how do you assess system vulnerabilities

[Rick Garland]

Hi all:

Doing a project and trying to gain consensus.
Basically, what tools and/or utilities do you use to assess the vulnerabilities in your UNIX systems?

[Mel Burslan · Accepted solution]

We periodically run nessus against all of our servers and baseline our assesment to the output of these security scans, for what it is worth.

My 2 cents.

[Florian Heigl (new acc)]

local on the system, no matter which unix:
- rkhunter or chkrootkit
(os-specific stuff depends on the OS, like port-vulnerabilities for various BSD's, scripts for AIX/HP-UX and Baseline Security Analizer for Windows ;))
- tripwire

external to the system:
-nmap
-nessus

it would be possible to 'diff' i.e. the results of netstat -na, nmap and filter rules, also of installed software, but at the moment this is too much effort, mostly because I'm coding very slow :)

I'm maintaining this environment for ~5 years now and have found the easiest way for assessment and fixing of vulnerabilities is three parts:

- run not the bleeding edge, but be absolutely uptodate on production versions of the code I use.
- for critical daemons/services (think httpd, firewalls, ...) there's always a preconfigured replacement active and running.
i.e. on my firewall there's a thttpd running You'll never see because the website is pointing to a regular apache server. if there's a really critical exploit to the apache server, I remove the NAT rule until apache can be updated.
- if this is not possible for an application, then chroot it at least. (this, unfortunately won't protect Your data, but at least You can still trust the data's backup.)

[Senthil Prabu.S_1]

Running nessus is a best way to audit a system or a network. Also, nessus uses Nmap for port scanning, hydra for password checking. So, nessus is a blend of host of other basic auditing tools. Also, you should get expertise in using Nessus inorder to get be best results, otherwise it may mislead you. Go through the documentation links in nessus.org site for more infos.

-
Prabu.S

[RAC_1]

I use following two.

Baston
Cecunia Security checklist.

[Arunvijai_4]

You can use Nessus in your network to asess Vulnerabilities.For more information, http://www.nessus.org/
Its part of HP-Internet Express as well,

http://h20293.www2.hp.com/portal/swdepot/displayProductInfo.do?productNumber=HPUXIEXP1111
http://h20293.www2.hp.com/portal/swdepot/displayProductInfo.do?productNumber=HPUXIEXP1123

-Arun

[Bharat Katkar]

Hi,

In addition to above i would also look for all world writable files and track them. You can get them using simple find command.
Monitor the outputs of "last", "lastb", "who -R" commands.

Regards,

[Ranjith_5]

Hi Rick,

Nessus is one of the best tool for security assessment and to find out all security holes on a large network. This is also used to do the penetration tests.

Download is available @
http://nessus.org/download/

You will get the documentation also here in this site on setting up a nessus.

Regards,
Syam

[Yogeeraj_1]

hi,

Don't forget the main steps:
1. Cataloging assets and capabilities (resources) in your system
2. Assigning quantifiable value and importance to the resources
3. Identifying the vulnerabilities or potential threats to each resource
4. Mitigating or eliminating the most serious vulnerabilities for the most valuable resources

As for the tool, also consider SAINT. The trial version is available at: http://download.saintcorporation.com/downloads/freetrial/saint-install-5.9.2.gz

hope this helps too!

kind regards
yogeeraj

[Robert Fritz]

Also note that Bastille can help you lockdown/harden the system to help reduce those vulnerabilities (web for 11.11/11.0, and shipped with 11.23)

For assesment, you might also consider CIS.

[Rick Garland]

Hi everybody:

Got my consensus. Thanks to all!