Practical UNIX and Internet Security: Securing Solaris, Mac OS X, Linux & Free BSD

by Simson Garfinkel, Gene Spafford, Alan Schwartz

Overview

When Practical Unix Security was first published more than a decade ago, it became an instant classic. Crammed with information about host security, it saved many a Unix system administrator from disaster. The second edition added much-needed Internet security coverage and doubled the size of the original volume. The third edition is a comprehensive update of this very popular book - a companion for the Unix/Linux system administrator who needs to secure his or her organization's system, networks, and web presence in an increasingly hostile world.Focusing on the four most popular Unix variants today--Solaris, Mac OS X, Linux, and FreeBSD--this book contains new information on PAM (Pluggable Authentication Modules), LDAP, SMB/Samba, anti-theft technologies, embedded systems, wireless and laptop issues, forensics, intrusion detection, chroot jails, telephone scanners and firewalls, virtual and cryptographic filesystems, WebNFS, kernel security levels, outsourcing, legal issues, new Internet protocols and cryptographic algorithms, and much more.Practical Unix & Internet Security consists of six parts:

• Computer security basics: introduction to security problems and solutions, Unix history and lineage, and the importance of security policies as a basic element of system security.
• Security building blocks: fundamentals of Unix passwords, users, groups, the Unix filesystem, cryptography, physical security, and personnel security.
• Network security: a detailed look at modem and dialup security, TCP/IP, securing individual network services, Sun's RPC, various host and network authentication systems (e.g., NIS, NIS+, and Kerberos), NFS and other filesystems, and the importance of secure programming.
• Secure operations: keeping up to date in today's changing security world, backups, defending against attacks, performing integrity management, and auditing.
• Handling security incidents: discovering a break-in, dealing with programmed threats and denial of service attacks, and legal aspects of computer security.
• Appendixes: a comprehensive security checklist and a detailed bibliography of paper and electronic references for further reading and research.

Packed with 1000 pages of helpful text, scripts, checklists, tips, and warnings, this third edition remains the definitive reference for Unix administrators and anyone who cares about protecting their systems and data from today's threats.

Product Details

ISBN-13:	9781449310127
Publisher:	O'Reilly Media, Incorporated
Publication date:	02/21/2003
Sold by:	Barnes & Noble
Format:	eBook
Pages:	988
File size:	7 MB

About the Author

Simson L. Garfinkel is a freelance writer, computer entrepreneur, and columnist for the Boston Globe. His articles have appeared in more than fifty publications, including ComputerWorld, Forbes, the New York Times, and Technology Review.

Read an Excerpt

Chapter 6: What Is Encryption?

Code Making and Code Breaking

As long as there have been code makers, there have been code breakers. And the two have been locked in a competition for centuries, with each advance one side being matched by counter- advances on the other.

For people who use codes, the code-breaking efforts of cryptanalysts pose danger that is potentially larger than the danger of not using cryptography in first place. Without cryptography, you might be reluctant to send sensitive i mation through the mail, across a telex, or by radio. But if you think that have a secure channel of communication, then you might use it to transmit sec that should not be widely revealed.

For this reason, cryptographers and organizations that use cryptography routinely conduct their own code-breaking efforts to make sure that their codes are resistant to attack. The findings of these self-inflicted intrusions are not always pleasant. The following brief story from a 1943 book on cryptography demonstrates this point quite nicely:

[The importance of the part played by cryptographers in military operations was demonstrated to us realistically in the First World War. One instructive incident occurred in September 1918, on the eve of the great offensive against Saint-Mihiel. A student cryptographer, fresh from Washington, arrived at United States Headquarters at the front. Promptly he threw the General Staff into a state of alarm by decrypting with comparative ease a secret radio message intercepted in the American sector.

The smashing of the German salient at Saint-Mihiel was one of the most gigantic tasks undertaken by the American forces during the war. For years that salient had stabbed into the Allied lines, cutting important railways and communication lines. Its lines of defense were thought to be virtually impregnable. But for several months the Americans had been making secret preparations for attacking it and wiping it out. The state was set, the minutest details of strategy had been determined-when the young officer of the United States Military Intelligence spread consternation through our General Staff.

The dismay at Headquarters was not caused by any new information about the strength of the enemy forces, but by the realization that the Germans must know as much about our secret plans as we did ourselves-even the exact hour set for the attack. The 'intercepted' message had been from our own base. German cryptographers were as expert as any in the world, and what had been done by an American student cryptographer could surely have been done by German specialists.

The revelation was even more bitter because the cipher the young officer had broken, without any knowledge of the system, was considered absolutely safe and had long been used for most important and secret communications.*

Cryptograpby and Digital Computers

Modem digital computers are, in some senses, the creations of cryptography. Some of the first digital computers were built by the Allies to break messages that had been encrypted by the Germans with electromechanical encrypting machines. Code breaking is usually a much harder problem than code making; after the Germans switched codes, the Allies often took several months to discover the new coding systems. Nevertheless, the codes were broken, and many historians say that World War II was shortened by at least a year as a result.

