Book description
Computer security is an ongoing process, a relentless contest between system administrators and intruders. A good administrator needs to stay one step ahead of any adversaries, which often involves a continuing process of education. If you're grounded in the basics of security, however, you won't necessarily want a complete treatise on the subject each time you pick up a book. Sometimes you want to get straight to the point. That's exactly what the new Linux Security Cookbook does. Rather than provide a total security solution for Linux computers, the authors present a series of easy-to-follow recipes--short, focused pieces of code that administrators can use to improve security and perform common tasks securely.The Linux Security Cookbook includes real solutions to a wide range of targeted problems, such as sending encrypted email within Emacs, restricting access to network services at particular times of day, firewalling a webserver, preventing IP spoofing, setting up key-based SSH authentication, and much more. With over 150 ready-to-use scripts and configuration files, this unique book helps administrators secure their systems without having to look up specific syntax. The book begins with recipes devised to establish a secure system, then moves on to secure day-to-day practices, and concludes with techniques to help your system stay secure.Some of the "recipes" you'll find in this book are:
- Controlling access to your system from firewalls down to individual services, using iptables, ipchains, xinetd, inetd, and more
- Monitoring your network with tcpdump, dsniff, netstat, and other tools
- Protecting network connections with Secure Shell (SSH) and stunnel
- Safeguarding email sessions with Secure Sockets Layer (SSL)
- Encrypting files and email messages with GnuPG
- Probing your own security with password crackers, nmap, and handy scripts
Publisher resources
Table of contents
- Linux Security Cookbook
- Preface
-
1. System Snapshots with Tripwire
- 1.1. Setting Up Tripwire
- 1.2. Displaying the Policy and Configuration
- 1.3. Modifying the Policy and Configuration
- 1.4. Basic Integrity Checking
- 1.5. Read-Only Integrity Checking
- 1.6. Remote Integrity Checking
- 1.7. Ultra-Paranoid Integrity Checking
- 1.8. Expensive, Ultra-Paranoid Security Checking
- 1.9. Automated Integrity Checking
- 1.10. Printing the Latest Tripwire Report
- 1.11. Updating the Database
- 1.12. Adding Files to the Database
- 1.13. Excluding Files from the Database
- 1.14. Checking Windows VFAT Filesystems
- 1.15. Verifying RPM-Installed Files
- 1.16. Integrity Checking with rsync
- 1.17. Integrity Checking Manually
-
2. Firewalls with iptables and ipchains
- 2.1. Enabling Source Address Verification
- 2.2. Blocking Spoofed Addresses
- 2.3. Blocking All Network Traffic
- 2.4. Blocking Incoming Traffic
- 2.5. Blocking Outgoing Traffic
- 2.6. Blocking Incoming Service Requests
- 2.7. Blocking Access from a Remote Host
- 2.8. Blocking Access to a Remote Host
- 2.9. Blocking Outgoing Access to All Web Servers on a Network
- 2.10. Blocking Remote Access, but Permitting Local
- 2.11. Controlling Access by MAC Address
- 2.12. Permitting SSH Access Only
- 2.13. Prohibiting Outgoing Telnet Connections
- 2.14. Protecting a Dedicated Server
- 2.15. Preventing pings
- 2.16. Listing Your Firewall Rules
- 2.17. Deleting Firewall Rules
- 2.18. Inserting Firewall Rules
- 2.19. Saving a Firewall Configuration
- 2.20. Loading a Firewall Configuration
- 2.21. Testing a Firewall Configuration
- 2.22. Building Complex Rule Trees
- 2.23. Logging Simplified
-
3. Network Access Control
- 3.1. Listing Your Network Interfaces
- 3.2. Starting and Stopping the Network Interface
