Many Linux Questions - Stumper

DirtylilTechBoy

Senior member
Oct 19, 2001
304
0
0
Hello,

Over the past month or so, I have been reading a bunch of FAQ's about Linux and Linux security, and as I read, I wrote down any question I had about a program, command, definition, etc.

I have a lot. I would like to post these questions on this forum, and I think this will really be a test for all of you Linux guru's out there. Some may be easy, some not.

The first set of stuff I will post will be terms that I am unsure of, or would like to have explained a little bit better. I'm looking for real world definitions and analogies would be great, especially if used with non-computer terms. I hope this isn't too much

I essentially need to know what each term is and what its purpose is. If you want to go into detail, that would be awesome!

inetd.conf
Tcp port
Tcpserver
Source routing
Kernel
NameD
Ipchains
Port 1024
Ports below 1024
Ports after 1024
Chroot
Bind
Daemon
UDP
Buffer overflow bugs
Buffer overflow attacks
X
Netstat
IP of 0.0.0.0
IP of 127.0.0.1
IP of 169.254.225.239
IP of 10.11.12.13
Xdm port
Lpd
Source ports in the range of 721-731
Pdq
NFS
Localhost.localdomain
Sandboxing
Ping of Death
Proxying firewall
Masquerading

/tmp directory
/bin directory
/var directory
/usr directory
/lib
other important directories???

SUID
World executable
Public port
LIDS
Openwall patches
Bastille hardening Script
Swap partition
Grep
NIS
Sniffing
Ssh
Wheel group
.rhosts
.netrc
/etc/hosts.equiv
the r commands
touch
MD5 hashes
/etc/shadow
PAM ? Pluggable Authentic Modules
LILO
/etc/hosts.allow
/etc/hosts.deny
TCP wrapper
SMB
COI scripts
FTP bounce attack
NISNuke Attack
Chargen
Discard
Inetd
Different port states
Shadow passwords
System binaries
SUDO
Shell escape
Absolute path to the binary
IPSEC
SATAN
Nessus
Trinux
Tripwire
TCP connections
UDP connections
ICMP connections
Append-only
Immutable
Chattr command
Lsattr command
Tar file
Nonexecutable stack
/tmp race condition
StackGuard
Stack smashing buffer overflow
Socket
Raw socket
Rule based access control
Stateful inspection packet filter
Abacus Port Sentry
Parallel scan
Ipfwadm facility
Syslog service
Ssyslog secure syslog
Syslog-ng
Kerberos
Adaptive filtering


 

DirtylilTechBoy

Senior member
Oct 19, 2001
304
0
0
This isn't biting off more than I can chew. I only need to hear things once. I already have a good idea what most of this stuff is, enough to say that I know what a port is, what DNS is, what apache is, etc. I probably understand this stuff better than I give myself credit for. However, I am uncertain I am correct in my understanding of this stuff. I already read plenty o' faq's, even some on advanced network security. And I get the big picture. I am just uncertain about syntax and purposes of stuff.

What I am looking for, for instance, is

inetd.conf.

This is a Linux config file for "_______" The big deal about this is ___________

thats all I'm looking for. clear and consice syntax.
 

Nothinman

Elite Member
Sep 14, 2001
30,672
0
0
That's just way too much, my fingers would cramp up explaining all that.

Maybe if I get bored tonight...
 

Barnaby W. Füi

Elite Member
Aug 14, 2001
12,343
0
0


<<
inetd.conf
>>


the configuration file for inetd, the internet superserver


<< Kernel >>


the main piece of code that makes the whole system tick, and controls everything. this *is* linux.


<< Ipchains >>


the netfilter package for 2.2 kernels


<< Ports below 1024 >>


privelaged


<< Ports after 1024 >>


not privelaged


<< Chroot >>


change root, make it so a directory that is not really / appear like /


<< Daemon >>


runs in teh background, like an NT service


<< X >>


a graphical display


<< Netstat >>


check network stuff, like what ports are listening


<< IP of 127.0.0.1 >>


loopback


<< Lpd >>


linux printer daemon (i think), its for printers


<< NFS >>


network filesystem


<< Ping of Death >>


the ping of death, i believe, was a bug in NT4 and win95 where you could give someone a BSOD by pinging them. you might be thinking of a ping flood.


<< Masquerading >>


like NAT, network address translation. it allows multiple computers to use one IP address on the internet.



