{"id":420,"date":"2018-07-13T12:09:38","date_gmt":"2018-07-13T12:09:38","guid":{"rendered":"http:\/\/itp7.epgpbooks.inflibnet.ac.in\/?post_type=chapter&p=420"},"modified":"2019-05-16T09:20:02","modified_gmt":"2019-05-16T09:20:02","slug":"open-source-security-tools","status":"publish","type":"chapter","link":"https:\/\/ebooks.inflibnet.ac.in\/itp7\/chapter\/open-source-security-tools\/","title":{"rendered":"Open Source Security Tools"},"content":{"raw":"
\"epgp<\/a>\r\n<\/span><\/div>\r\n \r\n\r\nNeed for Network Security<\/strong>\r\n\r\n \r\n

Day by day, network security is becoming important. New ways of hack attacks are being revealed with the development of complex computer systems. Most of the users now-a-days use Internet. With the increasing usage of Internet, the systems and networks are becoming more vulnerable. In this module, we will learn the followings:<\/p>\r\n \r\n\r\na) Scan a system for vulnerable services\r\n\r\nb) Protect a system using firewall\r\n\r\nc) Protect the data using OpenSSL tool\r\n\r\n \r\n\r\nOverview of Port-Scanning<\/strong>\r\n\r\n \r\n

Services like HTTP, FTP, TELNET etc. utilize well-known port numbers according to the conventions. Applications like TELNET are too old and they do not provide secure ways of communications. SSH is a utility to replace TELNET and is being used in most of the remote login sessions. Imagine if a network administrator has left the TELNET services open which was supposed to be closed, in that case any hacker can know that the vulnerable service is running on port no. 23. He can further device methods to hack the system and acquire data or control of the server. Port scanning utilities can help the network administrator to identify the unwanted services that are still running and he can immediately stop or suspend those services. Port scanning utilities are also helpful to hackers as they can use such utilities to scan computer systems or networks for vulnerable services.<\/p>\r\n \r\n

A widely known port scanning utility called \u201cnmap\u201d has gained popularity since years. A dedicated website is present to download the nmap utility and has many resources for the learners to learn nmap and experiment with the tool. Nmap can be downloaded from www.insecure.org <\/a>website. In this section, let us learn few basic commands of nmap and will try to scan our server to identify vulnerable services.<\/p>\r\n \r\n\r\nOverview of nmap<\/strong>\r\n\r\n \r\n\r\nNMAP is an abbreviation of network mapper, It is used to scan ports on a machine (local or remote)\r\n\r\n \r\n

It discovers hosts and services on a network and can be used to discover OS and some software\/services on remote systems. NMAP is licensed under GNU GPL v2. It was initially released in 1997. Nmap can be ported to Linux, Windows, Solaris, BSD variants. It is written in C, C++ and Python. There is a GUI equivalent for nmap utility known as Zenmap.<\/p>\r\n \r\n\r\nInstallation and use of nmap<\/strong>\r\n\r\n \r\n

Binaries of nmap is available on website that can be used to download and install the software on Windows or Linux system. However, the source code of nmap is available on website insecure.org. We can download the source code and compile the source (using make) to generate executable binary file. The steps required to generate binary are:<\/p>\r\n

\"\"<\/p>\r\n\"\"\"\"\r\n

Let us see an example of the output derived by using nmap command. Suppose, we want to scan the port of localhost system, the nmap command with its output is listed as follows:<\/p>\r\n

\"\"<\/p>\r\n

From the above output, we can come to the conclusion that the services identified by port numbers 21, 22, 23, 25 and 111 are open on the system. So, the network administrator has to take precautions of closing these ports or securing them if they are being used by clients or other applications. In the extra reading notes, we more examples have been included.<\/p>\r\n \r\n\r\nOverview of Firewall<\/strong>\r\n\r\n \r\n

A firewall is a network security system used to secure a host or a network. It has predetermined security rules. It is responsible to continuously monitor the outgoing and incoming network traffic. Firewall also controls the network traffic as specified in the set of rules. Firewall helps to secure a single system or an entire network. It works like a barrier between a trusted internal network and untrusted outside network, such as the Internet.<\/p>\r\n \r\n

In linux, iptables<\/strong> is a command line firewall that allows administrators and system engineers to manage outgoing and incoming traffic via a set of configurable rules. iptables uses a set of tables which have chains that contain set of built-in or user defined rules. System administrator can properly filter the network traffic of his system\/ network using firewalls.<\/p>\r\n \r\n\r\nManaging the firewall<\/strong>\r\n\r\n \r\n\r\nThe following is command to start or stop firewall in old RedHat based systems.\r\n\r\n \r\n

\"\"<\/p>\r\n \r\n

In modern RedHat based systems (RedHat 7 onwards), firewalld tool is used to manage firewalls. It is a dynamic firewall manager. The command used to enable or disable a firewall is:<\/p>\r\n \r\n

Before we understand how to modify the rules of a firewall, let us understand the basic keywords associated with iptables. iptables uses three different chains: input, forward, and output. The significance of these chains are as follows:<\/p>\r\n\r\n