Linux Server Security, Second Edition

Linux Server Security, Second Edition

by Michael D. Bauer
Released January 2005
Publisher(s): O'Reilly Media, Inc.
ISBN: 9780596006709

Read it now on the O’Reilly learning platform with a 10-day free trial.

O’Reilly members get unlimited access to books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.

Buy on Amazon Buy on ebooks.com
Start your free trial

Book description

Linux consistently appears high up in the list of popular Internet servers, whether it's for the Web, anonymous FTP, or general services such as DNS and delivering mail. But security is the foremost concern of anyone providing such a service. Any server experiences casual probe attempts dozens of time a day, and serious break-in attempts with some frequency as well. This highly regarded book, originally titled Building Secure Servers with Linux, combines practical advice with a firm knowledge of the technical tools needed to ensure security. The book focuses on the most common use of Linux--as a hub offering services to an organization or the Internet--and shows readers how to harden their hosts against attacks. An all-inclusive resource for Linux users who wish to harden their systems, Linux Server Security covers general security such as intrusion detection and firewalling a hub, as well as key services such as DNS, the Apache Web server, mail, and secure shell. Author Michael D. Bauer, a security consultant, network architect, and lead author of the popular Paranoid Penguin column in the Linux Journal, carefully outlines the security risks, defines precautions that can minimize those risks, and offers recipes for robust security. He is joined on several chapters by administrator and developer Bill Lubanovic. A number of new security topics have been added for this edition, including:

  • Database security, with a focus on MySQL

  • Using OpenLDAP for authentication

  • An introduction to email encryption

  • The Cyrus IMAP service, a popular mail delivery agent

  • The vsftpd FTP server

Geared toward Linux users with little security expertise, the author explains security concepts and techniques in clear language, beginning with the fundamentals. Linux Server Security with Linux provides a unique balance of "big picture" principles that transcend specific software packages and version numbers, and very clear procedures on securing some of those software packages on several popular distributions. With this book in hand, you'll have both the expertise and the tools to comprehensively secure your Linux system.