<< /tmp directory >>


temporary, and cleaned at boot usually.


<< /bin directory >>


"important" executeables


<< /var directory >>


various stuff like logs and mail, some other stuff, i dont know, actually i dont look in /var all that much except for specific things.


<< /usr directory >>


usually stuff that is not needed for thee system to *work*, user installed software, stuff like that. also documentation, and various other stuff (like in /usr/share/)


<< /lib >>


libraries


<< other important directories??? >>


/etc!



<< Swap partition >>


gives you more available memory than you have physical memory. swap is much slower though.


<< Grep >>


filter through text searching for one string


<< Sniffing >>


examining the packets going through an interface or machine.


<< Ssh >>


secure shell. http:https::telnet:ssh


<< Wheel group >>


users who are trusted a bit more and allowed to do certain things that normally only root can do.


<< touch >>


update a file's timestamp, or create a file if it's not there


<< /etc/shadow >>


where the system passwords are kept if you use shadow passwords. only readable by root.


<< LILO >>


LInux LOader. boot manager.


<< /etc/hosts.allow >>


hostnames and/or IP's to allow communication with


<< /etc/hosts.deny >>


hostnames to ignore and not communicate with


<< Inetd >>


network super-server


<< Shadow passwords >>


see above


<< System binaries >>


important stuff that is usually only executeable for root. in /sbin or /usr/sbin


<< SUDO >>


lets normal users do things they normally cannot


<< Chattr command >>


change attributes for a file


<< Lsattr command >>


list attributes for a file


<< Tar file >>


tape archive. turn many files/directories into one file.

ok those were the ones i knew.
 

SinNisTeR

Diamond Member
Jan 3, 2001
3,570
0
0
i'll do my duty for the day (hope i get this right)



<< IP of 169.254.225.239 >>



windows assigns this IP address if you dont have a static one or unable to get one from DHCP.


/me crosses fingers
 

nihil

Golden Member
Feb 13, 2002
1,479
0
0


<< i'll do my duty for the day (hope i get this right)



<< IP of 169.254.225.239 >>



windows assigns this IP address if you dont have a static one or unable to get one from DHCP.


/me crosses fingers
>>



yes, you are correct. although i thought it was just in the case that you were unable to get an ip via a DHCP server. i'm not sure about static.
 

n0cmonkey

Elite Member
Jun 10, 2001
42,936
1
0
BBFW's explanations looked good (the few I read), but Ill go ahead and throw out what I know

inetd.conf -The configuration file for inetd. inetd runs network servers. When a user connects to ftp port 21, inetd starts up ftp. ftp does not always run in the background, instead inetd starts it up. Not sure why this is the way they chose to do this, but its pretty standard.

Tcp port -This is a big one. There are 65536(?) tcp ports. When a program tries to access the internet it needs to use a port. The port is where it is coming from. If it is a non-root program, it comes from a port above 1023. When the program tries to access a service, it hits a specific port. Port 80 is httpd. If you want/need more of an explanation than that read tcp/ip illustrated.

Tcpserver -Its a program that is part of a tool package written by Dan Bernstein. Its a replacement for inetd. I use it for a couple of things.

Kernel -This is the core of the OS. The kernel is the essential center of a computer operating system, the core that provides basic services for all other parts of the operating system. A synonym is nucleus. (taken from whatis.com)

NameD -The service that provides dns resolutions. Look at BIND. named is the name of the process BIND runs.

Ipchains -Old Linux firewalling stuff. Replaced with IPTables.

Port 1024 -Just another non-privledged port

Ports below 1024 -Only root processes are supposed to be able to bind to these ports. Many of the ports have services that are supposed to run on them (80 = http, 666 = DOOM)

Ports after 1024 -unprivledged ports. Anyone can bind to them. When you run a bnc you should choose a port above 1024 so that you can run it as a non-root user.

Chroot -You basically setup an OS within your OS. For example, in OpenBSD I have linux emulation. Part of what happens is a chroot is setup at /usr/local/emul/redhat. Within that directory, a fulle system tree (basically). I have /bin, /usr/bin, /sbin, etc. When something in that chroot is run it thinks /usr/local/emul/redhat/ is the root (/) of the file system and it should be contained to that area. Its a good idea to chroot as many services as you can. BIND has this ability built in.

