host
Click on the red underlined text to get to the source
... owns computers or network-related resources. These resources may
include host computers that users use, routers, terminal servers, PCs ...
... and responses. Sites without firewalls will have to determine if a
single attempt to connect to a host constitutes an incident? What
about a systematic scan of systems?
...
... security reasons to attempt to isolate services onto dedicated host
computers. There are also performance reasons in most cases, but a
...
...
It is also important to distinguish between hosts which operate
within different models of trust (e.g., all the hosts ...
... between hosts which operate
within different models of trust (e.g., all the hosts inside of a
firewall and any host ...
... enable services on a case by case basis as they are needed. This can
be done at the host or network level as appropriate. This model,
which will here after be referred to as the "deny all" model, is
...
... than the "deny all" model. Simply turn on all services, usually the
default at the host level, and allow all protocols to travel across
network boundaries, usually the default at the router ...
... security holes become apparent, they are restricted or patched at
either the host or network level.
...
...
Many network administrators go to great lengths to protect the hosts
on their networks. Few administrators ...
... networks themselves. There is some rationale to this. For example,
it is far easier to protect a host than a network. Also, intruders
are likely to be after data on the hosts ...
... host than a network. Also, intruders
are likely to be after data on the hosts; damaging the network would
not serve their purposes. That said, there are still reasons to
...
... protect the networks. For example, an intruder might divert network
traffic through an outside host in order to examine the data (i.e.,
to search for passwords ...
... human error. When
an administrator misconfigures a host, that host may offer degraded
service ...
... an administrator misconfigures a host, that host may offer degraded
service. This only affects users who require that host ...
... host may offer degraded
service. This only affects users who require that host and, unless
that host is a primary server, the number of affected users will
...
... service. This only affects users who require that host and, unless
that host is a primary server, the number of affected users will
therefore be limited. However, if a router is misconfigured, all
...
... users who require the network will be affected. Obviously, this is a
far larger number of users than those depending on any one host.
...
... nodes and causes them to retransmit the packet, or
generate error packets, each of which is picked up and repeated by
another host. A well chosen attack packet can even generate an
exponential explosion of transmissions.
...
... route will
cause packets to be routed to a host from which an intruder may
monitor the data in the packets. These packets are then re-routed to
their correct destinations ...
... Unfortunately, there is no adequate protection against a flooding
attack, or a misbehaving host or router which is flooding the
...
... therefore wise to isolate the internal services to one set of server
host computers and the external services to another set of server
host ...
... host computers and the external services to another set of server
host computers. That is, internal and external servers should not be
co-located on the same host ...
... host computers. That is, internal and external servers should not be
co-located on the same host computer. In fact, many sites go so far
as to have one set of subnets (or even different networks ...
... FTP servers and guest login userids are
carefully isolated from any hosts and file systems from which outside
users should be kept. Another area to which special attention must
...
... Domain Name System (DNS) to perform address
resolution for host and network names. The Network Information
Service (NIS ...
... stored encryption). It is therefore necessary to ensure that these
servers are not accessable by hosts which do not plan to use them for
the service, and even those hosts ...
... hosts which do not plan to use them for
the service, and even those hosts should only be able to access the
service (i.e., general services ...
... security enhancements. It allows
sites to concentrate services through a specific host to allow
monitoring, hiding of internal structure, etc. This funnelling of
services ...
... proxy protocol in use and the services being proxied. The general
rule of limiting access only to those hosts which need the services,
and limiting access by those hosts ...
... hosts which need the services,
and limiting access by those hosts to only those services, is a good
starting ...
... Internet
community, it is especially important that confidential information
not be co-located on the same host as that server. In fact, it is
recommended that the server have a dedicated host which is not
...
... co-located on the same host as that server. In fact, it is
recommended that the server have a dedicated host which is not
"trusted" by other internal hosts.
...
... recommended that the server have a dedicated host which is not
"trusted" by other internal hosts.
...
... FTP servers can allow intruders to copy,
replace and delete files at will, anywhere on a host, so it is very
important to configure this service correctly. Access to encrypted ...
... service is configured incorrectly. FTP servers should reside on
their own host. Some sites choose to co-locate FTP with a Web
server, since the two protocols share common security considerations ...
... configuration
files to a router. TFTP should reside on its own host, and should
not be installed on hosts supporting external FTP ...
