Linux security

Please select a chapter from the "Contents" menu at the very bottom of the page.

Linux security

Preface A Cookbook About Security?!? Intended Audience Roadmap of the Book Our Security Philosophy Supported Linux Distributions Trying the Recipes Conventions Used in This Book We'd Like to Hear from You Acknowledgments Chapter 1. System Snapshots with Tripwire Recipe 1.1 Setting Up Tripwire Recipe 1.2 Displaying the Policy and Configuration Recipe 1.3 Modifying the Policy and Configuration Recipe 1.4 Basic Integrity Checking Recipe 1.5 Read-Only Integrity Checking Recipe 1.6 Remote Integrity Checking Recipe 1.7 Ultra-Paranoid Integrity Checking Recipe 1.8 Expensive, Ultra-Paranoid Security Checking Recipe 1.9 Automated Integrity Checking Recipe 1.10 Printing the Latest Tripwire Report Recipe 1.11 Updating the Database Recipe 1.12 Adding Files to the Database Recipe 1.13 Excluding Files from the Database Recipe 1.14 Checking Windows VFAT Filesystems Recipe 1.15 Verifying RPM-Installed Files Recipe 1.16 Integrity Checking with rsync Recipe 1.17 Integrity Checking Manually Chapter 2. Firewalls with iptables and ipchains Recipe 2.1 Enabling Source Address Verification Recipe 2.2 Blocking Spoofed Addresses Recipe 2.3 Blocking All Network Traffic Recipe 2.4 Blocking Incoming Traffic Recipe 2.5 Blocking Outgoing Traffic Recipe 2.6 Blocking Incoming Service Requests Recipe 2.7 Blocking Access from a Remote Host Recipe 2.8 Blocking Access to a Remote Host Recipe 2.9 Blocking Outgoing Access to All Web Servers on a Network Recipe 2.10 Blocking Remote Access, but Permitting Local Recipe 2.11 Controlling Access by MAC Address Recipe 2.12 Permitting SSH Access Only Recipe 2.13 Prohibiting Outgoing Telnet Connections Recipe 2.14 Protecting a Dedicated Server Recipe 2.15 Preventing pings Recipe 2.16 Listing Your Firewall Rules Recipe 2.17 Deleting Firewall Rules Recipe 2.18 Inserting Firewall Rules Recipe 2.19 Saving a Firewall Configuration Recipe 2.20 Loading a Firewall Configuration Recipe 2.21 Testing a Firewall Configuration Recipe 2.22 Building Complex Rule Trees Recipe 2.23 Logging Simplified Chapter 3. Network Access Control Recipe 3.1 Listing Your Network Interfaces Recipe 3.2 Starting and Stopping the Network Interface Recipe 3.3 Enabling/Disabling a Service (xinetd) Recipe 3.4 Enabling/Disabling a Service (inetd) Recipe 3.5 Adding a New Service (xinetd) Recipe 3.6 Adding a New Service (inetd) Recipe 3.7 Restricting Access by Remote Users Recipe 3.8 Restricting Access by Remote Hosts (xinetd) Recipe 3.9 Restricting Access by Remote Hosts (xinetd with libwrap) Recipe 3.10 Restricting Access by Remote Hosts (xinetd with tcpd) Recipe 3.11 Restricting Access by Remote Hosts (inetd) Recipe 3.12 Restricting Access by Time of Day Recipe 3.13 Restricting Access to an SSH Server by Host Recipe 3.14 Restricting Access to an SSH Server by Account Recipe 3.15 Restricting Services to Specific Filesystem Directories Recipe 3.16 Preventing Denial of Service Attacks Recipe 3.17 Redirecting to Another Socket Recipe 3.18 Logging Access to Your Services Recipe 3.19 Prohibiting root Logins on Terminal Devices