Bind -see named earlier

Daemon -Basically a service. Each service you connect to is a daemon. httpd, named, etc are all daemons. They offer services and whatnot for users to connect to.

UDP -unreliable(?) data protocol. Its a fast protocol, but has no built in error checking or authentication or state. Its fast, but unreliable (unless the program adds in reliability).

Buffer overflow bugs -When input isnt regulated correctly, users can input too much data, overwrite data in the memory stack, and possibly run malicious programs. If a program can handle 255 bytes of data, a user could input 300 bytes and possibly cause problems like crashing the program, or getting it to run something malicious.

Buffer overflow attacks -See above.

X -X Windowing system. Its a gui for UNIX and UNIX-like OSes.

Netstat -You can view routing and open ports with this. It will show ports you are connected to and from.

IP of 0.0.0.0 -Nothing

IP of 127.0.0.1 -loopback. Thats the machine you are on.

IP of 169.254.225.239 -explained above by Sinister (sorry about the caps, too lazy to look how you do it )

IP of 10.11.12.13 -An ip address that falls under RFC 1819.

Xdm port -No clue

Lpd -Printing daemon.

Source ports in the range of 721-731 - http://www.iana.org/assignments/port-numbers
# 712-728 Unassigned
netviewdm1 729/tcp IBM NetView DM/6000 Server/Client
netviewdm1 729/udp IBM NetView DM/6000 Server/Client
netviewdm2 730/tcp IBM NetView DM/6000 send/tcp
netviewdm2 730/udp IBM NetView DM/6000 send/tcp
netviewdm3 731/tcp IBM NetView DM/6000 receive/tcp
netviewdm3 731/udp IBM NetView DM/6000 receive/tcp


Pdq -No clue

NFS -Network File System. Its a way to mount file systems over the network and use them like they were local. I think its similar to CIFs and SMB.

Localhost.localdomain -loopback basically.

Sandboxing -Limiting the damage something can do. Similar to chroot in thought. Keep the program sandboxed so the damage it could do to the rest of the system is limited.

Ping of Death -Old DoS that I dont think works anymore. It sent pings that were larger than 65536 bytes(?) crashing the OS.

Proxying firewall -A firewall that proxies data. What do you really want to know about this? The name is very self explanatory.

Masquerading -NAT by another name.

/tmp directory -For temporary stuff

/bin directory -Binary directories

/var directory -Logs and other various stuff

/usr directory -user stuff. Mostly just the things the users would need.

/lib -Libraries for dynamically linked binary executables go here (and in other lib directories)

other important directories???

SUID -Set UID. This usually allows programs to run with root privledges. I think this is a bad idea and should be used as infrequently as possible.

World executable - ??1. Anyone on the system can run it.

Public port -A port accessible from the internet?

LIDS -Linux Intrusion Detection Software. Its a NIDS that runs on Linux. Havent used it though, but Ive heard good things about it.

Openwall patches -More security patches to limit what users do.

Bastille hardening Script -See above +firewall stuff I think

Swap partition -duh

Grep -BBFW has a great explanation for this one.

NIS -Cant explain it. whatis.com

Sniffing -Taking a look at all packets reaching an interface whether they are supposed to be seen by that interface or not. Easiest way is by putting the interface in promiscuous mode.

Ssh -is a secure rsh (not telnet )

Wheel group -Group of users allowed to su to root on BSD machines (maybe some other systems too)

.rhosts -Dont worry about it.

.netrc -Dunno, probably a config file for a program you are using.

/etc/hosts.equiv -Dont know, but I think it has something to do with the r commands.

the r commands -Delete them, never use them. They are junk.

touch -update/change timestamp on a file and create files if the file does not already exist.

MD5 hashes -used for checking the integrity of a file or for encrypting files. Its a one way hash.

/etc/shadow -Stores encrypted files on Linux machines

PAM ? Pluggable Authentic Modules -self explanatory (basically, anything more than modifying authentication I dont know)

LILO -duh

/etc/hosts.allow -used with tcpwrappers to allow connections to programs started by inetd from the hosts listed here. There is also a library with tcpwrappers or something that allows non-inetd programs to use these files.

/etc/hosts.deny -denies in the same way the last file allows

TCP wrapper -explained it above

SMB -Windows networking protocol. Used by SAMBA to provide Windows file sharing from other platforms.

COI scripts -No clue

FTP bounce attack -I will not explain this on here.

