Linux System Security: The Administrator's Guide to Open Source Security Tools

About

Features

• Fundamental discussions of functionality—Includes discussion of TCP/IP.

• Coverage of topics relating to security preparedness—Examines concepts essential to placing a system in a production environment, regardless of ultimate purpose.

• Coverage of most major applications, their security weaknesses, and risk minimization.

• Outline of steps needed to test a system prior to its incorporation into a production network—Assists administrators in identifying network vulnerabilities.

• Discussion of ongoing administrative requirements associated with maintaining security.

• Exploration of special case systems which will operate as firewalls or otherwise in a DMZ/Perimeter Network (Part VI).

• End-of-book summary—Ties together all text contents, focusing on when certain steps should be taken and on how to implement new utilities on systems after they have entered production.

• Exclusive focus on the Apache Web server which ships with Linux.



Description

• Copyright 2000
• Edition: 1st

• Book
• ISBN-10: 0-13-015807-0
• ISBN-13: 978-0-13-015807-9

1580G-1

Maximize Linux security, hands-on-with today's best open source tools

If you depend on Linux to run mission-critical networks or store business-critical data, are you sure you can protect your Linux systems from intruders? You'd better be-and with Linux System Security, you can be!

Long-time Linux sysadmins Scott Mann and Ellen Mitchell demonstrate exactly how to protect your vital resources, using today's most powerful open source security tools. Linux System Security makes you an expert fast, with insiders' coverage of the "gotchas," "rules of thumb," and undocumented tricks you'd otherwise have to learn the hard way. Coverage includes:

• Preparing Linux systems for a production environment
• Identifying vulnerabilities, and planning for security administration
• Configuring Linux-based firewalls, authentication, and encryption
• Intrusion detection on Linux systems
• Securing filesystems, email, web servers, and other key applications
• Protecting mixed Linux/Unix and Windows NT environments

You'll find hands-on introductions to the Linux community's most important security tools, including sudo, TCP, wrappers, xinetd, SSH, tiger, Tripwire, ipchains, PAM, crack, and many others.

If you want the benefits of Linux without the security risks, you want Linux System Security!



Sample Content

Downloadable Sample Chapter

Click here for a sample chapter for this book: 0130158070.pdf

Table of Contents

1. Vulnerability Survey.

What Happened? Other Cracker Activities. So, Are You Going to Show Us How to Break into Systems? A Survey of Vulnerabilities and Attacks. Technical. Social. Physical. Summary. For Further Reading. Books. Interesting Cracker Tales. Web Sites. Full-Disclosure Resources.

2. Security Policies.

What Is Computer and Network Security? Elements of a Computing Environment. Risk Analysis. The Security Policy. Securing Computers and Networks. User Privacy and Administrator Ethics. Summary. For Further Reading. Books. Web Resources. Other Resources.

3. Background Information.

BIOS Passwords. Linux Installation and LILO. A Note about LILO. Recovering a Corrupt System. Installation and LILO Resources. Start-Up Scripts. Red Hat Package Manager. Verifying Packages with RPM. Checking PGP Signatures with RPM. RPM Resources. RPM Mailing List. TCP/IP Networking Overview. The TCP/IP Model Layers. Remote Procedure Call Applications. Trusted Host Files and Related Commands. Some Major Applications. Network Monitoring. General TCP/IP Networking Resources. NFS, Samba, NIS, and DNS Resources. Request for Comment. Cryptography. The Purpose of Cryptography. Algorithm Types. Hash Functions and Digital Signatures. Passwords Aren't Encrypted, They're Hashed! An Overview of PGP. Cryptography References. Testing and Production Environments. Security Archives. Software Testing. Source Code Auditing. Pristine Backups. Security Resources. Licenses.

4. Users, Permissions, and Filesystems.

User Account Management. Good Passwords. All Accounts Must Have Passwords!Or Be Locked! Password Aging and the Shadow File. Restricted Accounts. Shell History. The Root Account. Using the Root Account. Multiple Root Users. Minimizing the Impact of Root Compromise. Configuring /etc/securetty. Group Account Management. File and Directory Permissions. User File and Directory Permissions. System File and Directory Permissions. SUID and SGID. File Attributes. Using xlock and xscreensaver. Filesystem Restrictions. Summary. For Further Reading. System Administration. System Security.

