[00:12.730 --> 00:17.270]  Anyone who has a voice after Saturday night at DEF CON?
[00:17.270 --> 00:19.690]  It wasn't really Saturday night at DEF CON, right?
[00:20.710 --> 00:23.650]  Okay, so, anyway, we'll start now.
[00:23.650 --> 00:24.870]  My name is Jay Beal.
[00:25.210 --> 00:27.770]  I'm here to talk about Bastille Linux,
[00:27.770 --> 00:30.510]  and we've done a lot more with the tool now,
[00:30.510 --> 00:37.140]  and I want to...
[00:37.140 --> 00:38.540]  What's that, louder?
[00:39.920 --> 00:40.800]  Yeah.
[00:40.880 --> 00:42.020]  How's that?
[00:42.360 --> 00:43.300]  Pick up any better?
[00:43.300 --> 00:44.080]  No.
[00:44.600 --> 00:45.480]  Okay.
[00:46.120 --> 00:48.560]  Try and type while I do this.
[00:49.320 --> 00:50.760]  Move closer.
[00:52.580 --> 00:53.860]  Like this?
[00:54.320 --> 00:56.540]  I will eat the microphone.
[00:57.440 --> 00:59.320]  I stole that from Raven.
[00:59.520 --> 01:00.240]  Okay.
[01:01.560 --> 01:03.840]  So I'm here to talk about Bastille Linux.
[01:03.840 --> 01:04.820]  My name is Jay Beal,
[01:04.820 --> 01:07.160]  and we've done lots of new stuff,
[01:07.160 --> 01:09.940]  or one major new thing,
[01:09.940 --> 01:11.380]  and a lot of little things,
[01:11.380 --> 01:13.140]  and I'll show you what we're doing.
[01:15.660 --> 01:18.260]  By the way, if you've got the slide putter on the CD,
[01:18.260 --> 01:19.680]  these are slightly updated.
[01:19.680 --> 01:21.120]  They're only minor updates.
[01:21.460 --> 01:23.420]  The stuff on the CD is pretty comprehensive.
[01:23.420 --> 01:25.100]  These just look a little bit nicer.
[01:25.380 --> 01:26.900]  So you can grab them from here.
[01:27.880 --> 01:29.300]  I'll let you write down the URL.
[01:35.440 --> 01:37.400]  I will let you stop writing down the URL.
[01:38.320 --> 01:39.300]  Okay, so let me...
[01:39.300 --> 01:40.080]  I'm going to talk to you...
[01:40.080 --> 01:41.920]  I'm going to tell you about what Bastille did before
[01:42.800 --> 01:43.920]  and what it does now.
[01:43.920 --> 01:45.460]  We'll take a pretty in-depth look,
[01:45.460 --> 01:46.480]  and I'll even tell you a little bit about
[01:46.480 --> 01:47.860]  how you can extend it yourself,
[01:47.860 --> 01:50.000]  because, well, it's open source,
[01:50.000 --> 01:51.400]  and we could always use the help.
[01:51.820 --> 01:54.060]  And heck, if you want to do it yourself back home
[01:54.060 --> 01:56.760]  and not share, we'll be okay with that, too.
[01:57.880 --> 02:01.800]  So Bastille Linux is a hardening program for Linux.
[02:01.800 --> 02:03.880]  That's a whole bunch of distributions.
[02:03.880 --> 02:06.160]  That's Red Hat and Mandrake and Sousa and Debian
[02:06.160 --> 02:09.480]  and Ubuntu and Gen2 and TurboLinux,
[02:09.480 --> 02:12.720]  and there's probably one or two others, but I'm not sure.
[02:13.520 --> 02:15.260]  Not yet Slack.
[02:16.620 --> 02:17.960]  I'm so sorry.
[02:17.960 --> 02:20.460]  I know, I keep promising Slack one day.
[02:20.820 --> 02:23.640]  Okay, well, Slack once I get a Slack VM, right?
[02:24.200 --> 02:26.040]  But it also works in HP-UX,
[02:26.040 --> 02:28.000]  because Hewlett Packard put in some programmers,
[02:28.000 --> 02:30.140]  and they've been helping a whole lot,
[02:30.140 --> 02:32.800]  and it works in OSX, except not 10.4,
[02:32.800 --> 02:35.380]  because Cisco's VPN client didn't work on 10.4
[02:35.380 --> 02:37.540]  in my first install, so I had to blow that away.
[02:37.540 --> 02:38.300]  Thank you.
[02:39.040 --> 02:45.180]  But, yeah, so it works on plenty of Unixes,
[02:45.800 --> 02:48.500]  the biggest thing that differentiated Bastille
[02:48.500 --> 02:51.280]  from other hardening scripts before was that,
[02:51.280 --> 02:53.580]  well, first, that we shared it, right?
[02:53.580 --> 02:56.420]  And that, you know, instead of us all using our one-offs,
[02:56.420 --> 02:58.540]  but also that it educated the administrator
[02:58.540 --> 02:59.580]  about the process.
[02:59.580 --> 03:01.440]  It educated the administrator about hardening
[03:01.440 --> 03:02.940]  and about what they could harden.
[03:02.940 --> 03:05.600]  It tried to get people to stop using Telnet, for example.
[03:05.600 --> 03:06.520]  Tried to stop getting people,
[03:06.520 --> 03:08.800]  tried to stop getting, get people to stop
[03:08.800 --> 03:10.260]  using cleartext protocols.
[03:10.300 --> 03:12.200]  Who's seen The Wall of Sheep?
[03:12.920 --> 03:15.160]  I can't believe that wall's still scrolling.
[03:15.160 --> 03:17.040]  I just, I mean, how could you walk by there,
[03:17.040 --> 03:18.980]  see your picture there, and not start telling everybody,
[03:18.980 --> 03:21.040]  oh my God, you know, cleartext, bad.
[03:21.460 --> 03:22.060]  Okay.
[03:23.620 --> 03:26.600]  Anyway, the new news is that Bastille now does,
[03:26.600 --> 03:29.200]  now has a kind of audit or assessment function.
[03:29.200 --> 03:31.320]  And what it's doing is, it can actually tell you
[03:31.320 --> 03:33.600]  how well-hardened the box is so far.
[03:33.760 --> 03:35.340]  Okay, it can say, these are all,
[03:35.340 --> 03:37.120]  these are all the hardening steps I know about,
[03:37.120 --> 03:38.320]  these are the ones that you've done,
[03:38.320 --> 03:39.980]  these are the ones that you haven't done.
[03:40.340 --> 03:42.440]  And the idea of well-hardened,
[03:42.440 --> 03:44.300]  it can also compute a score,
[03:44.300 --> 03:47.720]  so you can say, this is how well-hardened this box is,
[03:47.720 --> 03:49.920]  and well-hardened is something that you can define personally,
[03:49.920 --> 03:52.000]  you can kind of take the Bastille team's advice,
[03:52.000 --> 03:54.420]  or you can get a, or you can get a definitions file
[03:54.420 --> 03:56.600]  that talks about how well-hardened the box should be
[03:56.600 --> 03:59.180]  from your organization, whatever that organization is,
[03:59.180 --> 04:02.000]  employer or auditing board or whatever.
[04:03.300 --> 04:05.500]  So, let me just show you how the,
[04:05.500 --> 04:07.600]  show you how the two of them interact,
[04:07.600 --> 04:10.020]  and, and hopefully I'll be able to keep this mic
[04:10.020 --> 04:12.160]  close enough to my throat, you guys can still hear me.
[04:12.160 --> 04:14.780]  But let me just demo and show you how it works,
[04:14.780 --> 04:17.000]  so I don't keep just talking about it.
[04:20.650 --> 04:23.330]  Attempting to keep mic, can you guys hear me in the back still?
[04:24.030 --> 04:25.090]  Oh, man.
[04:30.260 --> 04:32.480]  Choked on a microphone. What's that?
[04:38.620 --> 04:40.560]  How's that? Better?
[04:41.700 --> 04:42.780]  Tip it up.
[04:43.540 --> 04:45.140]  Slightly in front of me.
[04:46.820 --> 04:48.620]  Stand on one foot.
[04:50.480 --> 04:53.520]  Start typing. Okay, I can do that, that's easy.
[04:54.280 --> 04:56.340]  So, let's see.
[04:58.460 --> 05:02.880]  I'm SSH'd right now into a Fedora Core 4 system.
[05:03.080 --> 05:04.780]  So what I'm going to do is, Bastille,
[05:04.780 --> 05:06.220]  can you guys see the bottom of the screen?
[05:06.600 --> 05:08.040]  Oh yeah, these are great screens.
[05:08.040 --> 05:11.500]  Okay, so, I'm typing Bastille minus A for audit.
[05:12.520 --> 05:14.740]  And it's gone and it's just finished the audit.
[05:15.520 --> 05:17.000]  It's kind of a fast process.
[05:17.000 --> 05:19.660]  And this is what our initial audit report looks like.
[05:19.840 --> 05:23.420]  What you've got here is a score out of 10,
[05:23.420 --> 05:25.500]  and I'll tell you more about that score over time.
[05:25.500 --> 05:28.200]  And this thing right here says how we got that score.
[05:28.260 --> 05:29.300]  What weights file we used.
[05:29.300 --> 05:31.320]  I'll talk about weights files tomorrow, but basically,
[05:31.320 --> 05:34.140]  who decided how your system should be scored is in that.
[05:34.560 --> 05:38.040]  Okay, so, there are items here that don't have a weight.
[05:38.140 --> 05:39.000]  There are items here...
[05:40.100 --> 05:41.420]  Here, let's see.
[05:42.460 --> 05:44.840]  So, I'll show you basically the way this works.
[05:44.840 --> 05:46.120]  Bastille's a whole bunch of modules,
[05:46.120 --> 05:47.180]  and you're going to see these modules.
[05:47.180 --> 05:49.260]  I just want you to see the structure of the report.
[05:49.340 --> 05:51.140]  Okay, Bastille's a whole bunch of modules.
[05:51.140 --> 05:53.340]  So, one of them's called file permissions,
[05:53.340 --> 05:55.620]  or we'll page down a little bit.
[05:56.980 --> 06:01.320]  Okay, one of them's a send mail module here.
[06:01.660 --> 06:05.520]  So, here's the DNS module here, just at the top of the screen.
[06:05.520 --> 06:07.740]  And this basically is an item called chroot bind,
[06:07.740 --> 06:10.420]  and that labels something you can redefine if you like.
[06:10.420 --> 06:12.940]  It can be item 4.3 if you like.
[06:13.560 --> 06:14.760]  Here's a question.
[06:15.680 --> 06:17.300]  Is bind in a chroot jail?
[06:17.300 --> 06:18.780]  Is it set to run non-root?
[06:19.100 --> 06:20.500]  Here's your current state.
[06:20.500 --> 06:21.680]  Yes, it is.
[06:22.400 --> 06:23.940]  Here's the weight of that question.
[06:23.940 --> 06:25.780]  Ah, sorry, you didn't really get anything for it.
[06:25.780 --> 06:26.580]  It was weighted zero.
[06:26.580 --> 06:28.320]  That wasn't something that you were required to do,
[06:28.320 --> 06:30.960]  or it wasn't something that you were considering as all that important.
[06:31.320 --> 06:33.720]  And then here's the score contribution based on that weight.
[06:33.740 --> 06:34.660]  Does that make sense?
[06:34.860 --> 06:35.920]  So, the idea is...
[06:35.920 --> 06:38.060]  Oh, and if we go to that question,
[06:38.060 --> 06:40.940]  you know it'll pop up if you've got JavaScript on in this browser.
[06:40.940 --> 06:42.240]  This is all running locally,
[06:42.240 --> 06:44.720]  so we want to talk about JavaScript issues and all that.
[06:45.280 --> 06:46.720]  Just trust me for now.
[06:46.720 --> 06:47.980]  This is running locally.
[06:47.980 --> 06:48.620]  You're not...
[06:48.620 --> 06:51.060]  The idea is that the browser isn't off doing other things.
[06:51.060 --> 06:53.020]  This browser popped up by best deal.
[06:53.020 --> 06:54.460]  You can have another browser hanging around.
[06:54.460 --> 06:56.040]  This is your separate one.
[06:56.740 --> 06:57.940]  So, we've got a pop-up.
[06:57.940 --> 07:00.520]  If you don't like pop-ups, you can turn off JavaScript in it,
[07:00.520 --> 07:02.160]  and you can just click on the question.
[07:02.340 --> 07:03.760]  And the question will give you...
[07:03.760 --> 07:04.880]  Can you guys see that?
