Differences between version 2 and previous revision of AdvancedSecurityNotes.
Other diffs: Previous Major Revision, Previous Author, or view the Annotated Edit History
| Newer page: | version 2 | Last edited on Wednesday, September 17, 2003 11:53:10 am | by PerryLorier | Revert |
| Older page: | version 1 | Last edited on Wednesday, September 17, 2003 11:50:58 am | by PerryLorier | Revert |
@@ -12,12 +12,12 @@
!!Change offsets
use
preload -R
-which randomises offsets of libraries, making more exploits fail. Not a great help, but worth a try, every bit helps.
+which randomises offsets of libraries, making more exploits fail. Not a great help, but worth a try, every bit helps. As a nice side effect, dynamic linking time is improved too :)
!!Prevent system accounts using networking in unauthorised ways
use iptables(8) stateful firewalling to disallow incoming connections to ports that aren't explicitly allowed by the administrator, but still allow ftp etc through. Thus exploits which open a rootshell on port 6666 will fail, as incoming connections to port 6666 will be firewalled.
use iptables(8) uid matching to disallow outgoing connections from system accounts. This prevents exploits from downloading more stuff (such as a local root exploit to get root) and is usually a very good indicator that your box is compromised and can be used to generate automatic notifications.
iptables --insert OUTPUT --jump DROP -m state --state NEW --uid-owner www-data
(note, check the above line, I've not tested it, although I've used the principle before).
