Anyone who has a voice after Saturday night at DEF CON?
It wasn't really Saturday night at DEF CON, right?
Okay, so, anyway, we'll start now.
My name is Jay Beal.
I'm here to talk about Bastille Linux,
and we've done a lot more with the tool now,
and I want to...
What's that, louder?
Yeah.
How's that?
Pick up any better?
No.
Okay.
Try and type while I do this.
Move closer.
Like this?
I will eat the microphone.
I stole that from Raven.
Okay.
So I'm here to talk about Bastille Linux.
My name is Jay Beal,
and we've done lots of new stuff,
or one major new thing,
and a lot of little things,
and I'll show you what we're doing.
By the way, if you've got the slide putter on the CD,
these are slightly updated.
They're only minor updates.
The stuff on the CD is pretty comprehensive.
These just look a little bit nicer.
So you can grab them from here.
I'll let you write down the URL.
I will let you stop writing down the URL.
Okay, so let me...
I'm going to talk to you...
I'm going to tell you about what Bastille did before
and what it does now.
We'll take a pretty in-depth look,
and I'll even tell you a little bit about
how you can extend it yourself,
because, well, it's open source,
and we could always use the help.
And heck, if you want to do it yourself back home
and not share, we'll be okay with that, too.
So Bastille Linux is a hardening program for Linux.
That's a whole bunch of distributions.
That's Red Hat and Mandrake and Sousa and Debian
and Ubuntu and Gen2 and TurboLinux,
and there's probably one or two others, but I'm not sure.
Not yet Slack.
I'm so sorry.
I know, I keep promising Slack one day.
Okay, well, Slack once I get a Slack VM, right?
But it also works in HP-UX,
because Hewlett Packard put in some programmers,
and they've been helping a whole lot,
and it works in OSX, except not 10.4,
because Cisco's VPN client didn't work on 10.4
in my first install, so I had to blow that away.
Thank you.
But, yeah, so it works on plenty of Unixes,
the biggest thing that differentiated Bastille
from other hardening scripts before was that,
well, first, that we shared it, right?
And that, you know, instead of us all using our one-offs,
but also that it educated the administrator
about the process.
It educated the administrator about hardening
and about what they could harden.
It tried to get people to stop using Telnet, for example.
Tried to stop getting people,
tried to stop getting, get people to stop
using cleartext protocols.
Who's seen The Wall of Sheep?
I can't believe that wall's still scrolling.
I just, I mean, how could you walk by there,
see your picture there, and not start telling everybody,
oh my God, you know, cleartext, bad.
Okay.
Anyway, the new news is that Bastille now does,
now has a kind of audit or assessment function.
And what it's doing is, it can actually tell you
how well-hardened the box is so far.
Okay, it can say, these are all,
these are all the hardening steps I know about,
these are the ones that you've done,
these are the ones that you haven't done.
And the idea of well-hardened,
it can also compute a score,
so you can say, this is how well-hardened this box is,
and well-hardened is something that you can define personally,
you can kind of take the Bastille team's advice,
or you can get a, or you can get a definitions file
that talks about how well-hardened the box should be
from your organization, whatever that organization is,
employer or auditing board or whatever.
So, let me just show you how the,
show you how the two of them interact,
and, and hopefully I'll be able to keep this mic
close enough to my throat, you guys can still hear me.
But let me just demo and show you how it works,
so I don't keep just talking about it.
Attempting to keep mic, can you guys hear me in the back still?
Oh, man.
Choked on a microphone. What's that?
How's that? Better?
Tip it up.
Slightly in front of me.
Stand on one foot.
Start typing. Okay, I can do that, that's easy.
So, let's see.
I'm SSH'd right now into a Fedora Core 4 system.
So what I'm going to do is, Bastille,
can you guys see the bottom of the screen?
Oh yeah, these are great screens.
Okay, so, I'm typing Bastille minus A for audit.
And it's gone and it's just finished the audit.
It's kind of a fast process.
And this is what our initial audit report looks like.
What you've got here is a score out of 10,
and I'll tell you more about that score over time.
And this thing right here says how we got that score.
What weights file we used.
I'll talk about weights files tomorrow, but basically,
who decided how your system should be scored is in that.
Okay, so, there are items here that don't have a weight.
There are items here...
Here, let's see.
So, I'll show you basically the way this works.
Bastille's a whole bunch of modules,
and you're going to see these modules.
I just want you to see the structure of the report.
Okay, Bastille's a whole bunch of modules.
So, one of them's called file permissions,
or we'll page down a little bit.
Okay, one of them's a send mail module here.
So, here's the DNS module here, just at the top of the screen.
And this basically is an item called chroot bind,
and that labels something you can redefine if you like.
It can be item 4.3 if you like.
Here's a question.
Is bind in a chroot jail?
Is it set to run non-root?
Here's your current state.
Yes, it is.
Here's the weight of that question.
Ah, sorry, you didn't really get anything for it.
It was weighted zero.
That wasn't something that you were required to do,
or it wasn't something that you were considering as all that important.
And then here's the score contribution based on that weight.
Does that make sense?
So, the idea is...
Oh, and if we go to that question,
you know it'll pop up if you've got JavaScript on in this browser.
This is all running locally,
so we want to talk about JavaScript issues and all that.
Just trust me for now.
This is running locally.
You're not...
The idea is that the browser isn't off doing other things.
This browser popped up by best deal.
You can have another browser hanging around.
This is your separate one.
So, we've got a pop-up.
