Bảo vệ chống lại Trojan Horse HacksHiện hành về cấp độ vá lỗi để hạn chế hoặc từ chối khả năng của kẻ tấn công để đạt được cấp đặc quyền root và cài đặttiêu chuẩn chương trình passwd trong cung cấp để kiểm tra sức mạnh mật khẩu | 320 Chapter 10 Dissecting Hacks the standard passwd program in provide for password strength checking before passwords are actually changed in the system files. If the user chooses a password that is considered too weak the password will be rejected and the user will be asked to choose another one. 0 Be sure to require the minimum password length to be eight characters. This can be controlled by changing the value of PASSMIN in etc default passwd from the default value of six to eight. 0 Do not run NIS unless absolutely necessary. Use NIS instead or consider other authentication methods such as Kerberos or LDAP. 0 Occasionally run a password-cracking program such as John the Ripper on the password shadow files to find weak user passwords. Notify the user that their password has been cracked and should be changed. Securing against Trojan Horse Hacks 0 Stay current on patch levels to limit or deny an attacker s ability to gain IF root privilege levels and install rootkits. 0 Restrict access to the cron through the use of the etc and etc files. 0 Run file-integrity-checking programs such as Tripwire Fcheck or AIDE to try to detect trojan programs. 0 Set the default search paths in etc default login for users and for root to usr bin and usr bin usr sbin sbin respectively. Securing against IP Spoofing 0 Use SSH in place of the r-services . rsh rlogin rcp etc. . 0 If disabling the r-services is not possible specify unique IP addresses rather than entire subnets in the etc or .rhosts files. Also specify the username to be granted trusted host access. For example if the system trusts the host the entry in the etc file for user jdoe would be jdoe Dissecting Hacks Chapter 10 321 0 Use tools such as arpwatch to try to detect possible MAC address spoofing attempts. 0 Use SSH in place of the r-services . rsh rlogin rcp etc. . Frequently Asked Questions .
