Building Secure Servers With Linux

by Bauer, Michael D.

• ISBN13: 9780596002176
• ISBN10: 0596002173
• Format: Paperback
• Copyright: 2002-10-01
• Publisher: Oreilly & Associates Inc

Summary

Linux consistently turns up high in the list of popular Internet servers, whether it's for the Web, anonymous FTP, or general services like DNS and routing mail. But security is uppermost on the mind of anyone providing such a service. Any server experiences casual probe attempts dozens of time a day, and serious break-in attempts with some frequency as well. As the cost of broadband and other high-speed Internet connectivity has gone down, and its availability has increased, more Linux users are providing or considering providing Internet services such as HTTP, Anonymous FTP, etc., to the world at large. At the same time, some important, powerful, and popular Open Source tools have emerged and rapidly matured--some of which rival expensive commercial equivalents--making Linux a particularly appropriate platform for providing secure Internet services. Building Secure Servers with Linuxwill help you master the principles of reliable system and network security by combining practical advice with a firm knowledge of the technical tools needed to ensure security. The book focuses on the most common use of Linux--as a hub offering services to an organization or the larger Internet--and shows readers how to harden their hosts against attacks. Author Mick Bauer, a security consultant, network architect, and lead author of the popular Paranoid Penguin column in Linux Journal, carefully outlines the security risks, defines precautions that can minimize those risks, and offers recipes for robust security. The book does not cover firewalls, but covers the more common situation where an organization protects its hub using other systems as firewalls, often proprietary firewalls. The book includes: Precise directions for securing common services, including the Web, mail, DNS, and file transfer. Ancillary tasks, such as hardening Linux, using SSH and certificates for tunneling, and using iptables for firewalling. Basic installation of intrusion detection tools. Writing for Linux users with little security expertise, the author explains security concepts and techniques in clear language, beginning with the fundamentals. Building Secure Servers with Linuxprovides a unique balance of "big picture" principles that transcend specific software packages and version numbers, and very clear procedures on securing some of those software packages. An all-inclusive resource for Linux users who wish to harden their systems, the book covers general security as well as key services such as DNS, the Apache Web server, mail, file transfer, and secure shell. With this book in hand, you'll have everything you need to ensure robust security of your Linux system.

Table of Contents

Preface	ix
Threat Modeling and Risk Management	1	(19)
Components of Risk	2	(9)
Simple Risk Analysis: ALEs	11	(4)
An Alternative: Attack Trees	15	(3)
Defenses	18	(1)
Conclusion	19	(1)
Resources	19	(1)
Designing Perimeter Networks	20	(20)
Some Terminology	21	(2)
Types of Firewall and DMZ Architectures	23	(4)
Deciding What Should Reside on the DMZ	27	(2)
Allocating Resources in the DMZ	29	(1)
The Firewall	29	(11)
Hardening Linux	40	(62)
OS Hardening Principles	41	(56)
Automated Hardening with Bastille Linux	97	(5)
Secure Remote Administration	102	(30)
Why It's Time to Retire Clear-Text Admin Tools	102	(1)
Secure Shell Background and Basic Use	103	(11)
Intermediate and Advanced SSH	114	(14)
Other Handy Tools	128	(4)
Tunneling	132	(22)
Stunnel and OpenSSL: Concepts	132	(22)
Securing Domain Name Services (DNS)	154	(44)
DNS Basics	154	(2)
DNS Security Principles	156	(1)
Selecting a DNS Software Package	157	(2)
Securing BIND	159	(21)
djbdns	180	(16)
Resources	196	(2)
Securing Internet Email	198	(43)
Background: MTA and SMTP Security	198	(4)
Using SMTP Commands to Troubleshoot and Test SMTP Servers	202	(1)
Securing Your MTA	203	(1)
Sendmail	204	(27)
Postfix	231	(8)
Resources	239	(2)
Securing Web Services	241	(46)
Web Server Security	241	(2)
Build Time: Installing Apache	243	(6)
Setup Time: Configuring Apache	249	(8)
Runtime: Securing CGI Scripts	257	(16)
Special Topics	273	(12)
Other Servers and Web Security	285	(2)
Securing File Services	287	(36)
FTP Security	287	(22)
Other File-Sharing Methods	309	(12)
Resources	321	(2)
System Log Management and Monitoring	323	(39)
Syslog	323	(10)
Syslog-ng	333	(15)
Testing System Logging with logger	348	(1)
Managing System-Log Files	349	(4)
Using Swatch for Automated Log Monitoring	353	(8)
Resources	361	(1)
Simple Intrusion Detection Techniques	362	(37)
Principles of Intrusion Detection Systems	362	(4)
Using Tripwire	366	(15)
Other Integrity Checkers	381	(2)
Snort	383	(13)
Resources	396	(3)
Appendix: Two Complete Iptables Startup Scripts	399	(12)
Index	411