If you don't like pop-ups, you can turn off JavaScript in it,
and you can just click on the question.
And the question will give you...
Can you guys see that?
No?
Okay.
How's that?
Okay, so this question is named in a chroot jail.
This is the thing that's being checked,
and it's also an item that can be hardened in best deal,
and this explanation here basically says,
this is why you should do this.
And I'll show you that some more,
but one of the best deal's things is it says,
listen, here's why you should chroot name D.
Because you could be a total newbie.
You could be like, what does chroot mean?
What's name D?
And so we'll try to give you a feel for it.
We'll say, okay, this is what you should know.
This is why you should do this.
Maybe this is when you shouldn't.
This is when...
Oh, it's hardening.
What if that's gonna break something?
Oh, it's gonna break something, right?
So the idea is, okay, I understand that risk.
Let us tell you when it would break something,
when it wouldn't break something,
and let you make an informed decision.
Does that make sense?
So here's my report thing,
and it goes on for pages.
You can print it out if you like,
but there's also something
where you can just contract all the modules.
We're working on a cooler looking version of this,
and I'll tell you a little bit about that as we go on.
But you can contract all the modules
and say just see one of them.
So it's a fun little interface.
It's a simple little interface,
but it does the job.
There are, of course, people who are really into,
who are really saying,
listen, why can't I run this in text mode?
I'm not really an X person.
If Bastille finds that you haven't,
that you're not actually doing X forwarding,
it'll pop up its own text browser.
It'll pop up links or W3M or links 2
or the other links, you know, or whatever it is.
And then there's two other things here
There's also a text version of that.
So you can see it like that.
And then the other piece,
which I'm going to refer to later,
is that there's something that's machine parsable.
And by machine parsable, the weird thing is
this thing looks a whole lot like a Bastille config file.
This will come up later.
This thing looks, we can give you a version that says
for each module, for each item number in there,
what your current state is.
Whether you're hardened, whether you're not hardened.
The Y and N's or whatever
are basically the answers that it found on the system.
Does that make sense?
So, I'll show you.
Let's take this and run Bastille normally.
I'm running Bastille minus X
to show it in X.
Oh, there's something everybody should know.
Remember when we all used to tell that into systems
and you'd type Xclock, you'd type Netscape
and you'd see things pop up graphically?
And that was good?
And then we did that with SSH and that was good?
And then it stopped working?
Like all of a sudden you SSH'd into something
and there was no X anymore?
Anybody have that?
Raise your hand if you had that happen.
Maybe only a few people have had that happen.
Just SSH minus capital X.
And it's like it used to be.
It's a security thing, almost, sort of, kind of.
Anyway.
So I've started up Bastille
and, I don't know, can you guys read this?
I can't see from over here.
Okay.
Well, anyway.
Why don't I just...
Fine.
What this basically is, is it's a bunch of...
What this basically is, is it's just a bunch of...
There's a bunch of modules on the left side
and I'll show you a screenshot later on
that will be a little bit easier to see.
But there's a bunch of modules on the left side.
There's a question up here that says,
would you like to do this thing?
There's an explanation here that says,
here's why you would want to
and here's why you wouldn't want to.
It's the same one you saw on the auditing side.
And then there's like a yes or no.
So we can kind of go through
and just tell it we want to harden the system.
And I'm basically just choosing the defaults for now.
The defaults for Bastille are basically chosen
so that you won't get...
so that you won't screw things up too badly
if you just go through and never make a decision
if you always click yes or click no.
You're losing a lot of the benefit if you do that
the first time
because we probably got something to tell you about.
Okay.
Bastille's got a firewall that I'm skipping
for anybody watching and...
another tool that I'm skipping that I'll talk about later.
So Bastille will go and it'll basically
just go and say these are the things I did.
And there's an error in here because
it's trying to work on inetd.conf
and there isn't one on the system
and there's no exinetd either.
But that's not something to really worry about.
So what I've got right now
is if I were to look at...
if I were to look at the number of things
that are still running...
Okay.
Wow, that should be all.
Okay, well...
what I can do right now, let me just
rerun in audit mode and show you.
I just went through and hardened the system.
And I hardened the system with
pretty significant speed because
I wasn't trying to so much demo the tool.
What we just did was we went from a score of 5 point something
to a score of 8 point something.
Almost 9. And if I'd chosen the non-
if I'd chosen something stricter than the defaults all along
we'd actually have a higher score.
And we can see and we can look at basically
each question and say, okay, what got turned off
and what got turned on. Does that make sense?
Is that kind of...
The idea is there are tools
that have been auditing... there are tools that have been
auditing before and there are tools that have been hardening
before and now we're kind of doing both.
And that's got a certain advantage.
And one of the advantages is that you can motivate people
to harden more because they're like, wow, hey,
look, I can see my score.
Or you can... well, I've got slides. I'll show you.
But the idea is that it's
a pretty useful thing to be able to
even have tools line up.
Let me show you. Let me show you slides.
Okay.
Here, now I can probably be heard
a whole lot better.
So, in essence,
the first question is kind of, why do you do assessment
at all? Right? I just showed you, hey,
we built an audit tool and you're like, wow,
gee, I'm not an auditor. Why do I care?
Right? Maybe you're not thinking that.
Maybe you're thinking this is really cool and that's what I hope you're thinking.
But if you're not, maybe I can tell you
why it's useful. Can you hear me
or am I still not eating the
mic sufficiently well? Okay.
I will keep trying to eat the microphone.
