Voyager Server Security and Monitoring

Best practices and tools

Common Security Threats

• Denial of Service Attacks• Exploitation of a bug in Software or OS• Compromised usernames / passwords• Attacking of other machines from

compromised machine• User Error

KNOW your system!

• What OS and patch level are you running?• What non-Ex-Libris components are there and

required to run Voyager?• What OTHER tools are on the machine and

WHY?• WHO has access to your system and WHY?• Who has the root password and WHY?• Is it backed up? Where, how often and how?

Patching

• Closes bugs in the Software or OS as they become known

• Sometimes provides improved performance or functionality

• Is NOT an upgrade!• Schedule maintenance windows• Patch Check Advanced (PCA)• LiveUpgrade (solaris)

Shell Access (Unix)

• Includes SSH, FTP, SFTP, RLOGON, etc• If possible, disable telnet and FTP• Disallow ROOT logons and control root access– sshd.config – “Permit root login no”

• Implement RBAC (Solaris) or Sudo (Solaris/Linux)

Logging

• Learn your syslog – What is it? What’s in it? Why is it there? SHOULD it be there?

• Central (remote) Syslog• Log other programs to Syslog

Hardening

• Remove / Disable unused services• Make sure “System Accounts” do not have a

login shell• Solaris Security Toolkit (JASS)• Harden software packages (Apache, PHP, FTP,

etc)

Hardening – Apache’s httpd.conf

• CHANGE THE DEFAULTS• Disable directory listings• Allowing “Overrides”• Directory Permissions

Usage Policy

• Who should be accessing your server and when?

• What are specific people allowed to do?• Who creates and manages accounts?• Who manages permissions?

External Security

• Access through Firewall– Only publicly accessible port should be 80 (http)– SSH, 70xx, etc can be open to Ex-Libris– Jerseycat Z39.50

• What other machines can access it from behind the firewall?

• Internal (machine specific) Firewalls

Server Monitoring

• Be proactive• Ask questions

Monitoring Logs

• Keep an eye on your syslogs daily.• Use a monitoring tool such as Logzilla (php-

syslog-ng) or Kiwi Syslog to monitor your system

Logzilla

Monitoring Services

• ps –ef (unix) / “Services” under control panel (Windows)

• top (unix)• Monitoring tools– Zabbix– Monit

Zabbix

• Configurable to Monitor, restart and notify about:– Services (apache, voyager, etc)– Files (config files, logs, etc)– Processor load– Available memory and disk space

Zabbix

Zabbix

Discussion

• What OS / Hardware are you using now?• Who is in charge of your System?• What, if any, tools are you using to monitor or

secure your system?

Resources - Books

Books:• Solaris 10 System Administration (Prentice Hall)

Solaris 10 Security Essentials (Prentice Hall)• Zabbix 1.8 Network Monitoring – Rihards Olups

(Pakt Publishing)• Hardening Apache – Tony Mobily (Apress)• Unix in a Nutshell – Arnold Robbins (O’Reilly

Media)

Resources - Web• Solaris – http://docs.sun.com• Solaris Security Toolkit (JASS) -

http://www.sun.com/software/security/jass/• Sun Blogs “Dr. Live Upgrade” -

http://blogs.sun.com/bobn/entry/dr_live_upgrade_or_how• Zabbix – http://www.zabbix.com• Logzilla/Php-Syslog-NG - http://code.google.com/p/php-syslog-ng/• Patch Check Advanced - http://www.par.univie.ac.at/solaris/pca/• Guide To General Server Security – Recommendations of the National

Institute of Standards and Technology: http://csrc.nist.gov/publications/nistpubs/800-123/SP800-123.pdf

• Building Scalable Syslog Management Solutions (Cisco) - http://www.cisco.com/en/US/technologies/collateral/tk869/tk769/white_paper_c11-557812.html