Slashdot Mirror
Practical Unix & Internet Security
Practical Unix & Internet Security is divided up into six sections:
The first section covers the basics of computer security, tracing the history of Unix and security, as well as providing details of what should be in a good security policy.
The second section covers the building blocks of security, authentication, users and groups, filesystems, cryptography, physical security for servers, and personnel security.
Network and Internet security are focused on in the third section, with emphasis on modems and dialup security, TCP/IP networks, securing TCP and UDP services, Sun RPC, NIS, Kerberos, LDAP, NFS, and SAMBA, and finishing up with a chapter dedicated to secure programming techniques.
Day-to-day operations are the focus of the fourth section. Keeping up to date, making backups, defending accounts, using integrity checking tools, and auditing, logging, and forensics are all expanded upon in detail over five chapters.
The fifth section rounds off the main part of the book by describing how to handle security incidents. Special focus is given to discovering a break-in, protecting against programmed threats, Denial of Service Attacks (& DDoS), legal options, and a chapter on who you can trust.
The Appendixes make up the sixth and final section. Not a spot is wasted in the appendixes, which begin with a Unix security checklist, and then outline Unix processes, provide extensive links to both paper and electronic resources, and conclude with a sub-section on security organizations.
Among the topics I found most interesting were: Access Control Lists (ACL), Pluggable Authentication Modules (PAM), the section about 128-bit keys and dictionary-based passwords, connection laundering, honeypots, the false syslog example, and the example detailing a call to Microsoft's anti-piracy help line. The real-life examples scattered throughout Practical Unix & Internet Security keep the security sections from seeming overwhelming. This is one of the few books that I've found ever chapter of the appendix useful, so don't overlook them as simple reference pages.
Normally one-liners are reserved for movie discussions but for those who've already delved into Practical Unix & Internet Security here are a few of my favorite one-liners:
- "...we do believe that making files readable and writable by everyone leads to many evil deeds." - talking about the octal mode 666.
- "Humidity is your computer's friend." - just before static discharge kills your entire system.
- "Beware of Key Employees." - warning against making one person so key that their departure could cause your company irreparable harm.
- "You mean, you don't really have a copy? [of Windows 98]" - the last part of a conversation with Microsoft's Anti-Piracy line. The company which called Microsoft's was tracing some intruders who had uploaded a copy of Windows 98 to the company's web site and was using the site to peddle warez. Microsoft was just about to launch Windows 98. The example shows just how clueless some help desks can be.
One of the great things about Practical Unix & Internet Security is that it is appropriate for a wide audience. There is relevant material for system administrators, security, company decision makers, even the guy sitting at the accounting terminal. Despite its massive size Practical Unix & Internet Security is entertaining enough to be read cover to cover. (It's good for the arm muscles too.) Though it is easy to read, beginners should probably reread their system manual before plunging headlong into this book. All in all Practical Unix & Internet Security continues to be one of those must-have books for any Linux user.
You can purchase Practical Unix & Internet Security from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.
happy fun
Is this a fp my friends? Empty fp !
How long do I have to wait for this?
Damn!
The companion book seems, uh, interesting too. :)
when talking about computer books is:
What does this book offer that I can't easily find by asking google or google groups?
lysergically yours
Does it really take this much to secure *nix?
BOO! TERRO
Thanks to froogle price check
one thing unix doesnt really have to worry about is viruses..
except when the virus has a brain and the users choose weak passwords
how come you never call me any more? we shared something special and now you just want to pretend like it never happened? i know you still remember all those nights where i pulled your body close to mine and we could feel eachother breathing in sync. i think we could be really good for each other if you could just give it a chance. please baby, don't turn your back on me.
signed,
a 350 lb black man serving life in prison
I think a few new books on Windows security will be coming out soon to take advantage of the latest worms. But its the nature of the open-source community to continually test each other that ultimately leads to security excellence.