Okay, so
in terms of why you do assessment in the first
place, the first reason you do
assessment is because it teaches
the system about things they could harden.
It teaches them about hardening settings they could
apply they might not have known about before.
And one of the weird things in the Unix world is we kind of all
feel like we know everything and it's
hard to find out that there's something you don't know
if you feel like you know everything.
And so it's kind of a, you know,
and so the idea of this is to show you what you
might not know or at least what hasn't been done
to the system yet. Bastille's always
had this education thing as a second purpose.
This is a normal screenshot.
This is what I was going through but a little
more blown up before.
If we look at this, what we're doing is this
goes and says, hey, do you want to turn on stack protection
in the kernel? Here's the reason
you want to do this. It turns out you can break tons
of buffer overflow exploits. You can
break lots of buffer overflows.
One of the major kinds of exploits out there
if you just turn on the stack protection. Here's
when you don't want to. GDB is a
mode that it doesn't work with if you turn on stack
protection. What else? Well, not much else.
Okay, so we can tell you
here's what we'd like to do and find out if
you want to do it. Why else do you do assessment?
Triage, right?
You basically take each of your systems. You're like
I'd like to harden my systems. I don't
know where to start. I can start at my workstation.
Yeah, that's good. Right, but I don't know where to start.
I can go with the most vital servers. How about which one's
worse? How about pick the one
that's least hardened? Pick the one that's in
worst need. So you can basically
go and take best deal and generate that
score or look at that config file and look at what
things matter. If you know what things matter
you can set weights according to these
are the things that matter and then score your systems.
Right, the score thing lets you start
the user configurable score
thing lets you start saying, okay, these
systems are worse. I'm going to take care of them
first. Or these systems are worse. I'm going to maybe
do a little bit of incident response because they're so bad, right?
Does that make sense? Or maybe I'll
start with, you know, running my
NMAP scans, running my Nessus scans. I'll look for vulnerabilities
in the system. I'll look for backdoors on the system
is really what I care about here.
Okay, what else? Another reason
to do assessment is that auditing
happens. You will be audited.
We all get audited at some point. Maybe you
don't, but a lot of us do. A lot of
my clients do, right? So the idea
is, okay, you know you're
going to get audited. It'd be nice to find out what's
going to show up. What's going to happen to be able to work on it
proactively? And so the idea
here is to give you a tool that's equivalent to your
auditor's tools. And you can use a waits
file again that's basically
defined the same way your auditor's is.
And that's our hope. If anybody
is with any of the major auditing organizations,
I've worked with CIS. If you're with ISACA,
if you're with one of the other organizations
and you want to contribute something, I would love it if you
would help contribute work on waits files.
Just help us tell, okay,
what are auditors looking for? But I mean, we've
got a framework now where we can do that.
What else? Bestial
could be helpful here with compliance.
If you've
just gotten hit over the head in the last year with new
legislation that says, okay, we've got to care about security
now, or
we're going to get measured on it. We always
cared about it. Well, maybe Bestial will help you
in figuring out how well you are in compliance.
The weird thing is that some
of these compliances are actually really
fuzzy. They say that you've got to do
due diligence, that you've got to do a pretty good job.
Well, what's that mean? Well, if we've
got an idea, if we've got an idea how systems
scored, and we can show, okay, well
we went from here to here, or we can say
listen, most of our industry does
this. They score at this on this waits
file. Well, then you start being able to say that you're
basically keeping up with your peers, which
is what due diligence means. It doesn't mean that
you did everything possible. It just basically
means you did what most everybody else who's
doing a good job is doing. That's kind
of fuzzy, but we'll try to help you with that anyway.
What else? You could
go and say, this is another thing that comes up
in universities, network protection. It's saying, listen,
I'd like to make sure that before
a system's put on my network, before
a Unix system's put on my network, I want to make sure that it's
well patched, and I want to make sure that it's well hardened.
And if it's well hardened to basically these
standards, then I'll let it on the network.
And if it's not, well, I'm sorry, you know,
just come back in a day when you're done.
Or actually, since hardening's pretty fast, as you guys
saw, you know, come back in five minutes.
Does that make sense?
Is this kind of interesting to you guys?
Useful? Okay, cool.
The other thing is,
scoring has this awesome psychological
power. Okay, I worked on
another tool like this,
and I remember when we were developing it, it was the
CIS Unix scoring tool. And when we
were developing it, they said, we're going to give you a score.
You know, you want to compute a score, and I'm like,
a score? One number?
I mean, I studied mathematics, okay?
You know, like, I did physics too. We don't
have one number. I was like, oh god,
at worst, like, make it a ten element vector, and then like,
you know, compute some kind of a mean of that,
or whatever, you know, compute a metric based on, like,
weights of that. And someone's like, no, no, no, no,
one number. And I'm like, one number. Okay,
fine, management folks will like one number.
That was my first thought. It turns out, geeks
like one number too. One number is really
kind of useful, okay?
The score thing is really nice because people
are naturally competitive, and geeks
are naturally competitive, and hackers are
really naturally competitive, right?
So, so the idea is
that first, people get around to hardening
sooner. People are like, you know, I'm meaning to
harden that system. I'll get around to it later on.
All of a sudden, when they're like confronted with, you know,
a score that says mediocre, they're like, wait,
I'm not mediocre. I kick ass.
You know? That's not the way this should be.
I shouldn't have a score of four.
I'm not getting around to that later. I'm doing it right freaking
now. Okay?
So, I'll give you an example.
We had a, we had a security instructor
who was a SANS instructor. He, you know,
was an instructor teaching lots of people things.
