Semester Progress for Fall 2003
Similar to last year, I joined COSI again this year for a single credit. This made my total credit count 19. I joined again because I found in the past that I learned any amazing amount within the confines of this organization. Last year my interest was immediately with the Z server, and this year was no exception. My overall interests lie with networking and security. As this is one of the focuses within the Z server I was immediately interested. This year one other individual expressed interest and joined the team with me. I was definitely excited as I am used to working on the team alone. However, after the initial meetings, it was working alone. The other group member was involved in other teams in COSI where he apparently had similar problems. Therefore, in an effort to not leave anyone behind, I continuously postponed more of our team work. This is a mistake that I will not make again and anyone that misses meetings will have to catch up on their own time. Individual work, which we decided on during the first meeting is what kept me busy. SInce I had 19 credits this semester and I was only taking COSI for one, cosi got the three hours per week attention outside of the weekly meetings, which I attended continuously. The individual work reflected the amount of knowledge that we had on networking and security (which leaves something to be desired). The first thing we needed was a place to play within the Z so a few dedicated guests for net/security usage were set up. Jason of course had us complete a test where we had to do this. This was something that was done within the confines of the entire Z team and everyone had to do it. Research was the largest part of the my first weeks. It took some time to get the Z team up and running and a bit longer to get the groups going. After which, reading and self learning was the largest parts of work. Numerous web sites were visited on security issues with Red Hat. I read a large part of the Red Hat Linux bible, and everything that it had on networking and security. I have several Oreily online books and I read selected parts on those as well. Primarily looking for information on IP Tables, and more specifically the default security settings. This would need to be know to continue work on the Z off of this base level. The original thoughts and outline is as follows.
Local security test
go through basic config
iptables
check permission
uid: 0
see what is running now
ports, etc
run local tests
nessus, saint
Specifics-
Versions of all "common" network daemons installed (not running)
Find /-perm 4000+
Permissions on /proc, /home, /dev
Kernel/tcp level security
Default startup services
Assigned/unassigned security policies (umask, etc)
Install vulnerable software
Test exploitability of software
Sandboxes
Evolving topic
The list was ideas of items that we would like to work on. Being solo on much of the project it became what I had time for. Therefore, if I wasn't familiar with something then I would have to learn it before executing the tasks. Since the beginning of the semester other items have also crept onto the list as I was working on the Z.
Create "Security Guidelines and Policies" -for the
team and the rest of the people using the z.
There are physical ips now on the z for different COSI services
Have started contacting individuals to see what ports need to be open
Like to lock down rest- prevent potential security risk
Have already got responses from mike
What about security risks for VM?
Can some sort of a script run every time a new linux par is created
Lock down unnecessary ports
Used a Z server contact @ IBM
see of there is recognized security risks to system
what they are
How they handle them
Some of the items on the list were accomplished but the list was not written for this semester alone. Looking through the basic configuration was accomplish as was iptables work and seeing if there were any users at UID: 0. I also contacted IBM late in the year to see what they know about security holes and their response (I am actually still waiting to hear back as the ZOS is what it primarily used).
The final project that I worked on for the final month's time on the Z was the creation of a DNS server. Documentation for such has been created and is availablehere. I had setup and DNS server before, but is was a cisco implementation and was a completely different process from what I was to do on the Z. The DNS server was by far what I am most proud of this semester and was something that took me quite some time to get used to, but was a great learning experience. It is know up and running and working properly. Next semester the featured ips' and there hostname's need to be added, but this is a small task. Personal plans for next semester include mantainance of the DNS server, and I would like to look into a customizable script that would lock out all unneeded ports specified by that guest's administrator.