About the Author |
|
xv | |
About the Technical Reviewer |
|
xvii | |
Acknowledgments |
|
xix | |
Introduction |
|
xxi | |
|
|
1 | (78) |
|
Installing Your Distribution Securely |
|
|
2 | (2) |
|
Some Answers to Common Installation Questions |
|
|
2 | (1) |
|
Install Only What You Need |
|
|
2 | (2) |
|
Secure Booting, Boot Loaders, and Boot-Time Services |
|
|
4 | (11) |
|
Securing Your Boat Loader |
|
|
5 | (3) |
|
Init, Starting Services, and Boot Sequencing |
|
|
8 | (7) |
|
Consoles, Virtual Terminals, and Login Screens |
|
|
15 | (4) |
|
|
16 | (1) |
|
|
16 | (1) |
|
Securing Virtual Terminals |
|
|
17 | (1) |
|
|
18 | (1) |
|
|
19 | (25) |
|
|
22 | (1) |
|
|
23 | (1) |
|
|
24 | (2) |
|
|
26 | (2) |
|
Deleting Unnecessary Users and Groups |
|
|
28 | (3) |
|
|
31 | (4) |
|
|
35 | (2) |
|
|
37 | (5) |
|
|
42 | (2) |
|
|
44 | (2) |
|
Pluggable Authentication Modules (PAM) |
|
|
46 | (10) |
|
|
48 | (1) |
|
The PAM ``Other'' Service |
|
|
49 | (1) |
|
|
50 | (1) |
|
|
51 | (2) |
|
Restricting Users to Specific Login Times with PAM |
|
|
53 | (3) |
|
Package Management, File Integrity, and Updating |
|
|
56 | (8) |
|
|
57 | (4) |
|
Downloading Updates and Patches |
|
|
61 | (3) |
|
Compilers and Development Tools |
|
|
64 | (2) |
|
Removing the Compilers and Development Tools |
|
|
64 | (1) |
|
Restricting the Compilers and Development Tools |
|
|
65 | (1) |
|
Hardening and Securing Your Kernel |
|
|
66 | (9) |
|
Getting Your Kernel Source |
|
|
66 | (2) |
|
|
68 | (6) |
|
Other Kernel-Hardening Options |
|
|
74 | (1) |
|
Keeping Informed About Security |
|
|
75 | (1) |
|
Security Sites and Mailing Lists |
|
|
75 | (1) |
|
Vendor and Distribution Security Sites |
|
|
76 | (1) |
|
|
76 | (3) |
|
|
76 | (1) |
|
|
77 | (2) |
|
|
79 | (58) |
|
So, How Does a Linux Firewall Work? |
|
|
80 | (3) |
|
|
82 | (1) |
|
|
82 | (1) |
|
|
82 | (1) |
|
|
83 | (3) |
|
Choosing Filtering Criteria |
|
|
86 | (1) |
|
|
87 | (4) |
|
Creating a Basic Firewall |
|
|
91 | (6) |
|
Creating a Firewall for a Bastion Host |
|
|
97 | (20) |
|
Securing the Bastion Services |
|
|
98 | (3) |
|
|
101 | (4) |
|
|
105 | (3) |
|
Spoofing, Hijacking, and Denial of Service Attacks |
|
|
108 | (3) |
|
|
111 | (5) |
|
Some Final Bastion Host Rules |
|
|
116 | (1) |
|
Kernel Modules and Parameters |
|
|
117 | (12) |
|
|
117 | (7) |
|
|
124 | (5) |
|
Managing iptables and Your Rules |
|
|
129 | (7) |
|
iptables-save and iptables-restore |
|
|
130 | (1) |
|
|
131 | (1) |
|
Testing and Troubleshooting |
|
|
132 | (4) |
|
|
136 | (1) |
|
|
136 | (1) |
|
|
136 | (1) |
|
|
136 | (1) |
|
Securing Connections and Remote Administration |
|
|
137 | (50) |
|
|
137 | (32) |
|
|
140 | (12) |
|
|
152 | (7) |
|
IPSec, VPNs, and Openswan |
|
|
159 | (8) |
|
inetd and xinetd-Based Connections |
|
|
167 | (2) |
|
|
169 | (16) |
|
|
171 | (4) |
|
|
175 | (2) |
|
ssh-agent and Agent Forwarding |
|
|
177 | (2) |
|
|
179 | (1) |
|
|
180 | (3) |
|
Port Forwarding with OpenSSH |
|
|
183 | (1) |
|
Forwarding X with OpenSSH |
|
|
184 | (1) |
|
|
185 | (2) |
|
|
185 | (1) |
|
|
185 | (2) |
|
Securing Files and File Systems |