[07:05.240 --> 07:05.880]  No?
[07:06.040 --> 07:06.760]  Okay.
[07:07.680 --> 07:08.660]  How's that?
[07:08.920 --> 07:12.360]  Okay, so this question is named in a chroot jail.
[07:12.360 --> 07:15.500]  This is the thing that's being checked,
[07:15.500 --> 07:17.980]  and it's also an item that can be hardened in best deal,
[07:17.980 --> 07:20.820]  and this explanation here basically says,
[07:20.820 --> 07:22.580]  this is why you should do this.
[07:22.720 --> 07:23.940]  And I'll show you that some more,
[07:23.940 --> 07:25.680]  but one of the best deal's things is it says,
[07:25.680 --> 07:27.780]  listen, here's why you should chroot name D.
[07:27.900 --> 07:29.380]  Because you could be a total newbie.
[07:29.380 --> 07:31.560]  You could be like, what does chroot mean?
[07:32.180 --> 07:33.440]  What's name D?
[07:33.460 --> 07:35.480]  And so we'll try to give you a feel for it.
[07:35.480 --> 07:36.940]  We'll say, okay, this is what you should know.
[07:36.940 --> 07:38.480]  This is why you should do this.
[07:38.500 --> 07:40.160]  Maybe this is when you shouldn't.
[07:40.160 --> 07:42.340]  This is when...
[07:42.340 --> 07:42.580]  Oh, it's hardening.
[07:42.580 --> 07:43.940]  What if that's gonna break something?
[07:43.940 --> 07:45.440]  Oh, it's gonna break something, right?
[07:45.440 --> 07:48.480]  So the idea is, okay, I understand that risk.
[07:48.480 --> 07:50.340]  Let us tell you when it would break something,
[07:50.340 --> 07:51.680]  when it wouldn't break something,
[07:51.680 --> 07:53.480]  and let you make an informed decision.
[07:53.520 --> 07:54.580]  Does that make sense?
[07:54.960 --> 08:00.580]  So here's my report thing,
[08:00.580 --> 08:01.900]  and it goes on for pages.
[08:01.900 --> 08:02.900]  You can print it out if you like,
[08:02.900 --> 08:03.620]  but there's also something
[08:03.620 --> 08:05.620]  where you can just contract all the modules.
[08:06.000 --> 08:08.840]  We're working on a cooler looking version of this,
[08:08.840 --> 08:11.560]  and I'll tell you a little bit about that as we go on.
[08:11.560 --> 08:13.880]  But you can contract all the modules
[08:13.880 --> 08:15.460]  and say just see one of them.
[08:15.700 --> 08:17.500]  So it's a fun little interface.
[08:17.500 --> 08:19.020]  It's a simple little interface,
[08:19.020 --> 08:20.380]  but it does the job.
[08:20.620 --> 08:22.740]  There are, of course, people who are really into,
[08:22.740 --> 08:23.380]  who are really saying,
[08:23.380 --> 08:25.220]  listen, why can't I run this in text mode?
[08:25.220 --> 08:27.000]  I'm not really an X person.
[08:27.740 --> 08:29.160]  If Bastille finds that you haven't,
[08:29.160 --> 08:30.760]  that you're not actually doing X forwarding,
[08:30.760 --> 08:32.540]  it'll pop up its own text browser.
[08:32.540 --> 08:35.220]  It'll pop up links or W3M or links 2
[08:35.220 --> 08:37.720]  or the other links, you know, or whatever it is.
[08:37.720 --> 08:40.020]  And then there's two other things here
[08:41.400 --> 08:46.100]  There's also a text version of that.
[08:47.300 --> 08:49.120]  So you can see it like that.
[08:49.520 --> 08:51.780]  And then the other piece,
[08:51.780 --> 08:53.500]  which I'm going to refer to later,
[08:53.500 --> 08:55.500]  is that there's something that's machine parsable.
[08:56.480 --> 08:58.760]  And by machine parsable, the weird thing is
[08:59.400 --> 09:02.080]  this thing looks a whole lot like a Bastille config file.
[09:02.080 --> 09:03.360]  This will come up later.
[09:03.360 --> 09:05.560]  This thing looks, we can give you a version that says
[09:05.560 --> 09:07.760]  for each module, for each item number in there,
[09:07.760 --> 09:09.060]  what your current state is.
[09:09.060 --> 09:10.580]  Whether you're hardened, whether you're not hardened.
[09:10.580 --> 09:11.700]  The Y and N's or whatever
[09:11.700 --> 09:14.440]  are basically the answers that it found on the system.
[09:14.480 --> 09:15.660]  Does that make sense?
[09:15.980 --> 09:18.240]  So, I'll show you.
[09:18.420 --> 09:21.460]  Let's take this and run Bastille normally.
[09:21.880 --> 09:23.220]  I'm running Bastille minus X
[09:23.220 --> 09:24.560]  to show it in X.
[09:24.560 --> 09:26.880]  Oh, there's something everybody should know.
[09:27.620 --> 09:29.400]  Remember when we all used to tell that into systems
[09:29.400 --> 09:31.280]  and you'd type Xclock, you'd type Netscape
[09:31.280 --> 09:33.320]  and you'd see things pop up graphically?
[09:33.320 --> 09:34.280]  And that was good?
[09:34.280 --> 09:36.400]  And then we did that with SSH and that was good?
[09:36.460 --> 09:38.060]  And then it stopped working?
[09:38.060 --> 09:39.680]  Like all of a sudden you SSH'd into something
[09:39.680 --> 09:41.080]  and there was no X anymore?
[09:41.420 --> 09:42.940]  Anybody have that?
[09:43.060 --> 09:44.640]  Raise your hand if you had that happen.
[09:45.120 --> 09:48.460]  Maybe only a few people have had that happen.
[09:48.460 --> 09:50.660]  Just SSH minus capital X.
[09:50.660 --> 09:51.840]  And it's like it used to be.
[09:51.840 --> 09:54.140]  It's a security thing, almost, sort of, kind of.
[09:54.340 --> 09:55.060]  Anyway.
[09:55.260 --> 09:56.480]  So I've started up Bastille
[09:58.000 --> 10:00.160]  and, I don't know, can you guys read this?
[10:00.540 --> 10:02.220]  I can't see from over here.
[10:02.820 --> 10:03.460]  Okay.
[10:03.600 --> 10:05.320]  Well, anyway.
[10:05.360 --> 10:06.520]  Why don't I just...
[10:07.280 --> 10:07.920]  Fine.
[10:08.600 --> 10:10.680]  What this basically is, is it's a bunch of...
[10:10.680 --> 10:12.980]  What this basically is, is it's just a bunch of...
[10:12.980 --> 10:14.620]  There's a bunch of modules on the left side
[10:14.940 --> 10:16.520]  and I'll show you a screenshot later on
[10:16.520 --> 10:18.120]  that will be a little bit easier to see.
[10:18.120 --> 10:20.120]  But there's a bunch of modules on the left side.
[10:20.160 --> 10:22.080]  There's a question up here that says,
[10:22.080 --> 10:23.440]  would you like to do this thing?
[10:23.600 --> 10:25.980]  There's an explanation here that says,
[10:25.980 --> 10:26.980]  here's why you would want to
[10:26.980 --> 10:28.220]  and here's why you wouldn't want to.
[10:28.220 --> 10:30.060]  It's the same one you saw on the auditing side.
[10:30.100 --> 10:31.640]  And then there's like a yes or no.
[10:31.840 --> 10:33.060]  So we can kind of go through
[10:34.240 --> 10:37.620]  and just tell it we want to harden the system.
[10:40.800 --> 10:44.000]  And I'm basically just choosing the defaults for now.
[10:44.260 --> 10:46.360]  The defaults for Bastille are basically chosen
[10:46.360 --> 10:47.400]  so that you won't get...
[10:47.400 --> 10:48.860]  so that you won't screw things up too badly
[10:48.860 --> 10:51.180]  if you just go through and never make a decision
[10:51.180 --> 10:53.040]  if you always click yes or click no.
[10:53.040 --> 10:54.980]  You're losing a lot of the benefit if you do that
[10:54.980 --> 10:56.280]  the first time
[10:57.240 --> 10:59.620]  because we probably got something to tell you about.
[11:00.540 --> 11:01.360]  Okay.
[11:01.360 --> 11:03.140]  Bastille's got a firewall that I'm skipping
[11:03.520 --> 11:05.360]  for anybody watching and...
[11:07.000 --> 11:09.400]  another tool that I'm skipping that I'll talk about later.
[11:09.540 --> 11:11.380]  So Bastille will go and it'll basically
[11:11.380 --> 11:13.800]  just go and say these are the things I did.
[11:13.900 --> 11:15.340]  And there's an error in here because
[11:15.340 --> 11:17.440]  it's trying to work on inetd.conf
[11:17.440 --> 11:18.480]  and there isn't one on the system
[11:18.480 --> 11:20.020]  and there's no exinetd either.
[11:20.820 --> 11:22.840]  But that's not something to really worry about.
[11:23.000 --> 11:24.180]  So what I've got right now
[11:24.540 --> 11:26.380]  is if I were to look at...
[11:27.060 --> 11:28.500]  if I were to look at the number of things
[11:28.500 --> 11:30.220]  that are still running...
[11:30.220 --> 11:30.880]  Okay.
[11:34.380 --> 11:35.740]  Wow, that should be all.
[11:35.980 --> 11:37.680]  Okay, well...
[11:37.680 --> 11:39.280]  what I can do right now, let me just
[11:39.280 --> 11:41.120]  rerun in audit mode and show you.
[11:41.120 --> 11:42.960]  I just went through and hardened the system.
[11:44.460 --> 11:45.800]  And I hardened the system with
[11:46.260 --> 11:47.920]  pretty significant speed because
[11:47.920 --> 11:49.520]  I wasn't trying to so much demo the tool.
[11:49.520 --> 11:51.760]  What we just did was we went from a score of 5 point something
[11:51.760 --> 11:53.960]  to a score of 8 point something.
[11:53.960 --> 11:55.720]  Almost 9. And if I'd chosen the non-
[11:55.720 --> 11:58.360]  if I'd chosen something stricter than the defaults all along
[11:58.360 --> 12:00.080]  we'd actually have a higher score.
[12:00.080 --> 12:02.000]  And we can see and we can look at basically
[12:02.000 --> 12:04.080]  each question and say, okay, what got turned off
[12:04.080 --> 12:06.380]  and what got turned on. Does that make sense?
[12:06.700 --> 12:07.920]  Is that kind of...
[12:07.920 --> 12:09.980]  The idea is there are tools
[12:09.980 --> 12:12.040]  that have been auditing... there are tools that have been
[12:12.040 --> 12:14.100]  auditing before and there are tools that have been hardening
[12:14.100 --> 12:15.900]  before and now we're kind of doing both.
[12:15.900 --> 12:17.840]  And that's got a certain advantage.
[12:17.840 --> 12:20.180]  And one of the advantages is that you can motivate people
[12:20.180 --> 12:22.240]  to harden more because they're like, wow, hey,
[12:22.240 --> 12:23.900]  look, I can see my score.
[12:23.900 --> 12:26.340]  Or you can... well, I've got slides. I'll show you.
[12:26.340 --> 12:27.660]  But the idea is that it's
[12:27.980 --> 12:29.760]  a pretty useful thing to be able to
[12:29.760 --> 12:31.500]  even have tools line up.
[12:32.400 --> 12:34.440]  Let me show you. Let me show you slides.
[12:35.320 --> 12:35.860]  Okay.
[12:36.800 --> 12:37.980]  Here, now I can probably be heard
[12:38.080 --> 12:38.900]  a whole lot better.
[12:40.160 --> 12:41.780]  So, in essence,
[12:41.780 --> 12:43.980]  the first question is kind of, why do you do assessment
[12:43.980 --> 12:45.820]  at all? Right? I just showed you, hey,
[12:45.820 --> 12:47.820]  we built an audit tool and you're like, wow,
[12:47.820 --> 12:50.200]  gee, I'm not an auditor. Why do I care?
[12:50.200 --> 12:51.840]  Right? Maybe you're not thinking that.
[12:51.840 --> 12:54.200]  Maybe you're thinking this is really cool and that's what I hope you're thinking.
[12:54.200 --> 12:55.900]  But if you're not, maybe I can tell you
[12:55.900 --> 12:57.960]  why it's useful. Can you hear me
[12:57.960 --> 12:59.980]  or am I still not eating the
[12:59.980 --> 13:02.180]  mic sufficiently well? Okay.
