Chapter 7: Securing Your System

Overview

Securing your system means ensuring that your computer's resources are used only by authorized people for authorized purposes, because even if you have no important data on your system, you still have valuable CPU time, memory, and bandwidth. In fact, many folks who thought that their systems were too unimportant to bother securing found themselves an unwitting relay for an attack that disabled a major corporation. You don't want to wake up one morning to the delightful sound of law enforcement agents kicking in your door because your insecure computer was used to break into a bank.

Sure, there are things worse than having some kid take over your servers— say, having both your legs broken. Coming in to work one day to discover that the company Web page now says, "Ha, ha, you've been r00ted!" is a pretty close second.

Sadly, over the last few years, it has become much easier to take over remote computers. Precanned point−and−click programs for subverting computers are becoming more and more common, and can be found through an underground search engine like http://astalavista.com/. It takes just one bright attacker to write an exploit, and several thousand bored teenagers with nothing better to do than download it and make life difficult for the rest of us. Even if you don't care about your system, you need to secure it.

Generally speaking, operating systems are not broken in to; the programs running on operating systems are. Even the most paranoically secure−by−default operating system in the world[1] cannot protect badly written programs from themselves.

Occasionally, a problem with one of these programs can interact with the operating system in such a way as to actually compromise the operating system. The most common of these are called buffer overflows, where an intruder's program is dumped right into the CPU's execution space and the operating system runs it. FreeBSD has undergone extensive auditing to eliminate buffer overflows, but that's no guarantee that they are totally eradicated. New functions and programs are being written all the time, and they can interact with older functions in unexpected ways.

This chapter focuses on patching and securing your systems. (Auditing your network design is a topic that fills thick books, and isn't really on topic for a book on FreeBSD.) FreeBSD gives you many tools to help you secure your system against network attackers.

[1]That would be OpenBSD. Or any OS on a computer that's disconnected from any network, buried under 12 feet of steel−reinforced concrete and, if at all possible, crushed into a billion tiny pieces and soaked in hydrofluoric acid for several months.

Who Is the Enemy?

First off, I'm going to arbitrarily lump potential attackers into three groups: script kiddies, disaffected users, and skilled attackers. You will find more fine−grained profiles in books dedicated to security, but that's not what you're here for. These categories are easily explained, easily understand, and include 99 percent of all the attackers you're likely to encounter.

138