Chapter 4. Authentication Techniques and Infrastructures Recipe 4.1 Creating a PAM-Aware Application Recipe 4.2 Enforcing Password Strength with PAM Recipe 4.3 Creating Access Control Lists with PAM Recipe 4.4 Validating an SSL Certificate Recipe 4.5 Decoding an SSL Certificate Recipe 4.6 Installing a New SSL Certificate Recipe 4.7 Generating an SSL Certificate Signing Request (CSR) Recipe 4.8 Creating a Self-Signed SSL Certificate Recipe 4.9 Setting Up a Certifying Authority Recipe 4.10 Converting SSL Certificates from DER to PEM Recipe 4.11 Getting Started with Kerberos Recipe 4.12 Adding Users to a Kerberos Realm Recipe 4.13 Adding Hosts to a Kerberos Realm Recipe 4.14 Using Kerberos with SSH Recipe 4.15 Using Kerberos with Telnet Recipe 4.16 Securing IMAP with Kerberos Recipe 4.17 Using Kerberos with PAM for System-Wide Authentication Chapter 5. Authorization Controls Recipe 5.1 Running a root Login Shell Recipe 5.2 Running X Programs as root Recipe 5.3 Running Commands as Another User via sudo Recipe 5.4 Bypassing Password Authentication in sudo Recipe 5.5 Forcing Password Authentication in sudo Recipe 5.6 Authorizing per Host in sudo Recipe 5.7 Granting Privileges to a Group via sudo Recipe 5.8 Running Any Program in a Directory via sudo Recipe 5.9 Prohibiting Command Arguments with sudo Recipe 5.10 Sharing Files Using Groups Recipe 5.11 Permitting Read-Only Access to a Shared File via sudo Recipe 5.12 Authorizing Password Changes via sudo Recipe 5.13 Starting/Stopping Daemons via sudo Recipe 5.14 Restricting root's Abilities via sudo Recipe 5.15 Killing Processes via sudo Recipe 5.16 Listing sudo Invocations Recipe 5.17 Logging sudo Remotely Recipe 5.18 Sharing root Privileges via SSH Recipe 5.19 Running root Commands via SSH Recipe 5.20 Sharing root Privileges via Kerberos su Chapter 6. Protecting Outgoing Network Connections Recipe 6.1 Logging into a Remote Host Recipe 6.2 Invoking Remote Programs Recipe 6.3 Copying Files Remotely Recipe 6.4 Authenticating by Public Key (OpenSSH) Recipe 6.5 Authenticating by Public Key (OpenSSH Client, SSH2 Server, OpenSSH Key) Recipe 6.6 Authenticating by Public Key (OpenSSH Client, SSH2 Server, SSH2 Key) Recipe 6.7 Authenticating by Public Key (SSH2 Client, OpenSSH Server) Recipe 6.8 Authenticating by Trusted Host Recipe 6.9 Authenticating Without a Password (Interactively) Recipe 6.10 Authenticating in cron Jobs Recipe 6.11 Terminating an SSH Agent on Logout Recipe 6.12 Tailoring SSH per Host Recipe 6.13 Changing SSH Client Defaults Recipe 6.14 Tunneling Another TCP Session Through SSH Recipe 6.15 Keeping Track of Passwords Chapter 7. Protecting Files Recipe 7.1 Using File Permissions Recipe 7.2 Securing a Shared Directory Recipe 7.3 Prohibiting Directory Listings Recipe 7.4 Encrypting Files with a Password Recipe 7.5 Decrypting Files Recipe 7.6 Setting Up GnuPG for Public-Key Encryption Recipe 7.7 Listing Your Keyring Recipe 7.8 Setting a Default Key Recipe 7.9 Sharing Public Keys Recipe 7.10 Adding Keys to Your Keyring Recipe 7.11 Encrypting Files for Others Recipe 7.12 Signing a Text File Recipe 7.13 Signing and Encrypting Files Recipe 7.14 Creating