Things really picked up when computers were turned to the task of code making. Before computers, all of cryptography was limited to two basic techniques: transposition, or rearranging the order of letters in a message (such as the Spartan's scythe), and substitution, or replacing one letter with another one. The most sophisticated pre- computer cipher used five or six transposition or substitution operations, but rarely more.

With the coming of computers, ciphers could be built from dozens, hundreds, or thousands of complex operations, and yet could still encrypt and decrypt messages in a short amount of time. Computers have also opened up the possibility of using complex algebraic operations to encrypt messages. All of these advantages have had a profound impact on cryptography.

Modern Controversy

In recent years, encryption has gone from being an arcane science and the stuff of James Bond movies, to being the subject of debate in several nations (but we'll focus on the case in the U.S. in the next few paragraphs). In the U.S. that debate is playing itself out on the front pages of newspapers such as The New York Times and the San Jose Mercury News.

* Smith, Laurence Dwight. cryptography. The Science of Secret Writing. Dover Publications, New York, 1941.

On one side of the debate are a large number of computer professionals, civil libertarians, and perhaps a majority of the American public, who are rightly concerned about their privacy and the secrecy of their communications. These people want the right and the ability to protect their data with the most powerful encryption systems possible.

On the other side of the debate are the United States Government, members of the nation's law enforcement and intelligence communities, and (apparently) a small number of computer professionals, who argue that the use of cryptography should be limited because it can be used to hide illegal activities from authorized wiretaps and electronic searches.

MIT Professor Ronald Rivest has observed that the controversy over cryptography fundamentally boils down to one question:

Should the citizens of a country have the right to create and store documents which their government cannot read?*

This chapter does not address this question. Nor do we attempt to explore the U.S. Government's claimed need to eavesdrop on communications, the fear that civil rights activists have of governmental abuse, or other encryption policy issues. Although those are interesting and important question--questions you should also be concerned with as a computer user--they are beyond the scope of this book. Instead, we focus on discussion of the types of encryption that are available to most UNIX users today and those that are likely to be available in the near future. If you are interested in the broader questions of who should have access to encryption, we suggest that you pursue some of the references listed in Appendix D, Paper Sources, starting with Building in Big Brother, edited by Professor Lance Hoffman.

What Is Encryption?

Encryption is a process by which a message (called plaintext) is transformed into another message (called ciphertext) using a mathematical function* and a special encryption password, called the key.

Decryption is the reverse process: the ciphertext is transformed back into the original plaintext using a mathematical function and a key. The process of encryption and decryption is shown in basic terms in Figure 6-1. Here is a simple piece of plaintext:

Encryption can make UNIX more secure. ...

Rivest, Ronald, speaking before the MIT Telecommunications Forum, Spring 1994. * Or any other government! * Although it may not be expressed as such in every case....

Table of Contents

Preface to the Second Edition
1. Introduction
2. Policies & Guidelines
3. Users and Passwords
4. Users, Groups, and the Superuser
5. The UNIX Filesystem
6. Cryptography
7. Backups
8. Defending Your Accounts
9. Integrity Management
10. Auditing and Logging
11. Protecting Against Programmed Threats
12. Physical Security
13. Personnel Security
14. Modems
15. UUCP 438
16. TCP/IP Networks
17. UNIX TCP/IP Services
18. WWW Security
19. RPC and Configuration Management
20. NFS
21. Firewalls
22. Wrappers & Proxies
23. Writing Secure SUID and Network Programs
24. Discovering a Break-in
25. Denial of Service Attacks and Solutions
26. Computer Security and U.S. Law
27. Who Do You Trust?
APPENDICES.
A. UNIX Security Checklist
B. Important Files
C. UNIX Processes
D. Paper Sources
E. Electronic Resources
F. Other Sources

Editorial Reviews

Fatbrain Review

Practical UNIX Security's exhaustive information on host security made the publication an instant classic revered by many a UNIX system administrator, and now the 1991 book has been completely rewritten with even more practical information for UNIX users. Garfinkel and Spafford start with an explanation of the features of many types of UNIX systems, including SunOS, Solaris, BSDI, AIX, HP-UX, Digital UNIX, Linux and others and move on to a thorough examination of system vulnerabilities and what the administrator can do to ward off threats to host and network security. Programmers shaky in their UNIX catechism can rest easy -- this book doesn't require advanced background knowledge of the UNIX system and almost anyone can follow Garfinkel and Spafford's practical tips and make their system as secure as it can be. Don't be caught off-guard -- get Practical UNIX & Internet Security and protect your system.