EducationaLinux 2004:
Network Analysis/Administration

Making OSS our institution's watchdog

By Lindsay Holmwood

What will this cover?

How we use it

A quick background of our school

Why we use Linux/OSS

What we think of it

Where Linux/OSS is going in our school

Who is this aimed at?

System administrators

IT Managers

Teacher who are technically inclined

Students who want to break(maybe fix) their own networks :)

Anyone with a vague interest in network security

Technical depth of this talk

Beginner -> Intermediate

n00b to geek

But first...

Who's this kid up the front?!?

My name is Lindsay Holmwood

I'm a student at the school

I do stuff with Linux

I like reading books and playing/writing/listening to music

About our school

St. Leo's College is a Catholic secondary school located in Sydney

We have a population of around 1000 students, and 80 staff

About our IT infrastructure

We have approximately 250 client computers on our network

It is a heterogeneous environment, consisting of a combination of Windows and
Macintosh PCs and laptops

Windows PCs

Macs

About our IT infrastructure (cont.)

We have a small (and little used) wireless network using WEP

We have a Linux box which is used for monitoring the network

We have a number of servers, running Windows NT and 2000, as well as MacOS 9 and X

The Linux Box

About our IT Staff

We have two sysadmins

One is from a Mac background

The other is from a Windows background, but plays around with Linux in his spare time

Why we use Linux/OSS

Fit's within our budget

It does the what we want it to

I nagged the sysadmins

It's reliable

It works

How we came about using Linux/OSS

A student was fooling around in class

He grabbed some silly/malicious VB code off the net

And was showing it off to his friends

Managed to slow down the network considerably

He ran the modified code on some of the machines

How we came about using Linux/OSS (cont.)

Sysadmins caught the student

But couldn't work out which computers were running the program

I offered to run a packet sniffer to see where the excess traffic was coming from

Managed to track down and isolate the infected	computers

How we came about using Linux/OSS (cont.)

The sysadmins wanted to have a Linux system around in case this happened again

Offered to set one up for them

The rest is history!

The Linux Box

Specs:

Pentium 233

64Mb Ram

2 Ethernet Cards

Gentoo Linux

What we do with Linux/OSS

Network monitoring

Traffic analysis

Intrusion detection

Security auditing

Network mapping

Network Monitoring/Traffic Analysis

Let's us see what is happening

Helps us troubleshoot

ngrep/tcpdump

They are both packet sniffers

Lets us see the raw information floating around on our network

We can see the information that non-working computers are spurting out

We can find out information on hosts that should not exist

Security Auditing

Security auditing is very useful

You can catch problems before they arise

Find configuration problems in programmes running on open ports

Catch exploits before they are exploited

Nessus: Security Auditing for the masses

Nessus is a security auditing package available under the GPL

It rivals many of it's commercial competitors

It's also very easy to use

What we have done with it

Scans are run every few weeks to see if any new software exploits have turned up

We have been able to patch a number of security holes before they were exploited

Configuration problem have shown up in programmes running, and once these problem been addressed, not only are the programmes secure, but do run faster at times

Network mapping

During the year our network address range changed significantly

Because we use dhcp, most of the hosts on the network picked up the change

However, the computers with static ips did not pick up the change

All of the Macs had to have their ips changed manually (this is a big task – we have almost 120 Macs)

Network mapping

A number of hosts in odd an unaccessible places did also not pick up the change, such as printers, and a number of routers

These computers had to be found quickly, otherwise teachers and students would riot

Enter Cheops-ng

Cheops-ng: network mapping made simple

Cheops-ng is a simple network mapping program for the artistically inclined

It searches out hosts on a certain subnet, finds out what operating system is running on it, and tells you what ports are open

Cheops-ng: conclusion

Cheops-ng made changing our network infrastructure a much easier task

It saved us having to walk around and find each host manually

Linux/OSS: What we think of it

Our admins were very impressed

They couldn't believe that they didn't have to pay anything to do all this

Linux/OSS: What I think of it

OSS has progressed far in a number of months at our school

At the moment, the box is more of a reactionary force. I want it to be a proactive force on our network, catching things before they happen

I don't think that we have reached our full potential, and this year I'm going to push Linux further

Where Linux/OSS is going in our school

OSS can only grow

Its' price and quality are both unrivaled

This year our Linux box is going to be upgraded

Our overall infrastructure is going to be upgraded as well, with the school purchasing a number of Apple Xserves running Samba 3

Our wireless network is going to be upgraded as well, blanketing our school with wireless coverage

Wireless

OSS's prospects on the wireless front are particularly promising

We may be setting up a number of boxes running Kismet, a wireless utility available on *NIX

Kismet lets you do all sorts of cool and sneaky stuff such as scanning for wireless hosts on a network, and gathering information on them

Kismet

Probably the most interesting thing with Kismet is it's ability to triangulate the position of wireless nodes on a network

It does this by bouncing signals and working out how long it takes for data to reach them

It can display the nodes on a map in real time

Linux on the desktop

A number of the older computers (P3 600's) are being replaced and moved to classrooms throughout the school

There is a possibility that Linux could be loaded on them to give students experience with the real world (read: non-Microsoft)

I am also pushing for OSS to be used in the creation of our school annual, reducing the cost of producing it by a significant margin

Thanks to:

Mr Peter Watt, for paying for trip

Mr Paul Harmon, for lending me the laptop (which is not working)

Andrew Bartlett, for loaning me this laptop

Resources...and Questions?

http://www.tcpdump.org

http://ngrep.sourceforge.net

http://cheops-ng.sourceforge.net

http://www.nessus.org (currently dns hijacked)

http://www.kismetwireless.net

http://www.scribus.org.uk?

Lindsay Holmwood

2004-01-06T15:25:15