6.4Security Operations

Configuring a firewall and SSH is not the end of the story. Day-to-day security operations involve continuously checking your own attack surface, detecting signs of intrusion, and tracking the latest vulnerability information. This section surveys the tools used in that ongoing work.

6.4.1Connectivity checks and port scanning

• netcat (nc, or its successor ncat) is a general-purpose tool that easily connects to or listens on any TCP/UDP port—useful for a quick open-port check or as an ad hoc file transfer / listener.
• nmap is a full-featured port scanner that surveys a target host's open ports, running services, and OS fingerprint—used for audits that visualize your own organization's attack surface (running it against another organization without authorization can constitute unauthorized access).

6.4.2Vulnerability information sources, IDS, and scanners

• Advisory sources for vulnerability news: Bugtraq (a long-running mailing-list-derived source among security researchers), CERT (from Carnegie Mellon University, a pioneering incident-response organization), and CIAC (a U.S. Department of Energy incident response team). Monitoring these routinely is basic security-staff work.
• fail2ban watches logs and automatically bans IP addresses after repeated authentication failures, working with iptables/firewalld—the standard defense against SSH brute-force attempts.
• snort is a leading open-source IDS (intrusion detection system) that matches network traffic against signatures to detect and log suspicious activity. OpenVAS and OpenSCAP are vulnerability/compliance scanning tools that check systems against known vulnerabilities and security configuration baselines.

Sort these tools into "before an attack" and "during/after an attack" to see where each fits. Proactive checking: run nmap against your own servers to surface unintentionally open ports or services, and use OpenVAS or OpenSCAP to check OS and middleware against known vulnerabilities and security configuration benchmarks—an active "health checkup" you initiate. Detection and defense: snort matches packets flowing across the network against signatures, detecting known attack patterns (e.g., traffic exploiting a specific vulnerability) and raising alerts. For brute-force attempts against SSH or web applications, fail2ban is the practical answer: it watches logs like /var/log/secure or /var/log/auth.log, and when it spots a source IP with repeated authentication failures in a short window, it dynamically adds a block rule to iptables or firewalld (typically auto-expiring after a set time). Ongoing information gathering: regularly check the Bugtraq mailing list and advisories from CERT and CIAC for newly disclosed vulnerabilities affecting the software your organization runs. For a quick connectivity check, netcat is handy (e.g., nc -zv host 80 to quickly confirm a port is open), while a thorough inventory calls for nmap—another practical distinction in granularity.

6.4.3Section summary

• Proactive checks = nmap (scanning), OpenVAS/OpenSCAP (vulnerability/compliance assessment); connectivity checks via netcat (nc/ncat)
• Detection = snort (IDS) / prevention = fail2ban (auto-block); information sources are Bugtraq, CERT, and CIAC