41:08,040 --> 00:41:16,440
You can go and, you know, b chamod, chamod changes the permissions, changes the ownership, remove setUid, create symlink.

795
00:41:16,560 --> 00:41:22,600
The reason we've end up, a lot of these things are things that were present in Perl already, we wrappered them so that you can undo the whole thing.

796
00:41:22,600 --> 00:41:27,060
The idea behind Bastille is you can either granularly undo it, or we've got a big red button called revert.

797
00:41:27,080 --> 00:41:31,420
And that big red button yanks the system all the way back to where it was before you were running Bastille.

798
00:41:31,460 --> 00:41:34,380
It's not something you want to run six months later, because that part's hard.

799
00:41:34,400 --> 00:41:41,100
But if you just ran Bastille and you're like, wait, I answered yes to everything and I should have read revert, you hit your big red button and you start over.

800
00:41:41,100 --> 00:41:44,200
Or you hit your big red button and you throw away Bastille and curse my name.

801
00:41:44,320 --> 00:41:44,840
Right?

802
00:41:44,840 --> 00:41:45,480
Doesn't matter.

803
00:41:45,480 --> 00:41:46,620
Whatever you want to do.

804
00:41:47,400 --> 00:41:49,060
So, these are other things.

805
00:41:49,060 --> 00:41:52,820
b checkConfigOff turns things off in the RC scripts and all that.

806
00:41:52,820 --> 00:41:54,360
You can copy files.

807
00:41:54,820 --> 00:41:56,180
These are kind of the fun ones.

808
00:41:56,180 --> 00:42:00,480
b appendLine just sticks a line on the end of a file if it's not already there.

809
00:42:00,480 --> 00:42:06,240
This is all made so that if you run Bastille you can run it 8,000 times again with the same config file and not break the system.

810
00:42:06,240 --> 00:42:09,920
Because Bastille will look for the stuff that it's trying to add.

811
00:42:10,000 --> 00:42:14,100
You can insert lines before a given line in the file.

812
00:42:14,160 --> 00:42:16,100
You can prepend a line at the beginning of the file.

813
00:42:16,100 --> 00:42:17,760
You can replace a given line.

814
00:42:18,420 --> 00:42:22,200
Basically this matches the way the Unix config files are done.

815
00:42:22,360 --> 00:42:23,800
b hashCommentLine.

816
00:42:23,800 --> 00:42:24,620
What could be easier?

817
00:42:24,620 --> 00:42:26,320
You want to turn a line off?

818
00:42:26,320 --> 00:42:27,100
You don't have to delete it.

819
00:42:27,100 --> 00:42:28,360
Just comment it out with hash.

820
00:42:28,780 --> 00:42:30,120
Hash comment it out.

821
00:42:30,540 --> 00:42:31,820
DeleteLine is another thing you can do.

822
00:42:31,820 --> 00:42:33,040
And all of these work.

823
00:42:33,040 --> 00:42:35,000
They all work on ProRegularExpressions.

824
00:42:35,000 --> 00:42:37,800
If you don't know that, you can use exact matches.

825
00:42:38,080 --> 00:42:39,980
But this is all really simple to do.

826
00:42:40,220 --> 00:42:41,060
And that's the idea.

827
00:42:42,120 --> 00:42:45,880
That's the API for adding things, for adding new items.

828
00:42:45,880 --> 00:42:47,740
It's really actually quite easy.

829
00:42:47,740 --> 00:42:50,820
If you don't know Perl, you still have a pretty good chance of being able to add an item.

830
00:42:50,820 --> 00:42:53,140
Especially if you can copy and paste something similar.

831
00:42:53,320 --> 00:42:59,120
I added something yesterday to remove... I added something yesterday in about five minutes to remove mDNSResponder.

832
00:42:59,120 --> 00:43:03,340
That rendezvous zero conf Bonjour thing that's on Apple.

833
00:43:03,340 --> 00:43:05,340
It's also on Red Hat Fedora Core now.

834
00:43:05,340 --> 00:43:06,660
It was really easy to turn it off.

835
00:43:06,660 --> 00:43:09,520
I copied and pasted something that turned off GPM.

