start	end	text
12730	17270	Anyone who has a voice after Saturday night at DEF CON?
17270	19690	It wasn't really Saturday night at DEF CON, right?
20710	23650	Okay, so, anyway, we'll start now.
23650	24870	My name is Jay Beal.
25210	27770	I'm here to talk about Bastille Linux,
27770	30510	and we've done a lot more with the tool now,
30510	37140	and I want to...
37140	38540	What's that, louder?
39920	40800	Yeah.
40880	42020	How's that?
42360	43300	Pick up any better?
43300	44080	No.
44600	45480	Okay.
46120	48560	Try and type while I do this.
49320	50760	Move closer.
52580	53860	Like this?
54320	56540	I will eat the microphone.
57440	59320	I stole that from Raven.
59520	60240	Okay.
61560	63840	So I'm here to talk about Bastille Linux.
63840	64820	My name is Jay Beal,
64820	67160	and we've done lots of new stuff,
67160	69940	or one major new thing,
69940	71380	and a lot of little things,
71380	73140	and I'll show you what we're doing.
75660	78260	By the way, if you've got the slide putter on the CD,
78260	79680	these are slightly updated.
79680	81120	They're only minor updates.
81460	83420	The stuff on the CD is pretty comprehensive.
83420	85100	These just look a little bit nicer.
85380	86900	So you can grab them from here.
87880	89300	I'll let you write down the URL.
95440	97400	I will let you stop writing down the URL.
98320	99300	Okay, so let me...
99300	100080	I'm going to talk to you...
100080	101920	I'm going to tell you about what Bastille did before
102800	103920	and what it does now.
103920	105460	We'll take a pretty in-depth look,
105460	106480	and I'll even tell you a little bit about
106480	107860	how you can extend it yourself,
107860	110000	because, well, it's open source,
110000	111400	and we could always use the help.
111820	114060	And heck, if you want to do it yourself back home
114060	116760	and not share, we'll be okay with that, too.
117880	121800	So Bastille Linux is a hardening program for Linux.
121800	123880	That's a whole bunch of distributions.
123880	126160	That's Red Hat and Mandrake and Sousa and Debian
126160	129480	and Ubuntu and Gen2 and TurboLinux,
129480	132720	and there's probably one or two others, but I'm not sure.
133520	135260	Not yet Slack.
136620	137960	I'm so sorry.
137960	140460	I know, I keep promising Slack one day.
140820	143640	Okay, well, Slack once I get a Slack VM, right?
144200	146040	But it also works in HP-UX,
146040	148000	because Hewlett Packard put in some programmers,
148000	150140	and they've been helping a whole lot,
150140	152800	and it works in OSX, except not 10.4,
152800	155380	because Cisco's VPN client didn't work on 10.4
155380	157540	in my first install, so I had to blow that away.
157540	158300	Thank you.
159040	165180	But, yeah, so it works on plenty of Unixes,
165800	168500	the biggest thing that differentiated Bastille
168500	171280	from other hardening scripts before was that,
171280	173580	well, first, that we shared it, right?
173580	176420	And that, you know, instead of us all using our one-offs,
176420	178540	but also that it educated the administrator
178540	179580	about the process.
179580	181440	It educated the administrator about hardening
181440	182940	and about what they could harden.
182940	185600	It tried to get people to stop using Telnet, for example.
185600	186520	Tried to stop getting people,
186520	188800	tried to stop getting, get people to stop
188800	190260	using cleartext protocols.
190300	192200	Who's seen The Wall of Sheep?
192920	195160	I can't believe that wall's still scrolling.
195160	197040	I just, I mean, how could you walk by there,
197040	198980	see your picture there, and not start telling everybody,
198980	201040	oh my God, you know, cleartext, bad.
201460	202060	Okay.
203620	206600	Anyway, the new news is that Bastille now does,
206600	209200	now has a kind of audit or assessment function.
209200	211320	And what it's doing is, it can actually tell you
211320	213600	how well-hardened the box is so far.
213760	215340	Okay, it can say, these are all,
215340	217120	these are all the hardening steps I know about,
217120	218320	these are the ones that you've done,
218320	219980	these are the ones that you haven't done.
220340	222440	And the idea of well-hardened,
222440	224300	it can also compute a score,
224300	227720	so you can say, this is how well-hardened this box is,
227720	229920	and well-hardened is something that you can define personally,
229920	232000	you can kind of take the Bastille team's advice,
232000	234420	or you can get a, or you can get a definitions file
234420	236600	that talks about how well-hardened the box should be
236600	239180	from your organization, whatever that organization is,
239180	242000	employer or auditing board or whatever.
243300	245500	So, let me just show you how the,
245500	247600	show you how the two of them interact,
247600	250020	and, and hopefully I'll be able to keep this mic
250020	252160	close enough to my throat, you guys can still hear me.
252160	254780	But let me just demo and show you how it works,
254780	257000	so I don't keep just talking about it.
260650	263330	Attempting to keep mic, can you guys hear me in the back still?
264030	265090	Oh, man.
270260	272480	Choked on a microphone. What's that?
278620	280560	How's that? Better?
281700	282780	Tip it up.
283540	285140	Slightly in front of me.
286820	288620	Stand on one foot.
290480	293520	Start typing. Okay, I can do that, that's easy.
294280	296340	So, let's see.
298460	302880	I'm SSH'd right now into a Fedora Core 4 system.
303080	304780	So what I'm going to do is, Bastille,
304780	306220	can you guys see the bottom of the screen?
306600	308040	Oh yeah, these are great screens.
308040	311500	Okay, so, I'm typing Bastille minus A for audit.
312520	314740	And it's gone and it's just finished the audit.
315520	317000	It's kind of a fast process.
317000	319660	And this is what our initial audit report looks like.
319840	323420	What you've got here is a score out of 10,
323420	325500	and I'll tell you more about that score over time.
325500	328200	And this thing right here says how we got that score.
328260	329300	What weights file we used.
329300	331320	I'll talk about weights files tomorrow, but basically,
331320	334140	who decided how your system should be scored is in that.
334560	338040	Okay, so, there are items here that don't have a weight.
338140	339000	There are items here...
340100	341420	Here, let's see.
342460	344840	So, I'll show you basically the way this works.
344840	346120	Bastille's a whole bunch of modules,
346120	347180	and you're going to see these modules.
347180	349260	I just want you to see the structure of the report.
349340	351140	Okay, Bastille's a whole bunch of modules.
351140	353340	So, one of them's called file permissions,
353340	355620	or we'll page down a little bit.
356980	361320	Okay, one of them's a send mail module here.
361660	365520	So, here's the DNS module here, just at the top of the screen.
365520	367740	And this basically is an item called chroot bind,
367740	370420	and that labels something you can redefine if you like.
370420	372940	It can be item 4.3 if you like.
373560	374760	Here's a question.
375680	377300	Is bind in a chroot jail?
377300	378780	Is it set to run non-root?
379100	380500	Here's your current state.
380500	381680	Yes, it is.
382400	383940	Here's the weight of that question.
383940	385780	Ah, sorry, you didn't really get anything for it.
385780	386580	It was weighted zero.
386580	388320	That wasn't something that you were required to do,
388320	390960	or it wasn't something that you were considering as all that important.
391320	393720	And then here's the score contribution based on that weight.
393740	394660	Does that make sense?
394860	395920	So, the idea is...
395920	398060	Oh, and if we go to that question,
398060	400940	you know it'll pop up if you've got JavaScript on in this browser.
400940	402240	This is all running locally,
402240	404720	so we want to talk about JavaScript issues and all that.
405280	406720	Just trust me for now.
406720	407980	This is running locally.
407980	408620	You're not...
408620	411060	The idea is that the browser isn't off doing other things.
411060	413020	This browser popped up by best deal.
413020	414460	You can have another browser hanging around.
414460	416040	This is your separate one.
416740	417940	So, we've got a pop-up.
417940	420520	If you don't like pop-ups, you can turn off JavaScript in it,
420520	422160	and you can just click on the question.
422340	423760	And the question will give you...
423760	424880	Can you guys see that?
425240	425880	No?
426040	426760	Okay.
427680	428660	How's that?
428920	432360	Okay, so this question is named in a chroot jail.
432360	435500	This is the thing that's being checked,
435500	437980	and it's also an item that can be hardened in best deal,
437980	440820	and this explanation here basically says,
440820	442580	this is why you should do this.
442720	443940	And I'll show you that some more,
443940	445680	but one of the best deal's things is it says,
445680	447780	listen, here's why you should chroot name D.
