system you run.
Autocracking scripts also come in another flavor: prewritten code that
exploits a vulnerability and gives its users special privileges on the hacked
machine. These scripts are rarely used by their creators; instead, they are
posted online and downloaded by wannabe hackers, who then use them to
attack vulnerable machines.
So, the external category is itself made up of worms, serious day job crackers,
and wannabe crackers (usually called script kiddies). Combined, they will
assault your Internet-facing servers, and it is your job to make sure your
boxes stay up, happily ignoring the firefight around them.
On the internal front, things are somewhat more difficult. Users who sit inside
your firewall are already past your primary source of defense and, worse,
might even have physical access to your machines. Those with malicious
intent and physical access to a machine are nearly impossible to stop unless
they are simply inept. The situation is only slightly better if they don’t have
physical access but do have access to your internal network.
Regardless of the source of the attack, you can follow a five-step checklist to
help secure your box:
- Assess your vulnerability. Decide which machines can be attacked, which
services they are running, and who has access to them. - Configure the server for maximum security. Install only what you need,
run only what you must, and configure a local firewall. - Secure physical access to the server.
- Create worst-case-scenario policies.
- Keep up-to-date with security news.
These steps are covered in the following sections, and all of them are equally
important.
Assessing Your Vulnerability
It is a common mistake for people to assume that switching on a firewall
makes them safe. This is not the case and, in fact, has never been the case.
Each system has distinct security needs, and taking the time to customize its
security layout will give you the maximum security and the best performance.
The following list summarizes the most common mistakes:
Installing every package—Do you plan to use the machine as a DNS