Practical UNIX Security

If you're a UNIX system administrator or user who needs to deal with security, you need this book. It's a practical guide that spells out options for both Berkeley UNIX and System V, as well as Sun's NFS and other network facilities. It's complete, rational, and doesn't require that you be a programmer to use it.

Practical UNIX Security describes the issues, approaches, and methods for implementing security measures — spelling out what the varying approaches cost and require in the way of equipment and other resources. After describing UNIX security basics and network security, this guide goes on to suggest how to keep intruders out of your system, how to tell if they've gotten in, how to clean up after them, and even how to prosecute them. Filled with practical scripts, tricks, and warnings, Practical UNIX Security tells you everything you need to know to make your UNIX system as secure as it can be.

Contents include:

• Understanding basic UNIX functions, such as users, passwords, groups, superuser, and the filesystem
• Defending against security breaches
• Defending against network and communications breaches, using modems, UUCP, NFS, NIS, secure NFS, Kerberos, and firewall machines
• Handling break-ins and other security incidents and repairing the damage
• Applying techniques of encryption and physical security to UNIX
• Appendices: UNIX security checklist, important files, UNIX processes, how Kerberos works, and an extensive, annotated list of other security sources

• Scope of This Book
• Which UNIX System?
• Conventions Used in This Book
• Acknowledgments
• Comments and Questions
• Three Final Notes
1.  UNIX and UNIX Security Basics
1. Introduction
• What's Computer Security?
• What's an Operating System?
• History of UNIX
• Security and UNIX
• Security and Networks
• Types of Security
• Risk Assessment
• Assessing Your Risk
• Reacting to an Emergency
• Other Important Steps
• The Problem with Security Through Obscurity
• The First Step
2. Users and Passwords
• Usernames
• The /etc/passwd File
• The /etc/passwd File and Network Databases
• Passwords
• Why Use Passwords?
• Entering Your Password
• Changing Your Password
• Checking Out Your New Password
• The UNIX Encrypted Password System
• The crypt(3) Algorithm
• What Is Salt?
• The Care and Feeding of Passwords
• Bad Passwords: Open Doors
• Good Passwords: Locked Doors
• Passwords on Multiple Machines
• Writing Down Passwords
• Administrative Techniques
• Assigning Passwords to Users
• Password Generators
• Shadow Password Files
• Password Aging and Expiration
• Algorithm Changes
• Preventing Direct Logins to Accounts
• Account Names Revisited
• Summary
3. Users, Groups, and the Superuser
• Users and Groups
• User Identifiers (UIDs)
• Groups and Group Identifiers (GIDs)
• Special Users
• The Superuser
• Other Special Users
• Impact of the /etc/passwd and /etc/group Files on Security
• The su(1) Command: Changing Who You Are
• Becoming the Superuser
• Restricting su
• The Bad su Log
• Other Uses of su
• Summary
4. The UNIX Filesystem
• Files
• Using the ls(1) Command
• Understanding File Permissions
• File Permissions in Detail
• Using File Permissions
• chmod: Changing a File's Permissions
• Setting a File's Permissions
• Calculating Octal File Permissions
• Using Octal File Permissions
• The umask
• The umask Command
• Common umask Values
• Using Directory Permissions
• SUID
• SUID, SGID, and Sticky Bits
• Problems with SUID
• Finding All of the SUID and SGID Files
• Turning Off SUID and SGID in Mounted Filesystems
• SGID and Sticky Bits on Directories
• SGID Bit on Files (System V UNIX Only)
• Device Files
• chown: Changing a File's Owner
• chgrp: Changing a File's Group
2. Enforcing Security on Your System
5. Defending Your Accounts
• Dangerous Accounts
• Accounts Without Passwords
• Default Accounts
• Accounts That Run a Single Command
• Open Accounts
• Group Accounts
• Dormant Accounts
• Changing an Account's Password
• Changing the Account's Login Shell
• Finding Dormant Accounts
• Protecting the root Account Under Berkeley UNIX
• Secure Terminals
• The wheel Group
6. Securing Your Data
• File Backups
• Why Make Backups?
• What Should You Back Up?
• Kinds of Backups
• How Long Should You Keep a Backup?
• Security for Backups
• Database Backups and Daily Checking
• Integrity Checking and Checklists
• Checklists
• File Protection Modes
• Read-only Disks
• Comparison Copies
• Checklists
• Signatures
7. The UNIX Log Files
• The /usr/adm/lastlog File
• The /etc/utmp and /usr/adm/wtmp Files
• The last Program
• Pruning the wtmp File
• The /usr/adm/acct File
• The Berkeley System Log (syslog) Facility
• The syslog.conf Configuration File
• Where to Log
8. Protecting Against Programmed Threats
• Programmed Threats: Definitions
• Back Doors and Trap Doors
• Logic Bombs
• Viruses
• Worms
• Trojan Horses
• Bacteria and Rabbits
• Damage
• Authors
• Entry
• Protecting Yourself
• Shell Features
• Startup File Attacks
• Abusing Automatic Mechanisms
• Unexpected Interactions
• Protecting Your System
• File Protections
• SUID and SGID Programs
• Notes on Writing a SUID Program
• SUID Shell Scripts
3. Communications and Security
9. Modems
• Theory of Operation
• Serial Interfaces
• The RS-232 Serial Protocol
• Originate and Answer
• Modems and Security
• One-way Phone Lines
• Modems and UNIX
• Hooking Up a Modem to Your Computer
• Setting Up the UNIX Device
