A handy guide when trying unfamiliar tools or techniques   July 1, 2004

Despite these comments, I still found NSH a great addition to my security bookshelf. I found the coverage of Windows more than adequate, given that true security innovation in the public sphere is being done in the open source world and not in Redmond's labs. The writing tends to be clear and the descriptions concise. I guarantee you will find a handful of hacks which pique your curiosity and ultimately help secure your enterprise.


Good simple reference   June 10, 2004
  8 out of 10 found this review helpful

When I first got this little book, I was unimpressed by its idea: a seemingly random collection of network security tips, combined under the same cover. However, when I started reading, more and more often I exclaimed "ah, that is how it is done", etc. The book is one cool collection of tips, ranging from mundane (`how to configure iptables on Linux') to fairly esoteric (`how to use MySQL as an authenticating backend for an FTP server'). Always wanted to use `grsecurity' or `systrace', but thought it is too complicated - grab the book and give it a shot. Want to set up a fancy encrypted tunnel between two networks - it covers that too. Admittedly, a lot of advice given in the book can be found on Google, but it is nice to find it in one place. The book covers selected topics in host security, SSH and VPNs, IDS, monitoring and even touches upon forensics. I also liked its multi-platform coverage, with a slight, but unmistakable UNIX/Linux bias.

Overall, it is a great simple book, provided you don't try to find in it something it isn't: a neat collection of simple network security tips. I somewhat disliked that many tips don't go beyond `how to install a tool' and stop short of discussing `how to use it best'.

Anton Chuvakin, Ph.D., GCIA, GCIH is a Senior Security Analyst with a major security information management company. He is the author of the book "Security Warrior" (O'Reilly, 2004) and contributor to "Know Your Enemy II" by the Honeynet Project (AWL, 2004)). His areas of infosec expertise include intrusion detection, UNIX security, forensics, honeypots, etc. In his spare time, he maintains his security portal info-secure.org


Another great collection of "hacks"   June 4, 2004
  4 out of 5 found this review helpful

As with the other "Hacks" books, there are 100 hacks listed, and these are focused on network security. As another reviewer points out these hacks seem to be heavily slanted toward Unix. Whether this is due to the Windows OS "keeping the administrator out of the loop about the inner workings of her environment," as the book points out or the numerous "helpful features" of Windows that aren't that helpful to Windows admins is unclear. There does appear to be some limits to how secure you can make a Windows network, as opposed to Unix which seems to have many more options. And while we constantly hear about new Windows viruses, we rarely hear about Unix viruses. But I digress.

There definitely are some good ones here, like the "honeypot hack," protecting logs from tampering (thereby making it more difficult for a network intruder to cover their tracks), preventing stack-smashing attacks (thereby preventing an attacker from overwriting the information on a stack), detecting spoofing, testing your firewall, monitoring your logs for any sign of tampering, even defending yourself against web application intrusions. In short, these hacks are the ones deemed most likely by the book's author to be useful in defending your network against any kind of hostile attack or intrusion.

And while you may agree or disagree with the list presented in this book, this book is a valuable tool and reference for any network admin to have on hand.


Excellent material, but heavily weighted towards Unix...   May 31, 2004
  5 out of 6 found this review helpful

If you're at all responsible for or mindful of the security aspects of your network, here's a book you'll enjoy... Network Security Hacks by Andrew Lockhart (O'Reilly). As with all the Hacks titles, this book contains 100 various tips and ideas on how to improve your network security through the use of various software packages or procedures you can implement. The Hacks are grouped into the following chapters:

Unix Host Security; Windows Host Security; Network Security; Logging; Monitoring and Trending; Secure Tunnels; Network Intrusion Detection; Recovery And Response.

This isn't a primer on all you need to know about system security, nor is it meant to be. Network Security Hacks is most helpful for the system or network administrator who understands security but is always looking for various ways to enhance their level of security or ease the administration processes. For instance, in the Monitoring and Trending chapter, you are introduced to a number of free tools you can download that will verify your services, graph your bandwidth trends, monitor real-time network stats, and audit the traffic on your network. While not every hack will appeal or apply to you, you will find plenty of gems that will give you a real and quick payback.

The only "gripe" I have about the book is that it is heavily weighted towards the Unix environment. The Windows chapter is pretty small, and even some of the Windows hacks involve allowing you to work with the data like you can with Unix. So, if you're looking strictly for Windows security tips, you will probably find less satisfaction than you might if you were a hard-core Unix admin. Even so, there is material there that will interest you, such as how to use Snort to set up an intrusion detection system or how to use built-in features of Windows to create your own firewall.

Very good book, and worthy to hold a spot on your bookshelf...


Try rummaging thru the hacks   May 24, 2004
  2 out of 2 found this review helpful

Lockhart has assembled a fascinating collection of 100 hacks to protect your computers against a network intrusion. He covers linux/unix systems and also Microsoft machines. An entire chapter, containing 10 hacks, is devoted to the latter. Most of the other 90 hacks can be applied to both systems, though the example implementations are usually given under linux/unix.

Perusing the list of hacks may cause different readers to be attracted to different hacks. Here, I briefly summarise a few that caught my eye. Consider "Block OS fingerprinting". In an earlier, more innocent age, someone connecting to a telnet, sendmail or ftp daemon would cause it to reply with the machine's operating system label and the version of that daemon. Yes, really! In fact, this is still largely true, by default, on most unixes. Well, nowadays, a sysadmin can stop those daemons doing this. But a cracker can then do other probes. If you are running OpenBSD, you can use pf to block those.

Logically continuing this train of thought, what if you wanted to actively mislead the cracker by mimicking another operating system? This is the honeypot hack. The honeyd daemon lets you masquerade as several types of systems. Pretty crafty, eh? The next hack would then be to record all the cracker's activity on your honeypot via the open source Sebek, which is freely available for linux and Solaris.

Granted, you might be interested in other hacks. But hopefully the above gives you some idea of the book's utility. And a lot of hacks refer to other closely related hacks, in the manner shown above.