He thought a lot of himself, of course, as we all do.
Right? And he said,
okay, I'll,
you know, I'll beta test your software. So he was beta testing
and he ran this thing on his workstation.
And his workstation came up at about a six out of ten.
And he got
peeved. He's like, what are you saying?
This is the mediocre issue. He said, I'm not
a six out of ten. Screw that.
And he sat down. He didn't even talk to us. He just sat down
and started hardening his system. And ten
minutes later, he ran the tool again and they gave him an eight.
And he's like, ah, that's more like it.
I'm not a six. A six is like, you know,
60%. That's like a D. No, no.
I'm much better than that. It's nice.
Play against people's ego. He didn't see
himself as a six out of ten kind of guy.
Fine by me. Whatever gets him to take
proactive security measures is good.
Okay.
This has happened lots of times. When we were developing
this previous scoring tool, we talked to a bank.
And the bank had set up a scoring tool
they'd created. Their security folks had,
you know, like many security folks in organizations
had no power whatsoever.
We couldn't, you know, it wasn't like, hand of God.
You know, you will harden.
It's not like that. They were like, uh, we'd like
to help. How can we help?
And that's what a lot of security folks in organizations
are like. So they went to their sysadmins.
They said, here's this tool. Why don't you try and run it
once? Okay. And so they ran it once.
They didn't have any mandated high score. They didn't have any
mandated anything. The only thing was, can you try
this tool once? Let us know how it goes.
And so they did start using it. And different
groups of sysadmins had different reactions.
They're basically all positive.
But there were some sysadmins who started voluntarily
posting their scores up on a cork board.
Like, outside their cube.
Okay, I know, that sounds really, really nerdy.
But, you know, okay, we're all really
nerds here, right? We're just pretending to be cool.
Okay, maybe you all are cool.
I'm just not.
Right, but the idea is, like, okay,
it'd be really great if we got people competing.
And they do. Okay, the start
Linux system scores around a 5.
This doesn't work on Solaris yet, but I wouldn't
be surprised if, like, a Solaris 8 system
scored around a 3. Right?
Solaris has got freaking everything on by default.
We will get around to
porting Bastille to Solaris.
It's just a whole lot of work.
Anybody wants to help,
we've got two people who are working on it already
and would love the help.
But there's, but the nice, so that's
why you do, that's why you do assessments.
It's why you do audit. These are the useful
things about pushing an auditing tool
in your organization or pushing whatever.
So, so why do you, why do you like
the two together? Why did I, you know,
why did we add auditing to Bastille
instead of just creating a new auditing tool? Right?
That would be kind of cool.
Well, the idea is that when you are hardening
a system, when you are hardening
a system, it creates a policy file.
When you go through this interactive yes, no, yes, no,
yes, no, yes, no, you get a policy file
whether you like it or not. It just gets saved.
It gets saved in this given place and you can take that policy file
and you can do something with it.
Well, one of the things you can do with it is you can feed it
back in, you can feed it back in
and see how well you are doing against that policy
file. You can say, okay, it's been
three months. I've been patching.
I have just, you know, ordinary system rot.
I'd like to know how far off I am.
The other thing in terms
of that policy file is if you, since we created
a policy file by default every time you harden,
you harden, we create a policy file. You can take that
policy file and say, this is my policy file for all
my web servers. And now you don't have to
run through the whole Bastille thing again, right?
It's just, it's got a back end where you just feed it a policy
file, it sucks it in, hardens the system
and, you know, two minutes later you're ready.
Right? You can take that policy file and reuse
it. And there's a lot of, there's a lot
of reuse. I was just
talking about skew detection. If you take that policy
file and you've said, this is my web server template.
Suppose you've got a web server that's older.
Maybe you can't harden it. Maybe the boss
has said, listen, we don't want anyone making any substantial
changes to this system. You can make changes
one at a time by hand. Fine.
You say, all our other web servers are here.
I've got a policy file that says how they
were hardened. Let's see how this one stacks up.
So I take this one and I
run the auditing tool on it and it says, okay,
these are the four things that you normally do
to all your other web servers that you haven't done to this one
because it's older. Is that cool? Does that make
sense? So it's called skew detection
and it's a decent thing.
There are some politics
to this. There's a reason.
I keep talking about psychological powers.
Psychology is a really weird thing to be
talking about with regard to hardening.
Not necessarily with regard to DEF CON, right? You're all
psyching each other out all the time. There's psychological games.
Eh. This is the weird
thing. Psychological games in the workplace.
Right? We're all used to it if we're in the
workplace. Politics.
There are lots of times
where you can't harden a system by hand
or with a tool because someone says,
oh no, I think that might break things. Or
you can't touch that. That's my system.
No changes. Right? The nice
thing about this is that you can say
we've taken, we've
got all of our web servers. We've got four web servers that I built.
We've got the one that, you know, that Mad Max is still
maintaining. And Mad Max says anyone who
touches his system gets his fingers chopped off.
Okay? Well, you know,
listen, Mad Max's boss, my boss,
can you just ask Mad Max if he'd run this tool for you
once? Like, just run it. Just auditing.
Read only. Won't modify a system in any
way. And if you survive the encounter of
requesting that he run it, what do we
find out? Well, we find out Mad Max's system
scores far worse than the rest of the
systems that do the exact same thing.
Oh, great. Now we've got another way to get, we've got
another way to get the worst systems hardened.
Why do I care about hardening so much?