NISNuke Attack -Again, I will not explain this here (even if I knew what this particular attack is for).

Chargen -Character generation. Its an almost useless service and should *NOT* be run.

Discard -Probably has to do with firewalling and discarding packets instead of rejecting.

Inetd -explained above.

Different port states -listening/open, closed, connected. Tells you what is going on on that port.

Shadow passwords -encrypted passwords

System binaries -binaries necessary for the operation of the system. Or something like that.

SUDO -Allows one user to run programs as another user.

Shell escape -No clue

Absolute path to the binary -Start with / and go all the way to the file ie /usr/local/bin/nmap instead of (if you are in /usr) local/bin/nmap

IPSEC -vpn stuff.

SATAN -Old out of date vulnerability scanner. SAINT is the newer version I think.

Nessus -Vulnerability scanner.

Trinux -small floppy based linux distro I think.

Tripwire -HIDS. Checks file integrity and other things.

TCP connections -Connections using the tcp protocol.

UDP connections -Do not exist (correct me if Im wrong).

ICMP connections -Do not exist.

Append-only -Append to the end of the file instead of being able to modify/delete/whatever the file. chattr in linux and chflags in OpenBSD will allow you to set this.

Immutable -File may not be modified or deleted at all.

Chattr command -see above.

Lsattr command -BBFW gave an explanation I hope is right

Tar file -Tape ARchive. Kind of like zipping a bunch of files in Windows, but without the compression.

Nonexecutable stack -No clue right off.

/tmp race condition -I wont be explaining that here.

StackGuard -Dont know right off, but it sounds like something that protects the kernel/memory/tcpip/whatever stack in a Linux machine to prevent some exploits.

Stack smashing buffer overflow -Above.

Socket -Couldnt explain it.

Raw socket -Again, cant explain it.

Rule based access control -Sounds like firewall type of thing.

Stateful inspection packet filter -Checks the state on tcp connections before applying rules.

Abacus Port Sentry -I know of a port sentry program for UNIX-like systems. It basically looks for scans on the system.

Parallel scan -I wont explain that here (if what I think it means is really what it means).

Ipfwadm facility -An Administration application for IPFW I think.

Syslog service -A way of sending log files to a syslog machine. The syslogd recieves the logs and places them in the log file.

Ssyslog secure syslog -No clue.

Syslog-ng -No clue.

Kerberos -Authentication method.

Adaptive filtering -No clue really, but it sounds like automatic responses to firewall alarms.


So are you trying to crack someone? There are some very fishy questions here. And 99% of these could have been answered through a quick http://www.google.com/linux search.
 

Nothinman

Elite Member
Sep 14, 2001
30,672
0
0
SUID

When the program is executed it's ran with the rights of the owner of the file, usually root but not always.

Wheel group -Group of users allowed to su to root on BSD machines (maybe some other systems too)

Linux PAM can do this, actually with any group not just wheel, it's just not usually setup by default.

Discard -Probably has to do with firewalling and discarding packets instead of rejecting

Actually it's a service like chargen, pretty much useless, anything you send to this port gets discarded.

Shell escape

Most shells have special characters for things (like !number to execute a command in the history by number in bash), to make bash not interpret them (say you have a file with a ! in it) you have to escape the character with \

Nonexecutable stack

The stack is a portion of memory for local variables in a process, on x86 it's executable so if you can overflow one of those variables you can put your own executable code on there and do whatever you want. If the system allows you to set the stack non-executable that makes this very hard (although not impossible).

/tmp race condition

2 processes work on a file in /tmp but don't use unique names (like including their PID or something else unique to them) they may both work on the file at the same time corrupting it.

StackGuard Commercial product to help prevent buffer overflows.

Socket

A connection endpoint. If you want to communicate over the network you have to open a socket.

Raw socket Same as above except you don't specify anything about it, it's up to you to write the whole packet, if you're using TCP/IP you're responsible for things like source IP, dest IP, etc that the kernel normally does for you.

Stateful inspection packet filter A smarter NAT, that can figure out which packets are part of which stream and which streams are related to make NAT more reliable and easier to deal with.

Parallel scan Either scanning more than one machine at a time, or running multiple scans against a single machine to speed up the scan.

Ipfwadm facility Linux 2.0 firewalling command.

Source routing You set the route the packet should take to it's destination, most routers shouldn't honor these as it's a bad idea and a security hazard.

Xdm port The port the X Display Manager listens on for remotely connecting to X sessions.

Lpd Line Printer daemon, print server.

SMB Server Message Block, Microsoft's filesharing protocol

 

DirtylilTechBoy

Senior member
Oct 19, 2001
304
0
0
Thanks guys. I reallly appreciate the help. I find all kinds of FAQ's on howto's, what for's, etc., but I have yet to find a guide or glossary that talks specifically about what's out there and what it all means. Kind of like a Linux Admin Primer. Its always easier for me to become familiar with what's out there, and then move on to learning individual things, than to walk into something blind and figure things out as I go.


The next step after this, sigh, is to ask specific questions about these services. However, I'm not ready for that yet.
 

slackware1995

Member
Apr 4, 2002
109
0
0
May I suggest next time you start with _ALOT_ less questions? Makes it so that each question can be dealt with in more detail.

Also, people won't have to compare a long list of answers with your long list of questions to see if anything was missed.

Just a helpful point.
 

Abzstrak

Platinum Member
Mar 11, 2000
2,450
0
0
I hate to be the ass here, but maybe U should buy a book and read it. Maybe the linux unleashed series... and they have an index.
 

DirtylilTechBoy

Senior member
Oct 19, 2001
304
0
0
Books are nice. and long.

If I'm going to read a 500 page book, I would like to read it in a mind frame that allows me to fully understand the material and have good insight into what I'm reading, rather than going into it blind, which is what I stated in the initial post.

Thanks for being an ass and recommending Linux Unleashed.
 

n0cmonkey

Elite Member
Jun 10, 2001
42,936
1
0
Abzstrak, I read this thread last wednesday and my friend at work and I laughed our heads off at some of the silly topics in it. So it was worth something.

Seriously, some of the things you mentioned are increadibly simplistic its a shame you have to ask about them. "inetd.conf," "IP of 127.0.0.1," "swap," "LILO," and "Tripwire" were some of the worst. The explanations out there for these are very good and basic.
 
sale-70-410-exam    | Exam-200-125-pdf    | we-sale-70-410-exam    | hot-sale-70-410-exam    | Latest-exam-700-603-Dumps    | Dumps-98-363-exams-date    | Certs-200-125-date    | Dumps-300-075-exams-date    | hot-sale-book-C8010-726-book    | Hot-Sale-200-310-Exam    | Exam-Description-200-310-dumps?    | hot-sale-book-200-125-book    | Latest-Updated-300-209-Exam    | Dumps-210-260-exams-date    | Download-200-125-Exam-PDF    | Exam-Description-300-101-dumps    | Certs-300-101-date    | Hot-Sale-300-075-Exam    | Latest-exam-200-125-Dumps    | Exam-Description-200-125-dumps    | Latest-Updated-300-075-Exam    | hot-sale-book-210-260-book    | Dumps-200-901-exams-date    | Certs-200-901-date    | Latest-exam-1Z0-062-Dumps    | Hot-Sale-1Z0-062-Exam    | Certs-CSSLP-date    | 100%-Pass-70-383-Exams    | Latest-JN0-360-real-exam-questions    | 100%-Pass-4A0-100-Real-Exam-Questions    | Dumps-300-135-exams-date    | Passed-200-105-Tech-Exams    | Latest-Updated-200-310-Exam    | Download-300-070-Exam-PDF    | Hot-Sale-JN0-360-Exam    | 100%-Pass-JN0-360-Exams    | 100%-Pass-JN0-360-Real-Exam-Questions    | Dumps-JN0-360-exams-date    | Exam-Description-1Z0-876-dumps    | Latest-exam-1Z0-876-Dumps    | Dumps-HPE0-Y53-exams-date    | 2017-Latest-HPE0-Y53-Exam    | 100%-Pass-HPE0-Y53-Real-Exam-Questions    | Pass-4A0-100-Exam    | Latest-4A0-100-Questions    | Dumps-98-365-exams-date    | 2017-Latest-98-365-Exam    | 100%-Pass-VCS-254-Exams    | 2017-Latest-VCS-273-Exam    | Dumps-200-355-exams-date    | 2017-Latest-300-320-Exam    | Pass-300-101-Exam    | 100%-Pass-300-115-Exams    |
http://www.portvapes.co.uk/    | http://www.portvapes.co.uk/    |