Linux Server Security

Is Linux inherently more secure than other server software? Most Linux system administrators think so. More than 75% of them have never experienced an unwanted intrusion, and 94% have operated virus-free. But now that Linux is moving into the mainstream, that story might change. That's why this concise but comprehensive guide to providing the best possible security for Linux servers is so timely. Packed with examples and contextual background to help administrators, developers and other Linux users understand the complex issues involved, Linux Server Security covers both background theory and practical step-by-step instructions for hardening a server that runs Linux, including firewalling, DNS, mail, Apache, remote administration and other common services. This new edition also has coverage of LDAP, MySQL, POstgreSQL, and Mail Delivery Agents. For those with servers running Linux, this is an essential title.

Michael D. (Mick) Bauer, CISSP, is Network Security Architect for a large financial services provider. He is also Security Editor for Linux Journal Magazine, and author of its monthly "Paranoid Penguin" security column. Mick's areas of expertise include Linux security and general Unix security, network (TCP/IP) security, security assessment, and the development of security policies and awareness programs.

Preface

ix

1. Threat Modeling and Risk Management

1

(20)

Components of Risk

2

(9)

Simple Risk Analysis: ALEs

11

(4)

An Alternative: Attack Trees

15

(3)

Defenses

18

(2)

Conclusion

20

(1)

Resources

20

(1)

2. Designing Perimeter Networks

21

(22)

Some Terminology

22

(2)

Types of Firewall and DMZ Architectures

24

(5)

Deciding What Should Reside on the DMZ

29

(1)

Allocating Resources in the DMZ

30

(2)

The Firewall

32

(11)

3. Hardening Linux and Using iptables

43

(74)

OS Hardening Principles

44

(67)

Automated Hardening with Bastille Linux

111

(6)

4. Secure Remote Administration

117

(26)

Why It's Time to Retire Cleartext Admin Tools

117

(1)

Secure Shell Background and Basic Use

118

(10)

Intermediate and Advanced SSH

128

(15)

5. OpenSSL and Stunnel

143

(25)

Stunnel and OpenSSL: Concepts

143

(25)

6. Securing Domain Name Services (DNS)

168

(47)

DNS Basics

168

(2)

DNS Security Principles

170

(2)

Selecting a DNS Software Package

172

(1)

Securing BIND

173

(21)

djbdns

194

(18)

Resources

212

(3)

7. Using LDAP for Authentication

215

(22)

LDAP Basics

215

(5)

Setting Up the Server

220

(9)

LDAP Database Management

229

(6)

Conclusions

235

(1)

Resources

235

(2)

8. Database Security

237

(14)

Types of Security Problems

238

(1)

Server Location

238

(3)

Server Installation

241

(5)

Database Operation

246

(4)

Resources

250

(1)

9. Securing Internet Email

251

(63)

Background: MTA and SMTP Security

252

(3)

Using SMTP Commands to Troubleshoot and Test SMTP Servers

255

(2)

Securing Your MTA

257

(1)

Sendmail

257

(28)

Postfix

285

(8)

Mail Delivery Agents

293

(15)

A Brief Introduction to Email Encryption

308

(3)

Resources

311

(3)

10. Securing Web Servers

314

(47)

Web Security

314

(2)

The Web Server

316

(11)

Web Content

327

(10)

Web Applications

337

(22)

Layers of Defense

359

(1)

Resources

359

(2)

11. Securing File Services

361

(45)

FTP Security

361

(31)

Other File-Sharing Methods

392

(13)

Resources

405

(1)

12. System Log Management and Monitoring

406

(44)

syslog

406

(11)

Syslog-ng

417

(18)

Testing System Logging with logger

435

(1)

Managing System Logfiles with logrotate

436

(3)

Using Swatch for Automated Log Monitoring

439

(9)

Some Simple Log-Reporting Tools

448

(1)

Resources

449

(1)

13. Simple Intrusion Detection Techniques

450

(36)

Principles of Intrusion Detection Systems

451

(3)

Using Tripwire

454

(15)

Other Integrity Checkers

469

(3)

Snort

472

(14)

Resources

486

(3)

Appendix: Two Complete iptables Startup Scripts

489

(12)

Index

501

What is included with this book?

The New copy of this book will include any supplemental materials advertised. Please check the title of the book to determine if it should include any access cards, study guides, lab manuals, CDs, etc.

The Used, Rental and eBook copies of this book are not guaranteed to include any supplemental materials. Typically, only the book itself is included. This is true even if the title states it includes any access cards, study guides, lab manuals, CDs, etc.

FREE SHIPPING

Amazon no longer offers textbook rentals. We do!

Linux Server Security

Summary

Author Biography

Table of Contents

Supplemental Materials