-ad105
How does one glance quickly through a 1000-page book without straining something important? ;-D
better than the whoreabull BugWear(tm) hostage scam proffered up buy the felonious kingdumb of stock markup FraUDs.
.contracked. saves you billyons right away.
so it should be easIE for you billyonerror fudgeheads?
for won thing there's no sighned in bullood payper liesense
you'll see the light. no matter when?
Later on this thread, I'm going to post a popular joke that gets 5, funny, but modified slightly to get -1, troll. If it gets modded down, then it will be PROOF that slashdot needs a new moderation system.
But can we patch OpenServer(UnixWare) with it?
Had to ask since SCO can not seem to patch OpenServer
Don't Tread on OpenSource
Sendmail (a program) is not an alternative to UUCP (a protocol). Even if you are talking about the UUCP software and not the protocol, the alternative is pppd, not sendmail.
Sendmail still supports UUCP, but most distros do not enable that support, and hardly anyone uses UUCP anymore.
...I love their music :D
LOL
Practical Unix
Glaring omission from the article,
Besides UUCP, what else has changed from part 2 to part 3 of this series?
For more book reviews, especially on computer security, watch for Robert Slade's regular contributions to comp.risks. It doesn't look as though Robert has reviewed this one yet so I'll look forward to reading and comparing. His praise for a former edition seems uncharacteristically positive -- compare reviews of Secrets of a Super Hacker or Computer Security Basics -- so I'll be surprised if he doesn't praise this one, too...
cheers...ank
Still hoping for Gentle Treatment...
my newest requirement is to have the book in PDF format so I can simply search for keywords, saving time, and hassle. having the PDF on a few different computers and storing the book away after skimming through it works better than having thousands and thousands of pages take up my precious 500 sq ft. apartment
Amazon has it for $5.50 cheaper and with FREE shipping! Referral Link to the Item
what are you on about?
what about social engineering? or do they trust management and sysadmins to be socially mobile, compatible, and perceptive? i think humans are one of the weaker links in the security chain.
One of the great things about Practical Unix & Internet Security is that it is appropriate for a wide audience
I resemble that remark.
If you do what you always did, you get what you always got.
Because the uucp uid still owns all the serial port hardware. You need UUCP so that your modems will work, even though they are not running the UUCP protocol.
One MORE reason why HP-UX is the most GODAWFUL WORST *NIX on the FUCKING PLANET!
I know that many computer users do not ever look at computer security, they just plug it in and go. At the best, some of my friends will block ports, but that is about it. They do not check logs, or anything. And how many people out there have a second PC attached by serial cable to log intrusion data? I think if more people secured their systems, then everyones security would increase because there would be less places to launch attacks from. What we need is someone at the major distros to write a program which, when executed, will secure a system. Something which is point and click "easy".
Rosco: "If brains were gunpowder, Enos couldn't blow his nose."
With Slammer and Blaster making their way into the news it seemed like a good time to brush up on security.
You don't need a 1000 page book on security to patch your systems against worms; you need a 1 page book on common sense.
-----BEGIN GEEK CODE BLOCK----- Version: 3.12 GIT d? s: a-- C++++ UL++++ P++ L+++ E- W++ N o-- K- w--- O- M+ V PS+ P
Sheeesh!
No no no it's microsoft software that's octal mode is 666. Making things world writeable and readable would be 777.
Check out my life
Amazon: $5.50 cheaper and free shipping
Get a yellow sticky note that says RTFM, Newb! and move it to whatever page you're reading, obscuring the info you need. It may help to maintain your comfort level with the online *nix help experience. :)
Sample chapters of the book can be found here and here. I read this first one (the one on TCP/IP) and found that it was an excellent introducation to it. The other is on "secure programming techniques." Gotta read that.
Using thisduring my install of an OpenBSD firewall taught me a quite a bit.