Table of contents

  1. Table of Contents
  2. Preface
    1. What This Book Is About
    2. The Paranoid Penguin Connection
    3. The Second Edition
    4. Audience
    5. What This Book Doesn’t Cover
    6. Assumptions This Book Makes
    7. Organization of This Book
    8. Conventions Used in This Book
    9. Safari® Enabled
    10. How to Contact Us
    11. Using Code Examples
    12. Acknowledgments
  3. Threat Modeling and Risk Management
    1. Components of Risk
      1. Assets
      2. Security Goals
        1. Data confidentiality
        2. Data integrity
        3. System integrity
        4. System/network availability
      3. Threats
      4. Motives
        1. Financial motives
        2. Political motives
        3. Personal/psychological motives
      5. Vulnerabilities and Attacks Against Them
    2. Simple Risk Analysis: ALEs
    3. An Alternative: Attack Trees
    4. Defenses
      1. Asset Devaluation
      2. Vulnerability Mitigation
      3. Attack Mitigation
    5. Conclusion
    6. Resources
  4. Designing Perimeter Networks
    1. Some Terminology
    2. Types of Firewall and DMZ Architectures
      1. The “Inside Versus Outside” Architecture
      2. The “Three-Homed Firewall” DMZ Architecture
      3. A Weak Screened-Subnet Architecture
      4. A Strong Screened-Subnet Architecture
    3. Deciding What Should Reside on the DMZ
    4. Allocating Resources in the DMZ
    5. The Firewall
      1. Types of Firewall
        1. Simple packet filters
        2. Stateful packet filtering
        3. Stateful Inspection
        4. Application-layer proxies
      2. Selecting a Firewall
      3. General Firewall Configuration Guidelines
        1. Harden your firewall’s OS
        2. Configure anti-IP-spoofing rules
        3. Deny by default
        4. Strictly limit incoming traffic
        5. Strictly limit all traffic out of the DMZ
        6. Don’t give internal systems unrestricted outbound access
        7. If you have the means, use an application-gateway firewall
        8. Don’t be complacent about host security
  5. Hardening Linux and Using iptables
    1. OS Hardening Principles
      1. Installing/Running Only Necessary Software (1/2)
      2. Installing/Running Only Necessary Software (2/2)
        1. Commonly unnecessary packages
        2. Disabling services in Red Hat and related distributions
        3. Disabling services in SUSE
        4. Disabling services in Debian 3.0
        5. Disabling services in other Linux distributions
      3. Keeping Software Up to Date (1/4)
      4. Keeping Software Up to Date (2/4)
      5. Keeping Software Up to Date (3/4)
      6. Keeping Software Up to Date (4/4)
        1. Distribution (global) updates versus per-package updates
        2. Whither X-based updates?
        3. How to be notified of and obtain security updates: Red Hat
        4. RPM updates for the extremely cautious
        5. Yum: a free alternative to up2date
        6. How to be notified of and obtain security updates: SUSE
        7. SUSE’s online-update feature
        8. How to be notified of and obtain security updates: Debian
      7. Deleting Unnecessary User Accounts and Restricting Shell Access
      8. Restricting Access to Known Users
      9. Running Services in chrooted Filesystems
      10. Minimizing Use of SUID root
        1. Identifying and dealing with SUID root files
      11. Using su and sudo
        1. Using su
        2. Using sudo
      12. Configuring, Managing, and Monitoring Logs
      13. Every System Can Be Its Own Firewall: Using iptables for Local Security
        1. Using iptables: Preparatory steps
        2. How netfilter works
        3. Using iptables
      14. Checking Your Work with Scanners (1/4)
      15. Checking Your Work with Scanners (2/4)
      16. Checking Your Work with Scanners (3/4)
      17. Checking Your Work with Scanners (4/4)
        1. Types of scans and their uses
        2. Why we (good guys) scan
        3. nmap, world champion port scanner
        4. Getting and installing nmap
        5. Using nmap
        6. Some simple port scans
        7. Nessus, a full-featured security scanner
        8. Security scanners explained
        9. Nessus’s architecture
        10. Getting and installing Nessus
        11. Nessus clients
        12. Performing security scans with Nessus
      18. Understanding and Using Available Security Features
      19. Documenting Bastion Hosts’ Configurations
    2. Automated Hardening with Bastille Linux
      1. Background
        1. How Bastille came to be
      2. Obtaining and Installing Bastille
      3. Running Bastille
      4. Some Notes on InteractiveBastille
      5. Bastille’s Logs
      6. Hooray! I’m Completely Secure Now! Or Am I?
  6. Secure Remote Administration
    1. Why It’s Time to Retire Cleartext Admin Tools
    2. Secure Shell Background and Basic Use
      1. How SSH Works
