| Preface |
|
xix | |
| Acknowledgments |
|
xxiii | |
| Part One Linux Really Secure? |
|
1 | (44) |
|
Chapter 1 Security Threats to Linux |
|
|
2 | (16) |
|
|
|
4 | (1) |
|
Security in an Open Source World |
|
|
5 | (3) |
|
|
|
8 | (1) |
|
|
|
9 | (2) |
|
Linux as a Security Device |
|
|
11 | (2) |
|
|
|
13 | (1) |
|
|
|
14 | (2) |
|
|
|
16 | (1) |
|
|
|
16 | (1) |
|
|
|
17 | (1) |
|
Chapter 2 Basic Components of Linux Security |
|
|
18 | (27) |
|
Linux Security Relates to the Kernel |
|
|
19 | (5) |
|
The Basic Linux Kernel Philosophy |
|
|
20 | (1) |
|
|
|
20 | (1) |
|
Distribution-Specific Linux Kernels |
|
|
21 | (1) |
|
|
|
21 | (3) |
|
Linux Kernel Security Options |
|
|
24 | (1) |
|
Securing a System During the Boot Process |
|
|
24 | (2) |
|
|
|
24 | (1) |
|
The Threat of the Live CD |
|
|
24 | (1) |
|
|
|
25 | (1) |
|
|
|
25 | (1) |
|
Virtual Physical Security |
|
|
26 | (1) |
|
Linux Security Issues Beyond the Basic Operating System |
|
|
26 | (2) |
|
|
|
26 | (1) |
|
Security Issues with the GUI |
|
|
27 | (1) |
|
Linux User Authentication Databases |
|
|
28 | (2) |
|
Protecting Files with Ownership, Permissions, and Access Controls |
|
|
30 | (1) |
|
Firewalls and Mandatory Access Controls in a Layered Defense |
|
|
31 | (3) |
|
|
|
31 | (2) |
|
Mandatory Access Control Support |
|
|
33 | (1) |
|
Protecting Networks Using Encrypted Communication |
|
|
34 | (1) |
|
Tracking the Latest Linux Security Updates |
|
|
35 | (2) |
|
Linux Security Updates for Regular Users |
|
|
35 | (1) |
|
Linux Security Updates for Home Hobbyists |
|
|
35 | (1) |
|
Linux Security Updates for Power Users |
|
|
36 | (1) |
|
Security Updates for Linux Administrators |
|
|
36 | (1) |
|
Linux Security Update Administration |
|
|
37 | (1) |
|
The Effect of Virtualization on Security |
|
|
37 | (1) |
|
Variations Between Distributions |
|
|
38 | (4) |
|
A Basic Comparison: Red Hat and Ubuntu |
|
|
38 | (1) |
|
More Diversity in Services |
|
|
39 | (3) |
|
|
|
42 | (1) |
|
|
|
43 | (1) |
|
|
|
43 | (2) |
| Part Two Layered Security and Linux |
|
45 | (266) |
|
Chapter 3 Starting Off: Getting Up and Running |
|
|
46 | (28) |
|
|
|
47 | (4) |
|
Picking a Delivery Platform |
|
|
51 | (7) |
|
|
|
52 | (1) |
|
|
|
53 | (2) |
|
|
|
55 | (3) |
|
|
|
58 | (3) |
|
|
|
58 | (1) |
|
Grand Unified Boot Loader |
|
|
59 | (2) |
|
|
|
61 | (7) |
|
|
|
65 | (3) |
|
|
|
68 | (1) |
|
|
|
68 | (2) |
|
|
|
70 | (1) |
|
|
|
71 | (1) |
|
|
|
72 | (1) |
|
|
|
72 | (2) |
|
Chapter 4 User Privileges and Permissions |
|
|
74 | (30) |
|
The Shadow Password Suite |
|
|
75 | (6) |
|
|
|
76 | (1) |
|
|
|
76 | (1) |
|
|
|
77 | (2) |
|
|
|
79 | (1) |
|
Defaults for the Shadow Password Suite |
|
|
79 | (2) |
|
Shadow Password Suite Commands |
|
|
81 | (1) |
|
Available User Privileges |
|
|
81 | (3) |
|
|
|
84 | (1) |
|
User Private Group Scheme |
|
|
84 | (1) |
|
|
|
84 | (1) |
|
Configuring the Hierarchy of Administrative Privileges |
|
|
85 | (5) |
|
Administrative Privileges in Services |
|