- 3.3. Enabling/Disabling a Service (xinetd)
- 3.4. Enabling/Disabling a Service (inetd)
- 3.5. Adding a New Service (xinetd)
- 3.6. Adding a New Service (inetd)
- 3.7. Restricting Access by Remote Users
- 3.8. Restricting Access by Remote Hosts (xinetd)
- 3.9. Restricting Access by Remote Hosts (xinetd with libwrap)
- 3.10. Restricting Access by Remote Hosts (xinetd with tcpd)
- 3.11. Restricting Access by Remote Hosts (inetd)
- 3.12. Restricting Access by Time of Day
- 3.13. Restricting Access to an SSH Server by Host
- 3.14. Restricting Access to an SSH Server by Account
- 3.15. Restricting Services to Specific Filesystem Directories
- 3.16. Preventing Denial of Service Attacks
- 3.17. Redirecting to Another Socket
- 3.18. Logging Access to Your Services
- 3.19. Prohibiting root Logins on Terminal Devices
-
4. Authentication Techniques and Infrastructures
- 4.1. Creating a PAM-Aware Application
- 4.2. Enforcing Password Strength with PAM
- 4.3. Creating Access Control Lists with PAM
- 4.4. Validating an SSL Certificate
- 4.5. Decoding an SSL Certificate
- 4.6. Installing a New SSL Certificate
- 4.7. Generating an SSL Certificate Signing Request (CSR)
- 4.8. Creating a Self-Signed SSL Certificate
- 4.9. Setting Up a Certifying Authority
- 4.10. Converting SSL Certificates from DER to PEM
- 4.11. Getting Started with Kerberos
- 4.12. Adding Users to a Kerberos Realm
- 4.13. Adding Hosts to a Kerberos Realm
- 4.14. Using Kerberos with SSH
- 4.15. Using Kerberos with Telnet
- 4.16. Securing IMAP with Kerberos
- 4.17. Using Kerberos with PAM for System-Wide Authentication
-
5. Authorization Controls
- 5.1. Running a root Login Shell
- 5.2. Running X Programs as root
- 5.3. Running Commands as Another User via sudo
- 5.4. Bypassing Password Authentication in sudo
- 5.5. Forcing Password Authentication in sudo
- 5.6. Authorizing per Host in sudo
- 5.7. Granting Privileges to a Group via sudo
- 5.8. Running Any Program in a Directory via sudo
- 5.9. Prohibiting Command Arguments with sudo
- 5.10. Sharing Files Using Groups
- 5.11. Permitting Read-Only Access to a Shared File via sudo
- 5.12. Authorizing Password Changes via sudo
- 5.13. Starting/Stopping Daemons via sudo
- 5.14. Restricting root’s Abilities via sudo
- 5.15. Killing Processes via sudo
- 5.16. Listing sudo Invocations
- 5.17. Logging sudo Remotely
- 5.18. Sharing root Privileges via SSH
- 5.19. Running root Commands via SSH
- 5.20. Sharing root Privileges via Kerberos su
-
6. Protecting Outgoing Network Connections
- 6.1. Logging into a Remote Host
- 6.2. Invoking Remote Programs
- 6.3. Copying Files Remotely
- 6.4. Authenticating by Public Key (OpenSSH)
- 6.5. Authenticating by Public Key (OpenSSH Client, SSH2 Server, OpenSSH Key)
- 6.6. Authenticating by Public Key (OpenSSH Client, SSH2 Server, SSH2 Key)
- 6.7. Authenticating by Public Key (SSH2 Client, OpenSSH Server)
- 6.8. Authenticating by Trusted Host
- 6.9. Authenticating Without a Password (Interactively)
- 6.10. Authenticating in cron Jobs
- 6.11. Terminating an SSH Agent on Logout
- 6.12. Tailoring SSH per Host
- 6.13. Changing SSH Client Defaults
- 6.14. Tunneling Another TCP Session Through SSH
- 6.15. Keeping Track of Passwords
-
7. Protecting Files
- 7.1. Using File Permissions
- 7.2. Securing a Shared Directory
- 7.3. Prohibiting Directory Listings
- 7.4. Encrypting Files with a Password
- 7.5. Decrypting Files
- 7.6. Setting Up GnuPG for Public-Key Encryption
- 7.7. Listing Your Keyring
- 7.8. Setting a Default Key
- 7.9. Sharing Public Keys
- 7.10. Adding Keys to Your Keyring
- 7.11. Encrypting Files for Others
- 7.12. Signing a Text File
- 7.13. Signing and Encrypting Files
- 7.14. Creating a Detached Signature File