This guy is way out there
I thought about audio books, but the sysadmins don't listen, either. <SIGH^2>
To the topic: All the manuals in the world, no matter how thorough & thoughtfully written, are of no use if the people who need to read them are busier worrying about their golf game. And the doubly sad thing, is that these guys "know it all" & therefore don't think they need any "practical" manuals.
"Obviously, I'm not an IBM computer any more than I'm an ashtray" (Bob Dylan)
I know a little OT but I just recently dusted off an old Windoze security book I had hanging around (when I was young and foolish). The funny thing was that when I opened it up I found that some real worms had been eating the pages....
From excellent karma to terible karma with a single +5 funny post...
Sounds practical, alright.
Now if I could only find a good off-shore haven...
The party of stupid and the party of evil get together and do something both stupid and evil, then call it bipartisan.
A full grown stallion's cock, when fully erect, will measure some two to
three feet long. It can be three to six inches thick at the base, to about
two inches thick at the head. Horses are somewhat different from other
animals in the way their cock head works. When a horse is fully erect and
excited and ready to mount, his cock head is somewhat pointed and not as
thick as might be normally observed. This is to facillatate an easier
entry into the mare. After the horse has entered and reaches a climax the
head swells (though it is more spongy then hard) into a fist sized mass as
he ejacultates. It is thought that this serves as a plug to force the
semen deep into the mare rather then allowing it to leak out. A full grown
stallion can ejaculate about one cup ( 8 ounces ) of semen. It will take
quite a few spurts to accomplish this. Each time his tail will raise and
lower in a brief flick. The first few jets are of a thin to average
consistency of cum. The final few jets are of a thick gelatinous
substance... it is thought that this serves to "seal" the mares pussy so
that the semen has time to do it's thing before leaking out. Horse semen
is extremely viscous, if you touch your finger to a pool of it you can draw
a thin string of it five to six feet long! Horse cum has a nice flat taste
to it...not at all bitter like man's cum. You can easily drink cups of it
with no discomfort.
The Mare - how to do it.
Mares can be quite satisfactory for the average well endowed male. If you
are somewhat less developed you might find better pleasure with a pony or
Miniature Horse. These are also better as they are lower to the ground. A
pony you can fuck standing up. A miniature horse on your knees or
squatting depending on the size. A mare will require something to stand on
or "platform shoes"...(IE mini stilts to raise you a foot off the ground)
so that you can reach her pussy.
Fucking any horse will depend on the horse. Some will be ready right
away...some will take coaxing. Pet the animal, talk to it softly, spend
time with it gaining it's trust. If something you are doing upsets it then
don't force it. Talk to it and calm it. If you work slowly you can make
an animal accept anything. It is just a question of helping it overcome
it's fears. All animals fear man if raised in the wild. How any animal
reacts will depend on it's own experiences. If you haved raised the animal
yourself in a loving enviroment, then you should have no problem
associating with it, if it is a strange animal that you have met in the
wild then you will have to go through an extended "courtship" to learn how
to respond to the beast.
MARES - TRAINING YOUR OWN
When the filly reaches weaning age, seperate her from her dam. If you have
limited time to spend then she should be put to pasture. If you have
plenty of time then you should keep her in a stall. Spend time with her
during the day petting and grooming her and allow her some time to run
free. Limit her access to other horses though and see that she spends at
least 8-12 hours a day in the stall. (Start with more free time and as she
approaches her first birthday confine her more...she is now at the right
age and her confinement will have made her so bored that she is amenable to
any new experience so long as it is not unpleasant)Young fillys have no
objection to someone playing with their pussy's. I have walked up on a pen
full of strange fillys at night and they came right up to me and I petted
them and felt up their pussys and they just lifted their tales and seemed
to enjoy it. These fillys didn't even know me but they were young,
inexperienced and bored...also since they were penned they were used to the
presence of people and did not fear me. Most horses in a large pasture
will run when they scent a strange human in their pasture at night.
