%
%	Copyright 1993, 1994 AT&T
%
\chapter{Useful Free Stuff}
\label{app:free}

\newcommand{\software}[2]{\par \noindent {\bf Host:} \m{#1} \newline {\bf Path:} \f{#2}}

For those contemplating securing their own networks, a lot of useful---and
free---code is available on the Internet.  Below, we list a number of packages,
along with their locations as of this writing.
The list is necessarily incomplete; new code is being written all the time.

Bear in mind that you must accept all responsibility for running any
of this code on your machine.  Even though we believe that none of the
authors have planted any Trojan horses, we cannot guarantee that any
of the code is bug-free.
Nor can
we guarantee the security of the archive
sites.
It is quite within the realm of possibility that some or all of
these packages have been tampered with.
Besides, we could be wrong about the authors\ldots.

On a more mundane, but equally serious, level, some of the software
we mention is subject to various usage and/or distribution requirements.
Read all such notices carefully.

In addition to the places we have listed, many tools are archived on
\m{ftp.uu.net} in the USENET archives, or on \m{ftp.cert.org}.
A number of other useful security tools may be found on the latter
as well.

\section{Building Firewalls}
\subsection{TCP Wrapper and Potmapper}

The \p{tcpwrapper}, by Wietse Venema, is the best-known mechanism
for adding logging and filtering to most standard services.  It is restricted
to services that are invoked through \p{inetd}.  A companion program,
\p{potmapper}, provides similar services for RPC-based servers invoked
via the standard \p{portmapper}.

\software{ftp.win.tue.nl}{/pub/security/tcp\_wrapper*}
\software{ftp.win.tue.nl}{/pub/security/portmap.shar*}

\subsection{Securelib}

As noted, the \p{tcpwrapper} only works for servers run via \p{inetd}.
The \p{securelib} \cite{demonfilt} package is a replacement shared library for SunOS that
provides filtering for standing servers.

\software{eecs.nwu.edu}{/pub/securelib.tar}

\subsection{Socks}

The \p{socks} \cite{socks} package can be used to build circuit relays and firewall machines.
The subroutines used by the applications have calling sequences that are almost identical
to the standard networking system calls, which makes installation fairly easy.
\software{ftp.inoc.dl.nec.com}{/pub/security/socks.cstc}

\subsection{TIS Firewall Kit}
The TIS firewall toolkit \cite{tis-toolkit} is a set of software components and
system configuration practices intended to provide the basic building
blocks for internet firewalls. Included with the tookit are application
proxies for telnet, rlogin, and FTP, as well as tools for securing
SMTP-based mail, and providing strong user authentication.

\software{ftp.tis.com}{/pub/firewalls/toolkit}

\subsection{Proxy \Xwindows}

As noted in Chapter~\ref{chap:firewall}, use of \Xwindows\ through a firewall is
best mediated via an application gateway.  The \t{xforward} \cite{xforward} package provides
this service.
Note the copyright restrictions before deciding to use it.

\software{crl.dec.com}{/pub/DEC/xforward.tar.Z} 

\subsection{Bellcore SKey}	
\P{Skey} is a one-time password scheme based on \cite{lamport-pw}.
Its big advantage is that it requires no extra hardware; you can
print off a list of passwords for use when traveling.
A version is include in the TIS firewall kit.

\software{thumper.bellcore.com}{/pub/nmh/skey}

\subsection{The \v{ident} Daemon}
There are two almost-compatible versions of the Identification Daemon protocol,
\t{IDENT} and \t{TAP}.  Both may be built from the same source code.

\software{ftp.lysator.liu.se}{/pub/ident}
\software{ftp.uu.net}{/networking/ident}

\subsection{The \p{Swatch} Logfile Monitor}

\p{Swatch} is a tool that lets you associate actions with logfile
entries.

\software{sierra.stanford.edu}{/pub/sources/swatch.tar.Z}

\subsection{Network Daemon Source Code}
The source code for recent versions of many network daemons is freely
available, though often protected to some extent by copyright.
We list just one set on one archive machine; many variants are
scattered around the Internet.

Most of these tools will not compile unchanged on your version of \unix.
On the other hand, they won't require much work, in most cases, and
if you spend the time to find or build a compatibility library early on,
you'll have a much easier time with the next one.

The \v{Linux} versions present an interesting question:
they are not for any
vendor's standard version of the \unix\ system, but they're often
the latest and greatest.  Of course, too often that means that they have
the latest and greatest bugs, or that they're Feature Creatures.

\software{ftp.uu.net}{/systems/unix/bsd-sources/usr.sbin/\{inetd,portmap,syslogd\}}
\software{ftp.uu.net}{/systems/unix/bsd-sources/libexec/*}
\software{ftp.uu.net}{/systems/unix/linux/packages/net/net-2/sources/*}

\section{Network Management and Monitoring Tools}

\subsection{Tcpdump}

\p{Tcpdump} is the best tool available for \unix\ systems for monitoring traffic on a
network.

\software{ftp.ee.lbl.gov}{tcpdump2.2.1.tar.Z}

\subsection{Traceroute}

\p{Traceroute} lets you determine the path to a given destination.

\software{ftp.ee.lbl.gov}{traceroute.tar.Z}

\subsection{dig}

\p{Dig} is a better tool for querying the \t{DNS} than the
standard \p{nslookup} program.

\software{ftp.isi.edu}{dig.2.0.tar.Z}

\subsection{host}
The \p{host} program is even better for building DNS shell scripts,
though still rather complex.

