お客様システムにおけるセキュリティ施策

Size: px

Start display at page:

Download "お客様システムにおけるセキュリティ施策"

ゆきさかいざわ
6 years ago
Views:

1 UNIX IT fujitsu.com

2 1. UNIX

3 1. UNIX

4 UNIX U1 BIND Domain Name System U2 Web Server U3 Authentication U4 Version Control Systems U5 Mail Transport Service U6 Simple Network Management Protocol U7 Open Secure Sockets Layer (SSL) U8 Misconfiguration of Enterprise Services NIS/NFS U9 Databases U10 Kernel SANS( 4

5 JPCERT IPA IPA 200x

6 WebApplication Cross Site Scripting(XSS) OS /SQL ssh Brute Force (?) 6

7 ( ) 7

8 2.

9 DNS 9

10 DNS # example.org axfr ; <<>> DiG axfr... ;; XFR size: 10 records # version.bind chaos txt ;; ANSWER SECTION Vesion.bind. 0 CH TXT

11 BIND named.conf options { version unknown ; fetch-glue no; # BIND 8 }; zone EXTERNAL { allow-transfer { SLAVE1; SLAVE2; } match-client { any; } recursion no; }; zone INTERNAL { allow-transfer { none; } match-client { /24; } recursion yes; }; 11

12 # example.org axfr ; <<>> DiG axfr... ;; Transfer failed. # version.bind chaos txt ;; ANSWER SECTION Vesion.bind. 0 CH TXT unknown 12

13 Web HTTP TRACE WebApplication 13

14 HTTP TRACE (Apache) HTTP TRACE XSS Basci (US-CERT VU#867593) httpd.conf RewriteEngine on RewriteCond %{REQUEST_METHOD} ^TRACE RewriteRule.* - [F] https VirtualHost mod_rewrite 14

15 HTTP TRACE (Apache) TRACE # telnet 80 TRACE / HTTP/1.1 Host: < > HTTP/ OK ( ) 200: HTTP TRACE ( ) 400: 403,404: HTTP TRACE ( ) 15

16 (Apache) OS httpd.conf ServerToken ProductOnly ServerSignature Off # telnet 80 HEAD / HTTP/1.0 < > HTTP/ OK Data: Sat, 21 Aug :12:03 GMT Server: Apache( ) Apache 16

17 Directory Index Web /backup /test backup.zip *.bak /manual/ index.html.* 17

18 Web 443/tcp stunnel( OpenSSL( openssl s_client -connect <IP Address>:<Port> - state nikto( N-Stealth( 18

19 WebApplication hidden 19

20 expn / vrfy 20

21 expn / vrfy ID( ) ID (ssh ) # telnet mail.example.com mail.example.com ESMTP Sendmail 8.XX.XX HELO test.example.com 250 test.example.com Hello... EXPN fuji fuji... User unknown EXPN toru toru@mail.example.com 21

22 expn / vrfy (sendmail / Postfix) sendmail.cf(sendmail) # privacy flags O PrivacyOptions=authwarnings,noexpn,novrfy sendmail.mc(sendmail) define( confprivacy_flags, authwarnings,noexpn,novrfy ) goaway main.cf(postfix) disable_vrfy_command = yes qmail 22

23 expn / vrfy # telnet mail.example.com mail.example.com ESMTP unknow HELO test.exaple.com 250 test.example.com Hello... EXPN fuji Sorry, we do not allow this option VRFY toru Cannot VRFY user; try RCPT to attempt delivery (or try finger) 23

24 SMTP SMTP # telnet mail.example.org mail.example.org ESMTP unknown MAIL FROM: spam@spam.com spam@spam.com RCPT TO: spam@ahoo.com spam@ahoo.com DATA 24

25 # telnet mail.example.org mail.example.org ESMTP unknown MAIL FROM: RCPT TO: Unable to relay for InterScan VirusWall for UNIX sendmail InterScan ORDB( 25

26 (sendmail) sendmail.mc (sendmail) define( confsmtp_login_msg, unknown )dnl define('confreceived_header','$?sfrom $s $.$?_($?s$ from $.$_) $.$?{auth_type}(authenticated) $.by $j (unknown)$?r with $r$. id $i$?u for $u; $ ; $.$b')dnl (Postfix) smtp_banner = $myhostname ESMTP unknown 26

27 Brute Force SNMP HTTP Proxy 27

28 Brute Force ID/Password Brute Force (RSA ) sshd_conf RSAAuthentication yes RhostsAuthentication no RhostsRSAAuthentication no PasswordAuthentication no PerimetRootLogin no PerimetEmptyPassword no AllowUsers user1, user2,... 28

29 SNMP public private SNMP ADMsnmp( snmpwalk( 29

30 HTTP (SPAM ) # telnet proxy.example.com 80 CONNECT mail.example.org:25 HTTP/1.0 < > HTTP/ Connection established 220 mail.exaple.org ESMTP ( ) 200: HTTP TRACE ( ) 403, 405: CONNECT ( ) 30

31 HTTP Proxy FireWall ForwardingProxy squid.conf acl office src / http_access allow office pxytest( 31

32 inetd (echo finger ) netstat nmap RPC(NIS NFS ) rpcinfo -p <IP > R X-Window NIS+ LDAP 32

33 cc(gcc) wget OS setuid setgid iptable TCP wrapper FireWall chroot 33

34 34

35 3.

36 OS OS 36

37 DAT ( ) Logwatch swatch ( ) analog / MRTG 37

38 ( ) FireWall Accept FireWall-1 Short Log ntp FireWall UDP 38

39 chkrootkit( tripwire( Nessus( QualysGurad( service/attacktest-express/index.html) 39

40 / 40

41 4.

42 ( ) 42

43 ( ) 43

44 JPCERT/CC FAX (IPA) ISEC TEL FAX

45 HDD ( HDD ) 45

46 LAN ( ) 46

47 47

48 48

DNS DNS(Domain Name System) named(bind), tinydns(djbdns), MicrosoftDNS(Windows), etc 3 2 (1) ( ) IP IP DNS 4

DNS minmin@jprs.co.jp DNS DAY Internet Week 2003 ( ) 2 DNS DNS(Domain Name System) named(bind), tinydns(djbdns), MicrosoftDNS(Windows), etc 3 2 (1) ( ) www.example.jp IP IP 10.20.30.40 DNS 4 PC /etc/resolv.conf