Responding to a Security Incident
So, what will happen now? Should you sit back and wait for the ISP you just contacted to report back, "Wow! We got rid of that user!" Think you're going to break up a large international ring of hackers trying to take over the Pentagon?
You'll be lucky to get any notification that your memo was received, unless it's an automated reply. You'll probably not get any followup done, either, on their end. So why bother?
Rarely do potential attackers work just on you. Unless you hang out on the Internet and antagonize people for a hobby or a living, chances are they're not targeting you, but they're doing wide sweeps of the Internet to find vulnerable hosts. What you've done is provide the ISP with data that says "They were here, too". This is why you bother. If enough people complain they'll see it's a real problem and probably fix it.
Remember, the ISP staff are busy people. Routers explode, billing situations come up with their customers, new hardware has to be installed, in short, they have daily business to take care of. Their response will be tailored to the severity of the incident. One port probe on one machine is nothing for them to worry about. If you can demonstrate it was a network-scale issue or a recurring problem, then they may start to care.
So, carry on with your network activities, keep a watchful eye out for problems and improve your defenses as needed.
The SecurityFocus INCIDENTS list is an excellent mailing list about security incidents. Sit back and learn.http://www.securityfocus.com
The SANS GIAC effort is also a good place to learn about detects, what generates them and the like.http://www.sans.org/giac.htm
The GeekTools Whois Proxy is my favorite method of searching for domain information about a hostname, a network name or even a numerical address. It's smart enough to hit the right servers for information. You can also download the source and run your own local instance.http://www.geektools.com/cgi-bin/proxy.cgi
Documentation on using TCP_wrappers and general Linux hardening can be found athttp://www.enteract.com/~lspitz/linux.html
Using grep on your logs will make your life a lot easier. A good piece of documentation on it is athttp://www.sunworld.com/sunworldonline/swol-11-1999/swol-11-unix101.html
Two books in investigating computer crimes for a legal standpoint are:
Criminalistics: An Introduction to Forensic Science by Richard Saferstein. Prentice Hall, 1998.
Investigating Computer Crime by Franklin Clark and Ken Diliberto. CRC Press, 1996.
Practical Task Scheduling Deployment
July 20, 2016 12:00 pm CDT
One of the best things about the UNIX environment (aside from being stable and efficient) is the vast array of software tools available to help you do your job. Traditionally, a UNIX tool does only one thing, but does that one thing very well. For example, grep is very easy to use and can search vast amounts of data quickly. The find tool can find a particular file or files based on all kinds of criteria. It's pretty easy to string these tools together to build even more powerful tools, such as a tool that finds all of the .log files in the /home directory and searches each one for a particular entry. This erector-set mentality allows UNIX system administrators to seem to always have the right tool for the job.
Cron traditionally has been considered another such a tool for job scheduling, but is it enough? This webinar considers that very question. The first part builds on a previous Geek Guide, Beyond Cron, and briefly describes how to know when it might be time to consider upgrading your job scheduling infrastructure. The second part presents an actual planning and implementation framework.
Join Linux Journal's Mike Diehl and Pat Cameron of Help Systems.
Free to Linux Journal readers.Register Now!
- SUSE LLC's SUSE Manager
- My +1 Sword of Productivity
- Murat Yener and Onur Dundar's Expert Android Studio (Wrox)
- Non-Linux FOSS: Caffeine!
- Managing Linux Using Puppet
- Doing for User Space What We Did for Kernel Space
- SuperTuxKart 0.9.2 Released
- Google's SwiftShader Released
- Parsing an RSS News Feed with a Bash Script
- Rogue Wave Software's Zend Server