Slashdot Mirror
Linux and Unix Security Portable Reference
The intended audience for this book is primarily IT professionals who have some experience in systems administration and security. The book is organized into logical sections: Part 1 deals with hacking techniques and defenses, Part 2 deals with host hardening, and Part 3 contains special topics. Each part is divided into chapters that follow a logical progression.
Part 1 starts with footprinting, which includes basic information gathering about potential targets. The chapters then proceed further into the stages of an attack (port scanning, obtaining a shell, privilege escalation) and finishes by discussing some of the techniques hackers use to cover their tracks. The services covered in this section include FTP, Telnet, SSH, SMTP, HTTP, HTTPS, R-services, NFS, Samba, POP, IMAP, MySQL, X, and VNC. An interesting point here is that these services are listed in ascending order with respect to their port numbers.
Part 2, Host Hardening, examines some vulnerabilities common to most systems and includes remedies. Choosing good passwords is discussed, as well as how to set password policies. Though the author warns of the dangers of weak passwords, I would have liked to see a more thorough explanation of how to choose passwords. The section goes on to explain how to disable unnecessary services and harden remote services. At the end of this section are chapter on good practices related to user and system privileges, as well as logging.
Part 3 contains some interesting material, including a whole chapter on the Nessus Attack Scripting Language (NASL), wireless hacking, hacking with the Sharp Zaurus PDA. The section on wireless networks contains some fairly standard material (WEP is insecure, using AirSnort, etc.) but nevertheless serves as a good reminder to use caution when deploying wireless networks. The final chapter, Hacking with the Sharp Zaurus PDA, is especially interesting and details all sorts of fun things you can do with this handheld device, including scanning for wireless networks, connecting to remote machines via SSH, and using VNC to control remote machines.
The Good
This book does an excellent job of presenting information in a clear and easy-to-understand manner. It avoids theories and concepts and delivers just the facts that a systems administrator needs to evaluate and protect a Unix or Linux system. It also makes use of helpful icons throughout the book which draw attention to key points. For example, hacking techniques have a sword icon next to them while defense techniques are listed with a shield. This visual feedback makes it easy to focus in on specific techniques and helps organize the material in a more usable manner. The content of the book is especially good, and the author does a thorough job of covering the basic hacking techniques as well as methods of defense against these techniques.
Another great feature of this book is the inclusion of a reference center in the middle of the book. This section, marked by easy-to-find blue pages, contains a wealth of relevant reference information, such as common commands, common ports, IP addressing, online resources, useful netcat commands, an ascii table, HTTP codes, and important files.
Suggestions
It's hard to find much wrong with this book. However, I felt that a few things were glossed over. For example, the section on passwords was extremely brief and gave no suggestions for choosing good passwords or for how long to set password expirations. In addition to the discussion on TCP Wrappers, I would have also liked to see some mention of using iptables for creating a software firewall.
Summary
HackNotes(tm) Linux and Unix Security Portable Reference is an excellent security reference for IT professionals and systems administrators. The clear, concise presentation of the book makes it easy to digest and use as a practical resource. It is well-organized and thorough and covers a wide range of situations. If you maintain one or more Unix or Linux machines, this book belongs on your shelf.
You can purchase HackNotes Linux and Unix Security Portable Reference from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.
omfg this is my third fp today!
On behalf of all grumpy readers, I would like to elaborate more on this book's flaws.
/.
First, lets start with the title. "HackNotes Linux and Unix Security Portable Refrence." The title is far too long. A much nicer title would have been an unpronounceable vowelless abbreviation such as HNLUSPR. Also the title is ambiguous - Is hacknotes the author/publisher or is it a description of what the book is about? And if you ask your local B&N service rep for books by HackNotes, is it one word or two?
Now, more on to the book. It is far from portable. Sure, you can move it around but don't try sticking it in your pocket. Perhaps they should have included a handle on the spline.