[13:02.200 --> 13:04.500]  I will keep trying to eat the microphone.
[13:05.500 --> 13:06.100]  Okay, so
[13:06.100 --> 13:07.980]  in terms of why you do assessment in the first
[13:07.980 --> 13:09.920]  place, the first reason you do
[13:09.920 --> 13:11.180]  assessment is because it teaches
[13:11.180 --> 13:14.080]  the system about things they could harden.
[13:14.080 --> 13:15.900]  It teaches them about hardening settings they could
[13:15.900 --> 13:17.900]  apply they might not have known about before.
[13:17.980 --> 13:20.020]  And one of the weird things in the Unix world is we kind of all
[13:20.020 --> 13:22.020]  feel like we know everything and it's
[13:22.020 --> 13:23.960]  hard to find out that there's something you don't know
[13:23.960 --> 13:25.460]  if you feel like you know everything.
[13:26.340 --> 13:28.200]  And so it's kind of a, you know,
[13:28.200 --> 13:30.040]  and so the idea of this is to show you what you
[13:30.040 --> 13:32.160]  might not know or at least what hasn't been done
[13:32.160 --> 13:34.020]  to the system yet. Bastille's always
[13:34.020 --> 13:36.220]  had this education thing as a second purpose.
[13:36.660 --> 13:38.500]  This is a normal screenshot.
[13:38.500 --> 13:40.060]  This is what I was going through but a little
[13:40.060 --> 13:42.240]  more blown up before.
[13:42.420 --> 13:43.980]  If we look at this, what we're doing is this
[13:43.980 --> 13:46.020]  goes and says, hey, do you want to turn on stack protection
[13:46.020 --> 13:48.020]  in the kernel? Here's the reason
[13:48.020 --> 13:50.140]  you want to do this. It turns out you can break tons
[13:50.140 --> 13:52.080]  of buffer overflow exploits. You can
[13:52.080 --> 13:54.120]  break lots of buffer overflows.
[13:54.200 --> 13:56.180]  One of the major kinds of exploits out there
[13:56.180 --> 13:58.120]  if you just turn on the stack protection. Here's
[13:58.120 --> 14:00.280]  when you don't want to. GDB is a
[14:00.280 --> 14:02.360]  mode that it doesn't work with if you turn on stack
[14:02.360 --> 14:04.540]  protection. What else? Well, not much else.
[14:04.540 --> 14:06.080]  Okay, so we can tell you
[14:06.900 --> 14:08.240]  here's what we'd like to do and find out if
[14:08.240 --> 14:11.420]  you want to do it. Why else do you do assessment?
[14:11.760 --> 14:12.880]  Triage, right?
[14:12.880 --> 14:14.820]  You basically take each of your systems. You're like
[14:14.820 --> 14:16.280]  I'd like to harden my systems. I don't
[14:16.280 --> 14:18.180]  know where to start. I can start at my workstation.
[14:18.180 --> 14:20.160]  Yeah, that's good. Right, but I don't know where to start.
[14:20.160 --> 14:22.160]  I can go with the most vital servers. How about which one's
[14:22.160 --> 14:24.220]  worse? How about pick the one
[14:24.220 --> 14:26.580]  that's least hardened? Pick the one that's in
[14:26.580 --> 14:28.200]  worst need. So you can basically
[14:28.200 --> 14:30.200]  go and take best deal and generate that
[14:30.200 --> 14:32.040]  score or look at that config file and look at what
[14:32.040 --> 14:34.180]  things matter. If you know what things matter
[14:34.180 --> 14:36.180]  you can set weights according to these
[14:36.180 --> 14:38.240]  are the things that matter and then score your systems.
[14:38.720 --> 14:39.960]  Right, the score thing lets you start
[14:39.960 --> 14:42.020]  the user configurable score
[14:42.020 --> 14:44.240]  thing lets you start saying, okay, these
[14:44.240 --> 14:46.020]  systems are worse. I'm going to take care of them
[14:46.020 --> 14:48.220]  first. Or these systems are worse. I'm going to maybe
[14:48.220 --> 14:50.520]  do a little bit of incident response because they're so bad, right?
[14:50.520 --> 14:52.360]  Does that make sense? Or maybe I'll
[14:52.360 --> 14:54.240]  start with, you know, running my
[14:54.240 --> 14:56.500]  NMAP scans, running my Nessus scans. I'll look for vulnerabilities
[14:56.500 --> 14:58.380]  in the system. I'll look for backdoors on the system
[14:58.380 --> 14:59.900]  is really what I care about here.
[15:00.140 --> 15:02.440]  Okay, what else? Another reason
[15:02.440 --> 15:03.660]  to do assessment is that auditing
[15:04.780 --> 15:06.540]  happens. You will be audited.
[15:06.540 --> 15:08.260]  We all get audited at some point. Maybe you
[15:08.260 --> 15:10.240]  don't, but a lot of us do. A lot of
[15:10.240 --> 15:12.380]  my clients do, right? So the idea
[15:12.380 --> 15:13.920]  is, okay, you know you're
[15:13.920 --> 15:16.280]  going to get audited. It'd be nice to find out what's
[15:16.280 --> 15:18.100]  going to show up. What's going to happen to be able to work on it
[15:18.100 --> 15:20.200]  proactively? And so the idea
[15:20.200 --> 15:22.140]  here is to give you a tool that's equivalent to your
[15:22.140 --> 15:24.240]  auditor's tools. And you can use a waits
[15:24.240 --> 15:26.180]  file again that's basically
[15:26.180 --> 15:27.920]  defined the same way your auditor's is.
[15:28.340 --> 15:29.880]  And that's our hope. If anybody
[15:29.880 --> 15:32.140]  is with any of the major auditing organizations,
[15:32.140 --> 15:34.440]  I've worked with CIS. If you're with ISACA,
[15:34.440 --> 15:35.760]  if you're with one of the other organizations
[15:35.760 --> 15:38.160]  and you want to contribute something, I would love it if you
[15:38.160 --> 15:40.080]  would help contribute work on waits files.
[15:40.100 --> 15:42.100]  Just help us tell, okay,
[15:42.100 --> 15:44.140]  what are auditors looking for? But I mean, we've
[15:44.140 --> 15:46.440]  got a framework now where we can do that.
[15:46.900 --> 15:48.140]  What else? Bestial
[15:48.140 --> 15:49.980]  could be helpful here with compliance.
[15:51.060 --> 15:51.640]  If you've
[15:52.000 --> 15:54.060]  just gotten hit over the head in the last year with new
[15:54.060 --> 15:56.300]  legislation that says, okay, we've got to care about security
[15:56.300 --> 15:57.860]  now, or
[15:57.860 --> 15:59.940]  we're going to get measured on it. We always
[15:59.940 --> 16:02.160]  cared about it. Well, maybe Bestial will help you
[16:02.160 --> 16:05.320]  in figuring out how well you are in compliance.
[16:05.320 --> 16:06.100]  The weird thing is that some
[16:06.100 --> 16:07.820]  of these compliances are actually really
[16:08.180 --> 16:09.940]  fuzzy. They say that you've got to do
[16:09.940 --> 16:12.100]  due diligence, that you've got to do a pretty good job.
[16:12.100 --> 16:14.220]  Well, what's that mean? Well, if we've
[16:14.220 --> 16:16.280]  got an idea, if we've got an idea how systems
[16:16.280 --> 16:18.180]  scored, and we can show, okay, well
[16:18.180 --> 16:20.220]  we went from here to here, or we can say
[16:20.220 --> 16:22.080]  listen, most of our industry does
[16:22.080 --> 16:24.200]  this. They score at this on this waits
[16:24.200 --> 16:26.220]  file. Well, then you start being able to say that you're
[16:26.220 --> 16:28.180]  basically keeping up with your peers, which
[16:28.180 --> 16:30.140]  is what due diligence means. It doesn't mean that
[16:30.140 --> 16:32.240]  you did everything possible. It just basically
[16:32.240 --> 16:34.100]  means you did what most everybody else who's
[16:34.100 --> 16:36.180]  doing a good job is doing. That's kind
[16:36.180 --> 16:38.620]  of fuzzy, but we'll try to help you with that anyway.
[16:38.860 --> 16:40.140]  What else? You could
[16:40.140 --> 16:41.780]  go and say, this is another thing that comes up
[16:41.780 --> 16:44.480]  in universities, network protection. It's saying, listen,
[16:44.480 --> 16:46.160]  I'd like to make sure that before
[16:46.340 --> 16:48.080]  a system's put on my network, before
[16:48.200 --> 16:50.080]  a Unix system's put on my network, I want to make sure that it's
[16:50.080 --> 16:52.280]  well patched, and I want to make sure that it's well hardened.
[16:52.280 --> 16:54.080]  And if it's well hardened to basically these
[16:54.080 --> 16:56.300]  standards, then I'll let it on the network.
[16:56.500 --> 16:58.300]  And if it's not, well, I'm sorry, you know,
[16:58.300 --> 17:00.020]  just come back in a day when you're done.
[17:00.060 --> 17:02.120]  Or actually, since hardening's pretty fast, as you guys
[17:02.120 --> 17:03.760]  saw, you know, come back in five minutes.
[17:04.900 --> 17:06.040]  Does that make sense?
[17:06.280 --> 17:07.940]  Is this kind of interesting to you guys?
[17:08.740 --> 17:10.700]  Useful? Okay, cool.
[17:11.560 --> 17:12.380]  The other thing is,
[17:12.380 --> 17:14.040]  scoring has this awesome psychological
[17:14.040 --> 17:15.660]  power. Okay, I worked on
[17:16.200 --> 17:18.040]  another tool like this,
[17:18.040 --> 17:19.860]  and I remember when we were developing it, it was the
[17:19.860 --> 17:22.040]  CIS Unix scoring tool. And when we
[17:22.040 --> 17:24.220]  were developing it, they said, we're going to give you a score.
[17:24.300 --> 17:26.000]  You know, you want to compute a score, and I'm like,
[17:26.140 --> 17:28.280]  a score? One number?
[17:28.460 --> 17:30.200]  I mean, I studied mathematics, okay?
[17:30.200 --> 17:31.960]  You know, like, I did physics too. We don't
[17:31.960 --> 17:33.980]  have one number. I was like, oh god,
[17:33.980 --> 17:36.520]  at worst, like, make it a ten element vector, and then like,
[17:36.520 --> 17:38.520]  you know, compute some kind of a mean of that,
[17:38.520 --> 17:40.520]  or whatever, you know, compute a metric based on, like,
[17:40.520 --> 17:42.280]  weights of that. And someone's like, no, no, no, no,
[17:42.280 --> 17:44.560]  one number. And I'm like, one number. Okay,
[17:44.560 --> 17:46.560]  fine, management folks will like one number.
[17:46.560 --> 17:48.360]  That was my first thought. It turns out, geeks
[17:48.360 --> 17:50.520]  like one number too. One number is really
[17:50.520 --> 17:52.200]  kind of useful, okay?
[17:52.620 --> 17:54.440]  The score thing is really nice because people
[17:54.440 --> 17:56.360]  are naturally competitive, and geeks
[17:56.360 --> 17:58.340]  are naturally competitive, and hackers are
[17:58.340 --> 18:00.380]  really naturally competitive, right?
[18:00.400 --> 18:02.460]  So, so the idea is
[18:02.460 --> 18:04.420]  that first, people get around to hardening
[18:04.420 --> 18:06.400]  sooner. People are like, you know, I'm meaning to
[18:06.400 --> 18:08.220]  harden that system. I'll get around to it later on.
[18:08.220 --> 18:10.380]  All of a sudden, when they're like confronted with, you know,
[18:10.560 --> 18:12.360]  a score that says mediocre, they're like, wait,
[18:12.360 --> 18:14.440]  I'm not mediocre. I kick ass.
[18:14.640 --> 18:16.960]  You know? That's not the way this should be.
[18:16.960 --> 18:18.340]  I shouldn't have a score of four.
[18:18.340 --> 18:20.420]  I'm not getting around to that later. I'm doing it right freaking
[18:20.420 --> 18:22.040]  now. Okay?
[18:22.560 --> 18:24.320]  So, I'll give you an example.
[18:24.520 --> 18:26.260]  We had a, we had a security instructor
[18:26.260 --> 18:28.040]  who was a SANS instructor. He, you know,
[18:28.040 --> 18:30.260]  was an instructor teaching lots of people things.
[18:30.260 --> 18:32.820]  He thought a lot of himself, of course, as we all do.