I care about hardening so much because while it's
kind of, you know, one of the least exciting
areas of computer security, right next to like
policy and logging,
you know, it's still, it's extremely
effective. You don't get boxes rooted.
It's really nice to not get boxes
rooted. It's not a lot of work either
if you're using a tool for it.
So anyway, you can read, you
can run Bastille and basically other
auditing tools, read only, and the idea
is okay, we'll learn something about the system without having
to modify it.
This really helps when you
have a shop that does manual hardening.
People say, okay, we only modify things by hand.
We don't trust any tool whatsoever. We don't trust any tool
that doesn't come with a million dollar warranty
from the vendor and an OILA that says
you know, we'll of course take care of any losses
you incur from bugs in our product.
If you can only do manual hardening,
fine, we'll tell you what to do.
Read only means you don't have to stop doing manual hardening.
It just means we'll help you out and tell you
what you should do. Toward that end
we're working to create Bastillex.
I don't know, we're going to have to call it something else.
But basically, Nopix plus Bastille.
So you've got a system
you've got a system
and we will, you've got a system
we'll basically just let you. You shut it
down, you bring it back up, booting Bastillex
or whatever we call it.
And it starts up
it says okay, I'm not
going to mount the drives read write.
Mount them read only. Run Bastille.
Here's your score. Here's your score report.
No changes ever made to the system.
You can do this to Mad Max's system
while he's on his lunch break or taking a sick day.
Right? As long as you have
someone's permission or something.
Okay.
So I've been talking about
trying to convince people to harden.
I've been talking about the psychology. I've been talking about
how it is you do it. You can use this tool to do it.
You can use this tool to find out how well you've hardened.
But the big question always comes up.
Why the heck do I harden in the first place?
Okay? Basically
if I haven't made it very clear
what hardening is already. I'm about to.
Hardening is just the process of trying to make a system
harder to break into.
And the idea is that you take any settings you can tweak
and you tweak them. You turn things off
and you configure stuff that you left on better.
Okay? So the biggest, the first
objection we always get to hardening
hopefully not at Defcon
is that people say
my box isn't interesting enough.
We're just a little K-12 school.
Why is anyone going to attack us?
We're just a paint thinner company.
Why is anyone actually going to attack our computers?
They're not interesting. You're not going to get any money out of
attacking our computers. Worst case you might have some
extra paint thinner shipped to you.
What hacker wants that?
Can you do anything with paint thinner that I don't know about?
Okay. I don't know.
Anyway. But everyone says I'm not
interesting enough. I won't be targeted.
Does anybody at Defcon still
think this? Okay. Don't raise
your hand. But
if you think this and you put your laptop
on the wireless network
well
try running an IDS for a few minutes
or a packet capture
program. You see some very interesting
attacks coming your way. I wonder how
many port scans everyone on the Defcon network sees
per, I don't know, minute.
Anyway.
Low value targets aren't.
Okay. Most targets aren't low value.
This is something we should all understand.
Your box is useful as the next hop on the way to the target
just to make it a little bit tougher to track
the attacker back. Your box is good as
a peer-to-peer host. Your box is good
as a wireless distribution site. Heck
you could be low bandwidth. Your box would be useful
as an IRC bot. Right? I mean
your box will be useful to someone.
The thing is that
your box isn't usually targeted in any way.
Right? Most of our attacks don't come from
being targeted.
And when they do, half the time,
probably at least half the time, we don't know that we've
even been compromised because people are that good.
Right? But most of the attacks that we see
are the script kitties coming after us.
Most of the attacks that we see aren't
targets of choice. They're targets of opportunity.
Okay? There's some...
Your attacker had an exploit against say
one particular version of PHP.
So they go and they scan a large swath of the internet.
They go and scan the entire Comcast at home network.
And they find your box along
with a hundred others.
And they take those hundred systems and they
take those hundred systems and they pwn them and
these boxes now belong to them.
But it's not because you were targeted.
It's because you had an IP on
Comcast that day and that was the guy
attacking that day. Right?
That was the network this guy was scanning.
Does that make sense? Okay.
I think that's kind of obvious at DEF CON.
Okay. So we do tons of
patching. Right? We do tons of patching.
We're constantly patching. I mean we're all...
I spent all of yesterday patching and all the day before
that and every single day patching. We all patch
and patch and patch and patch. Right?
Well, okay, not really. But
we do lots of patching. The problem is that if you patch
you still get compromised. You're like
wait, I patch every single day.
Why do I get compromised if I patch every
single day at midnight? Well you
still get patched because you've still got these windows of vulnerability.
A window of vulnerability is basically a time
during which somebody's got a working exploit
and the time
when your systems
are still vulnerable. It's the time when someone has
a working exploit and your system is vulnerable. That's your
window of vulnerability. It's broken apart into
three parts. Two of which you have no
control over. The first one is...
Can you guys still hear me or am I not micing well enough?
Sorry. The first one is
the first part of your window of vulnerability is where the
exploit exists but the vendor doesn't even
know about the issue. Call this Oday.
Right? You can do nothing about that.
If nobody knows
about the vulnerability except the people
with the exploit and they're hitting you, well
you're vulnerable whether you like it or not.
We can do something about that. Hardening actually
works on this. The next piece is
an exploit exists and the vendor isn't creating a patch.
They're not done creating a patch. It takes them a little while.
Say it takes them, you know, a week.
But really nowadays it's about a month.
Okay? And then the third is patch exists
and you haven't applied it yet. Most of us patch
kind of closer to monthly or
you know, weekly maybe. It would be nice if weekly.
