1. Vulnerability Survey. What Happened? Other Cracker Activities. So, Are You Going to Show Us How to Break into Systems? A Survey of Vulnerabilities and Attacks. Technical. Social. Physical. Summary.
For Further Reading. Books. Interesting Cracker Tales. Web Sites. Full-Disclosure Resources. 2. Security Policies. What Is Computer and Network Security? Elements of a Computing Environment.
Risk Analysis. The Security Policy. Securing Computers and Networks. User Privacy and Administrator Ethics. Summary. For Further Reading. Books. Web Resources.
Other Resources. 3. Background Information. BIOS Passwords. Linux Installation and LILO. A Note about LILO. Recovering a Corrupt System. Installation and LILO Resources.
Start-Up Scripts. Red Hat Package Manager. Verifying Packages with RPM. Checking PGP Signatures with RPM. RPM Resources. RPM Mailing List. TCP/IP Networking Overview. The TCP/IP Model Layers.
Remote Procedure Call Applications. Trusted Host Files and Related Commands. Some Major Applications. Network Monitoring. General TCP/IP Networking Resources. NFS, Samba, NIS, and DNS Resources. Request for Comment. Cryptography.
The Purpose of Cryptography. Algorithm Types. Hash Functions and Digital Signatures. Passwords Aren't Encrypted, They're Hashed! An Overview of PGP. Cryptography References. Testing and Production Environments. Security Archives. Software Testing.
Source Code Auditing. Pristine Backups. Security Resources. Licenses. 4. Users, Permissions, and Filesystems. User Account Management. Good Passwords.
All Accounts Must Have Passwords!Or Be Locked! Password Aging and the Shadow File. Restricted Accounts. Shell History. The Root Account. Using the Root Account. Multiple Root Users. Minimizing the Impact of Root Compromise. Configuring /etc/securetty.
Group Account Management. File and Directory Permissions. User File and Directory Permissions. System File and Directory Permissions. SUID and SGID. File Attributes. Using xlock and xscreensaver. Filesystem Restrictions.
Summary. For Further Reading. System Administration. System Security. 5. Pluggable Authentication Modules. PAM Overview. PAM Configuration.
PAM Administration. PAM and Passwords. PAM and Passwords Summary. PAM and login. Time and Resource Limits. Access Control with pam_listfile. PAM and su. Using pam_access.
Using pam_lastlog. Using pam_rhosts_auth. One-Time Password Support. PAM and the other Configuration File. Additional PAM Options. PAM Logs. Available PAM Modules. PAM-Aware Applications.
Important Notes about Configuring PAM. The Future of PAM. Summary. For Further Reading. On-Line Documentation. 6. One-Time Passwords. The Purpose of One-Time Passwords.
S/Key. S/Key OTP Overview. S/Key Version 1.1b. S/Key Version. OPIE. Obtaining and Installing OPIE. Implementing and Using OPIE.
OPIE and PAM. Obtaining and Installing pam_opie. Obtaining and Installing pam_if. Implementing pam_opie and pam_if. Which OTP System Should I Use? Advantages and Disadvantages of S/Key. Advantages and Disadvantages of OPIE. S/Key and OPIE Vulnerabilities. Summary.
For Further Reading. Programming. E-Mail Lists. 7. System Accounting. General System Accounting. Connection Accounting. The last Command.
The who Command. One Other Command. Process Accounting. The sa Command. The lastcomm Command. Accounting Files. Summary. For Further Reading.
Books. On-Line Documentation. 8. System Logging. The syslog System Logging Utility. Overview. The /etc/syslog.conf File.
Invoking the syslogd Daemon. Configuring /etc/syslog.conf. The klogd Daemon. Other Logs. Alternatives to syslog. The auditd Utility. Summary.
For Further Reading. General System Logging. Intrusion Detection. 9. Superuser Do (sudo). What Is.