[18:32.820 --> 18:34.840]  Right? And he said,
[18:35.640 --> 18:36.980]  okay, I'll,
[18:36.980 --> 18:38.940]  you know, I'll beta test your software. So he was beta testing
[18:38.940 --> 18:40.820]  and he ran this thing on his workstation.
[18:40.820 --> 18:43.340]  And his workstation came up at about a six out of ten.
[18:43.560 --> 18:44.700]  And he got
[18:44.700 --> 18:46.820]  peeved. He's like, what are you saying?
[18:46.820 --> 18:48.960]  This is the mediocre issue. He said, I'm not
[18:49.100 --> 18:50.920]  a six out of ten. Screw that.
[18:50.920 --> 18:52.920]  And he sat down. He didn't even talk to us. He just sat down
[18:52.920 --> 18:54.820]  and started hardening his system. And ten
[18:54.820 --> 18:57.000]  minutes later, he ran the tool again and they gave him an eight.
[18:57.000 --> 18:59.000]  And he's like, ah, that's more like it.
[18:59.000 --> 19:00.820]  I'm not a six. A six is like, you know,
[19:00.820 --> 19:02.860]  60%. That's like a D. No, no.
[19:02.860 --> 19:04.800]  I'm much better than that. It's nice.
[19:04.800 --> 19:06.760]  Play against people's ego. He didn't see
[19:06.760 --> 19:09.060]  himself as a six out of ten kind of guy.
[19:09.300 --> 19:10.820]  Fine by me. Whatever gets him to take
[19:10.820 --> 19:12.860]  proactive security measures is good.
[19:13.260 --> 19:13.660]  Okay.
[19:14.480 --> 19:16.800]  This has happened lots of times. When we were developing
[19:16.800 --> 19:19.280]  this previous scoring tool, we talked to a bank.
[19:19.280 --> 19:20.720]  And the bank had set up a scoring tool
[19:20.720 --> 19:22.840]  they'd created. Their security folks had,
[19:22.840 --> 19:24.760]  you know, like many security folks in organizations
[19:24.760 --> 19:26.760]  had no power whatsoever.
[19:26.760 --> 19:28.880]  We couldn't, you know, it wasn't like, hand of God.
[19:28.880 --> 19:30.680]  You know, you will harden.
[19:30.720 --> 19:32.880]  It's not like that. They were like, uh, we'd like
[19:32.880 --> 19:34.680]  to help. How can we help?
[19:34.680 --> 19:36.960]  And that's what a lot of security folks in organizations
[19:36.960 --> 19:38.720]  are like. So they went to their sysadmins.
[19:38.720 --> 19:40.860]  They said, here's this tool. Why don't you try and run it
[19:40.860 --> 19:42.900]  once? Okay. And so they ran it once.
[19:42.900 --> 19:44.720]  They didn't have any mandated high score. They didn't have any
[19:44.720 --> 19:46.980]  mandated anything. The only thing was, can you try
[19:46.980 --> 19:49.140]  this tool once? Let us know how it goes.
[19:49.200 --> 19:50.900]  And so they did start using it. And different
[19:50.900 --> 19:53.300]  groups of sysadmins had different reactions.
[19:53.300 --> 19:54.700]  They're basically all positive.
[19:54.820 --> 19:57.020]  But there were some sysadmins who started voluntarily
[19:57.020 --> 19:59.240]  posting their scores up on a cork board.
[19:59.240 --> 20:00.800]  Like, outside their cube.
[20:00.940 --> 20:03.220]  Okay, I know, that sounds really, really nerdy.
[20:03.220 --> 20:05.440]  But, you know, okay, we're all really
[20:05.440 --> 20:07.400]  nerds here, right? We're just pretending to be cool.
[20:07.940 --> 20:08.920]  Okay, maybe you all are cool.
[20:08.920 --> 20:09.740]  I'm just not.
[20:11.140 --> 20:13.340]  Right, but the idea is, like, okay,
[20:13.340 --> 20:15.080]  it'd be really great if we got people competing.
[20:15.080 --> 20:17.160]  And they do. Okay, the start
[20:17.160 --> 20:19.080]  Linux system scores around a 5.
[20:19.200 --> 20:21.160]  This doesn't work on Solaris yet, but I wouldn't
[20:21.160 --> 20:23.040]  be surprised if, like, a Solaris 8 system
[20:23.040 --> 20:24.940]  scored around a 3. Right?
[20:24.940 --> 20:27.720]  Solaris has got freaking everything on by default.
[20:27.940 --> 20:29.000]  We will get around to
[20:29.000 --> 20:30.500]  porting Bastille to Solaris.
[20:30.500 --> 20:32.900]  It's just a whole lot of work.
[20:34.040 --> 20:35.140]  Anybody wants to help,
[20:35.140 --> 20:36.560]  we've got two people who are working on it already
[20:36.560 --> 20:37.940]  and would love the help.
[20:39.080 --> 20:41.020]  But there's, but the nice, so that's
[20:41.020 --> 20:43.180]  why you do, that's why you do assessments.
[20:43.180 --> 20:45.080]  It's why you do audit. These are the useful
[20:45.080 --> 20:46.880]  things about pushing an auditing tool
[20:46.880 --> 20:48.880]  in your organization or pushing whatever.
[20:49.100 --> 20:50.800]  So, so why do you, why do you like
[20:50.800 --> 20:52.880]  the two together? Why did I, you know,
[20:52.880 --> 20:54.500]  why did we add auditing to Bastille
[20:54.500 --> 20:57.060]  instead of just creating a new auditing tool? Right?
[20:57.060 --> 20:58.120]  That would be kind of cool.
[20:58.360 --> 21:00.700]  Well, the idea is that when you are hardening
[21:00.880 --> 21:02.960]  a system, when you are hardening
[21:03.140 --> 21:04.840]  a system, it creates a policy file.
[21:04.840 --> 21:06.980]  When you go through this interactive yes, no, yes, no,
[21:06.980 --> 21:08.760]  yes, no, yes, no, you get a policy file
[21:08.760 --> 21:10.680]  whether you like it or not. It just gets saved.
[21:10.680 --> 21:12.960]  It gets saved in this given place and you can take that policy file
[21:12.960 --> 21:14.240]  and you can do something with it.
[21:14.280 --> 21:16.880]  Well, one of the things you can do with it is you can feed it
[21:16.880 --> 21:18.820]  back in, you can feed it back in
[21:18.820 --> 21:20.840]  and see how well you are doing against that policy
[21:20.840 --> 21:22.820]  file. You can say, okay, it's been
[21:22.820 --> 21:24.840]  three months. I've been patching.
[21:24.840 --> 21:26.940]  I have just, you know, ordinary system rot.
[21:26.940 --> 21:29.380]  I'd like to know how far off I am.
[21:29.940 --> 21:30.900]  The other thing in terms
[21:30.900 --> 21:32.740]  of that policy file is if you, since we created
[21:32.880 --> 21:34.940]  a policy file by default every time you harden,
[21:34.940 --> 21:36.780]  you harden, we create a policy file. You can take that
[21:36.780 --> 21:38.920]  policy file and say, this is my policy file for all
[21:38.920 --> 21:40.840]  my web servers. And now you don't have to
[21:40.840 --> 21:42.600]  run through the whole Bastille thing again, right?
[21:42.600 --> 21:44.940]  It's just, it's got a back end where you just feed it a policy
[21:44.940 --> 21:47.000]  file, it sucks it in, hardens the system
[21:47.000 --> 21:48.960]  and, you know, two minutes later you're ready.
[21:48.960 --> 21:51.220]  Right? You can take that policy file and reuse
[21:51.220 --> 21:53.020]  it. And there's a lot of, there's a lot
[21:53.020 --> 21:55.140]  of reuse. I was just
[21:55.140 --> 21:57.120]  talking about skew detection. If you take that policy
[21:57.120 --> 21:59.260]  file and you've said, this is my web server template.
[21:59.480 --> 22:01.420]  Suppose you've got a web server that's older.
[22:01.700 --> 22:03.100]  Maybe you can't harden it. Maybe the boss
[22:03.100 --> 22:05.220]  has said, listen, we don't want anyone making any substantial
[22:05.220 --> 22:07.100]  changes to this system. You can make changes
[22:07.100 --> 22:09.360]  one at a time by hand. Fine.
[22:09.360 --> 22:11.320]  You say, all our other web servers are here.
[22:11.400 --> 22:13.020]  I've got a policy file that says how they
[22:13.020 --> 22:15.420]  were hardened. Let's see how this one stacks up.
[22:15.480 --> 22:18.040]  So I take this one and I
[22:18.040 --> 22:20.120]  run the auditing tool on it and it says, okay,
[22:20.120 --> 22:22.100]  these are the four things that you normally do
[22:22.100 --> 22:23.880]  to all your other web servers that you haven't done to this one
[22:23.880 --> 22:26.120]  because it's older. Is that cool? Does that make
[22:26.120 --> 22:28.000]  sense? So it's called skew detection
[22:28.000 --> 22:29.680]  and it's a decent thing.
[22:30.520 --> 22:31.720]  There are some politics
[22:32.180 --> 22:34.040]  to this. There's a reason.
[22:34.040 --> 22:35.980]  I keep talking about psychological powers.
[22:36.440 --> 22:38.060]  Psychology is a really weird thing to be
[22:38.060 --> 22:40.000]  talking about with regard to hardening.
[22:40.000 --> 22:41.820]  Not necessarily with regard to DEF CON, right? You're all
[22:41.820 --> 22:44.280]  psyching each other out all the time. There's psychological games.
[22:44.620 --> 22:46.200]  Eh. This is the weird
[22:46.200 --> 22:48.460]  thing. Psychological games in the workplace.
[22:48.680 --> 22:50.180]  Right? We're all used to it if we're in the
[22:50.180 --> 22:52.140]  workplace. Politics.
[22:52.500 --> 22:54.280]  There are lots of times
[22:54.280 --> 22:56.380]  where you can't harden a system by hand
[22:56.380 --> 22:58.040]  or with a tool because someone says,
[22:58.040 --> 23:00.220]  oh no, I think that might break things. Or
[23:00.220 --> 23:02.340]  you can't touch that. That's my system.
[23:02.340 --> 23:04.220]  No changes. Right? The nice
[23:04.220 --> 23:06.340]  thing about this is that you can say
[23:07.420 --> 23:08.360]  we've taken, we've
[23:08.360 --> 23:10.340]  got all of our web servers. We've got four web servers that I built.
[23:10.340 --> 23:12.320]  We've got the one that, you know, that Mad Max is still
[23:12.320 --> 23:14.180]  maintaining. And Mad Max says anyone who
[23:14.180 --> 23:16.520]  touches his system gets his fingers chopped off.
[23:16.780 --> 23:18.120]  Okay? Well, you know,
[23:18.120 --> 23:20.040]  listen, Mad Max's boss, my boss,
[23:20.040 --> 23:22.180]  can you just ask Mad Max if he'd run this tool for you
[23:22.180 --> 23:24.240]  once? Like, just run it. Just auditing.
[23:24.240 --> 23:26.140]  Read only. Won't modify a system in any
[23:26.140 --> 23:28.120]  way. And if you survive the encounter of
[23:28.120 --> 23:30.040]  requesting that he run it, what do we
[23:30.040 --> 23:32.000]  find out? Well, we find out Mad Max's system
[23:32.000 --> 23:34.080]  scores far worse than the rest of the
[23:34.080 --> 23:35.900]  systems that do the exact same thing.
[23:36.140 --> 23:38.160]  Oh, great. Now we've got another way to get, we've got
[23:38.160 --> 23:40.140]  another way to get the worst systems hardened.
[23:40.600 --> 23:42.360]  Why do I care about hardening so much?
[23:42.360 --> 23:44.420]  I care about hardening so much because while it's
[23:44.420 --> 23:46.300]  kind of, you know, one of the least exciting
[23:46.300 --> 23:48.220]  areas of computer security, right next to like
[23:48.220 --> 23:49.620]  policy and logging,
[23:50.320 --> 23:52.220]  you know, it's still, it's extremely
[23:52.220 --> 23:54.720]  effective. You don't get boxes rooted.
[23:54.780 --> 23:56.400]  It's really nice to not get boxes
[23:56.400 --> 23:58.320]  rooted. It's not a lot of work either
[23:58.320 --> 23:59.920]  if you're using a tool for it.
[24:00.460 --> 24:02.440]  So anyway, you can read, you
[24:02.440 --> 24:04.420]  can run Bastille and basically other
[24:04.420 --> 24:06.340]  auditing tools, read only, and the idea
[24:06.340 --> 24:08.280]  is okay, we'll learn something about the system without having
[24:08.280 --> 24:09.360]  to modify it.