If you sit on the ground and wait patiently, they will get downwind of you
an
Passwords are security through obscurity. Passwords are good only when they are sufficiently random -- and humans can't create or memorize true random passwords. Passwords can also be stolen by watching somebody's fingers.
True security can't depend on humans entering passwords. We need physical keys that can do challenge-response. After all, it's physical keys that get you in the building and in the server room.
Checking logs is for "administrators" and IT guys, the PHBs of the tech industry.
You know, people who say things like:
What we need is someone at the major distros to write a program which, when executed, will secure a system. Something which is point and click "easy".
If it were so simple, don't you think someone would have done so? What's "secure" to you?
And I'm a programmer, I only check logs when something's broken.
You go ahead and make 'securing your box' a full time job. I have things to do, and would rather deal with it after the fact.
To me, security is a sound backup and restoration plan, and not keeping all of my personal info in a file called "my banking stuff.doc"
I don't need no instructions to know how to rock!!!!
While this book does an excellent job in detailing how to implement a solid security environment, it falls short of providing how to test the security of an environment.
There is an open source project methodology that would be a great additional read for the purpose of testing the security of your environment. Go check out the Open Source Security Testing Methodology Manual (OSSTMM). They just released the 2.1 version of it as described here.
You must not have met my parents, or many people who are not that computer literate. To many, many people a computer is just a tool they use to make life easier. It should not be a full time job to administer.
The problem is with all the hackers, port sniffers, crackers, and the like. I want to see some harsh penalties which send people to jail just for looking.
Rosco: "If brains were gunpowder, Enos couldn't blow his nose."
Why can't book publishers provide these tomes in multiple volumes so you don't have to break your wrists trying to read through the book?
My RSI is bad enough as it is.
A book like this borders on being unreadable because of its size. And its especially irritating to have to man-handle the book if you just want to look at the material in a single section or chapter.
After reading the sample chapter @ oreilly, it seems like a good book fo beginners. I if you have involved in sysadmin/sys security, this book might be too basic for you. Just my thoughts.
www.xml-dev.com
Consensus is good, but informed dictatorship is better
FYI, Fyodor of nmap fame endorsed this book in his earlier (and quite thorough) slashdot interview.
If it's good enough for him, it's good enough for me. That spurred me to read it, and I've found it to be quite an interesting read. It also has a good history section, detailing the "family-tree" of all the unices.
--I hate big sigs.
I have this book. It's very good. What I would be interested in are any comments from any old hands at UNIX security who also have it and noticed anything wrong with or ommited from it. For myself, a UNIX developer with average network experience, I'd like to learn what flaws there are that I can't see.
While I have thought of setting up such a configuration for regular user authentication, I had always just 'felt' that I shouldn't do that with the root accounts on the various machines under my control.
I never have known why I felt that way, just that it is something that didn't seem right to me. So, when I do get that all slapped together on the network I am running, I will make certain to work it in such a way as to keep root out of the chain.
I already use a different root password on every server on the network, even though I synchronize the passwd files for the user passwords to remain the same across the systems.
If you ignore the other uses of a tool, does that make the tool less useful, or you less useful?
I almost considered buying this book, but then I remembered that season 3 of The Simpsons just came out today. Guess I won't be reading for a while... :) And the DVD set comes with a bottle opener. Guess I'm going to be drinking tonight... :)
I really hate signatures, but go to my website.
Froogle isn't anywhere near as good as addall.com for books, or pricegrabber.com & pricewatch.com for tech.
--
Power to the Peaceful
Unless your parents are exceptionally stupid, and I mean helmet and drool cup stupid, I'm sure they can comprehend the principles of "make two copies of important stuff in case your computer breaks".
I don't need no instructions to know how to rock!!!!
Price at BN: $43.96, price at http://www.bookpool.com : $33.50 and possible free shipping if you order more than $40.
Disclaimer: I'm not affiliated with Bookpool and receive no kickbacks. I've been a happy customer with BP and just don't like to pay too much for books.
regards,
Heiko