Right? But some people only
patch quarterly and God, some people patch yearly
and some people never patch at all.
But the issue is that because you've got these first
two parts of that window, even if you patch
perfectly, you still end up with a vulnerable machine
now and then. You still end up with a vulnerable machine
and you're just kind of like rolling the dice, hoping that
today your machine isn't vulnerable and
attacked at the same time. Does that make sense?
So the idea is
we like hardening because this is reactive.
Reactive is going and patching. Reactive
is going and saying, oh God, we just got
attacked on this port or people are attacking on this
port. Maybe I should set my firewall to start blocking
to start blocking SQL server queries.
Right? That's kind of the reactive process.
The proactive process is
configuring that firewall ahead of time and saying
wait, there's no reason for anyone to do SQL queries
from outside my network into
my network. Or better yet, I don't
allow you, these are the protocols I allow in and
I don't allow the rest in so if SQL ends up
being the worm tomorrow,
not so much the worries.
The other thing we do is we harden a host
because if we harden a host, maybe it won't be
vulnerable.
Hardening is just the process of configuring
a system for better security. It means you turn
off things you're not using. It means
you're better configuring the stuff you are using.
It doesn't involve the kernel level
modification of the system like SELinux
or Pitbull or trusted BSD, Solaris
or whatever, what have you.
It does involve going and looking at
permissions, access controls, and
looking at whether the permissions are appropriate or too
lax. You remember a couple
releases ago, Apple, my trusty
Apple, right, had a wonderful vulnerability
to let any user on the system backdoor
a bunch of third party applications
because the permissions were world-writable.
Anybody remember that? That was a really good one. Dave G
found that, it was awesome.
It was awesome in multi-user systems.
I'm sure some people at universities had a really great
time with the Apple XServes.
What else?
The other side of it is it involves basically
tweaking settings in the system
and in the applications to give users
what access they need and not really anymore
of it. It comes down
to two principles. One is least privilege, the other is minimalism.
Least privilege says basically
each application or OS component
or user or whatever
only grants whatever privilege
the other users need, that the users need to give it.
The users only get what privilege we
want to give them. Minimalism says
we configure the system for fewer features.
We say these are the features we're using.
Let's better tune the system. You'll get some nice speed
out of this, right? Because you won't be running
50 applications, you'll be running 5.
Just the 5 that we're supposed to be running here.
In essence
ok
this is, now there's one thing people ask
well what about SELinux, what about the kernel level stuff?
Kernel level stuff is basically
complementary to hardening. You can
basically do both. Fedora
my Fedora core 4 system has SELinux turned on
and I'm hardening it with Bastille.
Ok
The thing with kernel level is that sometimes
is that kernel level can be really awesome
because it can contain a lot you can't do with hardening.
On the other hand, hardening can do some things that kernel
level can't do. One is that
one is that kernel level very often contains
the attacker after they've taken
down, after they've compromised bind. You know
they compromise bind, bind falls down, they don't
get their powerful root shell because they're SELinuxed.
On the other hand, if we can
configure the thing, the thing that was being
attacked so the exploit doesn't work
or the code the exploit was trying to hit
isn't available at all, maybe it's turned off, maybe
it's removed, well then we don't get compromised
at all, the bind server never goes down.
The best example I can give you is Apache.
Most of Apache's real functionality
comes in these Apache modules that you can
turn off at start time. It's not a
recompile, it's just like comment something out, it doesn't
load. You have code that doesn't load because
you configured it not to. Apache is a great
example too because it comes with, Red Hat
ships it with say 34 different Apache
modules, of which you might need
five, depending on what kind of site
you're running. So if you can turn off the ones
you're not using and a vulnerability comes out
and one of the ones that was on
before, congratulations, you don't get nailed
by it. Is that cool?
Does that make sense?
The other side of
kernel level hardening is that it's hard.
Kernel level, I mean kernel level
technologies are hard.
Writing the profiles, saying this program
needs to write to this, needs to read to this,
it needs to be able to do this capability
but not this capability, that takes
a lot of, that takes understanding, it takes
a whole bunch of training to learn how to do that.
Red Hat's made that possible with SE Linux
because they've said, okay, we'll write a really good profile
for the users and not require them to do it.
On the other hand, the profiles are a little
looser than you'd want them to be because Red Hat
has to make sure that whatever you're going to do with that
web server, it still works.
Does that make sense? Okay, cool.
You can learn to make your own profiles,
it just takes some real training.
There's a book on SE Linux.
Anyway, you should continue looking
at kernel level solutions. They're nice.
I really like GR security.
I like SE Linux. These are good.
They're complimentary. You can still harden
and probably still should.
It's not a difficult thing to do.
It's a little bit, it can be a little tedious
if you're doing it all by hand, but well,
we've got a tool for that.
It's not hard to do. CIS,
the Center for Internet Security, writes guides
and the guides are designed
to be used by junior level
sysadmins.
You might not even know entirely
how to work their favorite editor just yet.
This stuff can still be done.
Black Hat has a two day course, I teach it,
and that two day course does
Solaris and Linux and it's comprehensive.
There are five day courses at other organizations,
but the fact that you can learn it that quickly
says something.
I mean, I can teach you one operating system
how to manually harden in a day.
We do two in two days.
This is not hard stuff.
This isn't rocket science.
This isn't anywhere near rocket science.
Anyway, it's pretty easy to do.
It's also really effective.
And I'll tell you about two examples.
The first is the CIS guide.