|
|
187 | (46) |
|
Basic File Permissions and File Attributes |
|
|
188 | (10) |
|
|
188 | (10) |
|
|
198 | (1) |
|
|
198 | (2) |
|
|
200 | (2) |
|
|
202 | (2) |
|
Securely Mounting File Systems |
|
|
204 | (3) |
|
Securing Removable Devices |
|
|
207 | (1) |
|
Creating an Encrypted File System |
|
|
208 | (7) |
|
Installing the Userland Tools |
|
|
209 | (1) |
|
Enabling the Functionality |
|
|
209 | (1) |
|
Encrypting a Loop File System |
|
|
210 | (4) |
|
Unmounting Your Encrypted File System |
|
|
214 | (1) |
|
|
215 | (1) |
|
Maintaining File Integrity with Tripwire |
|
|
215 | (14) |
|
|
216 | (2) |
|
Explaining Tripwire Policy |
|
|
218 | (11) |
|
Network File System (NFS) |
|
|
229 | (2) |
|
|
231 | (2) |
|
|
231 | (1) |
|
|
231 | (1) |
|
|
231 | (2) |
|
Understanding Logging and Log Monitoring |
|
|
233 | (48) |
|
|
233 | (8) |
|
|
235 | (4) |
|
Starting syslogd and Its Options |
|
|
239 | (2) |
|
|
241 | (23) |
|
Installing and Configuring syslog-NG |
|
|
241 | (1) |
|
|
242 | (1) |
|
Running and Configuring syslog-NG |
|
|
242 | (12) |
|
Sample syslog-ng.conf File |
|
|
254 | (2) |
|
Logging to a Database with syslog-NG |
|
|
256 | (3) |
|
Secure Logging with syslog-NG |
|
|
259 | (4) |
|
Testing Logging with logger |
|
|
263 | (1) |
|
Log Analysis and Correlation |
|
|
264 | (13) |
|
Installing and Running SEC |
|
|
267 | (2) |
|
Inputting Messages to SEC |
|
|
269 | (1) |
|
|
270 | (7) |
|
Log Management and Rotation |
|
|
277 | (3) |
|
|
280 | (1) |
|
|
280 | (1) |
|
|
280 | (1) |
|
|
280 | (1) |
|
Using Tools for Security Testing |
|
|
281 | (40) |
|
|
282 | (13) |
|
Scanning for Exploits and Root Kits |
|
|
282 | (5) |
|
Testing Your Password Security |
|
|
287 | (3) |
|
Automated Security Hardening with Bastille Linux |
|
|
290 | (5) |
|
|
295 | (18) |
|
|
296 | (6) |
|
|
302 | (11) |
|
Other Methods of Detecting a Penetration |
|
|
313 | (2) |
|
Recovering from a Penetration |
|
|
315 | (3) |
|
Additional Security Tools |
|
|
318 | (1) |
|
|
318 | (1) |
|
|
318 | (1) |
|
|
318 | (1) |
|
|
318 | (1) |
|
|
319 | (1) |
|
|
319 | (1) |
|
|
319 | (1) |
|
|
319 | (1) |
|
|
319 | (1) |
|
|
319 | (2) |
|
|
320 | (1) |
|
Securing Your Mail Server |
|
|
321 | (52) |
|
Which Mail Server to Choose? |
|
|
321 | (2) |
|
How Is Your Mail Server at Risk? |
|
|
323 | (1) |
|
Protecting Your Mail Server |
|
|
323 | (10) |
|
Chrooting a Sendmail SMTP Gateway or Relay |
|
|
324 | (6) |
|
|
330 | (3) |
|
Securing Your SMTP Server |
|
|
333 | (13) |
|
Obfuscating the MTA Banner and Version |
|
|
333 | (3) |
|
Disabling Dangerous and Legacy SMTP Commands |
|
|
336 | (3) |
|
Some Additional Sendmail Privacy Flags |
|
|
339 | (1) |
|
|
339 | (1) |
|
|
340 | (1) |
|
Limiting the Risk of (Distributed) DoS Attacks |
|
|
341 | (5) |
|
Relaying, SPAM, and Viruses |
|
|
346 | (26) |
|
|
346 | (5) |
|
|
351 | (13) |
|
Antivirus Scanning Your E-mail Server |
|
|
364 | (8) |
|
|
372 | (1) |
|
|
372 | (1) |
|
|
372 | (1) |
|
Authenticating and Securing Your Mail |
|
|
373 | (30) |
|
|
373 | (14) |
|
Creating Certificates for TLS |
|
|
374 | (3) |
|
|
377 | (4) |
|
|
381 | (6) |