447900	449380	Because you could be a total newbie.
449380	451560	You could be like, what does chroot mean?
452180	453440	What's name D?
453460	455480	And so we'll try to give you a feel for it.
455480	456940	We'll say, okay, this is what you should know.
456940	458480	This is why you should do this.
458500	460160	Maybe this is when you shouldn't.
460160	462340	This is when...
462340	462580	Oh, it's hardening.
462580	463940	What if that's gonna break something?
463940	465440	Oh, it's gonna break something, right?
465440	468480	So the idea is, okay, I understand that risk.
468480	470340	Let us tell you when it would break something,
470340	471680	when it wouldn't break something,
471680	473480	and let you make an informed decision.
473520	474580	Does that make sense?
474960	480580	So here's my report thing,
480580	481900	and it goes on for pages.
481900	482900	You can print it out if you like,
482900	483620	but there's also something
483620	485620	where you can just contract all the modules.
486000	488840	We're working on a cooler looking version of this,
488840	491560	and I'll tell you a little bit about that as we go on.
491560	493880	But you can contract all the modules
493880	495460	and say just see one of them.
495700	497500	So it's a fun little interface.
497500	499020	It's a simple little interface,
499020	500380	but it does the job.
500620	502740	There are, of course, people who are really into,
502740	503380	who are really saying,
503380	505220	listen, why can't I run this in text mode?
505220	507000	I'm not really an X person.
507740	509160	If Bastille finds that you haven't,
509160	510760	that you're not actually doing X forwarding,
510760	512540	it'll pop up its own text browser.
512540	515220	It'll pop up links or W3M or links 2
515220	517720	or the other links, you know, or whatever it is.
517720	520020	And then there's two other things here
521400	526100	There's also a text version of that.
527300	529120	So you can see it like that.
529520	531780	And then the other piece,
531780	533500	which I'm going to refer to later,
533500	535500	is that there's something that's machine parsable.
536480	538760	And by machine parsable, the weird thing is
539400	542080	this thing looks a whole lot like a Bastille config file.
542080	543360	This will come up later.
543360	545560	This thing looks, we can give you a version that says
545560	547760	for each module, for each item number in there,
547760	549060	what your current state is.
549060	550580	Whether you're hardened, whether you're not hardened.
550580	551700	The Y and N's or whatever
551700	554440	are basically the answers that it found on the system.
554480	555660	Does that make sense?
555980	558240	So, I'll show you.
558420	561460	Let's take this and run Bastille normally.
561880	563220	I'm running Bastille minus X
563220	564560	to show it in X.
564560	566880	Oh, there's something everybody should know.
567620	569400	Remember when we all used to tell that into systems
569400	571280	and you'd type Xclock, you'd type Netscape
571280	573320	and you'd see things pop up graphically?
573320	574280	And that was good?
574280	576400	And then we did that with SSH and that was good?
576460	578060	And then it stopped working?
578060	579680	Like all of a sudden you SSH'd into something
579680	581080	and there was no X anymore?
581420	582940	Anybody have that?
583060	584640	Raise your hand if you had that happen.
585120	588460	Maybe only a few people have had that happen.
588460	590660	Just SSH minus capital X.
590660	591840	And it's like it used to be.
591840	594140	It's a security thing, almost, sort of, kind of.
594340	595060	Anyway.
595260	596480	So I've started up Bastille
598000	600160	and, I don't know, can you guys read this?
600540	602220	I can't see from over here.
602820	603460	Okay.
603600	605320	Well, anyway.
605360	606520	Why don't I just...
607280	607920	Fine.
608600	610680	What this basically is, is it's a bunch of...
610680	612980	What this basically is, is it's just a bunch of...
612980	614620	There's a bunch of modules on the left side
614940	616520	and I'll show you a screenshot later on
616520	618120	that will be a little bit easier to see.
618120	620120	But there's a bunch of modules on the left side.
620160	622080	There's a question up here that says,
622080	623440	would you like to do this thing?
623600	625980	There's an explanation here that says,
625980	626980	here's why you would want to
626980	628220	and here's why you wouldn't want to.
628220	630060	It's the same one you saw on the auditing side.
630100	631640	And then there's like a yes or no.
631840	633060	So we can kind of go through
634240	637620	and just tell it we want to harden the system.
640800	644000	And I'm basically just choosing the defaults for now.
644260	646360	The defaults for Bastille are basically chosen
646360	647400	so that you won't get...
647400	648860	so that you won't screw things up too badly
648860	651180	if you just go through and never make a decision
651180	653040	if you always click yes or click no.
653040	654980	You're losing a lot of the benefit if you do that
654980	656280	the first time
657240	659620	because we probably got something to tell you about.
660540	661360	Okay.
661360	663140	Bastille's got a firewall that I'm skipping
663520	665360	for anybody watching and...
667000	669400	another tool that I'm skipping that I'll talk about later.
669540	671380	So Bastille will go and it'll basically
671380	673800	just go and say these are the things I did.
673900	675340	And there's an error in here because
675340	677440	it's trying to work on inetd.conf
677440	678480	and there isn't one on the system
678480	680020	and there's no exinetd either.
680820	682840	But that's not something to really worry about.
683000	684180	So what I've got right now
684540	686380	is if I were to look at...
687060	688500	if I were to look at the number of things
688500	690220	that are still running...
690220	690880	Okay.
694380	695740	Wow, that should be all.
695980	697680	Okay, well...
697680	699280	what I can do right now, let me just
699280	701120	rerun in audit mode and show you.
701120	702960	I just went through and hardened the system.
704460	705800	And I hardened the system with
706260	707920	pretty significant speed because
707920	709520	I wasn't trying to so much demo the tool.
709520	711760	What we just did was we went from a score of 5 point something
711760	713960	to a score of 8 point something.
713960	715720	Almost 9. And if I'd chosen the non-
715720	718360	if I'd chosen something stricter than the defaults all along
718360	720080	we'd actually have a higher score.
720080	722000	And we can see and we can look at basically
722000	724080	each question and say, okay, what got turned off
724080	726380	and what got turned on. Does that make sense?
726700	727920	Is that kind of...
727920	729980	The idea is there are tools
729980	732040	that have been auditing... there are tools that have been
732040	734100	auditing before and there are tools that have been hardening
734100	735900	before and now we're kind of doing both.
735900	737840	And that's got a certain advantage.
737840	740180	And one of the advantages is that you can motivate people
740180	742240	to harden more because they're like, wow, hey,
742240	743900	look, I can see my score.
743900	746340	Or you can... well, I've got slides. I'll show you.
746340	747660	But the idea is that it's
747980	749760	a pretty useful thing to be able to
749760	751500	even have tools line up.
752400	754440	Let me show you. Let me show you slides.
755320	755860	Okay.
756800	757980	Here, now I can probably be heard
758080	758900	a whole lot better.
760160	761780	So, in essence,
761780	763980	the first question is kind of, why do you do assessment
763980	765820	at all? Right? I just showed you, hey,
765820	767820	we built an audit tool and you're like, wow,
767820	770200	gee, I'm not an auditor. Why do I care?
770200	771840	Right? Maybe you're not thinking that.
771840	774200	Maybe you're thinking this is really cool and that's what I hope you're thinking.
774200	775900	But if you're not, maybe I can tell you
775900	777960	why it's useful. Can you hear me
777960	779980	or am I still not eating the
779980	782180	mic sufficiently well? Okay.
782200	784500	I will keep trying to eat the microphone.
785500	786100	Okay, so
786100	787980	in terms of why you do assessment in the first
787980	789920	place, the first reason you do
789920	791180	assessment is because it teaches
791180	794080	the system about things they could harden.
794080	795900	It teaches them about hardening settings they could
795900	797900	apply they might not have known about before.
797980	800020	And one of the weird things in the Unix world is we kind of all
800020	802020	feel like we know everything and it's
802020	803960	hard to find out that there's something you don't know
803960	805460	if you feel like you know everything.
806340	808200	And so it's kind of a, you know,
808200	810040	and so the idea of this is to show you what you
810040	812160	might not know or at least what hasn't been done
812160	814020	to the system yet. Bastille's always
814020	816220	had this education thing as a second purpose.
816660	818500	This is a normal screenshot.
818500	820060	This is what I was going through but a little
820060	822240	more blown up before.
822420	823980	If we look at this, what we're doing is this
823980	826020	goes and says, hey, do you want to turn on stack protection
826020	828020	in the kernel? Here's the reason
828020	830140	you want to do this. It turns out you can break tons
830140	832080	of buffer overflow exploits. You can
832080	834120	break lots of buffer overflows.