|
86 | (1) |
|
|
|
86 | (1) |
|
Options with sudo and /etdsudoers |
|
|
87 | (3) |
|
Regular and Special Permissions |
|
|
90 | (2) |
|
|
|
90 | (1) |
|
|
|
91 | (1) |
|
|
|
92 | (1) |
|
Tracking Access Through Logs |
|
|
92 | (2) |
|
Authorization Log Options |
|
|
92 | (1) |
|
|
|
93 | (1) |
|
Pluggable Authentication Modules |
|
|
94 | (2) |
|
The Structure of a PAM Configuration File |
|
|
94 | (2) |
|
PAM Configuration for Users |
|
|
96 | (1) |
|
Authorizing Access with the Polkit |
|
|
96 | (2) |
|
|
|
97 | (1) |
|
|
|
97 | (1) |
|
The Polkit and Local Authority |
|
|
97 | (1) |
|
Network User Verification Tools |
|
|
98 | (2) |
|
|
|
99 | (1) |
|
LDAP Shares Authentication |
|
|
100 | (1) |
|
Best Practices: User Privileges and Permissions |
|
|
100 | (2) |
|
|
|
102 | (1) |
|
|
|
102 | (1) |
|
|
|
102 | (2) |
|
Chapter 5 Filesystems, Volumes, and Encryption |
|
|
104 | (34) |
|
|
|
105 | (7) |
|
|
|
105 | (1) |
|
The Filesystem Hierarchy Standard |
|
|
106 | (2) |
|
Good Volume Organization Can Help Secure a System |
|
|
108 | (3) |
|
|
|
111 | (1) |
|
How Options for Journals, Formats, and File Sizes Affect Security |
|
|
112 | (2) |
|
|
|
113 | (1) |
|
|
|
113 | (1) |
|
|
|
114 | (1) |
|
|
|
114 | (6) |
|
|
|
114 | (1) |
|
|
|
115 | (3) |
|
|
|
118 | (1) |
|
Encrypted Partitions and Volumes |
|
|
119 | (1) |
|
Local File and Folder Permissions |
|
|
120 | (4) |
|
Basic File Ownership Concepts |
|
|
121 | (1) |
|
Basic File-Permission Concepts |
|
|
121 | (1) |
|
Changing File Permissions |
|
|
122 | (2) |
|
Networked File and Folder Permissions |
|
|
124 | (4) |
|
|
|
124 | (1) |
|
Samba/CIFS Network Permissions |
|
|
125 | (2) |
|
Network Permissions for the vsftp Daemon |
|
|
127 | (1) |
|
Configuring and Implementing Quotas on a Filesystem |
|
|
128 | (4) |
|
The Quota Configuration Process |
|
|
129 | (1) |
|
|
|
130 | (1) |
|
|
|
131 | (1) |
|
How to Configure and Implement Access Control Lists on a Filesystem |
|
|
132 | (2) |
|
Configure a Filesystem for ACLs |
|
|
132 | (1) |
|
|
|
133 | (1) |
|
Configure Files and Directories with ACLs |
|
|
133 | (1) |
|
Best Practices: Filesystems, Volumes, and Encryption |
|
|
134 | (1) |
|
|
|
135 | (1) |
|
|
|
136 | (1) |
|
|
|
136 | (2) |
|
Chapter 6 Securing Services |
|
|
138 | (28) |
|
Starting a Hardened System |
|
|
140 | (5) |
|
|
|
145 | (9) |
|
|
|
146 | (5) |
|
|
|
151 | (1) |
|
|
|
152 | (2) |
|
|
|
154 | (3) |
|
Using Mandatory Access Controls |
|
|
157 | (3) |
|
|
|
157 | (2) |
|
|
|
159 | (1) |
|
|
|
160 | (1) |
|
Protecting Against Development Tools |
|
|
161 | (2) |
|
|
|
163 | (1) |
|
|
|
164 | (1) |
|
|
|
164 | (2) |
|
Chapter 7 Networks, Firewalls, and More |
|
|
166 | (44) |
|
Services on Every TCP/IP Port |
|
|
167 | (2) |
|
Protocols and Numbers in /etc/services |
|
|
168 | (1) |
|
Protection by the Protocol and Number |
|
|
168 | (1) |
|
Obscurity and the Open Port Problem |
|
|
169 | (2) |
|
|
|
169 | (1) |
|
Opening Obscure Open Ports |
|
|
169 | (1) |
|
|
|