NSA's IAD, the information assurance guys
that are around to stop machines
from being broken into,
they basically took a benchmark
and ran it against a Windows system.
And when they were done, 90% of the vulnerabilities
that were in that Windows system were mitigated.
You couldn't hit them.
You either couldn't use them
or you couldn't get anywhere by using them.
You can do the same thing with Linux.
If you basically do all the hardening guides,
you don't have an extremely useful system.
But 90-95% of your vulnerabilities are gone.
Bastion Linux is just a way
to do this programmatically.
When we created it, we created it
right when Red Hat 6.0 came out.
We just did a normal audit of a Red Hat 6.0 system.
Very, very standard.
Just looked at it and said,
what would you do if you're doing best practice hardening?
We wrote a program to do it.
It basically stopped or contained
every major vulnerability that was in the system,
which was really nice.
Bind had a remote root hole.
WooFTPD had a remote root hole.
LPD plus SendMail, the combination of those two,
got you another remote root.
DumpRestore, local privilege escalation.
GPM was a console-level
privilege escalation.
All of those things were stopped by Bastille.
That's not because Bastille is just amazingly wonderful.
I'd like to think it is, but
that's because if you do this standard, normal stuff
that we've got in books,
that we've got on documentation, we've got on websites or whatever,
this is what happens.
There were only two we didn't nail,
and they were just little commands that if root ran them
and somebody had created, and somebody had been able to
like, say, create a hostile man page,
well, that's not anything we can really do anything about.
That's one of those things that hardening won't get ya.
But that's okay.
So Bastille can kind of lock down.
This is our complete list of what Bastille locks down right now.
It does Red Hat, all the old ones,
and Enterprise, and FedoraCore,
and I'll release FedoraCore 4 tomorrow.
Support's only in CVS for that.
HPUX, Mandrake, or Mandrever, whatever you call it,
Debian, Sousa, Gen 2, Mac OSX,
Solaris soon.
Need help.
Again, one of the differences with Bastille
was that it educated the SysAdmin.
Educating the SysAdmin is really good if you, say,
want the SysAdmin to not end up on the wall of sheep.
If you want the SysAdmin to stop using Telnet,
you have to tell them Telnet's bad.
Because otherwise they'll say,
I've been using Telnet for 10 years.
What's wrong with Telnet?
And you say, well, I can take it over.
I can sniff it. I can sniff it or take it over.
And when you've got switches, don't use it.
Use SSH instead.
And your SysAdmin says, okay, I'll let you turn off Telnet.
Does that make sense? Yeah.
Okay, so people have found it very educational.
There are organizations that use Bastille
entirely for the educational component
and don't actually have it hard in the system
because they want to do it manually.
Hopefully the assessment mode makes things easier for that.
Okay, it's really easy to automate.
You create a config, two commands.
You SCP a config over to another system
and run Bastille over an SSH pipe
and you can apply it to another system.
If you're using one of those mass SSHers
that lets you SSH to a thousand systems at once,
congratulations, this gets really scalable.
Okay, the whole thing is written
so that it's very easy to script around Bastille.
It's very easy to add on to it
without having to know any Perl.
The nice thing is, so why do you use Bastille
or why do you use an automated system?
Well, one of the reasons you do it is for consistency.
If you don't have a thousand systems, fine,
you like to do one the same way every time.
Maybe you create a standard build config file.
Maybe you make this part of your build process.
All you have to do is every time you,
basically you only have to update these config files
when you get a new distro
or when you get a new release of the distro.
HPUX makes this really easy.
There are four different ways.
Part of their install process,
they're shipping with Bastille with the operating system.
What I want to do is, let's see,
we're running a little low on time.
What I've got is a list of modules
and kind of what they do.
Would you guys rather see a list of modules
and what they do or would you rather
kind of see how you add on to this?
Add on, okay, works for me.
Skip, skip, skip.
Skip, skip.
Bastille's actually really easy to add on to.
We wrote it and then like so many open source projects,
six months later we rewrote it entirely.
And the rewrite is just to make it,
was just to make it easier to maintain.
And that happens on a lot of open source projects.
Probably happens on a lot of commercial software.
Because once you've written it once,
you understand how to make it a lot better.
So what we did is,
the whole thing's in Perl,
but if you don't know Perl,
we actually worked to make it really understandable.
So that you could work on this
even if you don't know Perl.
And I'll show you an example
of how you kind of add something
to turn off a set UID bit.
So if you wanted to add an item,
the first major thing you have to do
is create a question for that item.
Basically that text, the explanation,
here's why you should do this,
here's why you shouldn't,
what the question is,
what the default answer could be.
You could add modules,
and we've had people contribute modules before,
and it's pretty easy.
Here's just the question type stuff.
This first one is just
every item gets its own name.
There's a short explanation,
you can have a long explanation
so you can give the user more detail.
There's a little explain less, explain more.
So that lets them granularly decide,
I know a lot about this kind of stuff,
so tell me less.
There's a question,
there's what distributions it works on,
there's a default answer,
there's a regular expression, answers have to match,
if you don't know what that means, don't worry about it,
you can skip that part.
And there's some stuff that says what the next question is
and what the previous question is,
and you can actually skip that part if you want to.
If I wanted to create a new thing that turned off setUid
for dump and restore,
this is the dump and restore action.
I've got this if getGlobalConfig,
the module name, the question name,
you could copy paste that, equals yes.
If they answered yes to this question,
then I run b remove suid,
remove setUid, it's one line,
from dump.
