Ever since this past March, I have begun to take a much more intense fascination with virtual machines running Linux operating systems on them. Two flavors of Linux in particular, an Ubuntu server and BackTrack 5 R2 have caught my interest. I've been working mainly on the Ubuntu server at this point fishing around for ways to secure it and the Apache server it will be running in order to create a comprehensive and simple to follow guide. (I'll post my secret plans for world domination using the server once they are done). However, how can I tell if my server is really secure once I've completed my initial tasks? How do I know what works, and what I need to try a different tactic on?
The answer is a little something known as BackTrack, or known jokingly within certain circles as Evil Linux. In truth, it is not really evil, it is a Linux distribution that centers around penetration testing and digital forensics. Being as such, BackTrack hosts a wide variety of tools to allow you to test systems, for which you have explicit permission to test, to your heart's content. So far, my favorite tool from observation has been the Metasploit framework tool for its sheer versatility. Metasploit was originally conceived and developed by HD Moore in 2003 to make penetration and vulnerability testing less tedious. Imagine trying to pick a lock without the proper tools, breaking in to a computer system is the same concept. While most penetration testers would build their own tools, it is far more simple to have the proper tools at hand and still allow for the testers to build more specialized tools. This was exactly what the Metasploit framework has allowed them to do.
I have been wanting to learn more about how to properly use Metasploit for a while now, and this project (the Ubuntu server guide) has provided me with a cornucopia of opportunities to play with numerous functionalities of the framework. Again I was left with the question of where to start. I tried Googling with few results on websites I would like to visit (you know, the ones where you don't automatically get put on the CIA watch list) until I came across a book Metasploit: The Pentration Tester's Guide by Kennedy, O'Gorman, Kearns, and Aharoni.
Suffice it to say, I tracked down a copy of the text immediately and began reading! I was extremely impressed with the book, the information was easy to understand, it showed how to utilize many of the tools in the framework and provided what you should see when you give certain commands, and most importantly they provided a very thorough tutorial in one place rather than me taking hours gathering little bits and pieces of information in a process that mostly resembles trying to make ill-fitting puzzle pieces come together.
What does any of this have to do with gaming? Everything! Particularly for server hosted games, penetration testing is of the utmost importance. It is even important for gamers who play often on their PC gaming rigs. Penetration and vulnerability testing on computer systems allows you to be aware of your weaknesses and gives you an opportunity to patch up these weaknesses before a hacker gets in and steals your MMORPG account information. On a larger scale (as with the games hosted on servers) the damage could effect several people, such as in the hack on Sony last year which caused the Playstation Network to be inaccessible for over a month.
Now that that rant is over with, what I am trying to convey is that it is important to test your computer and make sure that it is secure. Granted you can install an anti-malware program (and I highly recommend that you do!), but think of this additional security precaution as the moat of a castle (codename: your computer) , and worth learning how to implement. Adding this layer of protection is simple, I suggest downloading a virtual machine hosting program such as VMware or Virtual Box, and installing a BackTrack operating system on the virtual machine. After that you can test away on your host (the operating system running the virtual machine) system and fix what needs to be fixed. So far, everything but the book (which I believe is the best guide for beginners, please comment below if you find a better open-source online tutorial) is open-source software, so it will cost you nothing but a few gigabytes to ensure that you have a secure system. Just remember, like it says in the book, "don't be stupid." Only use the powers of BackTrack and Metasploit for good. Meaning, please only use them on your own system or someone else's who has given you explicit permission!
