Linux Server Security (2nd Edition( [Electronic resources] نسخه متنی

What This Book Is About

Acknowledging that system security is, on some level, futile is my
way of admitting that this book isn't really about
"Linux server security,"^[1] at least not in any
absolute sense. Clearly, the only way to make a computer
absolutely secure is to disconnect it from the
network, power it down, repeatedly degauss its hard drive and memory,
and pulverize the whole thing into dust. This book contains very
little information on degaussing or pulverizing. However, it contains
a great deal of practical advice on the following:

^[1] My original title was Attempting to Enhance Certain
Elements of Linux System Security in the Face of Overwhelming Odds:
Yo Arms Too Short to Box with God, but this was vetoed by
my editor (thanks, Andy!).

How to think about threats and risks, and the appropriate responses
to them How to protect publicly accessible hosts via good network design How to "harden" a fresh
installation of Linux and keep it patched against newly discovered
vulnerabilities with a minimum of ongoing effort How to make effective use of the security features of some
particularly popular and securable server applications How to implement some powerful security applications, including
Nessus and Snort
In particular, this book is about
"bastionizing" Linux servers. The
term bastion host can legitimately be used several ways,
one of which is as a synonym for firewall. (This book is
not about building Linux firewalls, though much of what I
cover can and should be done on firewalls.) My definition of
bastion host is a carefully configured, closely
monitored host that provides restricted but publicly accessible
services to nontrusted users and systems. Since the biggest, most
important, and least trustworthy public network is the Internet, my
focus is on creating Linux bastion hosts for Internet use.

I have several reasons for this seemingly narrow focus. First, Linux
has been particularly successful as a server platform: even in
organizations that otherwise rely heavily on commercial operating
systems such as Microsoft Windows, Linux is often deployed in
"infrastructure" roles, such as
SMTP gateway and DNS server, due to its reliability, low cost, and
the outstanding quality of its server applications.

Second, Linux and TCP/IP, the lingua franca of
the Internet, go together. Anything that can be done on a TCP/IP
network can be done with Linux, and done extremely well, with very
few exceptions. There are many, many different kinds of TCP/IP
applications, of which I can only cover a subset if I want to do so
in depth. Internet server applications are an important subset.

Third, this is my area of expertise. Since the mid-90s my career has
focused on network and system security; I've spent a
lot of time building Internet-worthy Unix and Linux systems. By
reading this book, you will hopefully benefit from some of the
experience I've gained along the way.