And this is a path name, but you can also,
if that path differs from operating system to operating system,
you can put in one of our getGlobal things,
it says this is in a table somewhere.
But you could just put user sbin dump.
Does that make sense?
This is really easy, I'll show you the API.
The API is really simple.
You can go and, you know,
b chamod, chamod changes the permissions,
changes the ownership,
remove setUid, create symlink.
The reason we've end up, a lot of these things
are things that were present in Perl already,
we wrappered them so that you can undo the whole thing.
The idea behind Bastille is you can either
granularly undo it, or we've got a big red button
called revert. And that big red button
yanks the system all the way back to where it was
before you were running Bastille.
It's not something you want to run six months later,
because that part's hard. But if you just ran Bastille
and you're like, wait, I answered yes to everything
and I should have read revert,
you hit your big red button and you start over.
Or you hit your big red button and you throw away Bastille
and curse my name. Right? Doesn't matter.
Whatever you want to do.
So, these are other things.
b checkConfigOff turns things off in the
RC scripts and all that.
You can copy files.
These are kind of the fun ones.
b appendLine just sticks a line on the end of a file
if it's not already there.
This is all made so that if you run Bastille
you can run it 8,000 times again with the same config file
and not break the system.
Because Bastille will look for
the stuff that it's trying to add.
You can insert lines
before a given line in the file.
You can prepend a line at the beginning of the file.
You can replace a given line.
Basically this matches the way
the Unix config files are done.
b hashCommentLine. What could be easier?
You want to turn a line off?
You don't have to delete it. Just comment it out with hash.
Hash comment it out.
DeleteLine is another thing you can do.
And all of these work.
They all work on ProRegularExpressions.
If you don't know that, you can use exact matches.
But this is all really simple to do.
And that's the idea.
That's the API
for adding things, for adding new items.
It's really actually quite easy.
If you don't know Perl,
you still have a pretty good chance of being able to add an item.
Especially if you can copy and paste something similar.
I added something yesterday
to remove... I added something yesterday
in about five minutes to remove mDNSResponder.
That rendezvous zero conf
Bonjour thing that's on Apple.
It's also on Red Hat Fedora Core now.
It was really easy to turn it off.
I copied and pasted something that turned off GPM.
Because that used CheckConfig.
And to turn off mDNSResponder,
it's another CheckConfig. It's really, really quick.
Eight lines of Perl.
And these kind of lines.
Not the kind of lines you can't read.
Does that make sense?
Doing the same thing, you create an audit item.
You can create an audit item.
We want you to create an audit item for anything
that you create a hardening item for.
And all it is, is you have this thing.
Just like this global test.
The module name.
And then that name of the question.
Equals sub.
And you basically have a subroutine
that does whatever it was that should be tested.
And you return ask or skip.
Or you return one or zero.
This says if B is sued.
If ping is setUID.
Or ping six is setUID.
Then I say, okay, the test fails.
It's really kind of that easy.
And you can do the same thing with match lines.
Everything that we basically could do to something
now has a corresponding check.
B is service off.
We'll go and tell you if something is INETD based
or XINETD based or RC based is on or off.
Return match line.
Is there a line in this file that matches this pattern?
If I was hash commenting or deleting a line,
now I can check and see if it's present.
So now I have an easy, quick way to write a check
at the same time that I'm writing the fix.
That makes it a lot easier to develop the tool.
It also, it makes it easier to write things
for your environment.
And the whole idea is that all these things
should be pretty self-explanatory.
B is package installed.
Tells you if something is installed.
Is process running?
The idea is that it should sound like English.
The idea is that this should be really easy
for you to look at a few and then make your own.
And you can make your own.
You can use it in your environment.
People have written whole modules.
I've actually got a module author in the front row.
Mike Rasch, hello.
Anyway, he wrote the port scan attack detector
which is like port sentry except 8,000 times better.
It just is.
You can look into it.
You'll agree.
These tests are really easy to write.
I'm going to stop now because we're basically
about a minute before.
But I've got some things to give out.
I've got books.
I've got t-shirts.
The goons are desperate for me to get rid of them
because they don't want to take them all home.
Because they've already taken their own stash.
They've got the extra ones.
I'm going to be doing a book signing
of the Snort 2.1 book.
But this is another book that I worked on
called Stealing the Continent.
And here's the t-shirt.
It's got a picture of the book
but it says
call it fiction if it helps you sleep better.
Anyway, who wants a t-shirt?
Okay, I'll do that with the books now.
No, these are signed books.
I've got...
Somebody should ask questions.
Wow, that guy's getting one.
I've got a Snort 2.1 book
which is one of the ones I'll be signing.
I've got Mike Rash
and I've got the Venice Enterprise Cluster
for people who don't want the big ones.
Okay, you can have this one.
Now, I will take three questions
and then we'll move on.
Ask one.
Can you check for password complexity?
Can you check for what?
Can you check for password complexity?
We can import a password complexity
and we can check for it.
We turned that check off for now but we're turning it back on.
We ran into a bug with how it works on one distro
versus another. That's a good question.
Intrusion prevention?
Okay.
Another question.
Over there.
Oh, that's a good question.
Can we check for SSH?
Version 1 versus Version 2, better configuration than SSH?
Not yet, but if you want to write it
or I want to write it, we'll do it.
That's a bug.
That one.
Can you test
SELinux?
Wow.
Can we check SELinux if it's target or permissive mode?
No.
I'd love to talk about it.
If you are exiting the room,
please exit this way.
Thank you.