834200	836180	One of the major kinds of exploits out there
836180	838120	if you just turn on the stack protection. Here's
838120	840280	when you don't want to. GDB is a
840280	842360	mode that it doesn't work with if you turn on stack
842360	844540	protection. What else? Well, not much else.
844540	846080	Okay, so we can tell you
846900	848240	here's what we'd like to do and find out if
848240	851420	you want to do it. Why else do you do assessment?
851760	852880	Triage, right?
852880	854820	You basically take each of your systems. You're like
854820	856280	I'd like to harden my systems. I don't
856280	858180	know where to start. I can start at my workstation.
858180	860160	Yeah, that's good. Right, but I don't know where to start.
860160	862160	I can go with the most vital servers. How about which one's
862160	864220	worse? How about pick the one
864220	866580	that's least hardened? Pick the one that's in
866580	868200	worst need. So you can basically
868200	870200	go and take best deal and generate that
870200	872040	score or look at that config file and look at what
872040	874180	things matter. If you know what things matter
874180	876180	you can set weights according to these
876180	878240	are the things that matter and then score your systems.
878720	879960	Right, the score thing lets you start
879960	882020	the user configurable score
882020	884240	thing lets you start saying, okay, these
884240	886020	systems are worse. I'm going to take care of them
886020	888220	first. Or these systems are worse. I'm going to maybe
888220	890520	do a little bit of incident response because they're so bad, right?
890520	892360	Does that make sense? Or maybe I'll
892360	894240	start with, you know, running my
894240	896500	NMAP scans, running my Nessus scans. I'll look for vulnerabilities
896500	898380	in the system. I'll look for backdoors on the system
898380	899900	is really what I care about here.
900140	902440	Okay, what else? Another reason
902440	903660	to do assessment is that auditing
904780	906540	happens. You will be audited.
906540	908260	We all get audited at some point. Maybe you
908260	910240	don't, but a lot of us do. A lot of
910240	912380	my clients do, right? So the idea
912380	913920	is, okay, you know you're
913920	916280	going to get audited. It'd be nice to find out what's
916280	918100	going to show up. What's going to happen to be able to work on it
918100	920200	proactively? And so the idea
920200	922140	here is to give you a tool that's equivalent to your
922140	924240	auditor's tools. And you can use a waits
924240	926180	file again that's basically
926180	927920	defined the same way your auditor's is.
928340	929880	And that's our hope. If anybody
929880	932140	is with any of the major auditing organizations,
932140	934440	I've worked with CIS. If you're with ISACA,
934440	935760	if you're with one of the other organizations
935760	938160	and you want to contribute something, I would love it if you
938160	940080	would help contribute work on waits files.
940100	942100	Just help us tell, okay,
942100	944140	what are auditors looking for? But I mean, we've
944140	946440	got a framework now where we can do that.
946900	948140	What else? Bestial
948140	949980	could be helpful here with compliance.
951060	951640	If you've
952000	954060	just gotten hit over the head in the last year with new
954060	956300	legislation that says, okay, we've got to care about security
956300	957860	now, or
957860	959940	we're going to get measured on it. We always
959940	962160	cared about it. Well, maybe Bestial will help you
962160	965320	in figuring out how well you are in compliance.
965320	966100	The weird thing is that some
966100	967820	of these compliances are actually really
968180	969940	fuzzy. They say that you've got to do
969940	972100	due diligence, that you've got to do a pretty good job.
972100	974220	Well, what's that mean? Well, if we've
974220	976280	got an idea, if we've got an idea how systems
976280	978180	scored, and we can show, okay, well
978180	980220	we went from here to here, or we can say
980220	982080	listen, most of our industry does
982080	984200	this. They score at this on this waits
984200	986220	file. Well, then you start being able to say that you're
986220	988180	basically keeping up with your peers, which
988180	990140	is what due diligence means. It doesn't mean that
990140	992240	you did everything possible. It just basically
992240	994100	means you did what most everybody else who's
994100	996180	doing a good job is doing. That's kind
996180	998620	of fuzzy, but we'll try to help you with that anyway.
998860	1000140	What else? You could
1000140	1001780	go and say, this is another thing that comes up
1001780	1004480	in universities, network protection. It's saying, listen,
1004480	1006160	I'd like to make sure that before
1006340	1008080	a system's put on my network, before
1008200	1010080	a Unix system's put on my network, I want to make sure that it's
1010080	1012280	well patched, and I want to make sure that it's well hardened.
1012280	1014080	And if it's well hardened to basically these
1014080	1016300	standards, then I'll let it on the network.
1016500	1018300	And if it's not, well, I'm sorry, you know,
1018300	1020020	just come back in a day when you're done.
1020060	1022120	Or actually, since hardening's pretty fast, as you guys
1022120	1023760	saw, you know, come back in five minutes.
1024900	1026040	Does that make sense?
1026280	1027940	Is this kind of interesting to you guys?
1028740	1030700	Useful? Okay, cool.
1031560	1032380	The other thing is,
1032380	1034040	scoring has this awesome psychological
1034040	1035660	power. Okay, I worked on
1036200	1038040	another tool like this,
1038040	1039860	and I remember when we were developing it, it was the
1039860	1042040	CIS Unix scoring tool. And when we
1042040	1044220	were developing it, they said, we're going to give you a score.
1044300	1046000	You know, you want to compute a score, and I'm like,
1046140	1048280	a score? One number?
1048460	1050200	I mean, I studied mathematics, okay?
1050200	1051960	You know, like, I did physics too. We don't
1051960	1053980	have one number. I was like, oh god,
1053980	1056520	at worst, like, make it a ten element vector, and then like,
1056520	1058520	you know, compute some kind of a mean of that,
1058520	1060520	or whatever, you know, compute a metric based on, like,
1060520	1062280	weights of that. And someone's like, no, no, no, no,
1062280	1064560	one number. And I'm like, one number. Okay,
1064560	1066560	fine, management folks will like one number.
1066560	1068360	That was my first thought. It turns out, geeks
1068360	1070520	like one number too. One number is really
1070520	1072200	kind of useful, okay?
1072620	1074440	The score thing is really nice because people
1074440	1076360	are naturally competitive, and geeks
1076360	1078340	are naturally competitive, and hackers are
1078340	1080380	really naturally competitive, right?
1080400	1082460	So, so the idea is
1082460	1084420	that first, people get around to hardening
1084420	1086400	sooner. People are like, you know, I'm meaning to
1086400	1088220	harden that system. I'll get around to it later on.
1088220	1090380	All of a sudden, when they're like confronted with, you know,
1090560	1092360	a score that says mediocre, they're like, wait,
1092360	1094440	I'm not mediocre. I kick ass.
1094640	1096960	You know? That's not the way this should be.
1096960	1098340	I shouldn't have a score of four.
1098340	1100420	I'm not getting around to that later. I'm doing it right freaking
1100420	1102040	now. Okay?
1102560	1104320	So, I'll give you an example.
1104520	1106260	We had a, we had a security instructor
1106260	1108040	who was a SANS instructor. He, you know,
1108040	1110260	was an instructor teaching lots of people things.
1110260	1112820	He thought a lot of himself, of course, as we all do.
1112820	1114840	Right? And he said,
1115640	1116980	okay, I'll,
1116980	1118940	you know, I'll beta test your software. So he was beta testing
1118940	1120820	and he ran this thing on his workstation.
1120820	1123340	And his workstation came up at about a six out of ten.
1123560	1124700	And he got
1124700	1126820	peeved. He's like, what are you saying?
1126820	1128960	This is the mediocre issue. He said, I'm not
1129100	1130920	a six out of ten. Screw that.
1130920	1132920	And he sat down. He didn't even talk to us. He just sat down
1132920	1134820	and started hardening his system. And ten
1134820	1137000	minutes later, he ran the tool again and they gave him an eight.
1137000	1139000	And he's like, ah, that's more like it.
1139000	1140820	I'm not a six. A six is like, you know,
1140820	1142860	60%. That's like a D. No, no.
1142860	1144800	I'm much better than that. It's nice.
1144800	1146760	Play against people's ego. He didn't see
1146760	1149060	himself as a six out of ten kind of guy.
1149300	1150820	Fine by me. Whatever gets him to take
1150820	1152860	proactive security measures is good.
1153260	1153660	Okay.
1154480	1156800	This has happened lots of times. When we were developing
1156800	1159280	this previous scoring tool, we talked to a bank.
1159280	1160720	And the bank had set up a scoring tool
1160720	1162840	they'd created. Their security folks had,
1162840	1164760	you know, like many security folks in organizations
1164760	1166760	had no power whatsoever.