[24:10.280 --> 24:11.460]  This really helps when you
[24:11.460 --> 24:13.040]  have a shop that does manual hardening.
[24:13.080 --> 24:15.140]  People say, okay, we only modify things by hand.
[24:15.140 --> 24:17.280]  We don't trust any tool whatsoever. We don't trust any tool
[24:17.280 --> 24:19.180]  that doesn't come with a million dollar warranty
[24:19.180 --> 24:21.400]  from the vendor and an OILA that says
[24:21.400 --> 24:23.320]  you know, we'll of course take care of any losses
[24:23.320 --> 24:25.180]  you incur from bugs in our product.
[24:25.440 --> 24:27.460]  If you can only do manual hardening,
[24:27.460 --> 24:29.140]  fine, we'll tell you what to do.
[24:29.460 --> 24:31.740]  Read only means you don't have to stop doing manual hardening.
[24:31.820 --> 24:33.380]  It just means we'll help you out and tell you
[24:33.380 --> 24:35.440]  what you should do. Toward that end
[24:35.440 --> 24:37.480]  we're working to create Bastillex.
[24:37.480 --> 24:39.360]  I don't know, we're going to have to call it something else.
[24:39.360 --> 24:41.420]  But basically, Nopix plus Bastille.
[24:41.420 --> 24:42.480]  So you've got a system
[24:44.580 --> 24:45.580]  you've got a system
[24:45.580 --> 24:47.520]  and we will, you've got a system
[24:47.520 --> 24:49.620]  we'll basically just let you. You shut it
[24:49.620 --> 24:51.920]  down, you bring it back up, booting Bastillex
[24:51.920 --> 24:53.500]  or whatever we call it.
[24:53.840 --> 24:55.940]  And it starts up
[24:55.940 --> 24:57.640]  it says okay, I'm not
[24:57.640 --> 24:59.320]  going to mount the drives read write.
[24:59.400 --> 25:01.680]  Mount them read only. Run Bastille.
[25:01.680 --> 25:04.020]  Here's your score. Here's your score report.
[25:04.020 --> 25:05.480]  No changes ever made to the system.
[25:05.480 --> 25:07.380]  You can do this to Mad Max's system
[25:07.380 --> 25:09.560]  while he's on his lunch break or taking a sick day.
[25:09.720 --> 25:11.240]  Right? As long as you have
[25:11.240 --> 25:13.420]  someone's permission or something.
[25:14.020 --> 25:14.620]  Okay.
[25:15.240 --> 25:16.620]  So I've been talking about
[25:17.480 --> 25:19.060]  trying to convince people to harden.
[25:19.060 --> 25:21.200]  I've been talking about the psychology. I've been talking about
[25:21.200 --> 25:23.660]  how it is you do it. You can use this tool to do it.
[25:23.660 --> 25:25.740]  You can use this tool to find out how well you've hardened.
[25:25.760 --> 25:27.600]  But the big question always comes up.
[25:27.600 --> 25:29.660]  Why the heck do I harden in the first place?
[25:29.800 --> 25:31.360]  Okay? Basically
[25:31.360 --> 25:33.440]  if I haven't made it very clear
[25:33.440 --> 25:35.500]  what hardening is already. I'm about to.
[25:35.500 --> 25:37.520]  Hardening is just the process of trying to make a system
[25:37.520 --> 25:38.840]  harder to break into.
[25:38.900 --> 25:41.080]  And the idea is that you take any settings you can tweak
[25:41.080 --> 25:42.760]  and you tweak them. You turn things off
[25:42.760 --> 25:45.280]  and you configure stuff that you left on better.
[25:45.540 --> 25:47.200]  Okay? So the biggest, the first
[25:47.200 --> 25:49.320]  objection we always get to hardening
[25:49.320 --> 25:51.180]  hopefully not at Defcon
[25:51.720 --> 25:52.860]  is that people say
[25:52.860 --> 25:54.960]  my box isn't interesting enough.
[25:54.960 --> 25:56.820]  We're just a little K-12 school.
[25:56.820 --> 25:59.180]  Why is anyone going to attack us?
[25:59.180 --> 26:01.760]  We're just a paint thinner company.
[26:01.760 --> 26:03.840]  Why is anyone actually going to attack our computers?
[26:03.840 --> 26:05.700]  They're not interesting. You're not going to get any money out of
[26:05.700 --> 26:07.680]  attacking our computers. Worst case you might have some
[26:07.680 --> 26:09.260]  extra paint thinner shipped to you.
[26:09.340 --> 26:10.960]  What hacker wants that?
[26:11.400 --> 26:13.800]  Can you do anything with paint thinner that I don't know about?
[26:14.080 --> 26:15.660]  Okay. I don't know.
[26:15.660 --> 26:17.720]  Anyway. But everyone says I'm not
[26:17.720 --> 26:19.480]  interesting enough. I won't be targeted.
[26:19.940 --> 26:21.560]  Does anybody at Defcon still
[26:21.560 --> 26:23.720]  think this? Okay. Don't raise
[26:23.720 --> 26:24.940]  your hand. But
[26:25.500 --> 26:27.840]  if you think this and you put your laptop
[26:27.840 --> 26:29.020]  on the wireless network
[26:29.700 --> 26:30.120]  well
[26:30.900 --> 26:32.860]  try running an IDS for a few minutes
[26:32.860 --> 26:34.440]  or a packet capture
[26:35.460 --> 26:36.960]  program. You see some very interesting
[26:36.960 --> 26:39.020]  attacks coming your way. I wonder how
[26:39.020 --> 26:41.020]  many port scans everyone on the Defcon network sees
[26:41.020 --> 26:42.520]  per, I don't know, minute.
[26:44.160 --> 26:45.000]  Anyway.
[26:45.240 --> 26:46.900]  Low value targets aren't.
[26:47.200 --> 26:49.340]  Okay. Most targets aren't low value.
[26:49.340 --> 26:50.860]  This is something we should all understand.
[26:50.860 --> 26:53.060]  Your box is useful as the next hop on the way to the target
[26:53.060 --> 26:54.940]  just to make it a little bit tougher to track
[26:54.940 --> 26:57.020]  the attacker back. Your box is good as
[26:57.160 --> 26:59.100]  a peer-to-peer host. Your box is good
[26:59.100 --> 27:00.960]  as a wireless distribution site. Heck
[27:00.960 --> 27:02.840]  you could be low bandwidth. Your box would be useful
[27:02.840 --> 27:04.980]  as an IRC bot. Right? I mean
[27:04.980 --> 27:07.520]  your box will be useful to someone.
[27:08.020 --> 27:09.040]  The thing is that
[27:09.040 --> 27:11.080]  your box isn't usually targeted in any way.
[27:11.080 --> 27:13.760]  Right? Most of our attacks don't come from
[27:13.760 --> 27:15.200]  being targeted.
[27:15.240 --> 27:16.800]  And when they do, half the time,
[27:16.800 --> 27:18.920]  probably at least half the time, we don't know that we've
[27:18.920 --> 27:21.000]  even been compromised because people are that good.
[27:21.180 --> 27:23.060]  Right? But most of the attacks that we see
[27:23.060 --> 27:25.180]  are the script kitties coming after us.
[27:25.180 --> 27:27.220]  Most of the attacks that we see aren't
[27:27.220 --> 27:29.680]  targets of choice. They're targets of opportunity.
[27:30.060 --> 27:30.720]  Okay? There's some...
[27:30.720 --> 27:32.860]  Your attacker had an exploit against say
[27:32.860 --> 27:35.140]  one particular version of PHP.
[27:35.340 --> 27:37.380]  So they go and they scan a large swath of the internet.
[27:37.380 --> 27:39.780]  They go and scan the entire Comcast at home network.
[27:39.780 --> 27:41.200]  And they find your box along
[27:41.200 --> 27:42.880]  with a hundred others.
[27:43.060 --> 27:44.500]  And they take those hundred systems and they
[27:45.100 --> 27:47.000]  take those hundred systems and they pwn them and
[27:47.440 --> 27:49.000]  these boxes now belong to them.
[27:49.000 --> 27:51.480]  But it's not because you were targeted.
[27:51.480 --> 27:53.080]  It's because you had an IP on
[27:53.080 --> 27:55.560]  Comcast that day and that was the guy
[27:55.560 --> 27:57.140]  attacking that day. Right?
[27:57.140 --> 27:59.200]  That was the network this guy was scanning.
[27:59.280 --> 28:01.060]  Does that make sense? Okay.
[28:01.060 --> 28:02.800]  I think that's kind of obvious at DEF CON.
[28:03.360 --> 28:05.280]  Okay. So we do tons of
[28:05.280 --> 28:07.080]  patching. Right? We do tons of patching.
[28:07.080 --> 28:08.760]  We're constantly patching. I mean we're all...
[28:08.760 --> 28:11.020]  I spent all of yesterday patching and all the day before
[28:11.020 --> 28:13.180]  that and every single day patching. We all patch
[28:13.180 --> 28:14.900]  and patch and patch and patch. Right?
[28:15.080 --> 28:16.540]  Well, okay, not really. But
[28:16.960 --> 28:19.440]  we do lots of patching. The problem is that if you patch
[28:19.440 --> 28:21.160]  you still get compromised. You're like
[28:21.160 --> 28:23.260]  wait, I patch every single day.
[28:23.260 --> 28:25.120]  Why do I get compromised if I patch every
[28:25.120 --> 28:27.180]  single day at midnight? Well you
[28:27.180 --> 28:29.780]  still get patched because you've still got these windows of vulnerability.
[28:29.840 --> 28:31.360]  A window of vulnerability is basically a time
[28:31.360 --> 28:33.140]  during which somebody's got a working exploit
[28:33.940 --> 28:34.960]  and the time
[28:34.960 --> 28:36.100]  when your systems
[28:36.920 --> 28:39.160]  are still vulnerable. It's the time when someone has
[28:39.240 --> 28:41.120]  a working exploit and your system is vulnerable. That's your
[28:41.120 --> 28:43.000]  window of vulnerability. It's broken apart into
[28:43.000 --> 28:45.080]  three parts. Two of which you have no
[28:45.080 --> 28:47.000]  control over. The first one is...
[28:47.000 --> 28:49.700]  Can you guys still hear me or am I not micing well enough?
[28:50.300 --> 28:52.140]  Sorry. The first one is
[28:52.140 --> 28:54.000]  the first part of your window of vulnerability is where the
[28:54.000 --> 28:55.960]  exploit exists but the vendor doesn't even
[28:55.960 --> 28:58.260]  know about the issue. Call this Oday.
[28:58.320 --> 29:00.540]  Right? You can do nothing about that.
[29:00.680 --> 29:02.020]  If nobody knows
[29:02.020 --> 29:04.040]  about the vulnerability except the people
[29:04.040 --> 29:06.120]  with the exploit and they're hitting you, well
[29:06.120 --> 29:08.280]  you're vulnerable whether you like it or not.
[29:08.340 --> 29:09.940]  We can do something about that. Hardening actually
[29:09.940 --> 29:11.840]  works on this. The next piece is
[29:11.840 --> 29:13.920]  an exploit exists and the vendor isn't creating a patch.
[29:13.920 --> 29:16.340]  They're not done creating a patch. It takes them a little while.
[29:16.360 --> 29:17.800]  Say it takes them, you know, a week.
[29:17.800 --> 29:19.780]  But really nowadays it's about a month.
[29:20.220 --> 29:21.820]  Okay? And then the third is patch exists
[29:21.820 --> 29:23.960]  and you haven't applied it yet. Most of us patch
[29:23.960 --> 29:25.620]  kind of closer to monthly or
[29:25.620 --> 29:28.260]  you know, weekly maybe. It would be nice if weekly.
[29:28.400 --> 29:29.840]  Right? But some people only
[29:29.840 --> 29:31.960]  patch quarterly and God, some people patch yearly
[29:31.960 --> 29:33.660]  and some people never patch at all.
[29:34.180 --> 29:35.940]  But the issue is that because you've got these first
[29:35.940 --> 29:37.840]  two parts of that window, even if you patch
[29:37.840 --> 29:39.800]  perfectly, you still end up with a vulnerable machine
[29:39.800 --> 29:41.920]  now and then. You still end up with a vulnerable machine
[29:41.920 --> 29:43.820]  and you're just kind of like rolling the dice, hoping that
[29:43.820 --> 29:45.800]  today your machine isn't vulnerable and
[29:45.800 --> 29:48.520]  attacked at the same time. Does that make sense?
