1.4 Discussion Questions What command will allow you to generate the keys needed for SSH? ~#sshd-generate What command will allow you to check for listening ports? ~# netstat -tan What is the procedure to start apache and sshd on the BackTrack 5 r3 Internal machine? Applications > BackTrack > Services > HTTPD > apache start. Applications > BackTrack > Services > SSHD > sshd start Which ports do FTP, SSHD, and HTTP utilize? FTP - 21 SSHD - 22 HTTP - 80 2.3 Discussion Questions 1. In Routing and Remote Access, which interface is configured to do redirection? Network Address Translation 2. What does Wireshark do? Wireshark is a tool that you use to monitor or “sniff” Network traffic. You can capture network travel over a specific or multiple connections. It can also be used to monitor ports that are being utilized. 3. Is secure shell (SSH) natively supported by the Microsoft Windows OS? No it is not, it must be added manually 4. What filter in Wireshark can be utilized to examine traffic over port 80? By typing in HTTP in the filter pane. You can also filter for other services as well. 3.3 Discussion Questions 1. What is the command to switch to binary mode when using FTP? ftp>bin 2. What happens during an initial SSH connection to a remote system? First it will ask you to verify that you really want to connect. Second, it will prompt you for a valid username and password to connect to the system 3. What is the location of the web root for the BackTrack Linux system? 216.1.1.1 4. Is the FTP root for VSFTPD actually the user’s home folder? No, you are simply establishing a remote connection to this folder 1.3 Discussion Questions 1. What needs to be done to configure a TELNET server on Windows 7? You have to enable the TELNET server windows feature. You can do this by going to Control Panel | Programs | Turn Windows Features on and off 2. What needs to be done so that SSHD can be configured on BackTrack? Public and private keys must be generated by using the command ~#sshd-generate 3. What protocol covered in this section uses UDP instead of TCP? TFTP uses udp port 69 4. Which ports do FTP, TELNET, SSH, HTTP, and TFTP utilize? FTP - 21 TELNET - 23 SSH - 22 HTTP - 80 TFTP - UDP 69 2.3 Discussion Questions 1. What is the difference between the GREEN and the RED Interface? The Green interface is for the trusted, internal connection, this is the source for outgoing traffic. The Red Interface is for the interested Wide area internet connection. Also used for the destination of outgoing traffic. 2. Does Domain Name System (DNS) use TCP, UDP, or both? DNS uses port 53 on both UDP and TCP 3. Does the Endian Community Firewall allow SSH out by default? No it does not, you can add the rule manually 4. Which ports do IMAPs and POPs utilize? IMAP - 143,993 POP - 110,995 3.3 Discussion Questions 1. Why might it be a good idea to block PING? ICMP is seen as a potential security risk by most network admins. While all ICMP traffic should not be blocked, there are security flaws in the protocol. 2. Why might it be a good idea to block TELNET? Telnet is usually safe when being used on an internal trusted network. The only issue that I could see is that telnet send usernames and passwords unencrypted for authentication. Certain types of Malware have also been known to use TELNET as a callout so if it is not being used it may be best to block. There are few if any situations where you would want to allow all TELNET connections. 3. Why might it be a good idea to block TFTP? TFTP is just an old transfer protocol. It tends to be slow and insecure. SFTP is better and more efficient. A reason to block this type of traffic would simply be to discourage users from using it to transfer files to your system. 4. Why might it be a good idea to block FTP? FTP transmits passwords and the data unencrypted. While this is fine for a trusted internal network, in most cases, FTP is a bad idea to keep wide open. You could and should disable FTP traffic to ensure that incoming and outgoing traffic uses SFTP.