836
00:43:09,520 --> 00:43:11,080
Because that used CheckConfig.

837
00:43:11,380 --> 00:43:13,660
And to turn off mDNSResponder, it's another CheckConfig.

838
00:43:13,660 --> 00:43:14,940
It's really, really quick.

839
00:43:14,940 --> 00:43:16,260
Eight lines of Perl.

840
00:43:16,540 --> 00:43:18,320
And these kind of lines.

841
00:43:18,320 --> 00:43:20,080
Not the kind of lines you can't read.

842
00:43:20,260 --> 00:43:21,380
Does that make sense?

843
00:43:22,580 --> 00:43:24,720
Doing the same thing, you create an audit item.

844
00:43:24,720 --> 00:43:26,500
You can create an audit item.

845
00:43:26,500 --> 00:43:29,660
We want you to create an audit item for anything that you create a hardening item for.

846
00:43:29,660 --> 00:43:31,420
And all it is, is you have this thing.

847
00:43:31,420 --> 00:43:33,020
Just like this global test.

848
00:43:33,140 --> 00:43:34,340
The module name.

849
00:43:34,340 --> 00:43:37,640
And then that name of the question.

850
00:43:37,960 --> 00:43:39,380
Equals sub.

851
00:43:39,420 --> 00:43:42,860
And you basically have a subroutine that does whatever it was that should be tested.

852
00:43:42,860 --> 00:43:45,460
And you return ask or skip.

853
00:43:45,700 --> 00:43:48,280
Or you return one or zero.

854
00:43:48,460 --> 00:43:50,720
This says if B is sued.

855
00:43:50,720 --> 00:43:52,140
If ping is setUID.

856
00:43:52,140 --> 00:43:53,740
Or ping six is setUID.

857
00:43:53,740 --> 00:43:56,660
Then I say, okay, the test fails.

858
00:43:56,660 --> 00:43:58,740
It's really kind of that easy.

859
00:43:58,960 --> 00:44:00,540
And you can do the same thing with match lines.

860
00:44:00,620 --> 00:44:04,940
Everything that we basically could do to something now has a corresponding check.

861
00:44:05,220 --> 00:44:06,280
B is service off.

862
00:44:06,280 --> 00:44:10,520
We'll go and tell you if something is INETD based or XINETD based or RC based is on or off.

863
00:44:10,520 --> 00:44:11,840
Return match line.

864
00:44:11,840 --> 00:44:14,060
Is there a line in this file that matches this pattern?

865
00:44:14,060 --> 00:44:18,020
If I was hash commenting or deleting a line, now I can check and see if it's present.

866
00:44:18,160 --> 00:44:22,300
So now I have an easy, quick way to write a check at the same time that I'm writing the fix.

867
00:44:22,540 --> 00:44:24,500
That makes it a lot easier to develop the tool.

868
00:44:24,500 --> 00:44:27,380
It also, it makes it easier to write things for your environment.

869
00:44:27,380 --> 00:44:30,880
And the whole idea is that all these things should be pretty self-explanatory.

870
00:44:30,880 --> 00:44:32,340
B is package installed.

871
00:44:32,340 --> 00:44:34,340
Tells you if something is installed.

872
00:44:34,340 --> 00:44:35,840
Is process running?

873
00:44:36,040 --> 00:44:37,980
The idea is that it should sound like English.

874
00:44:37,980 --> 00:44:42,520
The idea is that this should be really easy for you to look at a few and then make your own.

875
00:44:42,600 --> 00:44:43,540
And you can make your own.

876
00:44:43,540 --> 00:44:44,560
You can use it in your environment.

877
00:44:44,560 --> 00:44:46,160
People have written whole modules.

878
00:44:46,340 --> 00:44:48,600
I've actually got a module author in the front row.

879
00:44:48,600 --> 00:44:50,680
Mike Rasch, hello.

880
00:44:51,500 --> 00:44:56,860
Anyway, he wrote the port scan attack detector which is like port sentry except 8,000 times better.

881
00:44:57,800 --> 00:44:59,040
It just is.

882
00:44:59,040 --> 00:44:59,820
You can look into it.

883
00:44:59,820 --> 00:45:00,640
You'll agree.

