A security audit is a part of security implementation where we try to find out the vulnerabilities of the system and suggest actions to improve the security. In a normal audit, the points below should be checked, and a report with the results of that audit should be created.
1. Check intrusion detection. Use chkrootkit or rkhunter for this purpose.
2. Check for known bugs in the software installed on the server - the kernel, openssl, openssh, etc.
3. Scan all network ports and find out which ports are open. Report the ports that should not be open and what program is listening on them.
4. Check whether /tmp is secured.
5. Check for hidden processes.
6. Check for bad disk blocks in all partitions. (This is just to make sure that the system is reasonably healthy.)
7. Check for unsafe file permissions.
8. Check whether the kernel has a ptrace vulnerability.
9. Check the memory (Another system health check.)
10. Check if the server is an open e-mail relay.
11. Check if the partitions have enough free space.
12. Check the size of the log files. It's better that the log size remains in megabytes.
How to know if you are being hacked?
To find out if your box is compromised or not, follow these steps. These are the steps which I used to do and will be handy in most of the situations.
Check your box to see if your performance has degraded or if your machine is being over used.
For that, use the commands
vmstat
Displays information about memory, cpu and disk.
Ex: bash# vmstat 1 4 (where 1 is delay and 4 is count)
mpstat
Displays statistics about cpu utilization. This will help us to see if your cpu is over worked or not.
Ex: bash# mpstat 1 4 (where 1 is delay and 4 is count)
iostat
This command displays statistics about the disk system.
Useful options:
-d - Gives the device utilization report.
-k - Display statistics in kilobytes per second.
Ex: bash# iostat -dk 1 4 (where 1 is delay and 4 is count)
sar
Displays overall system performance.
Check to see if your server has any hidden processes running.
ps
Displays the status of all known processes.
lsof
List all open files. In Linux everything is considered a file, so you will be able to see almost all of the activity on your system with this command.
Use Intrusion Detection Tools
* rkHunter ( http://www.rootkit.nl/ )
* chkrootkit ( http://www.chkrootkit.org/ )
Check your machine's uptime.
If the uptime is less than it should be, this can mean that your machine's resources are being used by someone. Linux doesn't crash or reboot under normal conditions because it is such a stable OS. If your machine has been rebooted try to find out the actual reason behind it.
Determine what your unknown processes are and what they are doing.
Use commands like the following to take apart unknown programs:-
readelf
This command will display what the executable's program is performing.
ldd
This command will show the details of libraries used by a executable.
string
This command will display the strings in the binary.
strace
This command will display the system calls a program makes as it runs.
1. Check intrusion detection. Use chkrootkit or rkhunter for this purpose.
2. Check for known bugs in the software installed on the server - the kernel, openssl, openssh, etc.
3. Scan all network ports and find out which ports are open. Report the ports that should not be open and what program is listening on them.
4. Check whether /tmp is secured.
5. Check for hidden processes.
6. Check for bad disk blocks in all partitions. (This is just to make sure that the system is reasonably healthy.)
7. Check for unsafe file permissions.
8. Check whether the kernel has a ptrace vulnerability.
9. Check the memory (Another system health check.)
10. Check if the server is an open e-mail relay.
11. Check if the partitions have enough free space.
12. Check the size of the log files. It's better that the log size remains in megabytes.
How to know if you are being hacked?
To find out if your box is compromised or not, follow these steps. These are the steps which I used to do and will be handy in most of the situations.
Check your box to see if your performance has degraded or if your machine is being over used.
For that, use the commands
vmstat
Displays information about memory, cpu and disk.
Ex: bash# vmstat 1 4 (where 1 is delay and 4 is count)
mpstat
Displays statistics about cpu utilization. This will help us to see if your cpu is over worked or not.
Ex: bash# mpstat 1 4 (where 1 is delay and 4 is count)
iostat
This command displays statistics about the disk system.
Useful options:
-d - Gives the device utilization report.
-k - Display statistics in kilobytes per second.
Ex: bash# iostat -dk 1 4 (where 1 is delay and 4 is count)
sar
Displays overall system performance.
Check to see if your server has any hidden processes running.
ps
Displays the status of all known processes.
lsof
List all open files. In Linux everything is considered a file, so you will be able to see almost all of the activity on your system with this command.
Use Intrusion Detection Tools
* rkHunter ( http://www.rootkit.nl/ )
* chkrootkit ( http://www.chkrootkit.org/ )
Check your machine's uptime.
If the uptime is less than it should be, this can mean that your machine's resources are being used by someone. Linux doesn't crash or reboot under normal conditions because it is such a stable OS. If your machine has been rebooted try to find out the actual reason behind it.
Determine what your unknown processes are and what they are doing.
Use commands like the following to take apart unknown programs:-
readelf
This command will display what the executable's program is performing.
ldd
This command will show the details of libraries used by a executable.
string
This command will display the strings in the binary.
strace
This command will display the system calls a program makes as it runs.