170 | (1) |
|
|
|
171 | (2) |
|
What Services Are TCP Wrapped? |
|
|
171 | (1) |
|
Configure TCP Wrapper Protection |
|
|
171 | (2) |
|
Packet-Filtering Firewalls |
|
|
173 | (14) |
|
|
|
174 | (9) |
|
|
|
183 | (2) |
|
A Firewall for the Demilitarized Zone |
|
|
185 | (2) |
|
A Firewall for the Internal Network |
|
|
187 | (1) |
|
|
|
187 | (4) |
|
Attacks Through Nonstandard Connections |
|
|
188 | (1) |
|
Attacks on Scheduling Services |
|
|
189 | (2) |
|
|
|
191 | (2) |
|
Linux and Wireless Hardware |
|
|
191 | (1) |
|
Encrypting Wireless Networks |
|
|
191 | (1) |
|
|
|
192 | (1) |
|
|
|
193 | (9) |
|
|
|
194 | (1) |
|
Basic SELinux Configuration |
|
|
194 | (1) |
|
Configuration from the Command Line |
|
|
194 | (2) |
|
The SELinux Administration Tool |
|
|
196 | (1) |
|
The SELinux Troubleshooter |
|
|
197 | (1) |
|
|
|
197 | (5) |
|
Setting Up AppArmor Profiles |
|
|
202 | (4) |
|
Basic AppArmor Configuration |
|
|
202 | (1) |
|
AppArmor Configuration Files |
|
|
202 | (1) |
|
|
|
203 | (1) |
|
|
|
204 | (1) |
|
|
|
204 | (1) |
|
AppArmor Configuration and Management Commands |
|
|
204 | (2) |
|
An AppArmor Configuration Tool |
|
|
206 | (1) |
|
Best Practices: Networks, Firewalls, and TCP/IP Communications |
|
|
206 | (2) |
|
|
|
208 | (1) |
|
|
|
208 | (1) |
|
|
|
209 | (1) |
|
Chapter 8 Networked Filesystems and Remote Access |
|
|
210 | (33) |
|
Basic Principles for Systems with Shared Networking Services |
|
|
211 | (5) |
|
|
|
212 | (1) |
|
Install and Configure a Kerberos Server |
|
|
212 | (1) |
|
Basic Kerberos Configuration |
|
|
213 | (2) |
|
Additional Kerberos Configuration Options |
|
|
215 | (1) |
|
Securing NFS as If It Were Local |
|
|
216 | (1) |
|
Configure NES Kerberos Tickets |
|
|
216 | (1) |
|
Configure NFS Shares for Kerberos |
|
|
216 | (1) |
|
Keeping vsftp Very Secure |
|
|
217 | (2) |
|
Configuration Options for vsftp |
|
|
217 | (2) |
|
Additional vsftp Configuration Files |
|
|
219 | (1) |
|
Linux as a More Secure Windows Server |
|
|
219 | (6) |
|
|
|
220 | (4) |
|
Samba as a Primary Domain Controller |
|
|
224 | (1) |
|
Making Sure SSH Stays Secure |
|
|
225 | (5) |
|
|
|
225 | (3) |
|
|
|
228 | (1) |
|
Create a Secure Shell Passphrase |
|
|
228 | (2) |
|
Basic Principles of Encryption on Networks |
|
|
230 | (3) |
|
Host-to-Host IPSec on Red Hat |
|
|
231 | (1) |
|
Host-to-Host IPSec on Ubuntu |
|
|
231 | (2) |
|
Network-to-Network IPSec on Red Hat |
|
|
233 | (1) |
|
Network-to-Network IPSec on Ubuntu |
|
|
233 | (1) |
|
Helping Users Who Must Use Telnet |
|
|
233 | (2) |
|
Persuade Users to Convert to SSH |
|
|
234 | (1) |
|
Install More Secure Telnet Servers and Clients |
|
|
235 | (1) |
|
Securing Modem Connections |
|
|
235 | (1) |
|
|
|
236 | (1) |
|
RADIUS Configuration Files |
|
|
236 | (1) |
|
Moving Away from Cleartext Access |
|
|
236 | (3) |
|
The Simple r s ync Solution |
|
|
238 | (1) |
|
|
|
238 | (1) |
|
Best Practices: Networked Filesystems and Remote Access |
|
|
239 | (2) |
|
|
|
241 | (1) |