5. Pluggable Authentication Modules.

PAM Overview. PAM Configuration. PAM Administration. PAM and Passwords. PAM and Passwords Summary. PAM and login. Time and Resource Limits. Access Control with pam_listfile. PAM and su. Using pam_access. Using pam_lastlog. Using pam_rhosts_auth. One-Time Password Support. PAM and the other Configuration File. Additional PAM Options. PAM Logs. Available PAM Modules. PAM-Aware Applications. Important Notes about Configuring PAM. The Future of PAM. Summary. For Further Reading. On-Line Documentation.

6. One-Time Passwords.

The Purpose of One-Time Passwords. S/Key. S/Key OTP Overview. S/Key Version 1.1b. S/Key Version. OPIE. Obtaining and Installing OPIE. Implementing and Using OPIE. OPIE and PAM. Obtaining and Installing pam_opie. Obtaining and Installing pam_if. Implementing pam_opie and pam_if. Which OTP System Should I Use? Advantages and Disadvantages of S/Key. Advantages and Disadvantages of OPIE. S/Key and OPIE Vulnerabilities. Summary. For Further Reading. Programming. E-Mail Lists.

7. System Accounting.

General System Accounting. Connection Accounting. The last Command. The who Command. One Other Command. Process Accounting. The sa Command. The lastcomm Command. Accounting Files. Summary. For Further Reading. Books. On-Line Documentation.

8. System Logging.

The syslog System Logging Utility. Overview. The /etc/syslog.conf File. Invoking the syslogd Daemon. Configuring /etc/syslog.conf. The klogd Daemon. Other Logs. Alternatives to syslog. The auditd Utility. Summary. For Further Reading. General System Logging. Intrusion Detection.

9. Superuser Do (sudo).

What Is sudo? Obtaining and Implementing sudo. Features of Version 1.5.9p. Implementing Version 1.5.9p. Using sudo. The Functionality of sudo. The /etc/sudoers File. General Syntax of /etc/sudoers. The visudo Command. Options to the sudo Command. A More Sophisticated Example. Setting Up sudo Logging. Reading sudo Logs. PAM and sudo. Disabling root Access. Vulnerabilities of sudo. Summary. For Further Reading. Reference Books. E-Mail Lists. Web Sites. On-Line Documentation. Kerberos Resources. FWTK Resources.

10. Securing Network Services: TCP_wrappers, portmap,and xinetd.

TCP_Wrappers. Building TCP_Wrappers. Access Control with TCP_Wrappers. TCP_Wrappers Utility Programs. TCP_Wrappers Vulnerabilities. The Portmapper. Building the Portmapper. Implementing Portmapper Access Control. The portmap Log Entries. Gracefully Terminating and Recovering the Portmapper. Portmapper Vulnerabilities. Unwrapped Services. Replacing inetd with xinetd. Advantages of xinetd. Disadvantages of xinetd. Obtaining xinetd. Building xinetd. The xinetd Configuration File. The xinetd Daemon. Which One Should I Use? Summary. For Further Reading. Resources for TCP_Wrappers. Resources for the Portmapper. Resources for xinetd. Internet Services Resources.

11. The Secure Shell.

Overview of SSH. Host-Based Authentication Using RSA. Authenticating the User. Available Versions of SSH. Obtaining and Installing SSH. Compiling SSH. Configuring the Secure Shell. Configuring the Server Side. Configuring the Client Side. Using SSH. Configuring SSH Authentication Behavior. sshd Missing in Action. Authentication Flow of Events. Nonpassword Authentication. Password-Based Authentication. Exploring ssh Functionality. ssh Examples. scp Examples. Port Forwarding and Application Proxying. Secure Shell Alternatives. Summary. For Further Reading.

