Slashdot Mirror
Best Linux Security Books?
RyuMaou asks: "I'm about to move a small company from an old, ailing Windows server to some flavor of Linux and I want to make sure they're proprietary information is safe. Here's the problem: I've only run Linux as an application server, behind the firewall, in a Novell environment. Time is short and I have limited resources and want to read at least one really great book on Linux security, then follow that up with some good reinforcement. I know the information is mostly available on the Internet for free, but I like reading actual books, not printouts. So, if you had to pick five books, or fewer, on Linux security, what would you read?"
There - "There is something wrong with the grammar in the story."
Their - "It's their problem they don't know any better."
They're - "They're going to go down to the pub after installing Linux."
"Who are in control, they are not in control of anything - they don't even control themselves!" - Glen Beck
Why are you moving the server to a platform you are not familiar enough with? Because you have used it in an unrelated application? Is there something wrong with the Windows server (besides being old and the typical Windows bashing?)
I'm all for trying things out but is it right to do this with a clients "proprietary" data? What is your backup plan? Will the server store the information as well as act as the firewall? Why Linux and not a flavor of BSD?
After all of that, whlie a book may feel nice - you will get much better and more up to date information on the 'net.
Although I don't have a book to recommend, I can offer this advice. Use Gentoo. It's model is pretty secure to start with. You only install what you need, not what the distro thinks you need.
Linux is ok, but iptables is a mess if you are going to be doing firewalling[1].
Why not use OpenBSD? I might recomend using Absolute OpenBSD, Secure Architectures with OpenBSD, and Building Firewalls with OpenBSD and PF. Of course the OpenBSD man pages are superb. You also have access to CARP (rather an implementation that works as expected), plus you get the benefit of not having to update very often (I've only had to patch SSH and FTPD in the last 2 or 3 years).
[1]Shorewall does make this easier though.
/* oops I accidentally made a comment, sorry */
I recommend Bob Toxen's Real World Linux Security, it's a year or two old but still chock-full of goodness.
I'm a huge advocate of McKusick's Kernel Internals course. It's essential for anyone serious about understanding the core components of the OS. The videos are like a grand, but you can find it free in a lot of libraries, or you might be lucky to catch a copy on half.com.
The current slashbot cheer is "use Ubuntu!"
Example usage:
You're on the right track, though. This article had absolutely nothing to do with distribution selection and yet you felt compelled to get out your pom-poms and cheer for the flavor of the month. The only thing you did wrong was select last month's flavor.
Kudos to you, slashbot. Keep reaching for that rainbow!
Has a 5 year old copy of "Maximum Linux Security" from Sam's Publishing.
It's really only slightly dated, and I have no idea if an updated version is available, but it's a good start.
HexaByte - he's a square and a half!
Is that the answer you're looking for?
Are you prejudiced?
Seriously, though, he's a slashbot for responding with "I don't have anything to say about the actual topic, but use my distro of choice." It's a very botish thing to say.
I'm a jerk for pointing out what a butthole he is, sure. At least I'm not the kind of high-and-mighty jackass like yourself who comes down from their ivory tower of righteousness to defend such a moron from an obviously superior intellect.
While books are good, you will have to wade through a lot of verbiage to find the gems. Although they won't provide the historical and technical backgrounds, you should seriously consider beginning with industry benchmarks rather than trying to make up your own.
y =stepxstep&portal=d3e56294b582309b0d88a6990e8621ce
Try these for starters:
Center for Internet Security
http://www.cisecurity.org/
SANS Step-By-Step Guides
https://store.sans.org/store_category.php?categor
Both will provide you with a checklist to secure your systems, and although neither will be "all inclusive" they will give you a foundation to build your security program on.
In large enterprises subject to regulatory oversight and external auditing they use these as a starting point.
Hope this helps,
Jim Robinson Jr., CISSP
I've found Bill McCarty's SELinux book particularly useful for understanding the implementation of mandatory access controls on Linux.
Can You Say Linux? I Knew That You Could.
should have thought a little harder before asking:
..in one of your environment/shell startup files
export MANPAGER=less
much better!
The unofficial
This may be not that a good suggestion, but please don't chose the book (written in german) "Praxisbuch Sicherheit für Linux-Server und -Netze", it's a piece of crap. OK, that's hard, but i think it's really doesn't worth the money. It covers half theory and half of the practical side, but the "practical" things are mostly [better] explained on some internet ressources.
Regardless of whether you intend to actually use OpenBSD, I strongly recommend reading Absolute OpenBSD anyway - it's good reading for administering *any* UNIX-like server.
As the original poster stated, netfilter/iptables isn't the easiest thing to figure out, but it's not so bad once you get there. To help, I recommend reading Robert Zeigler's "Linux Firewalls" (second edition) - you can probably find it on Amazon.com for less than $20 (US).
Regardless of what you decide, good luck!
RW
Why would you need books anyway?
The first step towards security is to reduce the services and access to only what you need and what you understand. If you see the service in.inetd, and have no clue what it does, or what needs it, kill it.
The second step is to read peoples experiences on how they got hacked and what did they do wrong. Skim over cert advisories.
Lastly keep the system patched up depending on the OS. Windows should be automatically updated between 10pm and 7am, dont make all machines DDOS your firewall. Linux needs patches depending on the distro and the BSDs rarely need patching at all (esp OpenBSD).
Different people have differing ideas on how to achieve security nirvana. My plan is to simply understand what does what, so I can monitor and keep things simple. And if there is a popular daemon that runs like bind or sendmail, keep it patched, and chrooted if possible.
Apart from that of course, the usual. Keep tough passwords, tighten the ACLs, block all irrelevant ports, chroot whatever is possible, keep a DMZ etc.
Theres your book.
"Give orange me give eat orange me eat orange give me eat orange give me you." -Nim Chimpsky
I was surprised to see that nobody had mentioned Nessus and/or Nmap yet. They're excellent at showing you what you're exposing to the outside world. I should however caution you that they're merely a companion on your journey to security, not the path.
Game! - Where the stick is mightier than the sword!
2) Stop and Disable network servers that you do not need right now (e.g. chkconfig --del)
3) Restrict access to the rest using built in ACLs, tcp_wrappers (i.e. hosts.allow/hosts.deny) and/or iptables/netfilter.
4) Set strong passwords where applicable.
5) Keep patched up-to-date.
6) If your distribution includes SELinux, consider enabling it. Test thoroughly before moving to production status.
7) Perform regular backups.
8) Test your backups and your backup hardware.
9) Monitor log files.
To do anything more than that requires fairly extreme justification, and will increase costs due to administrative overhead. Doing the above will probably render your site a less attractive target than 90-something percent of sites. If you and a friend are running away from a tiger, you don't need to outrun the tiger - just your friend. :-)
Linux System Security - The Administrator's Guide to Open Source Security Tools
I am very pleased with this book... and just check out the (5 star average) reviews on Amazon above.
- Preferences: Solaris 10 (servers), Ubuntu (desktops), Solaris 11 (personal servers) -
Actually, Ethiopian cooking is pretty tasty. Those who have the means to eat tend to eat some pretty good-tasting food. The problem with computer security books, of course, is that they become obsolete before the ink is dry.
He really doesn't need a book, because Linux is 100% secure right out of the box... which is his reasoning for moving to it.
Right?
Oh dear.