The book is also missing GNU/'s all over the place. I mean, what is linux? I've always been severely beaten with a UNIX manual by a guy with a huge beard everytime I said linux without a GNU/ infront of it. And yes, you *MUST* pronounce the
The advice the book gives is fairly standard. Close all ports, don't use windows etc... Not too special for a "pocket" guide. A far more usefull guide would have included all ports to forward for games. I can't count the times I've had to research what ports a game uses in order to get it to work through my NAT.
Now, more about the book itself. Its made of paper! I attempted to test its easy-to-digestness but gave up around chapter 3. I seriously doubt that this is production quality digestableness. However, the copy I received may have been a pre-release so that might not apply to the final book.
The book itself is strewn with DMCA violations as well. In the forward, the editors openly admit to using the shift key while writing it -- a known security circumvention device. Also, the authors signature on the back jacket appears to be made with a Sharpie marker. Don't be supprised if the FBI raids your local bookstore. (Disclaimer: all uppercase letters in this post were made with the CAPS LOCK key. All extended characters such as * and () were made with thier ASCII code equivilants.)
All in all, this book doesn't live up to the hype. It will most likely be placed on the same shelf with all the other security guides. However if it will end up on the Unix or GNU/Linux shelf still remains a mystery.
Karma: SELECT `karma` FROM `users` WHERE `userid`=138474;
I guess the full sized one is too fucking heavy...
I keep hearing all this talking about Linux being secure. What makes it more secure than Windows?
CMDRTACO CHECK YOUR EMAIL!
Ref: Amazon has this book for $9 less than bn.
Spend $4 more to get free shipping.
Roar, I'm grumpy. This book makes me grumpy, cause it has no flaws! Grr.
503 Sig Unavailable
The Signature could not be accessed. Please try again later or contact the administrator
Its beacuse people like you DONT use it.. :)
---- Booth was a patriot ----
Why wouldn't a PDF/eBook be available that allows me to quickly search for a command or page number? I don't think the cost factor is to blame, is it?
You tell us "the good", so does that mean that there is no "the bad" or even "the ugly" ?
If there is no "the bad", does this imply the book is twice "the good"?
Please help me, as simple algebra is failing me. I need to sit down and think about this...
However, I felt that a few things were glossed over. For example, the section on passwords was extremely brief and gave no suggestions for choosing good passwords or for how long to set password expirations
Translation:
Despite years of reading that everyone needs alpha numeric and special characters, phrases not words, at least 8 characters, mandatory changes every 30 minutes, etc... I still feel someone should tell me all that USELESS shit again.
Make people's passwords hard to remember and they will write them on their monitors.
This
Sample Chapter:ch03-enumeration(pdf)
(3) Other Hacknotes titles
Disclosure: I am not a paid endorser for hacknotes products.
Well, U is a vowel, so I just hacked your title. However, your points are well taken.
stuff |
As an MCSE, I have to ask: Are there pictures? Are there ducks in the pictures? Will we be tested on how many ducks there are in the pictures? How many chances do we have to guess the correct number of ducks in the pictures? Can I go nap now?
A spectre is haunting the world -- the spectre of the Linux Zealot.
What the Linux Zealot is will appear evident to whoever has experienced or came in contact with the discussions which daily rage the Web disguised as news, e-mails, reference material, etc.
The Linux Zealot, is nothing but an animal wandering unceasingly in virtual and true reality (which moreover he treats in the same way) claiming to be an authority on the Linux operating system, an out-and-out guarantor for everyone's freedom, opposed to any safeguard of intellectual works (for a Linux zealot, the expression "copyright" is tantamount to sin against the Holy Spirit: there is no kind of expiation); in fact, he champions software freedom as a fundamental point for world evolution.
But first and foremost, the Linux zealot is a deeply dangerous being as he claims to be the guardian of truth, and looks with suspicion (when it goes off well) or scorn (for the rest of cases, i.e. most of them) those people who simply think differently from him.