a Detached Signature File Recipe 7.15 Checking a Signature Recipe 7.16 Printing Public Keys Recipe 7.17 Backing Up a Private Key Recipe 7.18 Encrypting Directories Recipe 7.19 Adding Your Key to a Keyserver Recipe 7.20 Uploading New Signatures to a Keyserver Recipe 7.21 Obtaining Keys from a Keyserver Recipe 7.22 Revoking a Key Recipe 7.23 Maintaining Encrypted Files with Emacs Recipe 7.24 Maintaining Encrypted Files with vim Recipe 7.25 Encrypting Backups Recipe 7.26 Using PGP Keys with GnuPG Chapter 8. Protecting Email Recipe 8.1 Encrypted Mail with Emacs Recipe 8.2 Encrypted Mail with vim Recipe 8.3 Encrypted Mail with Pine Recipe 8.4 Encrypted Mail with Mozilla Recipe 8.5 Encrypted Mail with Evolution Recipe 8.6 Encrypted Mail with mutt Recipe 8.7 Encrypted Mail with elm Recipe 8.8 Encrypted Mail with MH Recipe 8.9 Running a POP/IMAP Mail Server with SSL Recipe 8.10 Testing an SSL Mail Connection Recipe 8.11 Securing POP/IMAP with SSL and Pine Recipe 8.12 Securing POP/IMAP with SSL and mutt Recipe 8.13 Securing POP/IMAP with SSL and Evolution Recipe 8.14 Securing POP/IMAP with stunnel and SSL Recipe 8.15 Securing POP/IMAP with SSH Recipe 8.16 Securing POP/IMAP with SSH and Pine Recipe 8.17 Receiving Mail Without a Visible Server Recipe 8.18 Using an SMTP Server from Arbitrary Clients Chapter 9. Testing and Monitoring Recipe 9.1 Testing Login Passwords (John the Ripper) Recipe 9.2 Testing Login Passwords (CrackLib) Recipe 9.3 Finding Accounts with No Password Recipe 9.4 Finding Superuser Accounts Recipe 9.5 Checking for Suspicious Account Use Recipe 9.6 Checking for Suspicious Account Use, Multiple Systems Recipe 9.7 Testing Your Search Path Recipe 9.8 Searching Filesystems Effectively Recipe 9.9 Finding setuid (or setgid) Programs Recipe 9.10 Securing Device Special Files Recipe 9.11 Finding Writable Files Recipe 9.12 Looking for Rootkits Recipe 9.13 Testing for Open Ports Recipe 9.14 Examining Local Network Activities Recipe 9.15 Tracing Processes Recipe 9.16 Observing Network Traffic Recipe 9.17 Observing Network Traffic (GUI) Recipe 9.18 Searching for Strings in Network Traffic Recipe 9.19 Detecting Insecure Network Protocols Recipe 9.20 Getting Started with Snort Recipe 9.21 Packet Sniffing with Snort Recipe 9.22 Detecting Intrusions with Snort Recipe 9.23 Decoding Snort Alert Messages Recipe 9.24 Logging with Snort Recipe 9.25 Partitioning Snort Logs Into Separate Files Recipe 9.26 Upgrading and Tuning Snort's Ruleset Recipe 9.27 Directing System Messages to Log Files (syslog) Recipe 9.28 Testing a syslog Configuration Recipe 9.29 Logging Remotely Recipe 9.30 Rotating Log Files Recipe 9.31 Sending Messages to the System Logger Recipe 9.32 Writing Log Entries via Shell Scripts Recipe 9.33 Writing Log Entries via Perl Recipe 9.34 Writing Log Entries via C Recipe 9.35 Combining Log Files Recipe 9.36 Summarizing Your Logs with logwatch Recipe 9.37 Defining a logwatch Filter Recipe 9.38 Monitoring All Executed Commands Recipe 9.39 Displaying All Executed Commands Recipe 9.40 Parsing the Process Accounting Log Recipe 9.41 Recovering from a Hack Recipe 9.42 Filing an Incident Report Colophon