[-- Securing vali.roothack.org from remote attacks --]
I was given the responsability to secure our teams box from remote attacks, i broke my strategy into three different categories.
1 ) Removing vuln services
2 ) updating our services to the latest releases
3 ) changing banners on our services to fool potential attackers.
1 ) Removing vuln services
After nmap'ing our box I found multiple services running, possibly ten different services.
I got to work removing them by removing startup scripts from /etc/rc.d/ (we were running slackware).
To do this i issued the following command..(as root)..
chmod -x /etc/rc.d/START_UPSCRIPT
This stopped startup scripts from being executed at boot time.
Next i moved onto removing services started by inetd, to do this i edited /etc/inetd.conf (as root)..
After commenting out services started by inetd in /etc/inetd.conf i rebooted our box..( shutdown -r now )
After the reboot I once again nmap'ed our box, this time we were running 5 services ( the miminum amount of services we were required to run ).
Those services were :
1. FTP
2. SSH
3. HTTP
4. PRINTER SERVICES
5. the fifth i cant remember =\
My next move was to update to the latest versions of the services we were running.
2 ) Updating our services
I started to first update SSH, as we were running 2.9, i updated to 4.7..
I done this by using wget [link to ssh tar] on the gateway and then i scp'ed the tar over.
To scp files, you use this syntax scp filename user@box:/path/to/move/file/to
Before i compiled ssh, i changed the banner by editing 'version.h' in the openssh's src code.
I changed the banner to display version 2.9..
Afterwards i installed the latest apache,a small unheard of ftp daemon(to miminaze the risk of exploits being available for it).
I also then moved to disallow root logins over ssh, by editing the ssh configuration file.
And that was our approach to securing ourselves remotely.. Great game, great fun!