But what's Linux? A Linux zealot will never give an authentic answer to this kind of question. He won't, not because he doesn't want to (even if this is the case), but because this question has been answered already, somewhere else by someone else. Linux is nothing but an operating system. The Linux zealot will claim that it is a different operating system from all other ones. But this is not the case. Because an OS is an OS, its main function is to manage the resource of a machine we will call "computer" from now on, for comfort of description. By the term "computer" we mean what is commonly meant by this expression, i. e. the system of hardware resources which are fixed to a certain purpose, be it home use, business use, or server management. Linux is an operating system. Like Windows, MS-DOS, OS/2, etc. There is no difference, in this sense, between Linux and other operating systems. Linux manages a computer, no more, no less. So do MS-DOS, Windows and OS/2. What the Linux zealot self-importantly and arrogantly highlights, is the fact that Linux is a free operating system, i.e., it is made available free of charge to the end user. This of course isn't true at all, but the Linux Zealot believes it. Linux is freely distributable, not free of charge. This means that the kernel and everything included in the operating system's minimal requirements can be freely distributed, not that they must be distributed free of charge. This is the first great misapprehension of the Linux zealots, who find their claim challenged by facts: if the essential parts which make the operating system, and some additional software, are freely distributable, they should explain the reason of the costs -- not prohibitive but certainly notable -- of the most popular Linux distributions, Red Hat and SuSE foremost. And most of all, they should explain the fact that companies like Red Hat are regularly listed on the stock exchange, and Mr. Linux Torvalds enjoys a rather high standard of living. These benefactors of mankind, these software alternatives, these computer non-conformists (so much non-conformist as to be terribly conformist in their non-conformism) naturally justify the distributing companies' profits with excuses like "but there's a printed manual", "but the bundled software is qualitatively and numerically superior compared to the most popular distribution". "but it is easier to install" and other unspeakable nonsense. "On the other hand" they say "if someone wants Linux, they can just as easily download it from the Internet". Sure. Download it from the Internet. But how long must you stay connected, if you regularly pay an Internet bill, to complete the download of an updated version of a decent distribution of an operating system? So what? Is Linux free? No. Linux is not free, same as nothing downloaded from the Internet is free, unless you have access to an University server or can in whatever way scrounge a connection. If
Yes, Most linux boxes ARE insecure! Don't belive me? Press alt+print screen+b at the same time!
portable adj.
1. Carried or moved with ease: a portable typewriter; a portable generator.
2. Capable of being transferred from one employer to another. Used of an employee benefit.
3. Computer Science. Relating to or being software that can run on two or more kinds of computers or with two or more kinds of operating systems.
4. Obsolete. Bearable; endurable
It avoids theories and concepts and delivers just the facts that a systems administrator needs to evaluate and protect a Unix or Linux system.
Great! We can now admin Unix and Linux as mindlessly as MCSE's do MS Windows.
Theories? We don't need no stinkin' theories!
Why is it that everyone wants to write a security book nowadays without any regard to whether the book actually adds anything to the realm of infosec? Do the authors prize the idea of being viewed as subject matter experts so they will get invited to speak at cons, thereby further inflating their reputations/egos?
The whole review spoke of shit I have in half a dozen other books already. If I pick up a security book and it has crypto basics or passwd basics in it I'm tempted to just toss it right then and there, especially since most of these tomes are >$40.
Very few security books find their way to my shelf nowadays since most are redundant. Awesome exceptions include:
Incident Response (McGraw Hill)
Practical Unix & Internet Security (OReilly...like you didn't know)
Network Intrusion Detection (New Rider)
Building Internet FWs (OReilly)
There are others of course but these all share the characteristic of actually *adding knowledge to the field*.
"Though the author warns of the dangers of weak passwords, I would have liked to see a more thorough explanation of how to choose passwords."
Am I the only person sick of security books having yet another diatribe about password quality? How about a two page summary of recommended settings and the appropriate configuration files/menus? Security theory is nice, but dammit, if I had time to worry about the theories, I'd just read "Practical UNIX and Internet Security" and "Secrets and Lies," before writing a custom script to lock all of my systems down right after I finish with those kickstart/jumpstart scripts.