[29:48.720 --> 29:49.900]  So the idea is
[29:49.900 --> 29:52.140]  we like hardening because this is reactive.
[29:52.140 --> 29:53.880]  Reactive is going and patching. Reactive
[29:53.880 --> 29:55.860]  is going and saying, oh God, we just got
[29:55.860 --> 29:57.880]  attacked on this port or people are attacking on this
[29:57.880 --> 29:59.880]  port. Maybe I should set my firewall to start blocking
[29:59.880 --> 30:02.300]  to start blocking SQL server queries.
[30:02.500 --> 30:04.460]  Right? That's kind of the reactive process.
[30:04.480 --> 30:05.940]  The proactive process is
[30:05.940 --> 30:07.860]  configuring that firewall ahead of time and saying
[30:07.860 --> 30:10.060]  wait, there's no reason for anyone to do SQL queries
[30:10.060 --> 30:11.840]  from outside my network into
[30:11.840 --> 30:13.880]  my network. Or better yet, I don't
[30:13.880 --> 30:15.720]  allow you, these are the protocols I allow in and
[30:15.720 --> 30:17.600]  I don't allow the rest in so if SQL ends up
[30:17.600 --> 30:20.140]  being the worm tomorrow,
[30:20.140 --> 30:21.440]  not so much the worries.
[30:22.340 --> 30:24.060]  The other thing we do is we harden a host
[30:24.060 --> 30:25.900]  because if we harden a host, maybe it won't be
[30:25.900 --> 30:26.640]  vulnerable.
[30:27.920 --> 30:29.760]  Hardening is just the process of configuring
[30:29.920 --> 30:31.880]  a system for better security. It means you turn
[30:31.880 --> 30:33.880]  off things you're not using. It means
[30:33.880 --> 30:36.280]  you're better configuring the stuff you are using.
[30:36.520 --> 30:37.960]  It doesn't involve the kernel level
[30:37.960 --> 30:39.900]  modification of the system like SELinux
[30:39.900 --> 30:41.760]  or Pitbull or trusted BSD, Solaris
[30:41.760 --> 30:43.920]  or whatever, what have you.
[30:43.960 --> 30:45.700]  It does involve going and looking at
[30:45.700 --> 30:47.720]  permissions, access controls, and
[30:47.720 --> 30:49.720]  looking at whether the permissions are appropriate or too
[30:49.720 --> 30:51.740]  lax. You remember a couple
[30:51.740 --> 30:54.040]  releases ago, Apple, my trusty
[30:54.040 --> 30:55.700]  Apple, right, had a wonderful vulnerability
[30:55.700 --> 30:57.840]  to let any user on the system backdoor
[30:58.340 --> 30:59.600]  a bunch of third party applications
[30:59.600 --> 31:01.520]  because the permissions were world-writable.
[31:01.900 --> 31:03.880]  Anybody remember that? That was a really good one. Dave G
[31:03.880 --> 31:05.640]  found that, it was awesome.
[31:06.120 --> 31:07.940]  It was awesome in multi-user systems.
[31:07.940 --> 31:09.800]  I'm sure some people at universities had a really great
[31:09.800 --> 31:11.480]  time with the Apple XServes.
[31:12.320 --> 31:13.440]  What else?
[31:13.440 --> 31:15.780]  The other side of it is it involves basically
[31:15.780 --> 31:18.000]  tweaking settings in the system
[31:18.000 --> 31:19.620]  and in the applications to give users
[31:19.620 --> 31:21.900]  what access they need and not really anymore
[31:21.900 --> 31:23.820]  of it. It comes down
[31:23.820 --> 31:26.600]  to two principles. One is least privilege, the other is minimalism.
[31:26.600 --> 31:28.040]  Least privilege says basically
[31:28.040 --> 31:29.680]  each application or OS component
[31:29.680 --> 31:31.020]  or user or whatever
[31:32.120 --> 31:33.740]  only grants whatever privilege
[31:33.740 --> 31:36.260]  the other users need, that the users need to give it.
[31:36.260 --> 31:37.700]  The users only get what privilege we
[31:37.700 --> 31:39.440]  want to give them. Minimalism says
[31:39.440 --> 31:41.920]  we configure the system for fewer features.
[31:41.920 --> 31:43.540]  We say these are the features we're using.
[31:43.540 --> 31:45.740]  Let's better tune the system. You'll get some nice speed
[31:45.740 --> 31:47.420]  out of this, right? Because you won't be running
[31:47.420 --> 31:49.820]  50 applications, you'll be running 5.
[31:49.880 --> 31:52.200]  Just the 5 that we're supposed to be running here.
[31:53.600 --> 31:54.400]  In essence
[31:56.780 --> 31:57.180]  ok
[31:57.600 --> 31:59.500]  this is, now there's one thing people ask
[31:59.500 --> 32:01.880]  well what about SELinux, what about the kernel level stuff?
[32:01.880 --> 32:03.880]  Kernel level stuff is basically
[32:03.880 --> 32:05.560]  complementary to hardening. You can
[32:05.560 --> 32:07.200]  basically do both. Fedora
[32:07.200 --> 32:09.800]  my Fedora core 4 system has SELinux turned on
[32:09.800 --> 32:11.900]  and I'm hardening it with Bastille.
[32:12.400 --> 32:12.540]  Ok
[32:13.600 --> 32:15.640]  The thing with kernel level is that sometimes
[32:15.640 --> 32:17.480]  is that kernel level can be really awesome
[32:17.480 --> 32:19.980]  because it can contain a lot you can't do with hardening.
[32:19.980 --> 32:21.680]  On the other hand, hardening can do some things that kernel
[32:21.680 --> 32:23.440]  level can't do. One is that
[32:23.440 --> 32:25.860]  one is that kernel level very often contains
[32:25.860 --> 32:27.740]  the attacker after they've taken
[32:27.740 --> 32:29.400]  down, after they've compromised bind. You know
[32:29.400 --> 32:31.620]  they compromise bind, bind falls down, they don't
[32:31.620 --> 32:34.220]  get their powerful root shell because they're SELinuxed.
[32:34.220 --> 32:36.260]  On the other hand, if we can
[32:36.260 --> 32:38.260]  configure the thing, the thing that was being
[32:38.260 --> 32:39.760]  attacked so the exploit doesn't work
[32:39.760 --> 32:42.020]  or the code the exploit was trying to hit
[32:42.020 --> 32:44.220]  isn't available at all, maybe it's turned off, maybe
[32:44.220 --> 32:46.320]  it's removed, well then we don't get compromised
[32:46.320 --> 32:48.680]  at all, the bind server never goes down.
[32:48.760 --> 32:50.780]  The best example I can give you is Apache.
[32:50.860 --> 32:52.520]  Most of Apache's real functionality
[32:52.520 --> 32:54.140]  comes in these Apache modules that you can
[32:54.140 --> 32:56.580]  turn off at start time. It's not a
[32:56.580 --> 32:58.760]  recompile, it's just like comment something out, it doesn't
[32:58.760 --> 33:00.620]  load. You have code that doesn't load because
[33:00.620 --> 33:02.200]  you configured it not to. Apache is a great
[33:02.200 --> 33:04.080]  example too because it comes with, Red Hat
[33:04.080 --> 33:06.420]  ships it with say 34 different Apache
[33:06.420 --> 33:08.560]  modules, of which you might need
[33:08.960 --> 33:10.340]  five, depending on what kind of site
[33:10.340 --> 33:12.040]  you're running. So if you can turn off the ones
[33:12.040 --> 33:14.240]  you're not using and a vulnerability comes out
[33:14.240 --> 33:16.200]  and one of the ones that was on
[33:16.200 --> 33:18.180]  before, congratulations, you don't get nailed
[33:18.180 --> 33:20.200]  by it. Is that cool?
[33:20.200 --> 33:21.200]  Does that make sense?
[33:23.540 --> 33:24.480]  The other side of
[33:24.480 --> 33:26.700]  kernel level hardening is that it's hard.
[33:27.220 --> 33:28.340]  Kernel level, I mean kernel level
[33:29.040 --> 33:30.180]  technologies are hard.
[33:30.180 --> 33:31.920]  Writing the profiles, saying this program
[33:31.920 --> 33:34.020]  needs to write to this, needs to read to this,
[33:34.020 --> 33:35.760]  it needs to be able to do this capability
[33:35.760 --> 33:38.040]  but not this capability, that takes
[33:38.340 --> 33:39.940]  a lot of, that takes understanding, it takes
[33:40.040 --> 33:41.860]  a whole bunch of training to learn how to do that.
[33:41.980 --> 33:43.700]  Red Hat's made that possible with SE Linux
[33:43.700 --> 33:45.780]  because they've said, okay, we'll write a really good profile
[33:45.780 --> 33:48.480]  for the users and not require them to do it.
[33:48.500 --> 33:49.700]  On the other hand, the profiles are a little
[33:49.700 --> 33:51.820]  looser than you'd want them to be because Red Hat
[33:51.820 --> 33:53.440]  has to make sure that whatever you're going to do with that
[33:53.440 --> 33:55.220]  web server, it still works.
[33:55.740 --> 33:57.860]  Does that make sense? Okay, cool.
[33:58.820 --> 34:00.620]  You can learn to make your own profiles,
[34:00.620 --> 34:01.980]  it just takes some real training.
[34:02.320 --> 34:03.960]  There's a book on SE Linux.
[34:06.280 --> 34:07.900]  Anyway, you should continue looking
[34:07.900 --> 34:09.480]  at kernel level solutions. They're nice.
[34:09.480 --> 34:11.080]  I really like GR security.
[34:11.260 --> 34:13.120]  I like SE Linux. These are good.
[34:13.680 --> 34:15.540]  They're complimentary. You can still harden
[34:15.540 --> 34:17.040]  and probably still should.
[34:17.560 --> 34:19.580]  It's not a difficult thing to do.
[34:19.760 --> 34:21.620]  It's a little bit, it can be a little tedious
[34:21.620 --> 34:23.280]  if you're doing it all by hand, but well,
[34:23.280 --> 34:24.780]  we've got a tool for that.
[34:26.480 --> 34:28.160]  It's not hard to do. CIS,
[34:28.160 --> 34:29.860]  the Center for Internet Security, writes guides
[34:29.860 --> 34:31.980]  and the guides are designed
[34:31.980 --> 34:34.040]  to be used by junior level
[34:34.040 --> 34:35.020]  sysadmins.
[34:35.320 --> 34:37.820]  You might not even know entirely
[34:37.820 --> 34:40.200]  how to work their favorite editor just yet.
[34:41.400 --> 34:42.640]  This stuff can still be done.
[34:42.640 --> 34:45.540]  Black Hat has a two day course, I teach it,
[34:45.540 --> 34:46.940]  and that two day course does
[34:46.940 --> 34:48.920]  Solaris and Linux and it's comprehensive.
[34:49.200 --> 34:51.260]  There are five day courses at other organizations,
[34:51.260 --> 34:53.000]  but the fact that you can learn it that quickly
[34:53.000 --> 34:54.260]  says something.
[34:54.260 --> 34:56.280]  I mean, I can teach you one operating system
[34:56.280 --> 34:58.060]  how to manually harden in a day.
[34:58.180 --> 34:59.880]  We do two in two days.
[34:59.880 --> 35:01.000]  This is not hard stuff.
[35:01.000 --> 35:01.940]  This isn't rocket science.
[35:01.940 --> 35:04.100]  This isn't anywhere near rocket science.
[35:05.220 --> 35:07.280]  Anyway, it's pretty easy to do.
[35:07.280 --> 35:08.820]  It's also really effective.
[35:08.900 --> 35:10.440]  And I'll tell you about two examples.
[35:10.540 --> 35:12.600]  The first is the CIS guide.
[35:13.300 --> 35:15.420]  NSA's IAD, the information assurance guys
[35:15.420 --> 35:17.260]  that are around to stop machines
[35:17.260 --> 35:18.800]  from being broken into,
[35:18.800 --> 35:20.560]  they basically took a benchmark
[35:20.560 --> 35:22.320]  and ran it against a Windows system.
[35:22.320 --> 35:24.520]  And when they were done, 90% of the vulnerabilities
[35:24.520 --> 35:26.980]  that were in that Windows system were mitigated.
[35:26.980 --> 35:28.280]  You couldn't hit them.
[35:28.440 --> 35:30.360]  You either couldn't use them
[35:30.360 --> 35:32.280]  or you couldn't get anywhere by using them.
[35:33.100 --> 35:34.540]  You can do the same thing with Linux.