|
|
|
241 | (1) |
|
|
|
242 | (1) |
|
Chapter 9 Networked Application Security |
|
|
243 | (35) |
|
Options for Secure Web Sites with Apache |
|
|
244 | (11) |
|
|
|
245 | (2) |
|
|
|
247 | (1) |
|
Security-Related Apache Directives |
|
|
248 | (3) |
|
Configure Protection on a Web Site |
|
|
251 | (1) |
|
Configure a Secure Web site |
|
|
252 | (1) |
|
Configure a Certificate Authority |
|
|
252 | (2) |
|
|
|
254 | (1) |
|
|
|
255 | (3) |
|
Basic Squid Configuration |
|
|
256 | (1) |
|
Security-Related Squid Directives |
|
|
257 | (1) |
|
Limit Remote Access with Squid |
|
|
258 | (1) |
|
Protecting DNS Services with BIND |
|
|
258 | (5) |
|
The Basics of DNS on the Internet |
|
|
258 | (1) |
|
DNS Network Configuration |
|
|
259 | (1) |
|
Secure BIND Configuration |
|
|
259 | (2) |
|
|
|
261 | (1) |
|
|
|
261 | (1) |
|
Domain Name System Security Extensions |
|
|
261 | (2) |
|
|
|
263 | (5) |
|
|
|
263 | (3) |
|
|
|
266 | (1) |
|
|
|
267 | (1) |
|
|
|
268 | (1) |
|
|
|
268 | (2) |
|
Basic Asterisk Configuration |
|
|
269 | (1) |
|
Security Risks with Asterisk |
|
|
269 | (1) |
|
|
|
270 | (3) |
|
|
|
271 | (1) |
|
|
|
271 | (1) |
|
|
|
271 | (1) |
|
The CUPS Administrative Tool |
|
|
272 | (1) |
|
|
|
273 | (1) |
|
Obscuring Local and Network Services |
|
|
273 | (1) |
|
Best Practices: Networked Application Security |
|
|
274 | (1) |
|
|
|
275 | (1) |
|
|
|
276 | (1) |
|
|
|
276 | (2) |
|
Chapter 10 Kernel Security Risk Mitigation |
|
|
278 | (33) |
|
Distribution-Specific Functional Kernels |
|
|
279 | (3) |
|
|
|
280 | (1) |
|
Kernels for Different Functions |
|
|
281 | (1) |
|
|
|
282 | (3) |
|
|
|
283 | (1) |
|
Production Releases and More |
|
|
283 | (1) |
|
Download the Stock Kernel |
|
|
284 | (1) |
|
Stock Kernel Patches and Upgrades |
|
|
284 | (1) |
|
Managing Security and Kernel Updates |
|
|
285 | (2) |
|
Stock Kernel Security Issues |
|
|
285 | (1) |
|
Distribution-Specific Kernel Security Issues |
|
|
286 | (1) |
|
Installing an Updated Kernel |
|
|
286 | (1) |
|
Development Software for Custom Kernels |
|
|
287 | (1) |
|
Red Hat Kernel Development Software |
|
|
287 | (1) |
|
Ubuntu Kernel Development Software |
|
|
288 | (1) |
|
|
|
288 | (11) |
|
Before Customizing a Kernel |
|
|
289 | (1) |
|
Start the Kernel Customization Process |
|
|
289 | (2) |
|
Kernel Configuration Options |
|
|
291 | (8) |
|
Building Your Own Secure Kernel |
|
|
299 | (5) |
|
Download Kernel Source Code |
|
|
300 | (1) |
|
Download Ubuntu Kernel Source Code |
|
|
300 | (1) |
|
Download Red Hat Kernel Source Code |
|
|
300 | (1) |
|
Install Required Development Tools |
|
|
301 | (1) |
|
Navigate to the Directory with the Source Code |
|
|
301 | (1) |
|
Compile a Kernel on Ubuntu Systems |
|
|
302 | (1) |
|
Compile a Kernel on Red Hat Systems |
|
|
302 | (1) |
|
|
|
302 | (1) |
|
Install the New Kernel and More |
|
|
303 | (1) |
|
|
|
303 | (1) |
|
|
|
303 | (1) |
|
Increasing Security Using Kernels and the /prod Filesystem |
|
|
304 | (3) |
|
