Hakin9 March 2008 Issue
19 April, 2008
The March issue of
Hakin9 Magazine contains some noteworthy articles
and interviews. First is an article written by Ryan Maple entitled "Best Practices for
Secure Shell" which discusses various security measures that an administrator can use
to heighten the security of SSH. These measures include (among others) forcing the usage
of SSH protocol version 2, restricting the address (via the ListenAddress variable) that
SSHD binds to from the default of 0.0.0.0, using tcpwrappers, and configuring SSHD to
listen on a port other than tcp/22. Covering Single
Packet Authorization would have been difficult to include in the same article, but a
reference is made to another online article
Knock, Knock, Knockin' on EnGarde's Door (with FWKNOP) that does discuss protecting
SSH with SPA. Next, is Matt Jonkman's fifth part in his series "Writing IPS Rules".
This article covers the byte_test keyword in the Snort rules language and how to use it
to write signatures against length encoded protocols. In particular, Matt illustrates
using byte_test to look for specific byte values at particular offsets derived from data
within the DHCP protocol. The offsets themselves are determined by the data on the wire
and therefore cannot simply be hard coded within a signature beforehand. For those who are
interested in the latest IDS signatures from Matt, he has updated the online home of the
Bleeding Edge Snort ruleset to Emerging Threats.
Finally, both Marcus Ranum and
Richard Bejtlich were interviewed for the March issue. I would like to see Hakin9
do a more in-depth interview of Bejtlich though since he always has an
insightful perspective on computer security - particularly as demonstrated in his book
The Tao of Network Security Monitoring.