884
00:45:01,660 --> 00:45:04,080
These tests are really easy to write.

885
00:45:04,840 --> 00:45:08,060
I'm going to stop now because we're basically about a minute before.

886
00:45:08,060 --> 00:45:09,800
But I've got some things to give out.

887
00:45:09,800 --> 00:45:10,640
I've got books.

888
00:45:10,640 --> 00:45:11,820
I've got t-shirts.

889
00:45:11,880 --> 00:45:15,180
The goons are desperate for me to get rid of them because they don't want to take them all home.

890
00:45:15,180 --> 00:45:17,600
Because they've already taken their own stash.

891
00:45:17,780 --> 00:45:19,380
They've got the extra ones.

892
00:45:19,560 --> 00:45:22,700
I'm going to be doing a book signing of the Snort 2.1 book.

893
00:45:23,460 --> 00:45:27,400
But this is another book that I worked on called Stealing the Continent.

894
00:45:27,420 --> 00:45:28,840
And here's the t-shirt.

895
00:45:29,660 --> 00:45:35,100
It's got a picture of the book but it says call it fiction if it helps you sleep better.

896
00:45:36,000 --> 00:45:37,840
Anyway, who wants a t-shirt?

897
00:45:49,590 --> 00:45:51,290
Okay, I'll do that with the books now.

898
00:45:51,290 --> 00:45:56,690
No, these are signed books.

899
00:45:57,090 --> 00:45:58,070
I've got...

900
00:45:58,070 --> 00:45:59,750
Somebody should ask questions.

901
00:45:59,910 --> 00:46:01,370
Wow, that guy's getting one.

902
00:46:04,490 --> 00:46:08,590
I've got a Snort 2.1 book which is one of the ones I'll be signing.

903
00:46:08,590 --> 00:46:09,510
I've got Mike Rash

904
00:46:13,850 --> 00:46:18,450
and I've got the Venice Enterprise Cluster for people who don't want the big ones.

905
00:46:18,510 --> 00:46:20,530
Okay, you can have this one.

906
00:46:20,590 --> 00:46:25,480
Now, I will take three questions and then we'll move on.

907
00:46:25,620 --> 00:46:26,260
Ask one.

908
00:46:26,260 --> 00:46:28,180
Can you check for password complexity?

909
00:46:28,200 --> 00:46:29,560
Can you check for what?

910
00:46:30,440 --> 00:46:32,580
Can you check for password complexity?

911
00:46:32,720 --> 00:46:35,460
We can import a password complexity and we can check for it.

912
00:46:35,460 --> 00:46:38,140
We turned that check off for now but we're turning it back on.

913
00:46:38,140 --> 00:46:41,080
We ran into a bug with how it works on one distro versus another.

914
00:46:41,220 --> 00:46:42,160
That's a good question.

915
00:46:42,580 --> 00:46:43,740
Intrusion prevention?

916
00:46:44,140 --> 00:46:44,820
Okay.

917
00:46:47,160 --> 00:46:48,020
Another question.

918
00:46:48,020 --> 00:46:48,760
Over there.

919
00:46:51,820 --> 00:46:53,440
Oh, that's a good question.

920
00:46:53,440 --> 00:46:54,600
Can we check for SSH?

921
00:46:54,600 --> 00:46:57,820
Version 1 versus Version 2, better configuration than SSH?

922
00:46:57,820 --> 00:47:01,320
Not yet, but if you want to write it or I want to write it, we'll do it.

923
00:47:01,800 --> 00:47:02,960
That's a bug.

924
00:47:04,240 --> 00:47:05,560
That one.

925
00:47:06,480 --> 00:47:08,900
Can you test SELinux?

926
00:47:11,490 --> 00:47:12,070
Wow.

927
00:47:12,070 --> 00:47:15,130
Can we check SELinux if it's target or permissive mode?

928
00:47:15,490 --> 00:47:16,370
No.

929
00:47:17,950 --> 00:47:19,490
I'd love to talk about it.

930
00:47:19,490 --> 00:47:22,230
If you are exiting the room, please exit this way.

931
00:47:22,230 --> 00:47:22,790
Thank you.