bits & bytes - Ping! Zine Web Tech Magazine

[featured article]
the specific task that must be performed.
A server that was compromised will always
be suspect. I always recommend reinstalling any
system where administrator (or root) level access is
compromised, because even if you cleaned up the
apparent damage from the compromise, missing
even one file can quickly land you right back in
the same (leaky!) boat. This includes procedures
when restoring backups; you should never assume
that your previous backup is free of traces of the
compromise. You should ensure that configuration
files don’t contain instructions to allow access
to an outside party. Also, system binaries should
never be restored from backup – the restore should
be limited to user data and system configuration
only. User data should also be reviewed as it is
restored, while all passwords should be changed,
following a compromise. Even if your intruder is
only able to obtain user access to your machine,
that still allows them to get their “foot in the door,”
and may provide further potential exposure to
exploitation.
Another pitfall that is still far too common is the
use of shared accounts (like nobody or apache) to
execute web scripts. Not only does this potentially
allow for the defacement or removal of user data
accessible by the shared account, but it also makes
tracking down the point of entry more difficult in
the event a compromise does occur. Web scripts
should run with the privileges of a specific system
user, eliminating both of those issues, and limiting
the damage of a script exploit to the user with the
exploitable script.
Also, check the locations that a potential intruder
may use. I’ve found that on a Linux system /tmp, /
var/tmp, /dev/shm, and Apache’s proxy directories
(all writable by default to anyone) are common
places used to store exploit, scanning, and other
potentially malicious applications. Strange files
in these locations can be a good indicator that
your machine may be compromised – even if the
intruder has not gained root access yet.
There are a number of other security tools that
may or may not be of use to you. Obviously,
everyone has a unique situation, and considering
other solutions such as a hardware-based firewall,
Network IDS, and commercial security software
can be useful. Remember, though – if you just
take a few simple steps, you can easily improve
the security of all your servers. While the time
investment can seem like a lot up front, in the long
run the benefits truly outweigh the associated cost.
Security is a serious concern, but if you consider it
as a factor when making decisions, and take basic
steps to improve your system security, it doesn’t
have to be a huge draw on your time nor does it
have to increase your blood pressure!
P!
PING! ZINE WRITER BIO
Adam C. Greenfield currently serves as Site5’s Chief Technology Officer. He has
been involved in web hosting for almost 10 years as both a Systems Administrator
and a Developer. Currently his primary focus is leading the Site5 Engineering
Team. He maintains a professional weblog at http://www.adamgreenfield.com/.
Adam can be reached at adam.greenfield@site5.com
26 Ping! Zine Web Hosting Magazine