12. Crack.

Obtaining Crack. Major Components of Crack. Crack Overview. Building Crack. Modifying Crack for Linux. Modifying Crack for MD. Modifying Crack for Bigcrypt. Preparing Crack for crypt(3). Compiling and Linking Crack. Compiling Crack Itself. Crack Dictionaries. Obtaining Other Crack Dictionaries. Using Crack. Running Crack. Running Crack over the Network. Crack. Crack Rules. What Do We Do about Cracked Passwords? The White Hat Use of Crack. Effectively Using Crack. Summary. For Further Reading.

13. Auditing Your System with tiger.

Overview of tiger. Obtaining tiger. Major Components of tiger. Overview of tiger Configuration. Overview of Run-Time Operation. tiger Scripts. Installing tiger to Run through cron. Which Scripts Should I Run? cronrc for a Development Machine. Running Crack from Tiger. Deciphering tiger Output. Troubleshooting tiger. Modifying Tiger. Modifying Scripts. Adding New Checks. Signatures. Recommendations. Summary. For Further Reading. Mailing List for tiger. sendmail Resources.

14. Tripwire.

Tripwire Overview. Obtaining and Installing Tripwire. Tripwire Version. The Tripwire Configuration File. Extending the Configuration File. Effectively Building the Tripwire Configuration File. Example Configuration File for Red Hat Linux. The tripwire Command. Tripwire Initialize Mode. Effective Tripwire Initialization. Storing the Database. Routine Tripwire Runs? Compare Mode. A Note on Performance. Tripwire Update Mode. Summary. For Further Reading. On-Line Documentation. Web Site.

15. The Cryptographic and Transparent Cryptographic Filesystems.

Overview of the Cryptographic File System. CFS Flow of Events. Obtaining and Installing CFS. CFS Administrative Tasks. Using CFS. Creating and Attaching CFS Directories. The CFS Commands and Daemon Detailed. Using CFS over NFS. Vulnerabilities of CFS. Overview of TCFS. Obtaining and Installing TCFS. The TCFS Client Side. The TCFS Server Side. Using TCFS. Configuring TCFS for Use with PAM. TCFS Administrative Tasks. Extended Attributes for TCFS. Setting up the Encrypted Directory. TCFS Groups. TCFS Key Management. Vulnerabilities of TCFS. CFS and TCFS Comparison. Securely Deleting Files. Alternatives to CFS and TCFS. Summary. For Further Reading. Papers. E-Mail Lists.

16. Packet Filtering with ipchains.

Packet Filtering. Configuring the Kernel for ipchains. ipchains Overview. Behavior of a Chain. Malformed Packets. Analysis of an Inbound Packet. Analysis of an Outbound Packet. The Loopback Interface. Custom Chains. Introduction to Using ipchains. The ipchains Command. Some Simple Examples. Packet Fragments. IP Masquerading. Adding Custom Chains. ICMP Rules in a Custom Chain. Antispoofing Rules. Rule Ordering Is Important! Saving and Restoring Rules. Rule Writing and Logging Tips. Changing Rules. ipchains Start-up Scripts. Building Your Firewall. Simple Internal Network. Simple Internal Network Using DHCP. ipchains Isn't Just for Firewalls! One More Thing. Supplementary Utilities. Other Examples. Port Forwarding. The fwconfig GUI. Mason. The Network Mapper (nmap). Additional Firewall Software. Virtual Private Networks and Encrypted Tunnels. The Next Generation. Summary. For Further Reading. ipchains Documentation. Masquerading Documentation. ISP Connectivity-Related Resources. General Firewall References. DMZ Resources. ICMP-Related References. A Special Acknowledgment.

17. Log File Management.

General Log File Management. logrotate. Obtaining and Installing logrotate. Configuring logrotate. Pulling It All Together. swatch. Obtaining swatch. Installing swatch. Configuring and Running swatch. logcheck. Obtaining logcheck. Major Components of logcheck. Configuring and Installing logcheck. logcheck Output. Troubleshooting logcheck. Summary.

18. Implementing and Managing Security.

So, Where Do I Start? Hardening Linux. Selecting the Right Tools. Reducing the Workload. What if My Systems Are Already in the Production Environment? The Internal Network. Critical Internal Servers. Internal Maintenance. Firewalls and the DMZ. External Maintenance. Break-in Recovery. Adding New Software. Only through Knowledge.

