Re: Security matters: keep thy doors closed!

[scottstef]

You bring up some very good points. The only secure box is a turned off one with no connections. Most of the cracks that do happen fall into the category of what I call preventable. By this i mean if a patch had ben applied, or unneccessary services had been turned off, you would have prevented the attack. You mention a good point with telnet. IIRC Apache.org was defaced like that. Most of the attacks that occur are the results of someone that read about some kewl haxor trick and ran numerous scans to find the needle in the haystack that was vulnerable. (see any apache server's logs around the time of code red).

A few points that i stress to my coworkers- have only minimal services on each box. I hate to build a mail/web/ftp server on one machine. It creates way more headaches for me. Hardware is cheap enough now that I would rather build three seperate servers for public usage (if they do break in, it is easier to take one down than lose all three). I really do not belive in ftp for anything other than anonymous access. secure copy is a better option for me. All of my servers run email servers that are tightly configured to allow email usage for administrative usages only. Taking simple common sense steps can protect you. It may not be enough to prevent a determined hacker, but there is not a whole lot that can.

"The social dynamics of the net are a direct consequence of the fact that nobody has yet developed a Remote Strangulation Protocol." -- Larry Wall

[bastard]

Not to be pedantic or anything, but a box that is turned off with no connections can still be stolen, so it doesn't even stop there.
The thing to remember is that the box doesn't have to be 100% secure, it just needs to look like a less appealing target than the neighbors'. (and all that'll do is reduce, not stop the problems)

[Aristotle]

cjf beat me to the punch. These days, any script kiddie can fetch a suite of tools and start compromosing systems without having even a remote clue of what they're doing.

Also remember that a cracker looking to add drones to his swarm for a staged attack (DDoS, putting an MTA on your box to use you as a spam relay, etc) does not care about the individual systems at all.

Times have changed. Nowadays, your mere existence makes you an appealing target. (See Honeynet projects et al.)

Makeshifts last the longest.

[cjf]

The thing to remember is that the box doesn't have to be 100% secure, it just needs to look like a less appealing target than the neighbors'.

The "I don't have to run faster than the Lion, only faster than you" idea doesn't apply in situation where practically anyone can automatically compromise thousands of systems a minute.