Unix/Linux Security

Scheduled Dates (sort by: location | date)

Course Overview

The UNIX family of operating systems, including the Linux versions, is prized by IT professionals for its flexibility and openness. However, vulnerabilities can make UNIX systems susceptible to information assurance threats.

In this course, you gain the skills needed to secure your UNIX and Linux platforms. You learn to use tools and utilities to assess vulnerabilities, detect configurations that threaten information assurance and provide effective access controls.

Audience

This course is valuable for UNIX systems administrators and others responsible for deploying secure open systems. Course 428, " UNIX Introduction ", or Course 143, " Linux Introduction ", or equivalent experience is assumed.

Skills Gained

• Secure UNIX and Linux systems from internal and external threats
• Establish authenticated access to local and remote resources
• Avoid potential security loopholes by limiting superuser privileges
• Protect UNIX file systems
• Configure tools and utilities to minimise exposure and detect intrusions
• Tackle security problems by swapping out insecure software components
• Add tools and services to increase security

Course Outline

UNIX and Security

The aims of security

• Authenticity
• Privacy
• Availability
• Integrity
• Defending against exploits

Achieving UNIX security

• Detecting intrusions with audits and logs
• Avoiding security loopholes

Protecting data and systems with cryptography

• Pretty Good Privacy (PGP)
• Gnu Privacy Guard (GnuPG)
• Authenticity and integrity through digital signatures and cryptographic hashes

Protecting User Accounts and Strengthening Authentication

Establishing secure account usage

• The UNIX login process
• Controlling account access with Pluggable Authentication Modules (PAM)

• Enforcing password quality

Monitoring and disabling accounts

• Tracking account usage
• How and when to disable accounts
• Managing user and group IDs

Logging in across the network

• Risks of trusted hosts and networks
• Providing strong authentication for login with S/Key, tokens and OPIE
• Replacing TELNET, rlogin and FTP servers and clients with SSH

Reducing Exposure to Threats by Limiting Superuser Privileges

Controlling root access

• Configuring secure terminals
• Preventing insecure network access
• Gaining rootprivileges with su
• Using groups instead of rootidentity

Auditing superuser activity

• Limiting access to privileged accounts
• Detecting misuse and attacks with log files

Role-based access control (RBAC)

• Risks of UNIX all-or-nothing access
• RBAC in Solaris
• Adding RBAC with sudo

Safeguarding Vital Data by Securing Local and Network File Systems

Directory structure and partitioning for security

• Files, directories, devices and links
• Employing read-only partitions
• Ownership and access permissions
• Immutable and append-only files
• Identifying NFS vulnerabilities

Backup and integrity testing

• Safeguarding backed-up data
• Detecting intrusions with Tripwire

Hardening UNIX systems

• Increasing information assurance with yassp, TITANand Bastille
• Defending against DOS attacks

Avoiding the Exploitation of Programs

Risks from unwanted program execution

• Starting programs surreptitiously
• Running programs as other users
• Scheduling jobs with cronand at

Issues with scripts

• Minimising start-up script vulnerabilities
• Preventing Trojan horse and other attacks

Minimising Threats to Network Services

TCP/IP and its security loopholes

• Sniffing passwords with Etherealand dsniff
• Testing network exposure with netstat, lsofand nmap

Securing internal network services

• Enabling enhanced logging
• Configuring OpenSSH and OpenSSL
• Network authentication using Kerberos
• X Window System vulnerabilities/solutions

Safely connecting to external networks

• Controlling and logging server access with TCP wrappersand xinetd
• Minimising the effects of buffer overflow exploits
• Reducing information leakage
• Securing FTP, e-mail and Web access

Unix/Linux Security / 433