- 7.15. Checking a Signature
- 7.16. Printing Public Keys
- 7.17. Backing Up a Private Key
- 7.18. Encrypting Directories
- 7.19. Adding Your Key to a Keyserver
- 7.20. Uploading New Signatures to a Keyserver
- 7.21. Obtaining Keys from a Keyserver
- 7.22. Revoking a Key
- 7.23. Maintaining Encrypted Files with Emacs
- 7.24. Maintaining Encrypted Files with vim
- 7.25. Encrypting Backups
- 7.26. Using PGP Keys with GnuPG
-
8. Protecting Email
- 8.1. Encrypted Mail with Emacs
- 8.2. Encrypted Mail with vim
- 8.3. Encrypted Mail with Pine
- 8.4. Encrypted Mail with Mozilla
- 8.5. Encrypted Mail with Evolution
- 8.6. Encrypted Mail with mutt
- 8.7. Encrypted Mail with elm
- 8.8. Encrypted Mail with MH
- 8.9. Running a POP/IMAP Mail Server with SSL
- 8.10. Testing an SSL Mail Connection
- 8.11. Securing POP/IMAP with SSL and Pine
- 8.12. Securing POP/IMAP with SSL and mutt
- 8.13. Securing POP/IMAP with SSL and Evolution
- 8.14. Securing POP/IMAP with stunnel and SSL
- 8.15. Securing POP/IMAP with SSH
- 8.16. Securing POP/IMAP with SSH and Pine
- 8.17. Receiving Mail Without a Visible Server
- 8.18. Using an SMTP Server from Arbitrary Clients
-
9. Testing and Monitoring
- 9.1. Testing Login Passwords (John the Ripper)
- 9.2. Testing Login Passwords (CrackLib)
- 9.3. Finding Accounts with No Password
- 9.4. Finding Superuser Accounts
- 9.5. Checking for Suspicious Account Use
- 9.6. Checking for Suspicious Account Use, Multiple Systems
- 9.7. Testing Your Search Path
- 9.8. Searching Filesystems Effectively
- 9.9. Finding setuid (or setgid) Programs
- 9.10. Securing Device Special Files
- 9.11. Finding Writable Files
- 9.12. Looking for Rootkits
- 9.13. Testing for Open Ports
- 9.14. Examining Local Network Activities
- 9.15. Tracing Processes
- 9.16. Observing Network Traffic
- 9.17. Observing Network Traffic (GUI)
- 9.18. Searching for Strings in Network Traffic
- 9.19. Detecting Insecure Network Protocols
- 9.20. Getting Started with Snort
- 9.21. Packet Sniffing with Snort
- 9.22. Detecting Intrusions with Snort
- 9.23. Decoding Snort Alert Messages
- 9.24. Logging with Snort
- 9.25. Partitioning Snort Logs Into Separate Files
- 9.26. Upgrading and Tuning Snort’s Ruleset
- 9.27. Directing System Messages to Log Files (syslog)
- 9.28. Testing a syslog Configuration
- 9.29. Logging Remotely
- 9.30. Rotating Log Files
- 9.31. Sending Messages to the System Logger
- 9.32. Writing Log Entries via Shell Scripts
- 9.33. Writing Log Entries via Perl
- 9.34. Writing Log Entries via C
- 9.35. Combining Log Files
- 9.36. Summarizing Your Logs with logwatch
- 9.37. Defining a logwatch Filter
- 9.38. Monitoring All Executed Commands
- 9.39. Displaying All Executed Commands
- 9.40. Parsing the Process Accounting Log
- 9.41. Recovering from a Hack
- 9.42. Filing an Incident Report
- Index
- About the Authors
- Colophon
- Copyright
Product information
- Title: Linux Security Cookbook
- Author(s):
- Release date: June 2003
- Publisher(s): O'Reilly Media, Inc.
- ISBN: 9780596003913
You might also like
book
Practical Linux Security Cookbook - Second Edition
Enhance file system security and learn about network attack, security tools and different versions of Linux …
book
Linux Administration Cookbook
Over 100 recipes to get up and running with the modern Linux administration ecosystem Key Features …
book
Mastering Linux Security and Hardening - Second Edition
A comprehensive guide to securing your Linux system against cyberattacks and intruders Key Features Deliver a …
book
Practical Linux System Administration
This essential guide covers all aspects of Linux system administration, from user maintenance, backups, filesystem housekeeping, …