Don't Reply to Broadcasts |
|
|
304 | (1) |
|
Protect from Bad ICMP Messages |
|
|
305 | (1) |
|
|
|
305 | (1) |
|
Activate Reverse Path Filtering |
|
|
305 | (1) |
|
Close Access to Routing Tables |
|
|
306 | (1) |
|
|
|
306 | (1) |
|
Don't Pass Traffic Between Networks |
|
|
307 | (1) |
|
Log Spoofed, Source-Routed, and Redirected Packets |
|
|
307 | (1) |
|
Best Practices: Kernel Security Risk Mitigation |
|
|
307 | (2) |
|
|
|
309 | (1) |
|
|
|
309 | (1) |
|
|
|
309 | (2) |
| Part Three Building a Layered Linux Security Strategy |
|
311 | (160) |
|
Chapter 11 Managing Security Alerts and Updates |
|
|
312 | (37) |
|
Keeping Up with Distribution Security |
|
|
313 | (3) |
|
|
|
314 | (1) |
|
|
|
314 | (1) |
|
|
|
314 | (1) |
|
|
|
315 | (1) |
|
|
|
315 | (1) |
|
Keeping Up with Application Security |
|
|
316 | (4) |
|
|
|
317 | (1) |
|
|
|
317 | (1) |
|
|
|
318 | (1) |
|
|
|
318 | (2) |
|
Antivirus Options for Linux Systems |
|
|
320 | (3) |
|
The Clam AntiVirus System |
|
|
321 | (1) |
|
|
|
322 | (1) |
|
The Kaspersky Antivirus Alternative |
|
|
322 | (1) |
|
|
|
322 | (1) |
|
|
|
323 | (1) |
|
|
|
323 | (4) |
|
|
|
324 | (1) |
|
|
|
325 | (1) |
|
Application-Specific Bug Reports |
|
|
325 | (2) |
|
Security in an Open Source World |
|
|
327 | (2) |
|
The Institute for Security and Open Methodologies |
|
|
328 | (1) |
|
The National Security Agency |
|
|
328 | (1) |
|
The Free Software Foundation |
|
|
328 | (1) |
|
|
|
329 | (1) |
|
Deciding Between Automated Updates or Analyzed Alerts |
|
|
329 | (2) |
|
Do You Trust Your Distribution? |
|
|
330 | (1) |
|
Do You Trust Application Developers? |
|
|
330 | (1) |
|
Do You Trust Service Developers? |
|
|
330 | (1) |
|
|
|
331 | (4) |
|
|
|
332 | (1) |
|
|
|
332 | (1) |
|
Updates on Red Hat Enterprise Linux |
|
|
333 | (1) |
|
|
|
333 | (2) |
|
Options for Update Managers |
|
|
335 | (4) |
|
Configuring Automated Updates |
|
|
335 | (2) |
|
Automatic Red Hat Updates |
|
|
337 | (1) |
|
Pushing or Pulling Updates |
|
|
338 | (1) |
|
Local or Remote Repositories |
|
|
338 | (1) |
|
Configuring a Local Repository |
|
|
338 | (1) |
|
Commercial Update Managers |
|
|
339 | (3) |
|
|
|
340 | (1) |
|
|
|
341 | (1) |
|
|
|
341 | (1) |
|
Open Source Update Managers |
|
|
342 | (3) |
|
|
|
342 | (1) |
|
|
|
343 | (2) |
|
|
|
345 | (1) |
|
Best Practices: Security Operations Management |
|
|
345 | (1) |
|
|
|
346 | (1) |
|
|
|
347 | (1) |
|
|
|
347 | (2) |
|
Chapter 12 Building and Maintaining a Security Baseline |
|
|
349 | (27) |
|
Configuring a Simple Baseline |
|
|
350 | (4) |
|
A Minimal Red Hat Baseline |
|
|
351 | (2) |
|
A Minimal Ubuntu Baseline |
|
|
353 | (1) |
|
Read-Only or Live Bootable Operating Systems |
|
|
354 | (2) |
|
Appropriate Read-Only Filesystems |
|
|
355 | (1) |
|
|
|
356 | (1) |
|
Keeping the Baseline Up to Date |
|
|
356 | (3) |
|
|
|
357 | (2) |
|
|
|
359 | (1) |
|
|
|
359 | (6) |
|
The System and Kernel Log Services |
|
|
359 | (4) |
|
Logs from Individual Services |
|
|
363 | (2) |