[35:34.540 --> 35:37.140]  If you basically do all the hardening guides,
[35:37.140 --> 35:38.900]  you don't have an extremely useful system.
[35:38.900 --> 35:41.640]  But 90-95% of your vulnerabilities are gone.
[35:43.400 --> 35:44.540]  Bastion Linux is just a way
[35:44.540 --> 35:45.900]  to do this programmatically.
[35:46.380 --> 35:47.820]  When we created it, we created it
[35:47.820 --> 35:50.440]  right when Red Hat 6.0 came out.
[35:50.440 --> 35:52.560]  We just did a normal audit of a Red Hat 6.0 system.
[35:52.560 --> 35:53.780]  Very, very standard.
[35:53.780 --> 35:54.660]  Just looked at it and said,
[35:54.660 --> 35:56.840]  what would you do if you're doing best practice hardening?
[35:57.180 --> 35:58.900]  We wrote a program to do it.
[35:59.040 --> 36:00.560]  It basically stopped or contained
[36:00.560 --> 36:02.780]  every major vulnerability that was in the system,
[36:02.780 --> 36:03.620]  which was really nice.
[36:03.620 --> 36:05.220]  Bind had a remote root hole.
[36:06.500 --> 36:08.240]  WooFTPD had a remote root hole.
[36:08.340 --> 36:10.400]  LPD plus SendMail, the combination of those two,
[36:10.400 --> 36:11.780]  got you another remote root.
[36:11.780 --> 36:13.680]  DumpRestore, local privilege escalation.
[36:13.780 --> 36:15.360]  GPM was a console-level
[36:16.720 --> 36:17.780]  privilege escalation.
[36:17.780 --> 36:19.540]  All of those things were stopped by Bastille.
[36:19.540 --> 36:22.480]  That's not because Bastille is just amazingly wonderful.
[36:22.560 --> 36:23.860]  I'd like to think it is, but
[36:23.860 --> 36:26.220]  that's because if you do this standard, normal stuff
[36:26.220 --> 36:27.560]  that we've got in books,
[36:27.560 --> 36:30.060]  that we've got on documentation, we've got on websites or whatever,
[36:30.060 --> 36:31.580]  this is what happens.
[36:31.700 --> 36:33.520]  There were only two we didn't nail,
[36:33.520 --> 36:35.800]  and they were just little commands that if root ran them
[36:35.800 --> 36:38.060]  and somebody had created, and somebody had been able to
[36:38.060 --> 36:40.200]  like, say, create a hostile man page,
[36:40.200 --> 36:42.200]  well, that's not anything we can really do anything about.
[36:42.200 --> 36:44.300]  That's one of those things that hardening won't get ya.
[36:44.520 --> 36:45.620]  But that's okay.
[36:45.700 --> 36:46.880]  So Bastille can kind of lock down.
[36:46.880 --> 36:49.420]  This is our complete list of what Bastille locks down right now.
[36:49.440 --> 36:51.620]  It does Red Hat, all the old ones,
[36:51.620 --> 36:53.100]  and Enterprise, and FedoraCore,
[36:53.100 --> 36:55.400]  and I'll release FedoraCore 4 tomorrow.
[36:56.000 --> 36:57.700]  Support's only in CVS for that.
[36:57.960 --> 37:00.060]  HPUX, Mandrake, or Mandrever, whatever you call it,
[37:00.060 --> 37:02.060]  Debian, Sousa, Gen 2, Mac OSX,
[37:02.060 --> 37:03.240]  Solaris soon.
[37:03.920 --> 37:04.900]  Need help.
[37:05.600 --> 37:07.380]  Again, one of the differences with Bastille
[37:07.380 --> 37:08.860]  was that it educated the SysAdmin.
[37:09.220 --> 37:11.040]  Educating the SysAdmin is really good if you, say,
[37:11.040 --> 37:14.320]  want the SysAdmin to not end up on the wall of sheep.
[37:14.820 --> 37:16.700]  If you want the SysAdmin to stop using Telnet,
[37:16.700 --> 37:18.300]  you have to tell them Telnet's bad.
[37:18.340 --> 37:19.080]  Because otherwise they'll say,
[37:19.080 --> 37:20.860]  I've been using Telnet for 10 years.
[37:20.940 --> 37:21.880]  What's wrong with Telnet?
[37:21.880 --> 37:23.560]  And you say, well, I can take it over.
[37:23.560 --> 37:25.340]  I can sniff it. I can sniff it or take it over.
[37:25.340 --> 37:27.140]  And when you've got switches, don't use it.
[37:27.140 --> 37:28.320]  Use SSH instead.
[37:28.320 --> 37:31.000]  And your SysAdmin says, okay, I'll let you turn off Telnet.
[37:31.100 --> 37:32.780]  Does that make sense? Yeah.
[37:32.780 --> 37:35.540]  Okay, so people have found it very educational.
[37:35.540 --> 37:36.840]  There are organizations that use Bastille
[37:36.840 --> 37:38.240]  entirely for the educational component
[37:38.240 --> 37:39.820]  and don't actually have it hard in the system
[37:39.820 --> 37:41.300]  because they want to do it manually.
[37:41.400 --> 37:44.080]  Hopefully the assessment mode makes things easier for that.
[37:45.000 --> 37:46.840]  Okay, it's really easy to automate.
[37:46.840 --> 37:49.120]  You create a config, two commands.
[37:49.120 --> 37:50.980]  You SCP a config over to another system
[37:50.980 --> 37:52.720]  and run Bastille over an SSH pipe
[37:52.720 --> 37:54.480]  and you can apply it to another system.
[37:54.480 --> 37:56.280]  If you're using one of those mass SSHers
[37:56.280 --> 37:59.760]  that lets you SSH to a thousand systems at once,
[37:59.760 --> 38:02.020]  congratulations, this gets really scalable.
[38:02.020 --> 38:03.380]  Okay, the whole thing is written
[38:03.380 --> 38:05.620]  so that it's very easy to script around Bastille.
[38:05.620 --> 38:06.940]  It's very easy to add on to it
[38:06.940 --> 38:08.260]  without having to know any Perl.
[38:09.140 --> 38:11.200]  The nice thing is, so why do you use Bastille
[38:11.200 --> 38:12.720]  or why do you use an automated system?
[38:12.720 --> 38:15.360]  Well, one of the reasons you do it is for consistency.
[38:15.360 --> 38:16.840]  If you don't have a thousand systems, fine,
[38:16.840 --> 38:19.960]  you like to do one the same way every time.
[38:20.180 --> 38:22.400]  Maybe you create a standard build config file.
[38:22.400 --> 38:25.340]  Maybe you make this part of your build process.
[38:25.920 --> 38:27.380]  All you have to do is every time you,
[38:27.380 --> 38:29.600]  basically you only have to update these config files
[38:29.600 --> 38:30.480]  when you get a new distro
[38:30.480 --> 38:32.640]  or when you get a new release of the distro.
[38:32.940 --> 38:34.740]  HPUX makes this really easy.
[38:34.740 --> 38:35.580]  There are four different ways.
[38:35.580 --> 38:36.860]  Part of their install process,
[38:36.860 --> 38:39.160]  they're shipping with Bastille with the operating system.
[38:40.000 --> 38:42.240]  What I want to do is, let's see,
[38:42.240 --> 38:44.100]  we're running a little low on time.
[38:44.100 --> 38:46.020]  What I've got is a list of modules
[38:46.020 --> 38:47.760]  and kind of what they do.
[38:48.760 --> 38:50.880]  Would you guys rather see a list of modules
[38:50.880 --> 38:52.160]  and what they do or would you rather
[38:52.160 --> 38:54.200]  kind of see how you add on to this?
[38:54.820 --> 38:57.100]  Add on, okay, works for me.
[38:58.200 --> 39:00.280]  Skip, skip, skip.
[39:00.280 --> 39:02.420]  Skip, skip.
[39:03.620 --> 39:05.620]  Bastille's actually really easy to add on to.
[39:05.620 --> 39:08.260]  We wrote it and then like so many open source projects,
[39:08.260 --> 39:10.320]  six months later we rewrote it entirely.
[39:10.640 --> 39:12.120]  And the rewrite is just to make it,
[39:12.120 --> 39:13.760]  was just to make it easier to maintain.
[39:13.760 --> 39:15.860]  And that happens on a lot of open source projects.
[39:15.860 --> 39:17.800]  Probably happens on a lot of commercial software.
[39:17.840 --> 39:18.960]  Because once you've written it once,
[39:18.960 --> 39:20.800]  you understand how to make it a lot better.
[39:22.360 --> 39:23.640]  So what we did is,
[39:23.640 --> 39:25.160]  the whole thing's in Perl,
[39:25.160 --> 39:26.320]  but if you don't know Perl,
[39:26.320 --> 39:28.500]  we actually worked to make it really understandable.
[39:30.640 --> 39:32.640]  So that you could work on this
[39:32.640 --> 39:33.720]  even if you don't know Perl.
[39:33.720 --> 39:34.500]  And I'll show you an example
[39:34.500 --> 39:36.300]  of how you kind of add something
[39:36.300 --> 39:38.100]  to turn off a set UID bit.
[39:39.040 --> 39:40.720]  So if you wanted to add an item,
[39:40.720 --> 39:41.860]  the first major thing you have to do
[39:41.860 --> 39:43.600]  is create a question for that item.
[39:43.620 --> 39:45.600]  Basically that text, the explanation,
[39:45.600 --> 39:46.480]  here's why you should do this,
[39:46.480 --> 39:47.560]  here's why you shouldn't,
[39:47.560 --> 39:48.660]  what the question is,
[39:48.660 --> 39:50.600]  what the default answer could be.
[39:50.820 --> 39:51.900]  You could add modules,
[39:51.900 --> 39:55.460]  and we've had people contribute modules before,
[39:55.460 --> 39:56.900]  and it's pretty easy.
[39:57.880 --> 39:59.520]  Here's just the question type stuff.
[39:59.520 --> 40:00.320]  This first one is just
[40:00.320 --> 40:02.800]  every item gets its own name.
[40:02.800 --> 40:03.820]  There's a short explanation,
[40:03.820 --> 40:04.700]  you can have a long explanation
[40:04.700 --> 40:06.440]  so you can give the user more detail.
[40:06.440 --> 40:08.260]  There's a little explain less, explain more.
[40:08.280 --> 40:09.700]  So that lets them granularly decide,
[40:09.700 --> 40:10.820]  I know a lot about this kind of stuff,
[40:10.820 --> 40:11.860]  so tell me less.
[40:12.540 --> 40:13.540]  There's a question,
[40:13.540 --> 40:15.500]  there's what distributions it works on,
[40:15.500 --> 40:17.320]  there's a default answer,
[40:17.320 --> 40:19.240]  there's a regular expression, answers have to match,
[40:19.240 --> 40:21.440]  if you don't know what that means, don't worry about it,
[40:21.440 --> 40:22.700]  you can skip that part.
[40:22.800 --> 40:24.940]  And there's some stuff that says what the next question is
[40:24.940 --> 40:26.100]  and what the previous question is,
[40:26.100 --> 40:28.200]  and you can actually skip that part if you want to.
[40:28.760 --> 40:31.500]  If I wanted to create a new thing that turned off setUid
[40:31.500 --> 40:32.880]  for dump and restore,
[40:32.880 --> 40:34.500]  this is the dump and restore action.
[40:34.860 --> 40:37.140]  I've got this if getGlobalConfig,
[40:37.140 --> 40:38.540]  the module name, the question name,
[40:38.540 --> 40:41.160]  you could copy paste that, equals yes.
[40:41.160 --> 40:43.280]  If they answered yes to this question,
[40:43.280 --> 40:45.260]  then I run b remove suid,
[40:45.260 --> 40:47.760]  remove setUid, it's one line,
[40:47.760 --> 40:49.160]  from dump.
[40:49.160 --> 40:50.940]  And this is a path name, but you can also,
[40:50.940 --> 40:53.400]  if that path differs from operating system to operating system,
[40:53.400 --> 40:55.140]  you can put in one of our getGlobal things,
[40:55.140 --> 40:56.820]  it says this is in a table somewhere.
[40:56.820 --> 40:59.140]  But you could just put user sbin dump.
[40:59.740 --> 41:01.100]  Does that make sense?
[41:02.820 --> 41:05.500]  This is really easy, I'll show you the API.
[41:05.740 --> 41:07.500]  The API is really simple.
[41:08.040 --> 41:09.460]  You can go and, you know,
[41:09.460 --> 41:12.080]  b chamod, chamod changes the permissions,
[41:12.080 --> 41:13.720]  changes the ownership,
[41:13.720 --> 41:16.440]  remove setUid, create symlink.