1166760	1168880	We couldn't, you know, it wasn't like, hand of God.
1168880	1170680	You know, you will harden.
1170720	1172880	It's not like that. They were like, uh, we'd like
1172880	1174680	to help. How can we help?
1174680	1176960	And that's what a lot of security folks in organizations
1176960	1178720	are like. So they went to their sysadmins.
1178720	1180860	They said, here's this tool. Why don't you try and run it
1180860	1182900	once? Okay. And so they ran it once.
1182900	1184720	They didn't have any mandated high score. They didn't have any
1184720	1186980	mandated anything. The only thing was, can you try
1186980	1189140	this tool once? Let us know how it goes.
1189200	1190900	And so they did start using it. And different
1190900	1193300	groups of sysadmins had different reactions.
1193300	1194700	They're basically all positive.
1194820	1197020	But there were some sysadmins who started voluntarily
1197020	1199240	posting their scores up on a cork board.
1199240	1200800	Like, outside their cube.
1200940	1203220	Okay, I know, that sounds really, really nerdy.
1203220	1205440	But, you know, okay, we're all really
1205440	1207400	nerds here, right? We're just pretending to be cool.
1207940	1208920	Okay, maybe you all are cool.
1208920	1209740	I'm just not.
1211140	1213340	Right, but the idea is, like, okay,
1213340	1215080	it'd be really great if we got people competing.
1215080	1217160	And they do. Okay, the start
1217160	1219080	Linux system scores around a 5.
1219200	1221160	This doesn't work on Solaris yet, but I wouldn't
1221160	1223040	be surprised if, like, a Solaris 8 system
1223040	1224940	scored around a 3. Right?
1224940	1227720	Solaris has got freaking everything on by default.
1227940	1229000	We will get around to
1229000	1230500	porting Bastille to Solaris.
1230500	1232900	It's just a whole lot of work.
1234040	1235140	Anybody wants to help,
1235140	1236560	we've got two people who are working on it already
1236560	1237940	and would love the help.
1239080	1241020	But there's, but the nice, so that's
1241020	1243180	why you do, that's why you do assessments.
1243180	1245080	It's why you do audit. These are the useful
1245080	1246880	things about pushing an auditing tool
1246880	1248880	in your organization or pushing whatever.
1249100	1250800	So, so why do you, why do you like
1250800	1252880	the two together? Why did I, you know,
1252880	1254500	why did we add auditing to Bastille
1254500	1257060	instead of just creating a new auditing tool? Right?
1257060	1258120	That would be kind of cool.
1258360	1260700	Well, the idea is that when you are hardening
1260880	1262960	a system, when you are hardening
1263140	1264840	a system, it creates a policy file.
1264840	1266980	When you go through this interactive yes, no, yes, no,
1266980	1268760	yes, no, yes, no, you get a policy file
1268760	1270680	whether you like it or not. It just gets saved.
1270680	1272960	It gets saved in this given place and you can take that policy file
1272960	1274240	and you can do something with it.
1274280	1276880	Well, one of the things you can do with it is you can feed it
1276880	1278820	back in, you can feed it back in
1278820	1280840	and see how well you are doing against that policy
1280840	1282820	file. You can say, okay, it's been
1282820	1284840	three months. I've been patching.
1284840	1286940	I have just, you know, ordinary system rot.
1286940	1289380	I'd like to know how far off I am.
1289940	1290900	The other thing in terms
1290900	1292740	of that policy file is if you, since we created
1292880	1294940	a policy file by default every time you harden,
1294940	1296780	you harden, we create a policy file. You can take that
1296780	1298920	policy file and say, this is my policy file for all
1298920	1300840	my web servers. And now you don't have to
1300840	1302600	run through the whole Bastille thing again, right?
1302600	1304940	It's just, it's got a back end where you just feed it a policy
1304940	1307000	file, it sucks it in, hardens the system
1307000	1308960	and, you know, two minutes later you're ready.
1308960	1311220	Right? You can take that policy file and reuse
1311220	1313020	it. And there's a lot of, there's a lot
1313020	1315140	of reuse. I was just
1315140	1317120	talking about skew detection. If you take that policy
1317120	1319260	file and you've said, this is my web server template.
1319480	1321420	Suppose you've got a web server that's older.
1321700	1323100	Maybe you can't harden it. Maybe the boss
1323100	1325220	has said, listen, we don't want anyone making any substantial
1325220	1327100	changes to this system. You can make changes
1327100	1329360	one at a time by hand. Fine.
1329360	1331320	You say, all our other web servers are here.
1331400	1333020	I've got a policy file that says how they
1333020	1335420	were hardened. Let's see how this one stacks up.
1335480	1338040	So I take this one and I
1338040	1340120	run the auditing tool on it and it says, okay,
1340120	1342100	these are the four things that you normally do
1342100	1343880	to all your other web servers that you haven't done to this one
1343880	1346120	because it's older. Is that cool? Does that make
1346120	1348000	sense? So it's called skew detection
1348000	1349680	and it's a decent thing.
1350520	1351720	There are some politics
1352180	1354040	to this. There's a reason.
1354040	1355980	I keep talking about psychological powers.
1356440	1358060	Psychology is a really weird thing to be
1358060	1360000	talking about with regard to hardening.
1360000	1361820	Not necessarily with regard to DEF CON, right? You're all
1361820	1364280	psyching each other out all the time. There's psychological games.
1364620	1366200	Eh. This is the weird
1366200	1368460	thing. Psychological games in the workplace.
1368680	1370180	Right? We're all used to it if we're in the
1370180	1372140	workplace. Politics.
1372500	1374280	There are lots of times
1374280	1376380	where you can't harden a system by hand
1376380	1378040	or with a tool because someone says,
1378040	1380220	oh no, I think that might break things. Or
1380220	1382340	you can't touch that. That's my system.
1382340	1384220	No changes. Right? The nice
1384220	1386340	thing about this is that you can say
1387420	1388360	we've taken, we've
1388360	1390340	got all of our web servers. We've got four web servers that I built.
1390340	1392320	We've got the one that, you know, that Mad Max is still
1392320	1394180	maintaining. And Mad Max says anyone who
1394180	1396520	touches his system gets his fingers chopped off.
1396780	1398120	Okay? Well, you know,
1398120	1400040	listen, Mad Max's boss, my boss,
1400040	1402180	can you just ask Mad Max if he'd run this tool for you
1402180	1404240	once? Like, just run it. Just auditing.
1404240	1406140	Read only. Won't modify a system in any
1406140	1408120	way. And if you survive the encounter of
1408120	1410040	requesting that he run it, what do we
1410040	1412000	find out? Well, we find out Mad Max's system
1412000	1414080	scores far worse than the rest of the
1414080	1415900	systems that do the exact same thing.
1416140	1418160	Oh, great. Now we've got another way to get, we've got
1418160	1420140	another way to get the worst systems hardened.
1420600	1422360	Why do I care about hardening so much?
1422360	1424420	I care about hardening so much because while it's
1424420	1426300	kind of, you know, one of the least exciting
1426300	1428220	areas of computer security, right next to like
1428220	1429620	policy and logging,
1430320	1432220	you know, it's still, it's extremely
1432220	1434720	effective. You don't get boxes rooted.
1434780	1436400	It's really nice to not get boxes
1436400	1438320	rooted. It's not a lot of work either
1438320	1439920	if you're using a tool for it.
1440460	1442440	So anyway, you can read, you
1442440	1444420	can run Bastille and basically other
1444420	1446340	auditing tools, read only, and the idea
1446340	1448280	is okay, we'll learn something about the system without having
1448280	1449360	to modify it.
1450280	1451460	This really helps when you
1451460	1453040	have a shop that does manual hardening.
1453080	1455140	People say, okay, we only modify things by hand.
1455140	1457280	We don't trust any tool whatsoever. We don't trust any tool
1457280	1459180	that doesn't come with a million dollar warranty
1459180	1461400	from the vendor and an OILA that says
1461400	1463320	you know, we'll of course take care of any losses
1463320	1465180	you incur from bugs in our product.
1465440	1467460	If you can only do manual hardening,
1467460	1469140	fine, we'll tell you what to do.
1469460	1471740	Read only means you don't have to stop doing manual hardening.
1471820	1473380	It just means we'll help you out and tell you
1473380	1475440	what you should do. Toward that end
1475440	1477480	we're working to create Bastillex.
1477480	1479360	I don't know, we're going to have to call it something else.
1479360	1481420	But basically, Nopix plus Bastille.
