The document summarizes various free security tools that can be used to gain experience with system and network security. It describes tools for port scanning (Nessus, Saint, Nmap), firewalls (TCP Wrappers, Portsentry), intrusion detection (Snort, Logcheck), and system administration (Sudo, Lsof, Crack). The document recommends using freeware tools to familiarize yourself with security issues before evaluating commercial vendor tools.

1. Freeware Security Tools You Need Randy Marchany VA Tech Computing Center Blacksburg, VA 24060 [email_address] 540-231-9523 NetSec2001

15. X

55. IP Filter Log Format Jul 30 01:46:52 myhost.vt.edu ipmon[147]: [ID 702911local0.warning] 01:46:52.196772 hme0 @0:5 b 194.143.66.126,21 ->198.82.255.255, 21 PR tcp len 20 40 -S IN Jul 30 01:47:03 myhost.vt.edu ipmon[147]: [ID 702911local0.warning] 01:47:03.269595 hme0 @0:5 b 194.143.66.126,21 ->198.82.255.255, 21 PR tcp len 20 40 -S IN Jul 30 05:53:51 myhost.vt.edu ipmon[147]: [ID 702911local0.warning] 05:53:50.699235 hme0 @0:5 b 203.90.84.163,1781 ->198.82.255.255, 21 PR tcp len 20 60 -S IN

57. logcheck.violations These keywords denote a problem and are flagged by logcheck.

58. logcheck.ignore Phrases listed in this file are ignored by the logcheck program.

59. logcheck.hacking Keywords in this file indicate an attack is taking place

75. Sniffer Output - Solaris Snoop

76. Tcpdump Example

89. Sample lsof Utility Output