      2. Getting and Installing OpenSSH
      3. SSH Quick Start
      4. Using sftp and scp for Encrypted File Transfers
      5. Digging into SSH Configuration
      6. Configuring and Running sshd, the Secure Shell Daemon
    3. Intermediate and Advanced SSH
      1. Public-Key Cryptography
      2. Advanced SSH Theory: How SSH Uses PK Crypto
      3. Setting Up and Using RSA and DSA Authentication
      4. Minimizing Passphrase Typing with ssh-agent
      5. Passphrase-Less Keys for Maximum Scriptability
      6. Using SSH to Execute Remote Commands
      7. TCP Port Forwarding with SSH: VPN for the Masses!
  7. OpenSSL and Stunnel
    1. Stunnel and OpenSSL: Concepts
      1. OpenSSL (1/2)
      2. OpenSSL (2/2)
        1. What a Certificate Authority does and why you might need one
        2. How to become a small-time CA
        3. Creating CA-signed certificates
        4. Creating self-signed certificates
        5. Client certificates
      3. Using Stunnel (1/2)
      4. Using Stunnel (2/2)
        1. A quick Stunnel example
        2. Explanation of the example stunnel.conf settings
        3. Some security-enhancing global settings
        4. Another method for using Stunnel on the server
      5. Using Certificate Authentication
        1. X.509 authentication example
      6. Using Stunnel on the Server and Other SSL Applications on the Clients
      7. Other Tunneling Tools
      8. Resources
  8. Securing Domain Name Services (DNS)
    1. DNS Basics
    2. DNS Security Principles
    3. Selecting a DNS Software Package
    4. Securing BIND
      1. Making Sense out of BIND Versions
      2. Obtaining and Installing BIND
      3. Preparing to Run BIND (or, Furnishing the Cell) (1/2)
      4. Preparing to Run BIND (or, Furnishing the Cell) (2/2)
        1. Provisioning a chroot jail for BIND v8
        2. Provisioning a chroot jail for BIND v9
        3. Invoking named
      5. Securing named.conf (1/2)
      6. Securing named.conf (2/2)
        1. acl{} sections
        2. Global options: The options{} section
        3. Logging
        4. zone{} sections
        5. Split DNS and BIND v9
      7. Zone File Security
      8. Advanced BIND Security: TSIGS and DNSSEC
        1. Transaction Signatures (TSIGs)
        2. Additional uses for TSIGs
      9. Sources of BIND (and IS Security) Information
    5. djbdns
      1. What Is djbdns?
        1. Why not BIND?
      2. Choosing djbdns Services
      3. How djbdns Works
      4. Installing djbdns
        1. Installing the service manager: daemontools
        2. Installing djbdns itself
        3. Installing an internal cache: dnscache
        4. Installing an “external” cache: dnscachex
        5. Installing an “external” forwarding cache
        6. Split horizon
        7. Installing a DNS server: tinydns
      5. Running tinydns
        1. Helper applications
        2. The tinydns-data format
        3. tinydns-data reference
      6. Running djbdns client programs
      7. Coexisting with BIND
        1. Installing ucspi-tcp
        2. Running axfr-get
        3. Installing axfrdns
        4. Running axfrdns
      8. Encrypting Zone Transfers with rsync and ssh
      9. Migrating from BIND
    6. Resources
      1. General DNS Security Resources
        1. Some DNS-related RFCs (available at http://www.rfc-editor.org)
        2. Some DNS/BIND security advisories (available at http://www.cert.org)
      2. BIND Resources
      3. djbdns Resources
  9. Using LDAP for Authentication
    1. LDAP Basics
      1. Directory-Services Protocols
      2. Hierarchies and Naming Conventions
    2. Setting Up the Server
      1. Getting and Installing OpenLDAP
      2. Configuring and Starting slapd
      3. TLS for Secure LDAP Transactions
      4. slapd Startup Options for TLS
      5. Testing
      6. LDAP Schema
      7. Creating Your First LDAP Record
    3. LDAP Database Management
      1. Database Structure
        1. Schema and user records
      2. Building and Adding Records
      3. Creating Passwords
      4. Access Controls
    4. Conclusions
    5. Resources
  10. Database Security
    1. Types of Security Problems
    2. Server Location
      1. Secure Remote Administration
        1. VPN to the server
        2. ssh to the server
        3. Tunneling a local port to the server
        4. Using the Web
    3. Server Installation
      1. Choosing a Version
      2. Installing and Configuring the Server and Clients
      3. Files
      4. Setting the MySQL root User Password
      5. Deleting Anonymous Users and Test Databases
      6. Creating MySQL User Accounts and Privileges
      7. Checking Your Server
      8. The MySQL Configuration File
    4. Database Operation
      1. MySQL Table Types
      2. Loading Datafiles
      3. Writing Data to Files
      4. Viewing Database Threads
      5. Killing Database Threads
      6. Stopping the Server
      7. Backups