1481420	1482480	So you've got a system
1484580	1485580	you've got a system
1485580	1487520	and we will, you've got a system
1487520	1489620	we'll basically just let you. You shut it
1489620	1491920	down, you bring it back up, booting Bastillex
1491920	1493500	or whatever we call it.
1493840	1495940	And it starts up
1495940	1497640	it says okay, I'm not
1497640	1499320	going to mount the drives read write.
1499400	1501680	Mount them read only. Run Bastille.
1501680	1504020	Here's your score. Here's your score report.
1504020	1505480	No changes ever made to the system.
1505480	1507380	You can do this to Mad Max's system
1507380	1509560	while he's on his lunch break or taking a sick day.
1509720	1511240	Right? As long as you have
1511240	1513420	someone's permission or something.
1514020	1514620	Okay.
1515240	1516620	So I've been talking about
1517480	1519060	trying to convince people to harden.
1519060	1521200	I've been talking about the psychology. I've been talking about
1521200	1523660	how it is you do it. You can use this tool to do it.
1523660	1525740	You can use this tool to find out how well you've hardened.
1525760	1527600	But the big question always comes up.
1527600	1529660	Why the heck do I harden in the first place?
1529800	1531360	Okay? Basically
1531360	1533440	if I haven't made it very clear
1533440	1535500	what hardening is already. I'm about to.
1535500	1537520	Hardening is just the process of trying to make a system
1537520	1538840	harder to break into.
1538900	1541080	And the idea is that you take any settings you can tweak
1541080	1542760	and you tweak them. You turn things off
1542760	1545280	and you configure stuff that you left on better.
1545540	1547200	Okay? So the biggest, the first
1547200	1549320	objection we always get to hardening
1549320	1551180	hopefully not at Defcon
1551720	1552860	is that people say
1552860	1554960	my box isn't interesting enough.
1554960	1556820	We're just a little K-12 school.
1556820	1559180	Why is anyone going to attack us?
1559180	1561760	We're just a paint thinner company.
1561760	1563840	Why is anyone actually going to attack our computers?
1563840	1565700	They're not interesting. You're not going to get any money out of
1565700	1567680	attacking our computers. Worst case you might have some
1567680	1569260	extra paint thinner shipped to you.
1569340	1570960	What hacker wants that?
1571400	1573800	Can you do anything with paint thinner that I don't know about?
1574080	1575660	Okay. I don't know.
1575660	1577720	Anyway. But everyone says I'm not
1577720	1579480	interesting enough. I won't be targeted.
1579940	1581560	Does anybody at Defcon still
1581560	1583720	think this? Okay. Don't raise
1583720	1584940	your hand. But
1585500	1587840	if you think this and you put your laptop
1587840	1589020	on the wireless network
1589700	1590120	well
1590900	1592860	try running an IDS for a few minutes
1592860	1594440	or a packet capture
1595460	1596960	program. You see some very interesting
1596960	1599020	attacks coming your way. I wonder how
1599020	1601020	many port scans everyone on the Defcon network sees
1601020	1602520	per, I don't know, minute.
1604160	1605000	Anyway.
1605240	1606900	Low value targets aren't.
1607200	1609340	Okay. Most targets aren't low value.
1609340	1610860	This is something we should all understand.
1610860	1613060	Your box is useful as the next hop on the way to the target
1613060	1614940	just to make it a little bit tougher to track
1614940	1617020	the attacker back. Your box is good as
1617160	1619100	a peer-to-peer host. Your box is good
1619100	1620960	as a wireless distribution site. Heck
1620960	1622840	you could be low bandwidth. Your box would be useful
1622840	1624980	as an IRC bot. Right? I mean
1624980	1627520	your box will be useful to someone.
1628020	1629040	The thing is that
1629040	1631080	your box isn't usually targeted in any way.
1631080	1633760	Right? Most of our attacks don't come from
1633760	1635200	being targeted.
1635240	1636800	And when they do, half the time,
1636800	1638920	probably at least half the time, we don't know that we've
1638920	1641000	even been compromised because people are that good.
1641180	1643060	Right? But most of the attacks that we see
1643060	1645180	are the script kitties coming after us.
1645180	1647220	Most of the attacks that we see aren't
1647220	1649680	targets of choice. They're targets of opportunity.
1650060	1650720	Okay? There's some...
1650720	1652860	Your attacker had an exploit against say
1652860	1655140	one particular version of PHP.
1655340	1657380	So they go and they scan a large swath of the internet.
1657380	1659780	They go and scan the entire Comcast at home network.
1659780	1661200	And they find your box along
1661200	1662880	with a hundred others.
1663060	1664500	And they take those hundred systems and they
1665100	1667000	take those hundred systems and they pwn them and
1667440	1669000	these boxes now belong to them.
1669000	1671480	But it's not because you were targeted.
1671480	1673080	It's because you had an IP on
1673080	1675560	Comcast that day and that was the guy
1675560	1677140	attacking that day. Right?
1677140	1679200	That was the network this guy was scanning.
1679280	1681060	Does that make sense? Okay.
1681060	1682800	I think that's kind of obvious at DEF CON.
1683360	1685280	Okay. So we do tons of
1685280	1687080	patching. Right? We do tons of patching.
1687080	1688760	We're constantly patching. I mean we're all...
1688760	1691020	I spent all of yesterday patching and all the day before
1691020	1693180	that and every single day patching. We all patch
1693180	1694900	and patch and patch and patch. Right?
1695080	1696540	Well, okay, not really. But
1696960	1699440	we do lots of patching. The problem is that if you patch
1699440	1701160	you still get compromised. You're like
1701160	1703260	wait, I patch every single day.
1703260	1705120	Why do I get compromised if I patch every
1705120	1707180	single day at midnight? Well you
1707180	1709780	still get patched because you've still got these windows of vulnerability.
1709840	1711360	A window of vulnerability is basically a time
1711360	1713140	during which somebody's got a working exploit
1713940	1714960	and the time
1714960	1716100	when your systems
1716920	1719160	are still vulnerable. It's the time when someone has
1719240	1721120	a working exploit and your system is vulnerable. That's your
1721120	1723000	window of vulnerability. It's broken apart into
1723000	1725080	three parts. Two of which you have no
1725080	1727000	control over. The first one is...
1727000	1729700	Can you guys still hear me or am I not micing well enough?
1730300	1732140	Sorry. The first one is
1732140	1734000	the first part of your window of vulnerability is where the
1734000	1735960	exploit exists but the vendor doesn't even
1735960	1738260	know about the issue. Call this Oday.
1738320	1740540	Right? You can do nothing about that.
1740680	1742020	If nobody knows
1742020	1744040	about the vulnerability except the people
1744040	1746120	with the exploit and they're hitting you, well
1746120	1748280	you're vulnerable whether you like it or not.
1748340	1749940	We can do something about that. Hardening actually
1749940	1751840	works on this. The next piece is
1751840	1753920	an exploit exists and the vendor isn't creating a patch.
1753920	1756340	They're not done creating a patch. It takes them a little while.
1756360	1757800	Say it takes them, you know, a week.
1757800	1759780	But really nowadays it's about a month.
1760220	1761820	Okay? And then the third is patch exists
1761820	1763960	and you haven't applied it yet. Most of us patch
1763960	1765620	kind of closer to monthly or
1765620	1768260	you know, weekly maybe. It would be nice if weekly.
1768400	1769840	Right? But some people only
1769840	1771960	patch quarterly and God, some people patch yearly
1771960	1773660	and some people never patch at all.
1774180	1775940	But the issue is that because you've got these first
1775940	1777840	two parts of that window, even if you patch
1777840	1779800	perfectly, you still end up with a vulnerable machine
1779800	1781920	now and then. You still end up with a vulnerable machine
1781920	1783820	and you're just kind of like rolling the dice, hoping that
1783820	1785800	today your machine isn't vulnerable and
1785800	1788520	attacked at the same time. Does that make sense?
1788720	1789900	So the idea is
1789900	1792140	we like hardening because this is reactive.
1792140	1793880	Reactive is going and patching. Reactive
1793880	1795860	is going and saying, oh God, we just got
1795860	1797880	attacked on this port or people are attacking on this
1797880	1799880	port. Maybe I should set my firewall to start blocking
1799880	1802300	to start blocking SQL server queries.
1802500	1804460	Right? That's kind of the reactive process.
