edin.no-ip.com

After my recent dark ages, is time to review my Debian security level... As a starting point, the Securing Debian Manual is a must for ANY Debian administrator. Moreover, there is some useful tools, e.g. tripwire, chkrootkit and fail2ban, too.

Tripwire (http://www.tripwire.com/)

It is a great and handy tool. Tripwire will scan all the directory/files that you are interested in, giving them a MD5 fingerprint, check and compare it periodically, then send you a report though Anacron.

The installation of Tripwire is not too complicated in Debian, just run the following command:

During installation dpkg will ask for "site-key passphrase" twice. You can input 2 different set of password for them, but usually I will use the same.

Always use secure password! If you don't know how to generate a suitable password, install pwgen and run the following command:

pwgen -c -n -y 8

Next, we need to go back to Tripwire configuration. Default Debian setup monitoring to some ALWAYS change directory/files, e.g. /var/log, /proc and so on. As they ALWAYS change, keep on monitoring them will just result as some always warning of change... In my case that seems to be meaningless... So let's mask them from /etc/tripwire/twpol.txt as below:

Finally, run the following command to rebuild the tripwire configuration, and initialize your system snapshot:

You will also need some follow up action during daily operation, tripwire --help can give you some idea:

Chkrootkit (http://www.chkrootkit.org/)

A system snapshot can give you a hand for compare if there is any changes, but what if your server already infected and/or hijacked? In this case you will need a system scan tools. Rootkit (http://en.wikipedia.org/wiki/Rootkit) are some of the well-known form of hijack model after a system hack in, and so install chkrootkit can give you a hand for checking.

In case of Debian, install chkrootkit with the following command:

The operation of chkrootkit is quite simple. Just run chkrootkit in CLI and it will give you a simple report. I can't teach you how to fix those infected program in here, because most of them are case by case ;p

Fail2ban (http://www.fail2ban.org/)

So now we have system snapshot, we scan rootkits, what's the next? If you are hosting some public production servers, the brute force attack (http://en.wikipedia.org/wiki/Brute_force_attack) to SSH service should always annoying your system log, and also DNS scan, too. Fail2ban can let you define some rules for system monitoring, keep on checking your log report, setup deny rules into your firewall, which all running automatically in background.

Install fail2ban in Debian with:

By Debian's default only SSH will be monitoring. All default filters are located in /etc/fail2ban/filter.d and you should activate those services that interested in for monitoring. As mentioned in the header section of /etc/fail2ban/jail.conf, we should create a file called as /etc/fail2ban/jail.local which contain our changes for override, e.g.:

Since Fail2ban is running as a system daemon so you will need to restart it after reconfiguration:

Finally, check your firewall setting if there is any update changes, e.g. checking iptables with:

You should discover some new firewall chains are setup. In my case, I have setup protection for both courierauth, apache, ssh, apache-overflows, ssh-ddos, apache-noscript and exim, therefore the firewall should look like:

The extra firewall rules will only activation DURING blocking period. When they are still activate, you can discover them with iptables -nvL, e.g.:

In order to change the block history, use cat /var/log/fail2ban.log | grep WARNING, e.g.: