There is a huge number of tools available on the internet that have one singular purpose: security. Many of the tools crackers use against the unsuspecting are the same tools sysadmins use to lock down their own systems. It's extremely useful to view your computer through the eyes of a potential attacker, using the same tools they may be using. With these tools, you can close services that you don't need, firewall certain ports from one interface and allow them internally, scan your system to determine if you're running vulnerable software, and more. Not all of these tools may be available in Mandrake Linux, but we'll let you know which ones are, and where they are. Some may be in the main distribution, others may be in the contribs.
Scanners
nmap is a stealth network port scanner. It will report open ports on the systems you scan it against. Very useful to ensure that the ports you want open are the only ones that are open. [main]
nessus is a remote security scanner. What it does is audit remote systems to determine whether or not it may be vulnerable to attack or misuse. It is also very informative, and does probes to determine if software detected on any given port may be vulnerable to any currently-known exploits. [contribs]
SATAN (Security Administrator Tool for Analyzing Networks) is a tool to help system administrators recognize several common network-related security problems and report them without actually exploiting them. SATAN is dated software; SAINT is the next-generation SATAN.
SAINT (Security Administrator's Integrated Network Tool) is an updated and enhanced version of the SATAN scanner. It scans host systems looking for flaws in running services.
SARA (Security Auditor's Research Assistant) is a third-generation UNIX-based security analysis tool. It is used to for analysis of a variety of systems and was written to be modular and use other community products such as nmap in a comprehensive method of determining security flaws or vulnerabilities.
Blaster Scan is a TCP port scanner that does a number of security checks such as scanning for CGI bugs, checks anonymous access on FTP, brute force on FTP and POP3, among many others. It can do a subnet scan, simple OS detection, and can detect filtered ports.
Knocker is a simple and easy-to-use TCP security port scanner. It analyzes hosts and network services running on them.
nsat (Network Security Analysis Tool) is a fast, stable bulk security scanner designed to audit remote network services and check for versions, security problems, gather information about the servers and the machine, and much more.
Intrustion Detection Systems
prelude is a hybrid intrusion detection system. It is a NIDS; responsible for real-time packet capture and analysis. It is also a report server that sensors contacts in order to report an intrusion. [main]
Portsentry is an IDS that detects and responds to port scans against a target host in real-time. [main]
Snort is a content-based IDS tool that generates alerts to syslog and/or text files. It also comes with more than 1100 attack signatures. [contribs]
ACID (Analysis Console for Intrusion Databases) is a PHP-based analysis engine to search through and process a database of incidents generated by security-related software such as IDSes and firewalls (such as snort, ipchains, etc.).
arpwrap is a small tool that detects arp spoofing attacks before executing commands such as telnet or SSH. The homepage is written in French.
Tripwire is a tool that checks to see what has changed on your system. The program monitors key attributes of files that should not change, including binary signatures, size, expected change of size, etc. [main]
AIDE (Advanced Intrusion Detection Environment) is a free replacement for Tripwire. It does the same things as semi-free Tripwire and more.
SHADOW is a tcpdump-based Traffic Analysis IDS tool by the Naval Surface Warfare Center.
Attackwatch is a a tool that analyses the firewall output in near-realtime and runs scripts in response to incoming packets that get logged. It is intended to enhance restrictive firewalls with a few ports still open.
Saint Michael is a Linux kernel modules to detect and react to the insertion of LKM rootkits.
Rkdet is a rootkit detector.
Firewalls
Shoreline Firewall is an iptables-based firewall that can used on a dedicated firewall system, a standalone Linux system, or a multi-function masquerade gateway/server.
Loggrep is a utility that greps kernel log files on ipchains or iptables packet log entries and allows you to filter against given entries (ie. date, IP, port, etc.). It has a few other nice features as well.
WallFire is a package to build a very general and modular firewalling application based on Netfilter. It attempts to manage every aspect of firewall administration, from configuration to monitoring, intrustion detection, etc.
Dante is a circuit-level firewall/proxy that can be used to provide convenient and secure network conectivity to a wide range of hosts.
gfcc (GTK+ Firewall Control Center) is a GUI frontend to writing firewall rules and policies (with ipchains). [main]
fwmon is a firewall monitor that integrates with ipchains/iptables to give you realtime notification of firewall events.
Fwctl is a configuration tool for configuring your ipchains firewall. It provides a configuration syntax that is easier to use and more expressive than ipchains syntax and also supports masquerading and packet accounting.
IPTrap is a daemon that listens to several TCP ports to simulate fake services like X11, Netbios, DNS, etc. If a remote client connects to one of these ports, his IP address is immediately firewalled and an alert is logged.
Lokkit is an end-user firewall configuration tool. It asks a few simple questions and then fits your machine to a set of standard firewall patterns. It allows an end user who is unfamiliar with firewalling to have a reasonably secure firewall configured in seconds.
System Hardening/Reporting
Bastille Linux is a hardening system that attempts to "harden" or "tighten" the Linux operating system, to make it more secure by default. [main]
Adeos is an automated filesystem security scanner. It recursively walks all mounted filesystems on the local system and attempts to identify common security concerns such as SUID and world-writeable files.
Eliott is a tool to help sysadmins and programmers discover insecure temporary file creation, even in closed-source applications.
Kerberos is a network authentication protocol. It is designed to provide strong authentication for client/server applications by using secret-key cryptography. [main]
SES (Secure Export System) provides a Kerberos-authenticated interaction between the NFS client and NFS server, which results in the NFS server exporting the user's home directory to the PC the user is using, but only for the duration of the session.
Sniffers and Traffic Analysis
ntop is a tool that shows network usage, similar to what the top command does. ntop offers much more as a packet sniffer and traffic analysis program. [contribs]
dsniff is a collection of tools for network auditing and penetration testing. It includes a number of tools such as dsniff, webspy, filesnarf, msgsnarf, sshmitm, and many others. They can be used to passively monitor a network for interesting activity or implement man-in-the-middle attacks against redirected SSH and HTTPS sessions.
tcpspy is an administrator's tool that logs information about selected incoming and outgoing TCP/IP connections (username, local and remote addresses, and executable filename).
IPTraf is a console-based network statistics utility. It collects all kinds of figures based on network traffic such as TCP connection packet and byte counts, interface statistics, and more. [contribs]
Ethereal is a network protocol analyzer that lets you capture and interactively browse the contents of network frames. Ethereal can examine and capture a wide range of interface and packet types including ARP/RARP, BOOTP/DHCP, DNS, ICMP, IP/TCP/UDP, IPX, PPP, and AppleTalk, among others. [contribs]
Ettercap is a multi-purpose sniffer/interceptor/logger for switched LANs. It also supports active and passive dissection of many protocols, including some ciphered ones, and includes many features for network and host analysis.
monitord is a a lightweight (distributed?) network security monitor for TCP/IP+Etherent LANs. It will capture certain network events and record them in a relational database. The recorded data will be available for analysis through a CGI-based interface.
Encryption
GnuPG is the open source equivalent of PGP. It can be used to encrypt email messages, files, and data streams. [main]
OpenSSH is a free replacement for SSH1 and SSH2. It allows you to open secure shells on remote systems with all traffic encrypted. It is the preferred replacement for the hideously insecure telnet client/server. OpenSSH operates as both an SSH client and an SSH server. [main]
mod_ssl is a module for the Apache 1.3 webserver that provides strong cryptography using the Secure Sockets Layer (SSL v2/v3) and the Transport Layer Security (TLS v1) protocols using the OpenSSL toolkit. [main]
stunnel is a service that provides SSL encryption wrapping between remote clients and local or remote servers. This allows non-SSL aware daemons to easily communicate with clients over a secure SSL channel. [main]
sftp is a client that uses the File Transfer Protocol over ssh/rsh. The primary advantage is that users can use FTP wrapped in SSH encryption to prevent passwords from being exposed. sftp is included in the openssh-clients package in Mandrake Linux. [main]
OpenSSL is an open source collaborative project to develop a robust, commercial-grade, and fully-featured toolkit implementing Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) protocols with full-strength cryptography. [main]
Apache-SSL is a secure web server based on Apache and SSLeay/OpenSSL.
VTun is a program that creates Virtual Tunnels over TCP/IP networks and supports encryption, compression, and traffic shaping. It can be used for VPN, Mobile IP, and other various network tasks.
Bsdftpd-ssl is an RFC2228 "FTP Security Extensions" compliant FTP server. It is based on the FreeBSD ftpd and supports TLS/SSL for both control and data connections.
ccrypt is a utility for encrypting and decrypting files and streams. It was designed to replace the standard unix crypt utility, which is notorious for using a very weak encryption algorithm. ccrypt it based on the Rijndael date for the Advanced Encryption Standard (AES), which is believed to provide very strong security.
KCrypto is a KDE2 file encryptor. It uses Rijndael public domain C++ class implementation and is capable of encrypting and decrypting every kind of file in CBC mode with a 32-bit key (256 bits).
SFS (Self-certifying File System) is a secure, global file system with completely decentralized control. SFS lets you access your files from anywhere and share them with anyone, anywhere. At the same time, SFS uses strong cryptography to provide security over untrusted networks.
Log Auditing
Logcheck is a tool to audit log files. It helps spot problems and security violations in your log files and send the results to you in email. [main]
Swatch (Simple WATCHer) is a small tool that monitors system activity. It can monitor logfiles, or listen to a pipe from syslog. It can be run interactively, to have an open monitor on your desktop or console, or can respond to suspicious activities in different ways, such as email. [main]
securitylog2html is a script developed in AWK for filtering ipchains logs to generate HTML reports.
incident.pl is a small perl script that can generate an incident report for events that appear to be attempted security attacks by examining syslogs by snort or other tools. It will gather information on the remote host and report the attack to the defined administrator.
Logscan is a perl script to scan Apache logs and print out a summary of attacks and 404's by IP, attack type, date, and 404 request string.
Kernel Enhancements
LIDS (Linux Intrusion Detection System) is a system to enhance Linux kernel security by means of a kernel patch and an administration tool. It provides protection of files and processes, fine-granulate Access Control with ACLs, security alerts from the kernel, and even a port scanner detector in the kernel.
Medusa DS9 is a patch to the Linux kernel and a user-space daemon used to increase security. The kernel changes do the monitoring of syscalls, filesystem actions, and processes, and they implement the communication protocol. The security daemon communicates with the kernel using the character device to send and receive packets. Meusa can implement any model of data protection. Supports both 2.2 and 2.4 kernels.
Openwall Linux kernel patch is a patch to the Linux kernel with a collection of security "hardening" features. In addition to new features, some versions of the patch include various security fixes. It provides an extra layer of security against the easier ways to exploit certain classes of vulnerabilities and adds some privacy to the system by restricting parts of /proc. This patch is included in the 2.2 "secure" kernels. [main]
FreeS/WAN is an implementation of IPSEC and IKE for Linux. IPSEC (Internet Protocol SECurity) uses strong cryptography to provide both authentication and encryption services. This allows you to build secure tunnels through untrusted networks, resulting in a Virtual Private Network (VPN). This code is inluded in the Mandrake Linux kernel-secure kernels. [main]
RSBAC (Rule Set Based Access Control) is a flexible and powerful access control framework for current Linux kernels. It includes a range of different access control models like MAC, RC, ACL, and others.
grsecurity is a comprehensive set of security patches for Linux 2.4 kernels. It includes ports of the 2.2-based Openwall security patches, it's own ACL system, and other adapted features such as Trusted Path Execution and random IP ID implementations.
Miscellaneous
IPLimit is a daemon that aims to prevent some denial of services on common internet daemons. It will dynamically reject connections from hosts that already connected too many times on the same service or server, among many other duties.
Perlnecklace is a wrapper for the perl binary to increase site-wide security. It has the ability to chroot, set resource limits, allow/disallow modules, and log to syslog.
The Jail Chroot Project is a system that allows you to build chroot shell environments for any program.
Secure Programming
Flawfinder is a program that examines source code looking for security weaknesses, or flaws.
autoconf-sectest are autoconf macros to test for common security holes and bad simulations of good functions. They were extracted from the checkps special macros and previously posted to bugtraq.
ITS4 is a command-line tool for statically scanning C and C++ source code for security vulnerabilities. ITS4 scans through source code for potentially dangerous function calls that are stored in a database.
PScan scans C source files for problematic uses of printf style functions that have been the source of many security holes.
RATS (Rough Auditing Tool for Security) is a security auditing tool for C, C++, Perl, and Python code. RATS scans source code, finding potentially dangerous function calls.