• Checking Your Modem
• Physical Protection
• Additional Security for Modems
10. UUCP
• About UUCP
• The uucp Command
• The uux Command
• The mail Command
• How the uucp Commands Work
• Versions of UUCP
• UUCP and Security
• Assigning Additional UUCP Logins
• Establishing UUCP Passwords
• Security of the L.sys and Systems Files
• Security in Version 2 UUCP
• USERFILE: Providing Remote File Access
• A USERFILE Example
• L.cmds: Providing Remote Command Execution
• Security in BNU UUCP
• The Permissions File
• Permissions Commands
• uucheck(1): Checking Your Permissions File
• Additional Security Concerns
• Mail Forwarding for UUCP
• Automatic Execution of Cleanup Scripts
• Early Security Problems with UUCP
• Summary
11. Networks and Security
• The Internet
• Internet Addresses
• The /etc/hosts File
• Network Hostname Service
• Clients and Servers
• TCP/IP
• UDP/IP
• UNIX Network Servers
• The /etc/services File
• Starting the Servers
• The /etc/inetd Program
• Network Services
• TELNET
• rlogin and rsh
• rexec
• finger
• Electronic Mail
• FTP
• TFTP
• The X Window System
• Security Implications of Network Services
• Monitoring Your Network with netstat
• Summary
12. Sun's NFS
• NIS
• Netgroups
• Setting Up Netgroups
• NFS
• How NFS Works
• The /etc/exports File
• The showmount Command
• Authentication and NFS
• Improving Basic NFS Security
• Limiting Exported Filesystems
• Limit Exported Machines
• Use root Ownership
• Export Read-only
• Do Not Export Server Executables
• The fsirand Program
• Summary: Security Implications of NFS
• A Final Word on NIS
• Unintended Disclosure
• Spoofing the Servers
• Summary
13. Kerberos and Secure RPC
• The Problem
• What's Wrong with LANs?
• Minimizing the Problems
• MIT's Kerberos
• What's It Like to Use Kerberos?
• How to Install Kerberos
• What's Wrong with Kerberos?
• Sun Microsystems' Secure RPC
• How Secure RPC Works
• What's It Like to Use Secure NFS?
• How to Install Secure RPC
• What's Wrong with Secure RPC?
14. Firewall Machines
• What's a Firewall?
• Internal Firewalls
• External Firewalls
• Setting Up a Firewall
• The Choke
• Choosing the Choke's Protocols
• Setting Up the Gate
• Name Service
• Electronic Mail
• Netnews
• FTP
• Other Services
• An Alternate Method
• Special Considerations
4. Handling Security Incidents
15. Discovering a Break-in
• Prelude
• Discovering an Intruder
• Catching One in the Act
• What to Do When You Catch Somebody
• Tracing a Connection
• Getting Rid of the Intruder
• The Log Files: Discovering an Intruder's Tracks
• Cleaning Up After the Intruder
• New Accounts
• An Example
• A Last Note: Never Trust Anything Except Hardcopy
16. Denial of Service Attacks and Solutions
• Destruction Attacks
• Overload Attacks
• Process Overload Attacks
• Disk Attacks
• Swap Space Attacks
• Soft Process Limits: Preventing Accidental Denial of Service
• Network Denial of Service Attacks
• Service Overloading
• Message Flooding
• Signal Grounding
17. Computer Security and U.S. Law
• Legal Options After a Break-in
• Criminal Prosecution
• The Local Option
• Federal Jurisdiction
• Federal Computer Crime Laws
• Hazards of Criminal Prosecution
• If You or One of Your Employees is a Target of an Investigation
• Other Tips
• Civil Actions
• Privacy and the Electronic Communications Privacy Act
5. Other Security Topics
18. Encryption
• Who Needs Encryption?
• Cryptographic Strength
• Types of Encryption Systems
• ROT13
• crypt
• Enigma Encryption System
• UNIX crypt
• Ways of Improving the Security of crypt
• Example
• The Data Encryption Standard (DES)
• DES Modes
• Use and Export of DES
• DES Strength
• Sun's des Command
• RSA and Public Key Cryptography
• How RSA Works
• An RSA Example
• Strength of RSA
• Proprietary Encryption Systems
• Protect Your Key
19. Physical Security
• Protecting Computer Hardware
• The Environment
• Accidents
• Physical Access
• Vandalism
• Acts of War and Terrorism
• Theft
• Related Concerns
• Protecting Data
• Eavesdropping
• Backups
• Local Storage
• Unattended Terminals
6. Appendices
1. UNIX Security Checklist
2. Important Files
• System Files
• Important Files in Your Home Directory
• SUID Files in Berkeley UNIX
• SGID Files in Berkeley UNIX
• SUID Files in System V R3.2 UNIX
• SGID Files in System V UNIX
3. UNIX Processes
• Processes
• Processes and Programs
• The ps Command
• Process Properties
• Creating Processes
• Signals
• The kill Command
• Starting Up UNIX and Logging In
• Process #1: /etc/init
• Letting Users Log In
• Running the User's Shell
4. How Kerberos Works
• Kerberos's Parts
• Using Kerberos
• Using a Service
5. Other Sources
• References
• General Computer Security
• UNIX Security
• Computer Viruses and Programmed Threats
• Computer Crime and Law
• Understanding the Computer Security 'Culture'
• Understanding and Using Networks
• Using and Programming UNIX
• Security Products and Services Information
• Miscellaneous References
• Organizations
• Association for Computing Machinery (ACM)
• IEEE Computer Society
• USENIX
• American Society for Industrial Security (ASIS)
• Computer Security Institute (CSI)
• National Institute of Standards and Technology (NIST)
• National Security Agency (NSA)
• Computer Emergency Response Team (CERT)
• DOE's Computer Incident Advisory Capability (CIAC)
• Software Resources
• Getting Kerberos
• Getting COPS

A classical text. Unfortunately, you get to learn eveything in this book in every UNIX course in existance.