Linux Security Cookbook [Electronic resources] نسخه متنی

[SYMBOL]
[A]
[B]
[C]
[D]
[E]
[F]
[G]
[H]
[I]
[J]
[K]
[L]
[M]
[N]
[O]
[P]
[Q]
[R]
[S]
[T]
[U]
[V]
[W]
[X]

S/MIME

native support by Mozilla

support by Evolution mailer

sa -s command (truncating process accounting the log file)

Samhain (integrity checker)

scp command

mirroring set of files securely between computers

options for remote file copying

securely copying files between computers

syntax

scripts, enabling/disabling network interfaces

search path, testing

. (period) in

relative directories in, dangers of

SEC_BIN global variable (Tripwire)

secret keys

adding to GnuPG keyring

default key for GnuPG operations

listing for GnuPG

secret-key encryption

secure integrity checks

creating bootable CD-ROM securely

dual-ported disk array, using

Secure Sockets Layer
[See SSL]

securetty file, editing to prevent root logins via terminal devices

security policies
[See policies]

security tests
[See monitoring systems for suspicious activity]

security tools (Insecure.org)

self-signed certificates

creating

generating X.509 certificate

man-in-the-middle attacks, risk of

setting up your own CA to issue certificates

sending-filters for email (PinePGP)

sendmail

accepting mail from other hosts

authentication mechanisms accepted as trusted

daemons (visible), security risks with

restriction on accepting connections from only same host, changing

SSL, using to protect entire SMTP session

sense keyword (PAM, listfile module)

server arguments (inetd.conf file)

server authentication
[See Kerberos; PAM; SSH; SSL; trusted-host authentication]

server keyword (xinetd)

server program, OpenSSH

service filter configuration file (logwatch)

service filter executable (logwatch)

service names

conversion of port numbers to by netstat and lsof

executable

modifying to invoke tcpd in /etc/xinetd.d startup file

PAM
2nd

services file, adding service names to inetd.conf

session protection for mail

setgid bit on directories

setgid/setuid programs

security checks

setgid/setuid programs, security checks

finding and interactively fixing

listing all files

listing scripts only

removing setgid/setuid bits from a file

setuid programs for hostbased authentication

setlogsock (Sys::Syslog)

setuid root, ssh-keysign program

sftp

shadow directive (/etc/pam.d/system-auth)

shadow password file
2nd

sharing files

prohibiting directory listings

protecting shared directory

shell command substitution, exceeding command line maximum

shell item (PAM)

shell prompts, standards used

shell scripts

in your current directory

writing system log entries
2nd

shell-style wildcard expansion

shells

bash

checking for dormant accounts

invoking MH commands from prompt

invoking with root privileges by sudo, security risks

process substitution

root login shell, running

root shell vs. root login shell

terminating SSH agent on logout

umask command

shosts.equiv file

show command, decrypting email displayed with

shutdowns (system), records of

shutting down network interfaces

signature ID (Snort alerts)

signed cryptographic keys

signing files
[See digital signatures]

single computer

blocking spoofed addresses

firewall design

single-threaded services (inetd.conf file)

site key (Tripwire)

creating with twinstall.sh script

fingerprints, creating in secure integrity checks

read-only integrity checking

size, file

/bin/login, changes since last Tripwire check

verifying for RPM-installed files

SLAC (Stanford Linear Accelerator), Network Monitoring Tools page

SMTP

blocking requests for mail service from a remote host

capturing messages from with dsniff program mailsnarf

protecting dedicated server for smtp services

requiring authentication by server before relaying mail

using server from arbitrary clients

snapshots
[See Tripwire]

Snort

decoding alert messages

nmap port scan detected

priority levels

writing alerts to file instead of syslog

detecting intrusions with

dumping statistics to the system logger

promiscuous mode, setting

running in background as daemon

packet sniffing with

partitioning logs into separate files

upgrading and tuning ruleset

socket type (inetd.conf file)

software packages, risk of Trojan horses in

sort command

-z option for null filename separators

source address verification

enabling

enabling in kernel

website information on

source addresses

controlling access by

limiting server sessions by

source name for remote file copying

source quench, blocking

sources for system messages

spoofed addresses

blocking access from

MAC

source addresses

SquirrelMail

SSH (Secure Shell)

agents
[See ssh-agent]

authenticating between client/server by trusted host

authenticating between SSH2 client/OpenSSH server

authenticating by public key

changing client defaults

client configurations in ~/.ssh/config

connecting via ssh with Kerberos authentication

cryptographic authentication

download site for OpenSSH

fetchmail, use of

important programs and files

scp (client program)

ssh (client program)

Kerberos, using with

debugging

Kerberos-5 support

permitting only incoming access via SSH with firewall

protecting dedicated server for ssh services

public-key and ssh-agent, using with Pine

public-key authentication between SSH2 client/OpenSSH server

public/private authentication keys

remote user access by public key authentication

restricting access by remote users

restricting access to server by account

restricting access to server by host

running root commands via

securing POP/IMAP

with Pine

sharing root privileges via

SSH-2 connections, trusted-host authentication

SSH2 server and OpenSSH client, authenticating between with OpenSSH key

SSH2 server and OpenSSH client, authenticating between with SSH2 key

superusers, authentication of

tailoring per host

transferring email from another ISP over tunnel

tunneling NNTP with

tunneling TCP connection through

web site

ssh command

-t option (for pseudo-tty)