|
Consolidating and Securing Remote Logs |
|
|
365 | (3) |
|
Default rsyslog Configuration |
|
|
365 | (1) |
|
The Standard rsyslog Configuration File |
|
|
365 | (3) |
|
Identifying a Baseline System State |
|
|
368 | (3) |
|
Collect a List of Packages |
|
|
368 | (1) |
|
Compare Files, Permissions, and Ownership |
|
|
369 | (1) |
|
Define the Baseline Network Configuration |
|
|
370 | (1) |
|
Collect Runtime Information |
|
|
370 | (1) |
|
Checking for Changes with Integrity Scanners |
|
|
371 | (2) |
|
|
|
371 | (1) |
|
Advanced Intrusion Detection Environment |
|
|
372 | (1) |
|
Best Practices: Building and Maintaining a Secure Baseline |
|
|
373 | (1) |
|
|
|
374 | (1) |
|
|
|
374 | (1) |
|
|
|
374 | (2) |
|
Chapter 13 Testing and Reporting |
|
|
376 | (42) |
|
Testing Every Component of a Layered Defense |
|
|
377 | (5) |
|
|
|
377 | (1) |
|
|
|
378 | (3) |
|
|
|
381 | (1) |
|
Testing Mandatory Access Control Systems |
|
|
382 | (1) |
|
Checking for Open Network Ports |
|
|
382 | (10) |
|
|
|
382 | (1) |
|
|
|
383 | (3) |
|
|
|
386 | (1) |
|
|
|
387 | (5) |
|
Running Integrity Checks of Installed Files and Executables |
|
|
392 | (6) |
|
|
|
393 | (1) |
|
Performing a Tripwire Check |
|
|
394 | (1) |
|
Testing with the Advanced Intrusion Detection Environment |
|
|
395 | (3) |
|
Ensuring that Security Does Not Prevent Legitimate Access |
|
|
398 | (3) |
|
Reasonable Password Policies |
|
|
398 | (3) |
|
Allowing Access from Legitimate Systems |
|
|
401 | (1) |
|
Monitoring Virtualized Hardware |
|
|
401 | (3) |
|
|
|
402 | (1) |
|
|
|
402 | (1) |
|
Monitoring the Kernel-Based Virtual Machine (KVM) |
|
|
403 | (1) |
|
Standard Open Source Security-Testing Tools |
|
|
404 | (4) |
|
|
|
405 | (2) |
|
Netcat and the nc Command |
|
|
407 | (1) |
|
Vulnerability Scanners for Linux |
|
|
408 | (4) |
|
|
|
408 | (2) |
|
|
|
410 | (1) |
|
|
|
410 | (2) |
|
Where to Install Security-Testing Tools |
|
|
412 | (3) |
|
Hint: Not Where Attackers Can Use Them Against You |
|
|
412 | (1) |
|
Some Tools Are Already Available on Live CDs |
|
|
413 | (2) |
|
Best Practices: Testing and Reporting |
|
|
415 | (1) |
|
|
|
416 | (1) |
|
|
|
416 | (1) |
|
|
|
417 | (1) |
|
Chapter 14 Detecting and Responding to Security Breaches |
|
|
418 | (30) |
|
Performing Regular Performance Audits |
|
|
419 | (3) |
|
The Basic Tools: ps and top |
|
|
420 | (1) |
|
The System Status Package |
|
|
421 | (1) |
|
|
|
421 | (1) |
|
Making Sure Users Stay Within Secure Limits |
|
|
422 | (2) |
|
|
|
423 | (1) |
|
|
|
423 | (1) |
|
User Installation of Problematic Services |
|
|
424 | (1) |
|
Logging Access into the Network |
|
|
424 | (2) |
|
Identifying Users Who Have Logged In |
|
|
424 | (1) |
|
System Authentication Logs |
|
|
425 | (1) |
|
Monitoring Account Behavior for Security Issues |
|
|
426 | (1) |
|
Downloaded Packages and Source Code |
|
|
426 | (1) |
|
|
|
426 | (1) |
|
Creating an Incident Response Plan |
|
|
427 | (6) |
|
|
|
428 | (1) |
|
Should You Leave the System On? |
