Linux Server Security, Second Edition

v

Table of Contents

Preface

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

ix

1. Threat Modeling and Risk Management

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

1

Components of Risk 2

Simple Risk Analysis: ALEs 11

An Alternative: Attack Trees 15

Defenses 18

Conclusion 20

Resources 20

2. Designing Perimeter Networks

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

21

Some Terminology 22

Types of Firewall and DMZ Architectures 24

Deciding What Should Reside on the DMZ 29

Allocating Resources in the DMZ 30

The Firewall 32

3. Hardening Linux and Using iptables

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

43

OS Hardening Principles 44

Automated Hardening with Bastille Linux 111

4. Secure Remote Administration

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

117

Why It’s Time to Retire Cleartext Admin Tools 117

Secure Shell Background and Basic Use 118

Intermediate and Advanced SSH 128

5. OpenSSL and Stunnel

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

143

Stunnel and OpenSSL: Concepts 143

vi | Table of Contents

6. Securing Domain Name Services (DNS)

. . . . . . . . . . . . . . . . ...