Appendix A: Keeping Up to Date.


Appendix B: Tools Not Covered.


Glossary.


Index.

Preface

Preface

This book exists because we need it! In many ways, we (well, Scott, anyway) wish someone else had written it so that we could have just read it. We have found that it is much easier to read than it is to write (unlike disk drives, however, it takes orders of magnitude longer to write than to read!)

This book provides an introduction to installing, configuring, and maintaining Linux systems from a security perspective. In fact, it is really an administrator's guide to implementing security and security tools on Linux (although much of what is discussed can easily apply to other UNIX variants). It isn't a definitive book about security (there aren't any), but we think it provides a reasonable starting point for preparing and maintaining secure systems. If you follow the procedures outlined in this book, you will certainly reduce your overall level of vulnerability, and you will have an early warning system that may be able to prevent the most serious of system and network breaches.

We really tried to avoid discussing topics that are covered well elsewhere. Subjects such as cryptography, security policies, Transmission Control Protocol/Internet Protocol (TCP/IP) networking, firewalls, and so on are well documented in other sources. We've noted resources for these topics at the end of each appropriate chapter and in Appendix A. We've also tried to provide similar resources for the many topics we did not have time to cover (publishers are so deadline intensive).

This book will not teach you how to break into systems, although some obvious tricks are described to heighten your awareness. Neither will this document describe the process of system and code auditing for vulnerability assessment-that task is left to people far more industrious than we are. Simply, this book will provide a framework-a foundation if you will-that will allow you to learn more and, hopefully, be as dynamic as the field of computer security itself.

About This Book

The intent of this book is to give you a process to follow (with whatever modifications you feel are appropriate) to better secure your computing environment. We also tried to write in such a way that each chapter could stand on its own. For those of you who are unfamiliar with implementing secure computing environments, you may well benefit from reading this book in its entirety and then using it as a reference. If you are really new to the subject of security, read Practical UNIX and Internet Security or something similar first. Then read this book.

We have included instructions for compiling most of the utilities covered in this book. The reason behind such madness (mad, because those instructions will be out of date very quickly) is that, while there are resources that generically describe the procedure of building software, there are few that provide real-world examples. It has been our experience that very few new or junior system and network administrators have the experience necessary to fetch a publicly available tool, modify it appropriately, and successfully compile it. It is for those readers in particular that we have included these instructions. For those of you who don't need these instructions, just skip over them.

The first four chapters are overviews. We begin in Chapter 1 with a survey of vulnerabilities. Chapter 2 introduces the critical topic of security policies. Chapter 3 covers a wide range of topics from cryptography to networking to give us a framework for what follows. Chapter 4 provides a survey of user accounts, file permissions, and filesystem options as they relate to security.

Chapters 7 and 8 cover the topics of system accounting and system logging, respectively. A book about system security would not be complete without a discussion of these topics, which are very important in securing a system. Chapters 5, 6, and 9-17 are the heart of the book, providing a detailed look at utilizing the security capabilities of Linux and implementing publicly available tools to augment Linux security. Please be sure to learn about and utilize tiger (Chapter 13) and Tripwire (Chapter 14) before going live with any of the tools discussed elsewhere in the book. These two utilities will give you a high confidence level regarding the state of security of your systems, if used properly.

Chapter 18 shows how to implement all that is covered in the book. If you are in a hurry, you may want to read through this chapter early on in your study of this topic to get a sense of what needs to be done to provide a secure environment.

We sincerely hope you find this book as useful as we do!

Errata or, More Simply, Bugs

There will be those! While we tested everything presented in this book for accuracy on RedHat 5.2 and almost everything on Red Hat 6.0, there are undoubtedly mistakes in this text. If you find any, please e-mail them or any other comments you might have to us at

linux_upat@thekeyboard.com

We probably won't always answer, but we will post updates and corrections to

http://www.phptr.com/ptrbooks/ptr_0130158070.html

Please check the web site once in a while for new information.



Updates

Submit Errata