1804480	1805940	The proactive process is
1805940	1807860	configuring that firewall ahead of time and saying
1807860	1810060	wait, there's no reason for anyone to do SQL queries
1810060	1811840	from outside my network into
1811840	1813880	my network. Or better yet, I don't
1813880	1815720	allow you, these are the protocols I allow in and
1815720	1817600	I don't allow the rest in so if SQL ends up
1817600	1820140	being the worm tomorrow,
1820140	1821440	not so much the worries.
1822340	1824060	The other thing we do is we harden a host
1824060	1825900	because if we harden a host, maybe it won't be
1825900	1826640	vulnerable.
1827920	1829760	Hardening is just the process of configuring
1829920	1831880	a system for better security. It means you turn
1831880	1833880	off things you're not using. It means
1833880	1836280	you're better configuring the stuff you are using.
1836520	1837960	It doesn't involve the kernel level
1837960	1839900	modification of the system like SELinux
1839900	1841760	or Pitbull or trusted BSD, Solaris
1841760	1843920	or whatever, what have you.
1843960	1845700	It does involve going and looking at
1845700	1847720	permissions, access controls, and
1847720	1849720	looking at whether the permissions are appropriate or too
1849720	1851740	lax. You remember a couple
1851740	1854040	releases ago, Apple, my trusty
1854040	1855700	Apple, right, had a wonderful vulnerability
1855700	1857840	to let any user on the system backdoor
1858340	1859600	a bunch of third party applications
1859600	1861520	because the permissions were world-writable.
1861900	1863880	Anybody remember that? That was a really good one. Dave G
1863880	1865640	found that, it was awesome.
1866120	1867940	It was awesome in multi-user systems.
1867940	1869800	I'm sure some people at universities had a really great
1869800	1871480	time with the Apple XServes.
1872320	1873440	What else?
1873440	1875780	The other side of it is it involves basically
1875780	1878000	tweaking settings in the system
1878000	1879620	and in the applications to give users
1879620	1881900	what access they need and not really anymore
1881900	1883820	of it. It comes down
1883820	1886600	to two principles. One is least privilege, the other is minimalism.
1886600	1888040	Least privilege says basically
1888040	1889680	each application or OS component
1889680	1891020	or user or whatever
1892120	1893740	only grants whatever privilege
1893740	1896260	the other users need, that the users need to give it.
1896260	1897700	The users only get what privilege we
1897700	1899440	want to give them. Minimalism says
1899440	1901920	we configure the system for fewer features.
1901920	1903540	We say these are the features we're using.
1903540	1905740	Let's better tune the system. You'll get some nice speed
1905740	1907420	out of this, right? Because you won't be running
1907420	1909820	50 applications, you'll be running 5.
1909880	1912200	Just the 5 that we're supposed to be running here.
1913600	1914400	In essence
1916780	1917180	ok
1917600	1919500	this is, now there's one thing people ask
1919500	1921880	well what about SELinux, what about the kernel level stuff?
1921880	1923880	Kernel level stuff is basically
1923880	1925560	complementary to hardening. You can
1925560	1927200	basically do both. Fedora
1927200	1929800	my Fedora core 4 system has SELinux turned on
1929800	1931900	and I'm hardening it with Bastille.
1932400	1932540	Ok
1933600	1935640	The thing with kernel level is that sometimes
1935640	1937480	is that kernel level can be really awesome
1937480	1939980	because it can contain a lot you can't do with hardening.
1939980	1941680	On the other hand, hardening can do some things that kernel
1941680	1943440	level can't do. One is that
1943440	1945860	one is that kernel level very often contains
1945860	1947740	the attacker after they've taken
1947740	1949400	down, after they've compromised bind. You know
1949400	1951620	they compromise bind, bind falls down, they don't
1951620	1954220	get their powerful root shell because they're SELinuxed.
1954220	1956260	On the other hand, if we can
1956260	1958260	configure the thing, the thing that was being
1958260	1959760	attacked so the exploit doesn't work
1959760	1962020	or the code the exploit was trying to hit
1962020	1964220	isn't available at all, maybe it's turned off, maybe
1964220	1966320	it's removed, well then we don't get compromised
1966320	1968680	at all, the bind server never goes down.
1968760	1970780	The best example I can give you is Apache.
1970860	1972520	Most of Apache's real functionality
1972520	1974140	comes in these Apache modules that you can
1974140	1976580	turn off at start time. It's not a
1976580	1978760	recompile, it's just like comment something out, it doesn't
1978760	1980620	load. You have code that doesn't load because
1980620	1982200	you configured it not to. Apache is a great
1982200	1984080	example too because it comes with, Red Hat
1984080	1986420	ships it with say 34 different Apache
1986420	1988560	modules, of which you might need
1988960	1990340	five, depending on what kind of site
1990340	1992040	you're running. So if you can turn off the ones
1992040	1994240	you're not using and a vulnerability comes out
1994240	1996200	and one of the ones that was on
1996200	1998180	before, congratulations, you don't get nailed
1998180	2000200	by it. Is that cool?
2000200	2001200	Does that make sense?
2003540	2004480	The other side of
2004480	2006700	kernel level hardening is that it's hard.
2007220	2008340	Kernel level, I mean kernel level
2009040	2010180	technologies are hard.
2010180	2011920	Writing the profiles, saying this program
2011920	2014020	needs to write to this, needs to read to this,
2014020	2015760	it needs to be able to do this capability
2015760	2018040	but not this capability, that takes
2018340	2019940	a lot of, that takes understanding, it takes
2020040	2021860	a whole bunch of training to learn how to do that.
2021980	2023700	Red Hat's made that possible with SE Linux
2023700	2025780	because they've said, okay, we'll write a really good profile
2025780	2028480	for the users and not require them to do it.
2028500	2029700	On the other hand, the profiles are a little
2029700	2031820	looser than you'd want them to be because Red Hat
2031820	2033440	has to make sure that whatever you're going to do with that
2033440	2035220	web server, it still works.
2035740	2037860	Does that make sense? Okay, cool.
2038820	2040620	You can learn to make your own profiles,
2040620	2041980	it just takes some real training.
2042320	2043960	There's a book on SE Linux.
2046280	2047900	Anyway, you should continue looking
2047900	2049480	at kernel level solutions. They're nice.
2049480	2051080	I really like GR security.
2051260	2053120	I like SE Linux. These are good.
2053680	2055540	They're complimentary. You can still harden
2055540	2057040	and probably still should.
2057560	2059580	It's not a difficult thing to do.
2059760	2061620	It's a little bit, it can be a little tedious
2061620	2063280	if you're doing it all by hand, but well,
2063280	2064780	we've got a tool for that.
2066480	2068160	It's not hard to do. CIS,
2068160	2069860	the Center for Internet Security, writes guides
2069860	2071980	and the guides are designed
2071980	2074040	to be used by junior level
2074040	2075020	sysadmins.
2075320	2077820	You might not even know entirely
2077820	2080200	how to work their favorite editor just yet.
2081400	2082640	This stuff can still be done.
2082640	2085540	Black Hat has a two day course, I teach it,
2085540	2086940	and that two day course does
2086940	2088920	Solaris and Linux and it's comprehensive.
2089200	2091260	There are five day courses at other organizations,
2091260	2093000	but the fact that you can learn it that quickly
2093000	2094260	says something.
2094260	2096280	I mean, I can teach you one operating system
2096280	2098060	how to manually harden in a day.
2098180	2099880	We do two in two days.
2099880	2101000	This is not hard stuff.
2101000	2101940	This isn't rocket science.
2101940	2104100	This isn't anywhere near rocket science.
2105220	2107280	Anyway, it's pretty easy to do.
2107280	2108820	It's also really effective.
2108900	2110440	And I'll tell you about two examples.
2110540	2112600	The first is the CIS guide.
2113300	2115420	NSA's IAD, the information assurance guys
2115420	2117260	that are around to stop machines
2117260	2118800	from being broken into,
2118800	2120560	they basically took a benchmark
2120560	2122320	and ran it against a Windows system.
2122320	2124520	And when they were done, 90% of the vulnerabilities
2124520	2126980	that were in that Windows system were mitigated.
2126980	2128280	You couldn't hit them.
2128440	2130360	You either couldn't use them
2130360	2132280	or you couldn't get anywhere by using them.
2133100	2134540	You can do the same thing with Linux.
2134540	2137140	If you basically do all the hardening guides,
2137140	2138900	you don't have an extremely useful system.
2138900	2141640	But 90-95% of your vulnerabilities are gone.
2143400	2144540	Bastion Linux is just a way
2144540	2145900	to do this programmatically.
2146380	2147820	When we created it, we created it
2147820	2150440	right when Red Hat 6.0 came out.