\software{nikhefh.nikhef.nl}{pub/network/host.tar.Z}

\subsection{\t{SNMP}}
A variety of useful information can be obtained via \t{SNMP}, especially
from routers.  There are many commercial packages available.  A free
one can be obtained from CMU.

\software{lancaster.andrew.cmu.edu}{pub/snmp-dist}

\section{The \p{Fremont} Network Mapper}

\p{Fremont} is a network topology discovery program.  The copyright notice
contains the following usage restriction:
\begin{quote}
This software may not be used for purposes inconsistent with
network appropriate use policies.  Inappropriate use includes, but is not
limited to, collecting information for the purposes of attempted illegal
entry into a computing system.
\end{quote}

\software{ftp.cs.colorado.edu}{pub/cs/distribs/fremont}

\section{Auditing Packages}
\subsection{TAMU}

Even though the strongest gateways contemplate a successful invasion of their
bastion host, life is simpler if that never occurs.  There are a number of
auditing packages that can help spot configuration errors.
The auditing
function is exceedingly important even if you choose not to evaluate your
own machines. You may rest assured that various ne'er-do-wells on the Internet
will do it for you, with possibly-unpleasant results.

The \p{TAMU} system \cite{tamu} is a collection of very useful tools.  Some can be
used to build your own firewall, others can detect attack signatures.
The Tiger scripts can be used to assess the security of your own machines.

\software{net.tamu.edu}{/pub/security/TAMU}

\p{COPS} \cite{COPS} is another popular auditing package along the lines of the Tiger
scripts.

\software{ftp.cert.org}{/pub/tools/cops}

Gene Spafford and Gene Spafford have
produced a package named Tripwire \cite{Tripwire} that
evaluates a system and checks for altered files and the like.

\software{ftp.cw.purdue.edu}{/pub/spaf/COAST/Tripwire}

\subsection{ISS}

The \p{ISS} package is a network vulnerability auditing package, along the lines
of \p{TAMU} and our network sweep programs.  It can be used to probe entire
networks for vulnerabilities.  Again, even if you choose not to run this
package, others with less-than-pure hearts will.  Closing the holes it checks
for is vitally important.

\p{ISS} has been recently published for the first time.  It covers a number
of fairly old holes.  We expect that the public will add modules to this
package, until it becomes a very thorough test.  If we are right, we
encourage you to keep up with these tools and run them.  The Bad Guys
will.

%\software{ftp.uu.net}{/usenet/comp.sources.misc/volume39/iss}
\software{aql.gatech.edu}{/pub/security/iss}

\subsection{Crack}

Crack is a well-known and widely-distributed password cracking program
by Alec Moffat.  The best way to beat password crackers is to get out of
the game.  Authentication devices are the best defense.
Shadow password files help, but are no defense against the eavesdropper.
If you are stuck with passwords, the best
defense against bad passwords is a smart \p{passwd} program like
\p{passwd \tt +}.  The \p{cracklib} library provides routines to
check the safety of a proposed password.
If none of these are used, crack your own password
files and weed out the weak ones.

\software{ftp.cert.org}{/pub/tools/crack}
\software{ftp.cert.org}{/pub/tools/cracklib}

\section{Information Sources}

\subsection{CERT Tools and Advisories}

CERT---the Computer Emergency Response Team---provides an archive site.
Among other things, they store tools contributed by the community,
as well as their own security advisories.

\software{ftp.cert.org}{pub/cert\_advisories}
\software{ftp.cert.org}{pub/tools}

\subsection{The \v{Firewalls} Mailing List}

A mailing list dedicated to firewalls is hosted at \m{greatcircle.com}.
To join the list, send mail to \a{majordomo@greatcircle.com} with a
body consisting of the line
\begin{quote}
{\tt subscribe firewalls}
\end{quote}
or
\begin{quote}
{\tt subscribe firewalls} {\em your\_email\_address}
\end{quote}
rather than using the usual {\tt firewalls-request@greatcircle.com}
convention.

\subsection{The \v{Bugtraq} Mailing List}

\v{Bugtraq} is a security mailing list whose differentiating principle is that
it's proper to disclose details of security holes, so that you can assess
your own exposure, and---perhaps---see how you can fix them yourself.
Send subscription requests to \a{bugtraq-request@crimelab.com}.

\subsection{USENET Newsgroups}

A number of USENET newsgroups are dedicated to various aspects of security.
These include \f{comp.security.announce}, \f{comp.security.misc}, \f{comp.security.unix},
\f{alt.security}, and \f{sci.crypt}.
Other discussions are likely to occur in topic-specific newsgroups:  \f{comp.sys.*},
\f{comp.windows.x},
\f{misc.legal.computing}, etc.  Naturally, the list changes
constantly.

\section{Cryptographic Software}
Most of the packages listed in this
section are described in detail in Chapter~\ref{chap:crypt}; no
further description is given here.  As noted there, much cryptographic software is 
subject to a variety of import, export, usage, and patent restrictions.
Check carefully with a competent lawyer before proceeding.

\subsection{RIPEM}
\software{ripem.msu.edu}{/pub/crypt/ripem}

\subsection{PEM}
\software{ftp.tis.com}{/pub/PEM}

\subsection{PGP}
\software{ghost.dsi.unimi.it}{/pub/crypt/pgp*}

\subsection{Kerberos}
\software{athena-dist.mit.edu}{/pub/kerberos}