|
SMTP AUTH Using Cyrus SASL |
|
|
387 | (2) |
|
|
388 | (1) |
|
Configuring SASL saslauthd |
|
|
389 | (1) |
|
SMTP AUTH Using Cyrus SASL for Sendmail |
|
|
389 | (6) |
|
Compiling Cyrus SASL into Sendmail |
|
|
390 | (1) |
|
Configuring Cyrus SASL for Sendmail |
|
|
391 | (1) |
|
Using SMTP Server Authentication with Sendmail |
|
|
392 | (2) |
|
Using SMTP Client Authentication with Sendmail |
|
|
394 | (1) |
|
SMTP AUTH Using Cyrus SASL for Postfix |
|
|
395 | (5) |
|
Compiling Cyrus SASL into Postfix |
|
|
395 | (1) |
|
Configuring Cyrus SASL for Postfix |
|
|
396 | (2) |
|
Using SMTP Server Authentication with Postfix |
|
|
398 | (2) |
|
Using SMTP Client Authentication with Postfix |
|
|
400 | (1) |
|
Testing SMTP AUTH with Outlook Express |
|
|
400 | (2) |
|
|
402 | (1) |
|
|
402 | (1) |
|
|
402 | (1) |
|
Hardening Remote Access to E-mail |
|
|
403 | (40) |
|
|
404 | (1) |
|
|
404 | (1) |
|
Choosing IMAP or POP Servers |
|
|
405 | (1) |
|
How Is Your IMAP or POP Server at Risk? |
|
|
406 | (1) |
|
|
407 | (23) |
|
Installing and Compiling Cyrus IMAP |
|
|
409 | (2) |
|
Installing Cyrus IMAP into a chroot Jail |
|
|
411 | (6) |
|
|
417 | (5) |
|
Cyrus IMAP Authentication with SASL |
|
|
422 | (3) |
|
Cyrus IMAP Access Control and Authorization |
|
|
425 | (3) |
|
Testing Cyrus IMAP with imtest/pop3test |
|
|
428 | (2) |
|
|
430 | (11) |
|
|
431 | (3) |
|
Configuring and Running Fetchmail |
|
|
434 | (7) |
|
|
441 | (2) |
|
|
441 | (1) |
|
|
441 | (2) |
|
|
443 | (20) |
|
|
444 | (2) |
|
Firewalling Your FTP Server |
|
|
446 | (2) |
|
|
448 | (1) |
|
|
448 | (2) |
|
Configuring vsftpd for Anonymous FTP |
|
|
450 | (6) |
|
|
451 | (1) |
|
|
452 | (2) |
|
|
454 | (1) |
|
Preventing Denial of Service Attacks |
|
|
455 | (1) |
|
Configuring vsftpd with Local Users |
|
|
456 | (3) |
|
|
459 | (2) |
|
Starting and Stopping vsftpd |
|
|
461 | (1) |
|
|
461 | (2) |
|
|
461 | (2) |
|
|
463 | (48) |
|
|
464 | (2) |
|
Man-in-the-Middle Attacks |
|
|
464 | (1) |
|
|
465 | (1) |
|
Denial of Service Attacks |
|
|
465 | (1) |
|
Data Corruption and Alteration |
|
|
466 | (1) |
|
|
466 | (1) |
|
What DNS Server Should You Choose? |
|
|
466 | (1) |
|
|
467 | (3) |
|
|
470 | (2) |
|
|
472 | (1) |
|
Permissions in the chroot Jail |
|
|
473 | (1) |
|
Starting and Running named |
|
|
474 | (2) |
|
|
476 | (24) |
|
|
479 | (1) |
|
|
480 | (4) |
|
|
484 | (9) |
|
|
493 | (4) |
|
|
497 | (3) |
|
|
500 | (4) |
|
|
504 | (6) |
|
|
505 | (2) |
|
Adding rndc Support to named.conf |
|
|
507 | (1) |
|
|
508 | (2) |
|
|
510 | (1) |
|
|
510 | (1) |
|
|
510 | (1) |
|
Information About Zone Files |
|
|
510 | (1) |
|
|
510 | (1) |
|
APPENDIX A The Bastion Host Firewall Script |
|
|
511 | (6) |
|
APPENDIX B BIND Configuration Files |
|
|
517 | (8) |
|
|
517 | (2) |
|
An Authoritative Master Name Server |
|
|
519 | (1) |
|
|
520 | (3) |
|
A Sample Named init Script |
|
|
523 | (2) |
|
|
525 | (8) |
|
|
525 | (1) |
|
|
526 | (1) |
|
|
527 | (1) |
|
|
527 | (1) |
|
|
528 | (1) |
|
|
529 | (1) |
|
|
529 | (1) |
|
|
530 | (1) |
|
|
530 | (1) |
|
|
531 | (1) |
|
|
531 | (2) |
Index |
|
533 | |