SSH on Solaris 10

To generate your keys:

ssh-keygen -t dsa
ssh-keygen -t rda

Then, save the public (NOT the private keys!) keys that you just generated.

#cat  *.pub keys >> authorized_keys

The newly created authorized_keys file can then be copied to the destination system. This will allow you to log in without providing a password.

To stop and start sshd:

svcadm disable ssh
svcadm enable ssh

Debugging tips:

Server side debugging - Once ssh service is disabled (svcadm disable ssh), you can start manually in debug mode:

cd /usr/lib/ssh
./sshd -dd

./sshd -v will available command-line options

ssh -v will turn on client debugging

sshd config file for the entire server is in /etc/ssh/sshd_config

permissions on your home directory MUST be 750

Secure Your Passwords...

How Network Access Controls Work?

Network access control is the process of restricting the access to network resources by devices that are used by the end user. Network access controls implement a defined security policy for access which is supported by a network access server that performs the authentication and authorization. The server also restricts the data that each user can access, as well as the activities that can be performed by the end user once they gain access to the network.




How Network Access Controls Work

There are several different types of network access controls that perform different functions according to the needs of the organization and the level of security that is required for performing daily functions.



•Agent-Based Network Access Control: An agent-based network access control operates through the endpoint device (user's device) which provides a higher level of security and ensures that the end-user is complying with security policies. The unit continually operates in the background of the device to monitor security compliance and then sends periodic updates to the policy server.

•Agentless Network Access Control: An agentless network access control does not require any added installations. Instead this type of network access control assesses compliancy on both endpoints before the user is allowed to access the network. The problem with this type of network access control is that authorization is provided through the assessment of network traffic. This makes the application easier to exploit to gain unauthorized access to the network system.

•Hardware-Based Network Access Control: A hardware-based network access control works through an appliance that is installed on the network and functions in conjunction with the network traffic. This type of network access control requires changes in the infrastructure and operational practices to allow for defined access by the end user. Because implementation requires significant server configuration changes, the chances of failure are greater than other network access control systems.•Dynamic Network Access Control: Dynamic network access control is the easiest form of deployment for controlling access by end users. This is because the system does not require any software or hardware appliance installation or changes in the network configuration. Instead a dynamic network access control works on specific computers that are connected to a local area network and are considered to be trusted systems. When an unauthorized user attempts to access the network, the trusted systems will restrict access and then communicate the action to the main policy server.

The type of network access control you choose for your organization depends upon your network configuration and set up. Before choosing an option that suits your organization, it is necessary to evaluate the network configuration and the different reasons for defining access by the end users.

How to spoof a MAC address?

MAC address filtering for wireless networking isn’t real “security”. Anyone who pays any attention to current trends in wireless security at all should know that MAC filtering is less effective than WEP — and that WEP can be cracked almost instantly these days with commonly available tools.

This doesn’t mean MAC filtering is useless. Its resource consumption is almost unmeasurable, and even if it doesn’t keep out any reasonably knowledgeable security crackers willing to spend a few moments gaining access, it does keep out a lot of automated opportunistic attacks that are aiming solely for the absolute lowest-hanging fruit on the security tree. Since that lowest-hanging fruit consists of the majority of wireless access points, MAC filtering can be of value as a way of turning away the majority of opportunistic attackers.

Don’t rely on MAC filtering alone, however. Please, just don’t. It’s a bad idea. People seem to think “Oh, well, sure a determined attacker can get past it, but not anyone else.” It doesn’t take much determination at all to spoof a MAC address. In fact, I’ll tell you how:

1.“Listen” in on network traffic. Pick out the MAC address. This can be done with a plethora of freely available security tools, including Nmap.

2.Change your MAC address.

You can spoof a MAC address when using Nmap with nothing more than a –spoof-mac command line option for Nmap itself to hide the true source of Nmap probes. If you give it a MAC address argument of “0″, it will even generate a random MAC address for you.

For more general MAC address spoofing, your MAC address is trivially reset with tools available in default installs of most operating systems. Here are some examples:

Linux: ifconfig eth0 hw ether 03:a0:04:d3:00:11

FreeBSD: ifconfig bge0 link 03:a0:04:d3:00:11

MS Windows: On Microsoft Windows systems, the MAC address is stored in a registry key. The location of that key varies from one MS Windows version to the next, but find that and you can just edit it yourself. There are, of course, numerous free utilities you can download to make this change for you as well (such as Macshift for MS Windows XP).

All of these techniques can of course be automated by self-propagating malware, and the creation of the malware can even be automated to some extent by existing malware creation “kits”. If that doesn’t convince you that MAC filtering does not provide real security, I don’t know what will.