2150440	2152560	We just did a normal audit of a Red Hat 6.0 system.
2152560	2153780	Very, very standard.
2153780	2154660	Just looked at it and said,
2154660	2156840	what would you do if you're doing best practice hardening?
2157180	2158900	We wrote a program to do it.
2159040	2160560	It basically stopped or contained
2160560	2162780	every major vulnerability that was in the system,
2162780	2163620	which was really nice.
2163620	2165220	Bind had a remote root hole.
2166500	2168240	WooFTPD had a remote root hole.
2168340	2170400	LPD plus SendMail, the combination of those two,
2170400	2171780	got you another remote root.
2171780	2173680	DumpRestore, local privilege escalation.
2173780	2175360	GPM was a console-level
2176720	2177780	privilege escalation.
2177780	2179540	All of those things were stopped by Bastille.
2179540	2182480	That's not because Bastille is just amazingly wonderful.
2182560	2183860	I'd like to think it is, but
2183860	2186220	that's because if you do this standard, normal stuff
2186220	2187560	that we've got in books,
2187560	2190060	that we've got on documentation, we've got on websites or whatever,
2190060	2191580	this is what happens.
2191700	2193520	There were only two we didn't nail,
2193520	2195800	and they were just little commands that if root ran them
2195800	2198060	and somebody had created, and somebody had been able to
2198060	2200200	like, say, create a hostile man page,
2200200	2202200	well, that's not anything we can really do anything about.
2202200	2204300	That's one of those things that hardening won't get ya.
2204520	2205620	But that's okay.
2205700	2206880	So Bastille can kind of lock down.
2206880	2209420	This is our complete list of what Bastille locks down right now.
2209440	2211620	It does Red Hat, all the old ones,
2211620	2213100	and Enterprise, and FedoraCore,
2213100	2215400	and I'll release FedoraCore 4 tomorrow.
2216000	2217700	Support's only in CVS for that.
2217960	2220060	HPUX, Mandrake, or Mandrever, whatever you call it,
2220060	2222060	Debian, Sousa, Gen 2, Mac OSX,
2222060	2223240	Solaris soon.
2223920	2224900	Need help.
2225600	2227380	Again, one of the differences with Bastille
2227380	2228860	was that it educated the SysAdmin.
2229220	2231040	Educating the SysAdmin is really good if you, say,
2231040	2234320	want the SysAdmin to not end up on the wall of sheep.
2234820	2236700	If you want the SysAdmin to stop using Telnet,
2236700	2238300	you have to tell them Telnet's bad.
2238340	2239080	Because otherwise they'll say,
2239080	2240860	I've been using Telnet for 10 years.
2240940	2241880	What's wrong with Telnet?
2241880	2243560	And you say, well, I can take it over.
2243560	2245340	I can sniff it. I can sniff it or take it over.
2245340	2247140	And when you've got switches, don't use it.
2247140	2248320	Use SSH instead.
2248320	2251000	And your SysAdmin says, okay, I'll let you turn off Telnet.
2251100	2252780	Does that make sense? Yeah.
2252780	2255540	Okay, so people have found it very educational.
2255540	2256840	There are organizations that use Bastille
2256840	2258240	entirely for the educational component
2258240	2259820	and don't actually have it hard in the system
2259820	2261300	because they want to do it manually.
2261400	2264080	Hopefully the assessment mode makes things easier for that.
2265000	2266840	Okay, it's really easy to automate.
2266840	2269120	You create a config, two commands.
2269120	2270980	You SCP a config over to another system
2270980	2272720	and run Bastille over an SSH pipe
2272720	2274480	and you can apply it to another system.
2274480	2276280	If you're using one of those mass SSHers
2276280	2279760	that lets you SSH to a thousand systems at once,
2279760	2282020	congratulations, this gets really scalable.
2282020	2283380	Okay, the whole thing is written
2283380	2285620	so that it's very easy to script around Bastille.
2285620	2286940	It's very easy to add on to it
2286940	2288260	without having to know any Perl.
2289140	2291200	The nice thing is, so why do you use Bastille
2291200	2292720	or why do you use an automated system?
2292720	2295360	Well, one of the reasons you do it is for consistency.
2295360	2296840	If you don't have a thousand systems, fine,
2296840	2299960	you like to do one the same way every time.
2300180	2302400	Maybe you create a standard build config file.
2302400	2305340	Maybe you make this part of your build process.
2305920	2307380	All you have to do is every time you,
2307380	2309600	basically you only have to update these config files
2309600	2310480	when you get a new distro
2310480	2312640	or when you get a new release of the distro.
2312940	2314740	HPUX makes this really easy.
2314740	2315580	There are four different ways.
2315580	2316860	Part of their install process,
2316860	2319160	they're shipping with Bastille with the operating system.
2320000	2322240	What I want to do is, let's see,
2322240	2324100	we're running a little low on time.
2324100	2326020	What I've got is a list of modules
2326020	2327760	and kind of what they do.
2328760	2330880	Would you guys rather see a list of modules
2330880	2332160	and what they do or would you rather
2332160	2334200	kind of see how you add on to this?
2334820	2337100	Add on, okay, works for me.
2338200	2340280	Skip, skip, skip.
2340280	2342420	Skip, skip.
2343620	2345620	Bastille's actually really easy to add on to.
2345620	2348260	We wrote it and then like so many open source projects,
2348260	2350320	six months later we rewrote it entirely.
2350640	2352120	And the rewrite is just to make it,
2352120	2353760	was just to make it easier to maintain.
2353760	2355860	And that happens on a lot of open source projects.
2355860	2357800	Probably happens on a lot of commercial software.
2357840	2358960	Because once you've written it once,
2358960	2360800	you understand how to make it a lot better.
2362360	2363640	So what we did is,
2363640	2365160	the whole thing's in Perl,
2365160	2366320	but if you don't know Perl,
2366320	2368500	we actually worked to make it really understandable.
2370640	2372640	So that you could work on this
2372640	2373720	even if you don't know Perl.
2373720	2374500	And I'll show you an example
2374500	2376300	of how you kind of add something
2376300	2378100	to turn off a set UID bit.
2379040	2380720	So if you wanted to add an item,
2380720	2381860	the first major thing you have to do
2381860	2383600	is create a question for that item.
2383620	2385600	Basically that text, the explanation,
2385600	2386480	here's why you should do this,
2386480	2387560	here's why you shouldn't,
2387560	2388660	what the question is,
2388660	2390600	what the default answer could be.
2390820	2391900	You could add modules,
2391900	2395460	and we've had people contribute modules before,
2395460	2396900	and it's pretty easy.
2397880	2399520	Here's just the question type stuff.
2399520	2400320	This first one is just
2400320	2402800	every item gets its own name.
2402800	2403820	There's a short explanation,
2403820	2404700	you can have a long explanation
2404700	2406440	so you can give the user more detail.
2406440	2408260	There's a little explain less, explain more.
2408280	2409700	So that lets them granularly decide,
2409700	2410820	I know a lot about this kind of stuff,
2410820	2411860	so tell me less.
2412540	2413540	There's a question,
2413540	2415500	there's what distributions it works on,
2415500	2417320	there's a default answer,
2417320	2419240	there's a regular expression, answers have to match,
2419240	2421440	if you don't know what that means, don't worry about it,
2421440	2422700	you can skip that part.
2422800	2424940	And there's some stuff that says what the next question is
2424940	2426100	and what the previous question is,
2426100	2428200	and you can actually skip that part if you want to.
2428760	2431500	If I wanted to create a new thing that turned off setUid
2431500	2432880	for dump and restore,
2432880	2434500	this is the dump and restore action.
2434860	2437140	I've got this if getGlobalConfig,
2437140	2438540	the module name, the question name,
2438540	2441160	you could copy paste that, equals yes.
2441160	2443280	If they answered yes to this question,
2443280	2445260	then I run b remove suid,
2445260	2447760	remove setUid, it's one line,
2447760	2449160	from dump.
2449160	2450940	And this is a path name, but you can also,
2450940	2453400	if that path differs from operating system to operating system,
2453400	2455140	you can put in one of our getGlobal things,
2455140	2456820	it says this is in a table somewhere.
2456820	2459140	But you could just put user sbin dump.
2459740	2461100	Does that make sense?
2462820	2465500	This is really easy, I'll show you the API.
2465740	2467500	The API is really simple.
2468040	2469460	You can go and, you know,
2469460	2472080	b chamod, chamod changes the permissions,
2472080	2473720	changes the ownership,
2473720	2476440	remove setUid, create symlink.
