There are many ways to divide up the types of computer attacks, but perhaps the easiest to understand is the internal attack, where someone has access to a computer on the local area network, versus the external attack, which occurs over the Internet. The distinction is important because it clarifies the relative danger your system is in. Chances are excellent that your local network is protected quite well by the system of permissions, along with the trust you place in your users to not damage the system. Unless you are in the habit of hanging around with the bad guys and giving them access to your system, you shouldn’t have to spend a great deal of time protecting your system against your users.

It’s that outside world that you must worry about most. In a world—and Internet—filled with millions upon millions of people, some percentage (usually small) will be evil. The Internet makes it possible for machines to connect on a vast scale, and any single machine can be attacked by people located anywhere on the planet. Within minutes of making first contact with the Internet, some machines can be attacked, although usually not successfully. Don’t let your machines be counted among the victims.

This situation is not a result of malicious users lying in wait for your IP address to do something interesting. Instead, canny virus writers have created worms that exploit a vulnerability, take control of a machine, and then spread it to other machines around them. As a result, more attacks today are the result of these autohacking tools. There are really only a handful of the truly evil out there; however, as with most human endeavors, if you’re really the target of someone’s attack, you probably cannot prevent it without a massive effort.

Scripts come in another flavor as well: prewritten code that exploits a vulnerability and gives its users special privileges on the compromised machine. These scripts are rarely used by their creators. They get posted online for the aforementioned script kiddies, who use them to invade vulnerable systems and brag about it to their friends.

Your job as a system administrator is to keep your computers and local networks from being compromised by worms, script kiddies, and the more serious attacks conducted by more experienced criminals. Your users (even if it’s just you) want to use the computer to accomplish great things and not worry about the firefights outside. Wearing your sysadmin hat, you can accomplish this task.

Regardless of the source of the attack, you can follow a five-step checklist to secure your SUSE Linux box:

You’ll learn more about each step in the following sections. You must implement all the steps.

It is a common mistake for people to assume that switching on a firewall makes them safe. Although there’s no question that switching on a firewall is an important step to take, it is not a solution and never has been. Each system has distinct security needs, and taking the time to customize its security layout will give you maximum protection and best performance.

Following are the most common security mistakes people make:

After you have ruled out these common problems, you’re on to the real problem. How can the bad guys attack your machine? What can people access from the outside? This comes down to the question of what applications and services face the Internet, and what ports do they run on?

The best way to find answers to these questions is through the Nmap networking utility. This little tool will scan the ports of any machine on your network, or all of them, and tell you which ones are open at that moment. Any service you have installed that responds to Nmap’s query is pointed out, and you may, in turn, choose to lock down ports that should not be open.

SUSE Linux does not install Nmap by default, but you can install the command-line version and a GUI front-end called Nmap-gtk through YaST. Other GUIs are available at the Nmap website, http://www.insecure.org/nmap.

Although you can use the shell version, it is much easier to configure and see the results of Nmap’s work in the GUI (Figure 23.1). It is also better to run Nmap as the SuperUser, because you will get more information that way. To launch Nmap-gtk, log in as the SuperUser and type xnmap &.

Figure 23.1. Nmap scans ports to see what is open and vulnerable.

The best way to run Nmap, especially the first time, is to use the SYN Stealth scan (on by default when you launch it as SuperUser) with OS Detection and Version Probe on. By default, Nmap scans the localhost (127.0.0.1), but you can add or change targets by typing the IP address(es) into the Target(s) edit box. The first time you run Nmap, you should click the Scanned Ports box to change the scan range from a few default ports; select All from the drop-down menu. This scan takes a little longer, but gives you a more complete picture of your status. As you adjust your options in the GUI, you’ll see the actual shell command being built at the bottom of the window. You could, if so inclined, copy this command to a text file and run it as a shell script later on.

When you have made your selections, click Scan. Nmap tests each port to determine whether it responds. If it does, Nmap asks the application at that port for version information and displays that to the Nmap screen. You then get results like those displayed in Figure 23.1. Ideally, there will be no surprises on the list. If there are surprises, or you decide that there are some unnecessary services on the list, you can take action.

You can log your Nmap scan by going to Save Log in the File menu and choosing a location from the menu. To view the log file later, go to Open Log from the File menu.

If you just have one or a few machines on the network, you probably need to run Nmap only once a year, or if you suspect your system is compromised. Sysadmins of larger networks should run Nmap regularly as part of their general maintenance regimen.

After you have disabled all the unnecessary services on your system, what remains is a core set of connections and programs that you want to keep. Don’t think you’re done, though. It’s time to consider what to do about your wireless network and the physical security of your servers.

If you connect to the Internet, even with a modem and dial-up connection, you need a firewall to protect you from attack. Fortunately, SUSE Linux includes an excellent firewall to help you. Go to YaST Security and Users and click the Firewall module to start the process.

The first screen in this wizard (see Figure 23.2) asks for the interfaces you want to protect.

Figure 23.2. Select your LAN interface and Internet interface on this screen.

The External Interface is your Internet connection. The Internal Interface is your LAN card. Use the drop-down menu to select or change an interface from the default. Click Next to continue.

The second wizard page (see Figure 23.3) is used mainly for systems with active server components that need ports open to communicate with their clients. If you are using a web server (Apache or similar), a mail server, or any other server on the list, check the appropriate box.

Figure 23.3. Open ports for any servers on this screen.

If an Internet application needs a specific port opened, you can click the Expert button to open that port.

Click Next to continue.

The Features page comes up next. Going with the defaults here is usually best. If this machine is only going to be a router, check the Forward Traffic and Do Masquerading box. If you want other computers on your LAN to have only the same access to services on your computer that the rest of the Internet has, check Protect from Internal Network.

The last screen sets up what information the firewall logs contain. Unless you are trying to troubleshoot a specific problem, it’s a bad idea to log every packet, or even every dropped packet. Stick to the defaults here. Click Finish to activate the firewall.

The configuration file adds a script to the boot process so the firewall loads each time you boot. To turn off the firewall, reopen the module and select Stop Firewall and Remove from Boot Process.

In addition to the tools mentioned thus far, you should also consider adding some basic Linux security tools to your toolbox. These include the following:

Humor books aside, it is never fun trying to come up with worst-case scenarios, and it’s even less fun trying to figure out how to survive them. Thinking about the day someone breaks into your carefully protected, what-seemed-secure network and compromises your system is harder still. Yet thinking about it ahead of time can ease the stress of that day and can also put that day further into the future.

You can take courses and even get certified in disaster recovery management, also called business continuity. So the suggestions offered here just scrape the surface, but following are some ideas to help you think out and plan for the day that no one wants to come—and how to survive and recover from it. The job you save may be your own.

It’s no surprise that computer security is a hot topic on the Web. You can find a lot about it in the technology news sites and most Linux-oriented news sites as well. Two sites you should be familiar with are

To keep up with the latest security updates for SUSE Linux, keep your SUSEwatcher application in your desktop taskbar, too. This will help you keep your system as secure as the SUSE/Novell engineers can make it.