|
|
428 | (1) |
|
Acquiring the Memory Contents |
|
|
429 | (4) |
|
Having Live Linux CDs Ready for Forensics Purposes |
|
|
433 | (4) |
|
|
|
433 | (2) |
|
SANS Investigative Forensics Toolkit |
|
|
435 | (1) |
|
Digital Evidence and Forensics Toolkit |
|
|
435 | (1) |
|
|
|
435 | (1) |
|
|
|
436 | (1) |
|
When You Put Your Plan into Action |
|
|
437 | (2) |
|
|
|
437 | (1) |
|
Identifying Compromised Systems |
|
|
438 | (1) |
|
Having Replacement Systems in Place |
|
|
438 | (1) |
|
Secure Backup and Recovery Tools |
|
|
439 | (2) |
|
Disk Images for Later Investigation |
|
|
439 | (1) |
|
|
|
440 | (1) |
|
Mount Encrypted Filesystems |
|
|
440 | (1) |
|
The Right Way to Save Compromised Data as Evidence |
|
|
441 | (1) |
|
Basic Principles for Evidence |
|
|
441 | (1) |
|
Remembering the Volatile Data |
|
|
442 | (1) |
|
Preserving the Hard Disks |
|
|
442 | (1) |
|
Disaster Recovery from a Security Breach |
|
|
442 | (2) |
|
Determining What Happened |
|
|
443 | (1) |
|
|
|
443 | (1) |
|
|
|
443 | (1) |
|
How and When to Share with the Open Source Community |
|
|
444 | (1) |
|
If the Security Issue Is Known |
|
|
444 | (1) |
|
If the Security Issue Has Not Been Reported |
|
|
444 | (1) |
|
Best Practices: Security Breach Detection and Response |
|
|
445 | (1) |
|
|
|
446 | (1) |
|
|
|
446 | (1) |
|
|
|
447 | (1) |
|
Chapter 15 Best Practices and Emerging Technologies |
|
|
448 | (23) |
|
Maintaining a Gold Baseline |
|
|
449 | (2) |
|
Monitoring Security Reports |
|
|
450 | (1) |
|
|
|
450 | (1) |
|
Recalibrating System Integrity |
|
|
450 | (1) |
|
Ensuring Availability with Redundancy |
|
|
451 | (2) |
|
|
|
451 | (1) |
|
A Gold Virtual Baseline Host |
|
|
451 | (2) |
|
Identifying Your Support Options |
|
|
453 | (3) |
|
|
|
454 | (1) |
|
Canonical Support Options |
|
|
455 | (1) |
|
Open Source Community Support |
|
|
455 | (1) |
|
Checking Compliance with Security Policies |
|
|
456 | (1) |
|
|
|
456 | (1) |
|
|
|
456 | (1) |
|
Keeping the Linux Operating System Up to Date |
|
|
457 | (2) |
|
|
|
457 | (1) |
|
|
|
458 | (1) |
|
|
|
458 | (1) |
|
Keeping Distribution-Related Applications Up to Date |
|
|
459 | (2) |
|
|
|
459 | (2) |
|
|
|
461 | (1) |
|
Managing Third-Party Applications |
|
|
461 | (1) |
|
|
|
461 | (1) |
|
|
|
462 | (1) |
|
Sharing Problems and Solutions with the Community |
|
|
462 | (2) |
|
|
|
462 | (1) |
|
|
|
463 | (1) |
|
|
|
464 | (1) |
|
Testing New Components Before Putting Them into Production |
|
|
464 | (2) |
|
|
|
465 | (1) |
|
|
|
465 | (1) |
|
|
|
466 | (1) |
|
Keeping Up with Security on Your Systems |
|
|
466 | (3) |
|
|
|
466 | (1) |
|
More Mandatory Access Controls |
|
|
466 | (1) |
|
Penetration-Testing Tools |
|
|
467 | (1) |
|
|
|
468 | (1) |
|
|
|
468 | (1) |
|
|
|
469 | (1) |
|
|
|
470 | (1) |
|
|
|
470 | (1) |
| Appendix A Answer Key |
|
471 | (2) |
| Appendix B Standard Acronyms |
|
473 | (4) |
| Glossary of Key Terms |
|
477 | (14) |
| References |
|
491 | (6) |
| Index |
|
497 | |
