canthen be stored in a DNS TXT record for that host. When a host that isset up for opportunistic encryption wishes to initiate an encryptedconnection with another host, it will look up the host's public keythrough DNS and use it to initiate the connection. To begin, you'll need to generate a key for each host that youwant to use this feature with. You can do that by running thefollowing command: ipsec newhostkey --output /tmp/`hostname`.keyNow you'll need to add the contents of the file that was created bythat command to /etc/ipsec.secrets: cat /tmp/`hostname`.key >> /etc/ipsec.secretsNext, you'll need to generate a TXT record to put into your DNS zone.You can do this by running a command similar to this one: ipsec showhostkey --txt @colossus.nncNow add this record to your zone and reload it. You can verify thatDNS is working correctly by running this command: ipsec verifyChecking your system to see if IPsec got installed and started correctlyVersion check and ipsec on-path [OK]Checking for KLIPS support in kernel [OK]Checking for RSA private key (/etc/ipsec.secrets) [OK]Checking that pluto is running [OK]DNS checks. Looking for TXT in forward map: colossus [OK]Does the machine have at least one non-private address [OK]Now just restart FreeS/WAN - you should now be able to connect to anyother host that supports opportunistic encryption. But what if otherhosts want to connect to you? To allow this, you'll need to create aTXT record for your machine in your reverse DNS zone. You can generate the record by running a command similar to this: ipsec showhostkey --txt 192.168.0.64Add this record to the reverse zone for your subnet, and othermachines will be able to initiate opportunistic encryption with yourmachine. With opportunistic encryption in use, all traffic betweenthe hosts will be automatically encrypted, protecting all servicessimultaneously. Eliminate suid binariesDifficulty: Intermediate Application: find If your server has more shell users than yourself, you shouldregularly audit the setuid and setgid binaries on your system.Chances are you'll be surprised at just how many you'll find. Here'sone command for finding all of the files with a setuid or setgid bitset: find / -perm +6000 -type f -exec ls -ld {} \; > setuid.txt &This will create a file called setuid.txt that contains the detailsof all of the matching files present on your system. To remove the sbits of any tools that you don't use, type: chmod a-s programMac filtering Host APDifficulty: Expert Application: iwpriv While you can certainly perform MAC filtering at the link layerusing iptables or ebtables, it is far safer to let Host AP do it foryou. This not only blocks traffic that is destined for your network,but also prevents miscreants from even associating with your station.This helps to preclude the possibility that someone could still causetrouble for your other associated wireless clients, even if theydon't have further network access. When using MAC filtering, most people make a list of wirelessdevices that they wish to allow, and then deny all others. This isdone using the iwpriv command. iwpriv wlan0 addmac 00:30:65:23:17:05iwpriv wlan0 addmac 00:40:96:aa:99:fd ...iwpriv wlan0 maccmd 1iwpriv wlan0 maccmd 4The addmac directive adds a MAC address to the