      8. Logging
      9. Replication
      10. Queries
      11. SQL Injection
    5. Resources
  11. Securing Internet Email
    1. Background: MTA and SMTP Security
      1. Email Architecture: SMTP Gateways and DMZ Networks
      2. SMTP Security
      3. Unsolicited Commercial Email
      4. SMTP AUTH
    2. Using SMTP Commands to Troubleshoot and Test SMTP Servers
    3. Securing Your MTA
    4. Sendmail
      1. Sendmail Pros and Cons
      2. Sendmail Architecture
      3. Obtaining and Installing Sendmail
        1. Sendmail on SUSE
        2. Red Hat Sendmail preparation
        3. Debian Sendmail preparation
      4. Configuring Sendmail: Overview
      5. Configuring sendmail.mc
        1. Some sendmail.mc m4 variable definitions
      6. Configuring Sendmail to Run Semichrooted
        1. Feature directives and databases
        2. Masquerading
        3. Applying your new configuration
      7. Configuring Sendmail’s Maps and Other Files
        1. local-host-names
        2. Configuring the mailertable
        3. Configuring the access database
        4. Configuring virtusers
        5. Defining aliases
      8. Sendmail and SMTP AUTH (1/2)
      9. Sendmail and SMTP AUTH (2/2)
        1. Versions of Sendmail that support SMTP AUTH
        2. Obtaining Cyrus SASL
        3. Configuring SASL for server-server authentication
        4. Configuring SASL for client-server authentication
        5. Configuring Sendmail for server-server authentication
        6. Configuring Sendmail for client-server authentication
      10. Sendmail and STARTTLS
        1. Sendmail support for STARTTLS
        2. Getting keys and certificates
        3. Configuring Sendmail to use TLS
    5. Postfix
      1. Postfix Architecture
      2. Getting and Installing Postfix
      3. Postfix for the Lazy: A Quick-Start Procedure
      4. Configuring Postfix
      5. Hiding Internal Email Addresses by Masquerading
      6. Running Postfix in a chroot Jail
      7. Postfix Aliases, Revealed
      8. Keeping Out Unsolicited Commercial Email (UCE)
    6. Mail Delivery Agents
      1. Principles of MDA Security
      2. Which IMAP Server?
        1. Getting and installing Cyrus IMAP
      3. Configuring SASL
        1. Configuring SASL to use LDAP directly
        2. Configuring SASL to use LDAP via PAM
        3. Configuring Cyrus IMAP
      4. Using cyradm to Administer Cyrus IMAP
        1. Creating mailboxes with cyradm
      5. Cyrus IMAP ACLs (and Deleting Mailboxes)
        1. Configuring Postfix to deliver mail to Cyrus IMAP
        2. Next steps
    7. A Brief Introduction to Email Encryption
      1. PGP and GnuPG
      2. S/MIME
      3. Which Should You Use?
    8. Resources
      1. SMTP Information
      2. Sendmail Information
      3. Postfix Information
      4. IMAP Information
  12. Securing Web Servers
    1. Web Security
      1. What, When, and Where to Secure
      2. Some Principles
    2. The Web Server
      1. Build Time: Installing Apache (1/2)
      2. Build Time: Installing Apache (2/2)
        1. Setting up your firewall
        2. Checking your Apache version
        3. Installation methods
        4. Linking methods
        5. Securing Apache’s file hierarchy
        6. Logging
      3. Setup Time: Configuring Apache
        1. Apache configuration files
        2. Configuration options
      4. Robots and Spiders
    3. Web Content
      1. Static Content
      2. Dynamic Content: Server-Side Includes (SSI)
        1. SSI configuration
        2. Including files
        3. Executing commands
      3. Dynamic Content: Common Gateway Interface (CGI) (1/2)
      4. Dynamic Content: Common Gateway Interface (CGI) (2/2)
        1. Standalone and built-in CGI interpreters
        2. suEXEC
        3. Cgiwrap
        4. FastCGI
        5. Specifying CGI programs
        6. HTTP, URLs, and CGI
        7. CGI languages
    4. Web Applications
      1. Processing Forms
        1. PHP
        2. Perl
      2. Including Files
        1. PHP
        2. Perl
      3. Executing Programs
        1. PHP
        2. Perl
      4. Uploading Files from Forms
        1. PHP
        2. Perl
      5. Accessing Databases
        1. PHP
        2. Perl
      6. Authentication
        1. Basic authentication
        2. Digest authentication
        3. Safer authentication
      7. Access Control and Authorization
        1. Host-based access control
        2. Environment-variable access control
        3. User-based access control
        4. Combined access control
      8. SSL
      9. Sessions and Cookies
        1. PHP
        2. Perl
      10. Site Management: Uploading Files
        1. Not-so-good ideas
        2. Better ideas: ssh, scp, sftp, rsync
        3. DAV
      11. XML, Web Services, and REST
      12. Detecting and Deflecting Attackers
      13. Caches, Proxies, and Load Balancers
    5. Layers of Defense
    6. Resources