-X option (for X forwarding)

using with rsync to mirror set of files between computers

ssh file

ssh-add

ssh-agent

automatic authentication (without password)

invoking between backticks (` `)

public-key authentication without passphrase

terminating on logout

ssh-keygen

conversion of SSH2 private key into OpenSSH private key with -i (import) option

ssh-keysign

setuid root on client

ssh_config file

~/.ssh file, using instead of

client configuration keywords

HostbasedAuthentication, enabling

ssh_known_hosts file

OpenSSH client, using ~/.ssh file instead of

sshd

AllowUsers keyword

authorizing users to restart

restricting access from specific remote hosts

TCP wrappers support

sshd_config file

AllowUsers keyword

HostbasedAuthentication, enabling

HostbasedUsesNameFromPacketOnly

KerberosTgtPassing, enabling

ListenAddress statements, adding

PermitRootLogin, setting

PublicAuthentication, permitting

X11Forwarding setting

SSL (Secure Sockets Layer)

connection problems, server-side debugging

converting certificates from DER to PEM

creating self-signed certificate

decoding SSL certificates

generating Certificate Signing Request (CSR)

installing new certificate

OpenSSL

web site

POP/IMAP security

mail server, running with

mail sessions for Evolution

mutt mail client, using with

stunnel, using

with pine mail client

setting up CA and issuing certificates

STARTTLS command (IMAP), negotiating protection for mail

STLS command (POP), negotiating protection for email

validating a certificate

verifying connection to secure POP or IMAP server

SSL-port

on mail servers

POP or IMAP connections for mutt client

testing use in pine mail client

standard input, redirecting from /dev/null

Stanford Linear Accelerator (SLAC) Network Monitoring Tools page

starting network interfaces

STARTTLS command (IMAP)

mail server support for SSL

mutt client connection over IMAP, testing

testing use in pine mail client

startup scripts (bootable CD-ROM), disabling networking

stateful

stateless

sticky bit

set on world-writable directories

setting on world-writable directory

STLS command (POP)
2nd

strace command
2nd

strings

matching with fgrep command

searching network traffic for

strings command

strong authentication for email sessions

strong session protection for mail (by SSL)

stunnel, securing POP/IMAP with SSL

su command

invoking with root privileges by sudo, security risks

ksu (Kerberized su)

authentication via Kerberos

sharing root privileges via

su -, running root login shell

su configuration (PAM)

subject (certificates)

components of certificate subject name

self-signed

sudo command

bypassing password authentication

careful practices for using

forcing password authentication

killing processes via

listing invocations

logging remotely

password changes, authorizing via

prohibiting command-line arguments for command run via

read-only access to shared file

running any program in a directory

running commands as another user

starting/stopping daemons

user authorization privileges, allowing per host

sudoers file

argument lists for each command, specifying meticulously

editing with visudo program

listing permissible commands for root privileges

running commands as another user

timestamp_timeout variable

user authorization to kill certain processes

superdaemons

inetd
[See inetd]

xinetd
[See xinetd]

superuser
2nd
[See also root]

assigning privileges via ssh without disclosing root password

finding all accounts on system

ksu (Kerberized su)

processes owned by others, examining

SuSE Linux

firewall rules, building

Heimdal Kerberos

inetd superdaemon

loading firewall rules at boot time

process accounting RPM

script allowing users to start/stop daemons

Snort, starting automatically at boot

SSL certificates
2nd

TCP wrappers
2nd

switched networks

packet sniffers and

simulated attacks with dsniff

symbolic links

for encrypted files on separate system

inability to verify with manual integrity check

permission bits, ignoring

scp command and

symmetric encryption

file encryption with gpg -c

files encrypted with GnuPG, decrypting

problems with

single encrypted file containing all files in directory

SYN_RECV state, large numbers of network connections in

synchronizing files on two machines (rsync)

integrity checking with

Sys::Lastlog and Sys::Utmp modules (Perl)

Sys::Syslog module

syslog function

using in C program

syslog-ng (Ònew generationÓ)

syslog.conf file

directing messages to different log files by facility and priority

remote logging, configuring
2nd

RPM-installed, verifying with Tripwire

setting up for local logging

signaling system logger about changes in

tracing configuration errors in

syslogd

-r flag to receive remote messages

signaling to pick up changes in syslog.conf

system accounts, login activity on
2nd

system calls, tracing on network

system logger

combining log files

debugging SSL connections

directing system messages to log files

log files created by, permissions and

logging messages remotely

programs not using

scanning log files for problem reports

sending messages to

signaling changes in syslog.conf

standard API, functions provided by

testing and monitoring

writing system log entries

in C
2nd

in Perl

in shell scripts

xinetd, logging to

system-wide authentication (Kerberos with PAM)

system_auth (/etc/pam.d startup file)

forbidding local password validation

Kerberos in

systems

authentication methods and policies (authconfig)

security tests on
[See monitoring systems for suspicious activity]