2KKUU7ita

246
Part IV: Hacking Operating Systems
If you believe that someone has recently gained access to your system, either
physically or by exploiting a vulnerability, such as a weak password or buffer
overflow, you can use last, the program, to view the last few logins into the
system to check for strange login IDs or login times. This program peruses the
/var/log/wtmp file and displays the users who logged in last. You can enter
last | head to view the first part of the file (the first ten lines) if you want to
see the most recent logins.
Performing General Security Tests
Figure 12-12:
Running the
Tiger security-auditing
tool.
You can assess critical, and often overlooked, security issues on your Linux
systems, such as the following:
✓ Misconfigurations or unauthorized entries in the shadow password files,
which could provide covert system access
✓ Password complexity requirements
✓ Users equivalent to root
✓ Suspicious automated tasks configured in cron, the script scheduler
program
✓ Signature checks on system binary files
✓ Checks for rootkits
✓ Network configuration, including measures to prevent packet spoofing
and other denial of service (DoS) attacks
✓ Permissions on system log files
You can do all these assessments manually — or better yet, use an automated
tool to do it for you! Figure 12-12 shows the initiation of the Tiger securityauditing
tool (www.nongnu.org/tiger), and Figure 12-13 shows a portion of
the audit results. Talk about some great bang for no buck with this tool!