2476560	2478240	The reason we've end up, a lot of these things
2478240	2480200	are things that were present in Perl already,
2480200	2482600	we wrappered them so that you can undo the whole thing.
2482600	2483980	The idea behind Bastille is you can either
2483980	2486100	granularly undo it, or we've got a big red button
2486100	2488000	called revert. And that big red button
2488000	2489980	yanks the system all the way back to where it was
2489980	2491420	before you were running Bastille.
2491460	2493160	It's not something you want to run six months later,
2493160	2495540	because that part's hard. But if you just ran Bastille
2495540	2497360	and you're like, wait, I answered yes to everything
2497360	2499380	and I should have read revert,
2499380	2501100	you hit your big red button and you start over.
2501100	2503300	Or you hit your big red button and you throw away Bastille
2503300	2505480	and curse my name. Right? Doesn't matter.
2505480	2506620	Whatever you want to do.
2507400	2509060	So, these are other things.
2509060	2511260	b checkConfigOff turns things off in the
2511260	2512820	RC scripts and all that.
2512820	2514360	You can copy files.
2514820	2516180	These are kind of the fun ones.
2516180	2518900	b appendLine just sticks a line on the end of a file
2518900	2520480	if it's not already there.
2520480	2522400	This is all made so that if you run Bastille
2522400	2524980	you can run it 8,000 times again with the same config file
2524980	2526240	and not break the system.
2526240	2528080	Because Bastille will look for
2528080	2529920	the stuff that it's trying to add.
2530000	2530980	You can insert lines
2532260	2534100	before a given line in the file.
2534160	2536100	You can prepend a line at the beginning of the file.
2536100	2537760	You can replace a given line.
2538420	2540600	Basically this matches the way
2540600	2542200	the Unix config files are done.
2542360	2544620	b hashCommentLine. What could be easier?
2544620	2546320	You want to turn a line off?
2546320	2548360	You don't have to delete it. Just comment it out with hash.
2548780	2550120	Hash comment it out.
2550540	2551820	DeleteLine is another thing you can do.
2551820	2553040	And all of these work.
2553040	2555000	They all work on ProRegularExpressions.
2555000	2557800	If you don't know that, you can use exact matches.
2558080	2559980	But this is all really simple to do.
2560220	2561060	And that's the idea.
2562120	2563140	That's the API
2563140	2565880	for adding things, for adding new items.
2565880	2567740	It's really actually quite easy.
2567740	2568860	If you don't know Perl,
2568860	2570820	you still have a pretty good chance of being able to add an item.
2570820	2573140	Especially if you can copy and paste something similar.
2573320	2574740	I added something yesterday
2574740	2576620	to remove... I added something yesterday
2576620	2579120	in about five minutes to remove mDNSResponder.
2579120	2581020	That rendezvous zero conf
2581020	2583340	Bonjour thing that's on Apple.
2583340	2585340	It's also on Red Hat Fedora Core now.
2585340	2586660	It was really easy to turn it off.
2586660	2589520	I copied and pasted something that turned off GPM.
2589520	2591080	Because that used CheckConfig.
2591380	2592760	And to turn off mDNSResponder,
2592760	2594940	it's another CheckConfig. It's really, really quick.
2594940	2596260	Eight lines of Perl.
2596540	2598320	And these kind of lines.
2598320	2600080	Not the kind of lines you can't read.
2600260	2601380	Does that make sense?
2602580	2604720	Doing the same thing, you create an audit item.
2604720	2606500	You can create an audit item.
2606500	2608160	We want you to create an audit item for anything
2608160	2609660	that you create a hardening item for.
2609660	2611420	And all it is, is you have this thing.
2611420	2613020	Just like this global test.
2613140	2614340	The module name.
2614340	2617640	And then that name of the question.
2617960	2619380	Equals sub.
2619420	2620560	And you basically have a subroutine
2620560	2622860	that does whatever it was that should be tested.
2622860	2625460	And you return ask or skip.
2625700	2628280	Or you return one or zero.
2628460	2630720	This says if B is sued.
2630720	2632140	If ping is setUID.
2632140	2633740	Or ping six is setUID.
2633740	2636660	Then I say, okay, the test fails.
2636660	2638740	It's really kind of that easy.
2638960	2640540	And you can do the same thing with match lines.
2640620	2642560	Everything that we basically could do to something
2642920	2644940	now has a corresponding check.
2645220	2646280	B is service off.
2646280	2647980	We'll go and tell you if something is INETD based
2647980	2650520	or XINETD based or RC based is on or off.
2650520	2651840	Return match line.
2651840	2654060	Is there a line in this file that matches this pattern?
2654060	2656320	If I was hash commenting or deleting a line,
2656320	2658020	now I can check and see if it's present.
2658160	2660360	So now I have an easy, quick way to write a check
2660360	2662300	at the same time that I'm writing the fix.
2662540	2664500	That makes it a lot easier to develop the tool.
2664500	2666680	It also, it makes it easier to write things
2666680	2667380	for your environment.
2667380	2669580	And the whole idea is that all these things
2669580	2670880	should be pretty self-explanatory.
2670880	2672340	B is package installed.
2672340	2674340	Tells you if something is installed.
2674340	2675840	Is process running?
2676040	2677980	The idea is that it should sound like English.
2677980	2679600	The idea is that this should be really easy
2679600	2682520	for you to look at a few and then make your own.
2682600	2683540	And you can make your own.
2683540	2684560	You can use it in your environment.
2684560	2686160	People have written whole modules.
2686340	2688600	I've actually got a module author in the front row.
2688600	2690680	Mike Rasch, hello.
2691500	2693980	Anyway, he wrote the port scan attack detector
2693980	2696860	which is like port sentry except 8,000 times better.
2697800	2699040	It just is.
2699040	2699820	You can look into it.
2699820	2700640	You'll agree.
2701660	2704080	These tests are really easy to write.
2704840	2706580	I'm going to stop now because we're basically
2706580	2708060	about a minute before.
2708060	2709800	But I've got some things to give out.
2709800	2710640	I've got books.
2710640	2711820	I've got t-shirts.
2711880	2713460	The goons are desperate for me to get rid of them
2713460	2715180	because they don't want to take them all home.
2715180	2717600	Because they've already taken their own stash.
2717780	2719380	They've got the extra ones.
2719560	2720700	I'm going to be doing a book signing
2720700	2722700	of the Snort 2.1 book.
2723460	2726000	But this is another book that I worked on
2726000	2727400	called Stealing the Continent.
2727420	2728840	And here's the t-shirt.
2729660	2730880	It's got a picture of the book
2730880	2731720	but it says
2732740	2735100	call it fiction if it helps you sleep better.
2736000	2737840	Anyway, who wants a t-shirt?
2749590	2751290	Okay, I'll do that with the books now.
2751290	2756690	No, these are signed books.
2757090	2758070	I've got...
2758070	2759750	Somebody should ask questions.
2759910	2761370	Wow, that guy's getting one.
2764490	2766630	I've got a Snort 2.1 book
2766630	2768590	which is one of the ones I'll be signing.
2768590	2769510	I've got Mike Rash
2773850	2775970	and I've got the Venice Enterprise Cluster
2776590	2778450	for people who don't want the big ones.
2778510	2780530	Okay, you can have this one.
2780590	2782350	Now, I will take three questions
2782350	2785480	and then we'll move on.
2785620	2786260	Ask one.
2786260	2788180	Can you check for password complexity?
2788200	2789560	Can you check for what?
2790440	2792580	Can you check for password complexity?
2792720	2794360	We can import a password complexity
2794360	2795460	and we can check for it.
2795460	2798140	We turned that check off for now but we're turning it back on.
2798140	2800120	We ran into a bug with how it works on one distro
2800120	2802160	versus another. That's a good question.
2802580	2803740	Intrusion prevention?
2804140	2804820	Okay.
2807160	2808020	Another question.
2808020	2808760	Over there.
2811820	2813440	Oh, that's a good question.
2813440	2814600	Can we check for SSH?
2814600	2817820	Version 1 versus Version 2, better configuration than SSH?
2817820	2819600	Not yet, but if you want to write it
2819600	2821320	or I want to write it, we'll do it.
2821800	2822960	That's a bug.
2824240	2825560	That one.
2826480	2827540	Can you test
2828140	2828900	SELinux?
2831490	2832070	Wow.
2832070	2835130	Can we check SELinux if it's target or permissive mode?
2835490	2836370	No.
2837950	2839490	I'd love to talk about it.
2839490	2840810	If you are exiting the room,
2840810	2842230	please exit this way.
2842230	2842790	Thank you.