[41:16.560 --> 41:18.240]  The reason we've end up, a lot of these things
[41:18.240 --> 41:20.200]  are things that were present in Perl already,
[41:20.200 --> 41:22.600]  we wrappered them so that you can undo the whole thing.
[41:22.600 --> 41:23.980]  The idea behind Bastille is you can either
[41:23.980 --> 41:26.100]  granularly undo it, or we've got a big red button
[41:26.100 --> 41:28.000]  called revert. And that big red button
[41:28.000 --> 41:29.980]  yanks the system all the way back to where it was
[41:29.980 --> 41:31.420]  before you were running Bastille.
[41:31.460 --> 41:33.160]  It's not something you want to run six months later,
[41:33.160 --> 41:35.540]  because that part's hard. But if you just ran Bastille
[41:35.540 --> 41:37.360]  and you're like, wait, I answered yes to everything
[41:37.360 --> 41:39.380]  and I should have read revert,
[41:39.380 --> 41:41.100]  you hit your big red button and you start over.
[41:41.100 --> 41:43.300]  Or you hit your big red button and you throw away Bastille
[41:43.300 --> 41:45.480]  and curse my name. Right? Doesn't matter.
[41:45.480 --> 41:46.620]  Whatever you want to do.
[41:47.400 --> 41:49.060]  So, these are other things.
[41:49.060 --> 41:51.260]  b checkConfigOff turns things off in the
[41:51.260 --> 41:52.820]  RC scripts and all that.
[41:52.820 --> 41:54.360]  You can copy files.
[41:54.820 --> 41:56.180]  These are kind of the fun ones.
[41:56.180 --> 41:58.900]  b appendLine just sticks a line on the end of a file
[41:58.900 --> 42:00.480]  if it's not already there.
[42:00.480 --> 42:02.400]  This is all made so that if you run Bastille
[42:02.400 --> 42:04.980]  you can run it 8,000 times again with the same config file
[42:04.980 --> 42:06.240]  and not break the system.
[42:06.240 --> 42:08.080]  Because Bastille will look for
[42:08.080 --> 42:09.920]  the stuff that it's trying to add.
[42:10.000 --> 42:10.980]  You can insert lines
[42:12.260 --> 42:14.100]  before a given line in the file.
[42:14.160 --> 42:16.100]  You can prepend a line at the beginning of the file.
[42:16.100 --> 42:17.760]  You can replace a given line.
[42:18.420 --> 42:20.600]  Basically this matches the way
[42:20.600 --> 42:22.200]  the Unix config files are done.
[42:22.360 --> 42:24.620]  b hashCommentLine. What could be easier?
[42:24.620 --> 42:26.320]  You want to turn a line off?
[42:26.320 --> 42:28.360]  You don't have to delete it. Just comment it out with hash.
[42:28.780 --> 42:30.120]  Hash comment it out.
[42:30.540 --> 42:31.820]  DeleteLine is another thing you can do.
[42:31.820 --> 42:33.040]  And all of these work.
[42:33.040 --> 42:35.000]  They all work on ProRegularExpressions.
[42:35.000 --> 42:37.800]  If you don't know that, you can use exact matches.
[42:38.080 --> 42:39.980]  But this is all really simple to do.
[42:40.220 --> 42:41.060]  And that's the idea.
[42:42.120 --> 42:43.140]  That's the API
[42:43.140 --> 42:45.880]  for adding things, for adding new items.
[42:45.880 --> 42:47.740]  It's really actually quite easy.
[42:47.740 --> 42:48.860]  If you don't know Perl,
[42:48.860 --> 42:50.820]  you still have a pretty good chance of being able to add an item.
[42:50.820 --> 42:53.140]  Especially if you can copy and paste something similar.
[42:53.320 --> 42:54.740]  I added something yesterday
[42:54.740 --> 42:56.620]  to remove... I added something yesterday
[42:56.620 --> 42:59.120]  in about five minutes to remove mDNSResponder.
[42:59.120 --> 43:01.020]  That rendezvous zero conf
[43:01.020 --> 43:03.340]  Bonjour thing that's on Apple.
[43:03.340 --> 43:05.340]  It's also on Red Hat Fedora Core now.
[43:05.340 --> 43:06.660]  It was really easy to turn it off.
[43:06.660 --> 43:09.520]  I copied and pasted something that turned off GPM.
[43:09.520 --> 43:11.080]  Because that used CheckConfig.
[43:11.380 --> 43:12.760]  And to turn off mDNSResponder,
[43:12.760 --> 43:14.940]  it's another CheckConfig. It's really, really quick.
[43:14.940 --> 43:16.260]  Eight lines of Perl.
[43:16.540 --> 43:18.320]  And these kind of lines.
[43:18.320 --> 43:20.080]  Not the kind of lines you can't read.
[43:20.260 --> 43:21.380]  Does that make sense?
[43:22.580 --> 43:24.720]  Doing the same thing, you create an audit item.
[43:24.720 --> 43:26.500]  You can create an audit item.
[43:26.500 --> 43:28.160]  We want you to create an audit item for anything
[43:28.160 --> 43:29.660]  that you create a hardening item for.
[43:29.660 --> 43:31.420]  And all it is, is you have this thing.
[43:31.420 --> 43:33.020]  Just like this global test.
[43:33.140 --> 43:34.340]  The module name.
[43:34.340 --> 43:37.640]  And then that name of the question.
[43:37.960 --> 43:39.380]  Equals sub.
[43:39.420 --> 43:40.560]  And you basically have a subroutine
[43:40.560 --> 43:42.860]  that does whatever it was that should be tested.
[43:42.860 --> 43:45.460]  And you return ask or skip.
[43:45.700 --> 43:48.280]  Or you return one or zero.
[43:48.460 --> 43:50.720]  This says if B is sued.
[43:50.720 --> 43:52.140]  If ping is setUID.
[43:52.140 --> 43:53.740]  Or ping six is setUID.
[43:53.740 --> 43:56.660]  Then I say, okay, the test fails.
[43:56.660 --> 43:58.740]  It's really kind of that easy.
[43:58.960 --> 44:00.540]  And you can do the same thing with match lines.
[44:00.620 --> 44:02.560]  Everything that we basically could do to something
[44:02.920 --> 44:04.940]  now has a corresponding check.
[44:05.220 --> 44:06.280]  B is service off.
[44:06.280 --> 44:07.980]  We'll go and tell you if something is INETD based
[44:07.980 --> 44:10.520]  or XINETD based or RC based is on or off.
[44:10.520 --> 44:11.840]  Return match line.
[44:11.840 --> 44:14.060]  Is there a line in this file that matches this pattern?
[44:14.060 --> 44:16.320]  If I was hash commenting or deleting a line,
[44:16.320 --> 44:18.020]  now I can check and see if it's present.
[44:18.160 --> 44:20.360]  So now I have an easy, quick way to write a check
[44:20.360 --> 44:22.300]  at the same time that I'm writing the fix.
[44:22.540 --> 44:24.500]  That makes it a lot easier to develop the tool.
[44:24.500 --> 44:26.680]  It also, it makes it easier to write things
[44:26.680 --> 44:27.380]  for your environment.
[44:27.380 --> 44:29.580]  And the whole idea is that all these things
[44:29.580 --> 44:30.880]  should be pretty self-explanatory.
[44:30.880 --> 44:32.340]  B is package installed.
[44:32.340 --> 44:34.340]  Tells you if something is installed.
[44:34.340 --> 44:35.840]  Is process running?
[44:36.040 --> 44:37.980]  The idea is that it should sound like English.
[44:37.980 --> 44:39.600]  The idea is that this should be really easy
[44:39.600 --> 44:42.520]  for you to look at a few and then make your own.
[44:42.600 --> 44:43.540]  And you can make your own.
[44:43.540 --> 44:44.560]  You can use it in your environment.
[44:44.560 --> 44:46.160]  People have written whole modules.
[44:46.340 --> 44:48.600]  I've actually got a module author in the front row.
[44:48.600 --> 44:50.680]  Mike Rasch, hello.
[44:51.500 --> 44:53.980]  Anyway, he wrote the port scan attack detector
[44:53.980 --> 44:56.860]  which is like port sentry except 8,000 times better.
[44:57.800 --> 44:59.040]  It just is.
[44:59.040 --> 44:59.820]  You can look into it.
[44:59.820 --> 45:00.640]  You'll agree.
[45:01.660 --> 45:04.080]  These tests are really easy to write.
[45:04.840 --> 45:06.580]  I'm going to stop now because we're basically
[45:06.580 --> 45:08.060]  about a minute before.
[45:08.060 --> 45:09.800]  But I've got some things to give out.
[45:09.800 --> 45:10.640]  I've got books.
[45:10.640 --> 45:11.820]  I've got t-shirts.
[45:11.880 --> 45:13.460]  The goons are desperate for me to get rid of them
[45:13.460 --> 45:15.180]  because they don't want to take them all home.
[45:15.180 --> 45:17.600]  Because they've already taken their own stash.
[45:17.780 --> 45:19.380]  They've got the extra ones.
[45:19.560 --> 45:20.700]  I'm going to be doing a book signing
[45:20.700 --> 45:22.700]  of the Snort 2.1 book.
[45:23.460 --> 45:26.000]  But this is another book that I worked on
[45:26.000 --> 45:27.400]  called Stealing the Continent.
[45:27.420 --> 45:28.840]  And here's the t-shirt.
[45:29.660 --> 45:30.880]  It's got a picture of the book
[45:30.880 --> 45:31.720]  but it says
[45:32.740 --> 45:35.100]  call it fiction if it helps you sleep better.
[45:36.000 --> 45:37.840]  Anyway, who wants a t-shirt?
[45:49.590 --> 45:51.290]  Okay, I'll do that with the books now.
[45:51.290 --> 45:56.690]  No, these are signed books.
[45:57.090 --> 45:58.070]  I've got...
[45:58.070 --> 45:59.750]  Somebody should ask questions.
[45:59.910 --> 46:01.370]  Wow, that guy's getting one.
[46:04.490 --> 46:06.630]  I've got a Snort 2.1 book
[46:06.630 --> 46:08.590]  which is one of the ones I'll be signing.
[46:08.590 --> 46:09.510]  I've got Mike Rash
[46:13.850 --> 46:15.970]  and I've got the Venice Enterprise Cluster
[46:16.590 --> 46:18.450]  for people who don't want the big ones.
[46:18.510 --> 46:20.530]  Okay, you can have this one.
[46:20.590 --> 46:22.350]  Now, I will take three questions
[46:22.350 --> 46:25.480]  and then we'll move on.
[46:25.620 --> 46:26.260]  Ask one.
[46:26.260 --> 46:28.180]  Can you check for password complexity?
[46:28.200 --> 46:29.560]  Can you check for what?
[46:30.440 --> 46:32.580]  Can you check for password complexity?
[46:32.720 --> 46:34.360]  We can import a password complexity
[46:34.360 --> 46:35.460]  and we can check for it.
[46:35.460 --> 46:38.140]  We turned that check off for now but we're turning it back on.
[46:38.140 --> 46:40.120]  We ran into a bug with how it works on one distro
[46:40.120 --> 46:42.160]  versus another. That's a good question.
[46:42.580 --> 46:43.740]  Intrusion prevention?
[46:44.140 --> 46:44.820]  Okay.
[46:47.160 --> 46:48.020]  Another question.
[46:48.020 --> 46:48.760]  Over there.
[46:51.820 --> 46:53.440]  Oh, that's a good question.
[46:53.440 --> 46:54.600]  Can we check for SSH?
[46:54.600 --> 46:57.820]  Version 1 versus Version 2, better configuration than SSH?
[46:57.820 --> 46:59.600]  Not yet, but if you want to write it
[46:59.600 --> 47:01.320]  or I want to write it, we'll do it.
[47:01.800 --> 47:02.960]  That's a bug.
[47:04.240 --> 47:05.560]  That one.
[47:06.480 --> 47:07.540]  Can you test
[47:08.140 --> 47:08.900]  SELinux?
[47:11.490 --> 47:12.070]  Wow.
[47:12.070 --> 47:15.130]  Can we check SELinux if it's target or permissive mode?
[47:15.490 --> 47:16.370]  No.
[47:17.950 --> 47:19.490]  I'd love to talk about it.
[47:19.490 --> 47:20.810]  If you are exiting the room,
[47:20.810 --> 47:22.230]  please exit this way.
[47:22.230 --> 47:22.790]  Thank you.