  13. Securing File Services
    1. FTP Security
      1. Principles of FTP Security (1/2)
      2. Principles of FTP Security (2/2)
        1. Active mode versus passive mode FTP
        2. The case against nonanonymous FTP
        3. Tips for securing anonymous FTP
      3. Using ProFTPD for Anonymous FTP (1/3)
      4. Using ProFTPD for Anonymous FTP (2/3)
      5. Using ProFTPD for Anonymous FTP (3/3)
        1. Getting ProFTPD
        2. ProFTPD modules
        3. Setting up the anonymous FTP account and its chroot jail
        4. General ProFTPD configuration
        5. Base-server and global settings
        6. Anonymous FTP setup
        7. Virtual-server setup
      6. Using vsftpd for Anonymous FTP (1/2)
      7. Using vsftpd for Anonymous FTP (2/2)
        1. Getting and installing vsftpd
        2. vsftpd’s documentation
        3. Standalone daemon versus inetd/xinetd
        4. Configuring vsftpd for anonymous FTP
        5. Virtual servers
    2. Other File-Sharing Methods
      1. SFTP and scp
      2. rsync (1/3)
      3. rsync (2/3)
      4. rsync (3/3)
        1. Getting, compiling, and installing rsync
        2. Running rsync over SSH
        3. Setting up an rsync server
        4. Using rsync to connect to an rsync server
        5. Tunneling rsync with Stunnel
    3. Resources
  14. System Log Management and Monitoring
    1. syslog
      1. Configuring syslog (1/2)
      2. Configuring syslog (2/2)
        1. Facilities
        2. Priorities
        3. Actions
        4. More sophisticated selectors
        5. Running syslogd
    2. Syslog-ng
      1. Installing Syslog-ng from Binary Packages
        1. Replacing syslogd with Syslog-ng on SUSE
        2. Replacing syslogd with Syslog-ng on Fedora (Vidal’s RPMs)
      2. Compiling and Installing Syslog-ng from Source Code
      3. Setting Syslog-ng’s Startup Parameters
        1. Building a chroot jail for Syslog-ng
        2. Where to specify Syslog-ng’s startup parameters
      4. Configuring Syslog-ng (1/3)
      5. Configuring Syslog-ng (2/3)
      6. Configuring Syslog-ng (3/3)
        1. Global options
        2. Sources
        3. Destinations
        4. Filters
        5. Log statements
      7. Advanced Configurations
    3. Testing System Logging with logger
    4. Managing System Logfiles with logrotate
      1. Running logrotate
        1. Syntax of logrotate.conf and its included scripts
        2. Running logrotate
    5. Using Swatch for Automated Log Monitoring
      1. Installing Swatch
      2. Swatch Configuration in Brief
      3. Advanced Swatch Configuration
      4. Running Swatch
      5. Fine-Tuning Swatch
      6. Why You Shouldn’t Configure Swatch Once and Forget About It
    6. Some Simple Log-Reporting Tools
    7. Resources
  15. Simple Intrusion Detection Techniques
    1. Principles of Intrusion Detection Systems
      1. Host-Based IDSes: Integrity Checkers
      2. NIDS: Scanning for Signatures Versus Anomalies
        1. Signature-based systems
        2. Anomaly-detection systems
    2. Using Tripwire
      1. Obtaining, Compiling, and Installing Tripwire
        1. Building from official source
        2. Building from patched source
        3. Installing
      2. Configuring Tripwire (1/2)
      3. Configuring Tripwire (2/2)
        1. Managing the configuration file
        2. Editing or creating a policy
        3. Policy file structure and syntax
        4. Property masks
        5. Installing the policy file
      4. Running Tripwire Checks and Updates
        1. Updating Tripwire’s database after violations or system changes
      5. Changing Tripwire’s Policy
    3. Other Integrity Checkers
    4. Snort
      1. Obtaining, Compiling, and Installing Snort
        1. Getting Snort source code and binaries
        2. Installing Snort RPMs
        3. Compiling and installing Snort from source
        4. Making Snort feel at home after compiling and installing it
        5. Creating a database for Snort
      2. Using Snort as a Packet Sniffer
      3. Using Snort as a Packet Logger
      4. Configuring and Using Snort as an IDS (1/2)
      5. Configuring and Using Snort as an IDS (2/2)
        1. Variable definitions
        2. Preprocessor plug-in statements
        3. Output (postprocessor) plug-in statements
        4. Rules
        5. Starting snort in IDS mode
        6. Testing Snort and watching its logs
        7. Snort analyzers
        8. Updating Snort’s rules automatically
    5. Resources
  16. Two Complete iptables Startup Scripts (1/3)
  17. Two Complete iptables Startup Scripts (2/3)
  18. Two Complete iptables Startup Scripts (3/3)
  19. Index (1/5)
  20. Index (2/5)
  21. Index (3/5)
  22. Index (4/5)
  23. Index (5/5)

Product information

  • Title: Linux Server Security, Second Edition
  • Author(s): Michael D. Bauer
  • Release date: January 2005
  • Publisher(s): O'Reilly Media, Inc.
  • ISBN: 9780596006709