Mastering FreeBSD and OpenBSD Security: Building, Securing, and Maintaining BSD Systems

by Yanek Korff, Paco Hope, Bruce Potter

Overview

FreeBSD and OpenBSD are increasingly gaining traction in educational institutions, non-profits, and corporations worldwide because they provide significant security advantages over Linux. Although a lot can be said for the robustness, clean organization, and stability of the BSD operating systems, security is one of the main reasons system administrators use these two platforms.There are plenty of books to help you get a FreeBSD or OpenBSD system off the ground, and all of them touch on security to some extent, usually dedicating a chapter to the subject. But, as security is commonly named as the key concern for today's system administrators, a single chapter on the subject can't provide the depth of information you need to keep your systems secure.FreeBSD and OpenBSD are rife with security "building blocks" that you can put to use, and Mastering FreeBSD and OpenBSD Security shows you how. Both operating systems have kernel options and filesystem features that go well beyond traditional Unix permissions and controls. This power and flexibility is valuable, but the colossal range of possibilities need to be tackled one step at a time. This book walks you through the installation of a hardened operating system, the installation and configuration of critical services, and ongoing maintenance of your FreeBSD and OpenBSD systems.Using an application-specific approach that builds on your existing knowledge, the book provides sound technical information on FreeBSD and Open-BSD security with plenty of real-world examples to help you configure and deploy a secure system. By imparting a solid technical foundation as well as practical know-how, it enables administrators to push their server's security to the next level. Even administrators in other environments--like Linux and Solaris--can find useful paradigms to emulate.Written by security professionals with two decades of operating system experience, Mastering FreeBSD and OpenBSD Security features broad and deep explanations of how how to secure your most critical systems. Where other books on BSD systems help you achieve functionality, this book will help you more thoroughly secure your deployments.

Product Details

ISBN-13:	9781449369576
Publisher:	O'Reilly Media, Incorporated
Publication date:	03/24/2005
Sold by:	Barnes & Noble
Format:	eBook
Pages:	466
File size:	2 MB

About the Author

Yanek Korff graduated with a Bachelor's degree in Computer Science from the College of William and Mary and is currently a Certified Information Systems Security Professional (CISSP). Mr. Korff joined Bell Atlantic as a Systems Engineer where he played a major role in the strategy, design, and deployment of a key Northern Virginia test facility. He later joined Cigital, Inc., a software quality management company, where he played a central role in the design of their systems infrastructure. He is now an essential member of the Information Security division at America Online. During his career, Mr. Korff has been able to identify and mitigate information security risks particularly relating to host-based BSD security. By leveraging his experience, he has been able to apply security fundamentals to influence business and industry practices.

Paco Hope is a Technical Manager with Cigital. His areas of expertise software security, security testing, and casino gaming. He specializes in analyzing the security of software, software systems, and software development processes. Paco frequently speaks at conferences such as the Better Software Conference, STAR East, and STAR West. He conducts training on risk-based security testing, writing security requirements, and software security fundamentals. He can be reached at [e-mail].

Bruce Potter is a Senior Associate at Booz Allen Hamilton. Prior to working at Booz Allen Hamilton, Bruce served as a software security consultant for Cigital in Dulles, VA. Bruce is the founder of the Shmoo Group of security professionals. His areas of expertise include wireless security, large-scale network architectures, smartcards, and promotion of secure software engineering practices. Bruce coauthored the books 802.11 Security and Mac OS X Security. He was trained in computer science at the University of Alaska, Fairbanks.

Table of Contents

	Preface	vii
Part I	Security Foundation
1	The Big Picture	3
	What Is System Security?	4
	Identifying Risks	6
	Responding to Risk	19
	Security Process and Principles	23
	System Security Principles	26
	Wrapping Up	30
	Resources	31
2	BSD Security Building Blocks	32
	Filesystem Protections	33
	Tweaking a Running Kernel: sysctl	44
	The Basic Sandbox: chroot	53
	Jail: Beyond chroot	60
	Inherent Protections	67
	OS Tuning	70
	Wrapping Up	73
	Resources	73
3	Secure Installation and Hardening	74
	General Concerns	75
	Installing FreeBSD	87
	FreeBSD Hardening: Your First Steps	93
	Installing OpenBSD	100
	OpenBSD Hardening: Your First Steps	103
	Post-Upgrade Hardening	107
	Wrapping Up	116
	Resources	116
4	Secure Administration Techniques	117
	Access Control	118
	Security in Everyday Tasks	129
	Upgrading	141
	Security Vulnerability Response	144
	Network Service Security	149
	Monitoring System Health	163
	Wrapping Up	168
	Resources	168
Part II	Deployment Situations
5	Creating a Secure DNS Server	173
	The Criticality of DNS	174
	DNS Software	183
	Installing BIND	189
	Installing djbdns	190
	Operating BIND	193
	Operating djbdns	201
	Wrapping Up	205
	Resources	205
6	Building Secure Mail Servers	207
	Mail Server Attacks	208
	Mail Architecture	211
	Mail and DNS	216
	SMTP	218
	Mail Server Configurations	223
	Sendmail	226
	Postfix	241
	qmail	255
	Mail Access	255
	Wrapping Up	258
	Resources	258
7	Building a Secure Web Server	260
	Web Server Attacks	261
	Web Architecture	265
	Apache	267
	thttpd	292
	Advanced Web Servers with Jails	295
	Wrapping Up	302
	Resources	303
8	Firewalls	305
	Firewall Architectures	305
	Host Lockdown	314
	The Options: IPFW Versus PF	314
	Basic IPFW Configuration	316
	Basic PF Configuration	325
	Handling Failure	331
	Wrapping Up	334
	Resources	335
9	Intrusion Detection	336
	No Magic Bullets	336
	IDS Architectures	338
	NIDS on BSD	345
	Snort	346
	ACID	353
	HIDS on BSD	354
	Wrapping Up	360
	Resources	360
Part III	Auditing and Incident Response
10	Managing the Audit Trails	363
	System Logging	364
	Logging via syslogd	365
	Securing a Loghost	378
	logfile Management	381
	Automated Log Monitoring	386
	Automated Auditing Scripts	392
	Wrapping Up	394
	Resources	394
11	Incident Response and Forensics	396
	Incident Response	396
	Forensics on BSD	402
	Digging Deeper with the Sleuth Kit	408
	Wrapping Up	412
	Resources	413
	Index	415