Just give me a chapter-by-chapter list of exactly what should be locked down, how to do it, and a VERY CONCISE explanation of why?
There was an article in the The Register last week that was mentioned here that does a really good job of answering your question.
Cheers,
Fuzzy The Quantum Duck
=0)
I strongly suggest that you don't waste your money. Go with Hacking Linux Exposed. Same publisher, better book.
Hey all! I am a 12 year old looking to piss my parents the fuck off! Can anyone here teach me how to hack, read slashdot appropriately and and tell soviet russia jokes? Thanks! you guys are teh swell!!!!
is tantamount to wishful thinking.
Looking back at the number and severity of vulnerabilities exposed in the past 18 months or so (across many platforms) I am becoming increasingly pessimistic about the effectiveness of preventative measures. The rate at which I need to be patching/updating software to plug the holes has become simply unmanageable. Meanwhile, crackers have access to increasingly effective tools like the new Nmap with version detection.
I'm beginning to question whether the amount of time I spend on prevention would be better spent simply preparing for rapid recovery/response in the event of getting hit. I'm leaning toward reliance on packet filtering at the network edge (ingress AND egress) while treating the internal machines hard drives as disposable devices. How about some information on tools for imaging entire system drives? Rapid recovery methods? Forensics? What works well? What doesn't?
I want more than just a user's guide. I want a repair manual for when things don't go as planned.
I'm sorry, but in this field, nothing is ever printed because it is out of date so quickly. The thought of carrying around a paper reference book when doing security work is, well, futile.
A slashdotter who didn't build his own computer is like a Jedi who didn't build his own lightsaber.
Hacking Exposed Linux is good but if you want to spend reading 10 fucking pages telling you how to do a simple portscan, then thats fine. I have the entire hacknotes series of books that I picked up at a security conference, and yeah I like them. They are to the point and dont waste your time dicking around with stupid page fillers. I own both the books, and they are from the same publisher, so what? I hate it when people dont even fucking read the books and want to talk like they have.
The review states "Each part is divided into chapters that follow a logical progression."
Is this something to brag about, shouldn't I already have assumed this? Or is it some new format of book writing?
Good job finding flaws with a book you probably even have read yet. Moron.
Um, you cheated.
MSWindows2000 was released on February 17, 2000.
RedHat 9.0 was released on March 31, 2003 (All release dates for RedHat are from this link.)
So Redhat had over 3 years to fix holes in the distribution, while crackers had 3 more years to find holes in MSWindows2000. If you want to play fair,
- use Windows2003 released April 24, 2003 and RedHat9.0 (24 days between the releases), or
- use RedHat 6.2 (released March 8, 2000) (19 days difference from MSWindows2000) or maybe RedHat 7.0 (released August 28, 2000).
If you want to compare RedHat9.0 and MSWindows2000 today, you should fully patch both of them.
I believe RedHat will still win any of the fair tests, but if you use unpatched RH6.2, it will get cracked. It will just take longer because there are tons of script kiddies just sending easy URL cracks at every web server hoping it is running MSWindows.
I spend my life entertaining my brain.
This is how I usually choose passwords: I get 12 to 24 bytes from /dev/random (depanding on how much entropy and how large keyspace do I really need) and just use its base64 representation as a password. It's quite hard to guess and after few years I have little problem in remembering the short (96 bits of entropy) ones. The secret is that I don't have to remember them for long, as I change it weekly anyway. This is what I always tell my lusers to use. Once they get used to it, they stop complaining. It's easier to remember if you make a sentence with words starting from those letters and it can be actually fun (e.g. you can write a poem, a song, etc.).
Sincerely,
Pan Tarhei Hosé, PhD.
"Homo sum et cogito ergo odi profanum vulgus et libido."
Are you serious? Can you really remember such passwords? Don't they look like "PGY6xzGyP1xFvOJy"? Am I right?
Yes, yes, yes and yes.
Sincerely,
Pan Tarhei Hosé, PhD.
"Homo sum et cogito ergo odi profanum vulgus et libido."