... TFTP should reside on its own host, and should
not be installed on hosts supporting external FTP or Web access.
...
... The Network File Service allows hosts to share common disks. NFS is
frequently used by diskless hosts ...
... hosts to share common disks. NFS is
frequently used by diskless hosts who depend on a disk server for all
of their storage needs. Unfortunately, NFS has no built-in security ...
... It is therefore necessary that the NFS server be accessable only by
those hosts which are using it for service. This is achieved by
specifying which hosts ...
... hosts which are using it for service. This is achieved by
specifying which hosts the file system is being exported to and in
what manner (e.g., read-only, read-write ...
... what manner (e.g., read-only, read-write, etc.). Filesystems should
not be exported to any hosts outside the local network since this
will require that the NFS ...
... network
segments, and host computers. Therefore, for the purposes of this
discussion, the term "firewall ...
... security, the filters usually restrict access between the
two connected nets to just one host, the bastion host. It is only
possible to access the other network ...
... filters usually restrict access between the
two connected nets to just one host, the bastion host. It is only
possible to access the other network via this bastion host ...
... host. It is only
possible to access the other network via this bastion host. As only
this host, rather than a few hundred hosts ...
... network via this bastion host. As only
this host, rather than a few hundred hosts, can get attacked, it is
easier to maintain a certain level of security ...
... host. As only
this host, rather than a few hundred hosts, can get attacked, it is
easier to maintain a certain level of security because only this host ...
... hosts, can get attacked, it is
easier to maintain a certain level of security because only this host
has to be protected very carefully. To make resources available to
legitimate users across this firewall ...
... firewall, services have to be forwarded
by the bastion host. Some servers have forwarding built in (like
DNS-servers or SMTP ...
... application services through a
single machine. There is typically a single machine (the bastion
host) that acts as a proxy server for a variety of protocols (Telnet,
...
... SMTP, FTP, HTTP, etc.) but there can be individual host computers for
each service. Instead of connecting directly to an external server,
...
... hostname/account name/password triplets. Intruders can use the
captured information for subsequent access to those hosts and
accounts. This is possible because 1) the password is used over and
...
...
Restrict physical access to hosts, allowing access only to those
people who are supposed to use the hosts. Hosts ...
... physical access to hosts, allowing access only to those
people who are supposed to use the hosts. Hosts include "trusted"
terminals ...
... hosts, allowing access only to those
people who are supposed to use the hosts. Hosts include "trusted"
terminals (i.e., terminals ...
...
Portable hosts are a particular risk. Make sure it won't cause
problems if one of your staff's portable computer is stolen.
Consider developing guidelines for the kinds of data that should be
...
... connections, we mean network connection points located
to provide a convenient way for users to connect a portable host to
your network.
...
... Consider whether you need to provide this service, bearing in mind
that it allows any user to attach an unauthorized host to your
network. This increases the risk of attacks ...
...
A walk-up host should be authenticated before its user is permitted
to access resources on your network ...
... network, such as vacant offices. It may be sensible to disconnect
such areas at the wiring closet, and consider using secure hubs and
monitoring attempts to connect unauthorized hosts.
...
... Many sites use a system default contained in a message of the day
file for their opening banner. Unfortunately, this often includes the
type of host hardware or operating system present on the host ...
... host hardware or operating system present on the host. This
can provide valuable information to a would-be intruder. Instead,
each site should create ...
... chain of logins. This can be hard to detect, particularly if a
hacker sets up a path through several hosts on your site.
...
...
The collection process should be enacted by the host or resource
being accessed. Depending on the importance of the data and the need
...
...
There are basically three ways to store audit records: in a
read/write file on a host, on a write-once/read-many device (e.g., a
CD-ROM or a specially configured tape drive), or on a write-only
...
... File system logging is also the least reliable method. If
the logging host has been compromised, the file system is usually the
first thing to go; an intruder could easily cover up traces ...
... audit data, is
it responsible for examining it to search for incidents? If a host
in one organization is used as a launching point for an attack
against another organization, can the second organization use the
...
... This chapter of the document will supply guidance to be used before,
during, and after a computer security incident occurs on a host,
network, site, or multi-site environment. The operative philosophy
...
... information about the remote system, including host names,
IP addresses and (perhaps) user IDs ...