Unix: Audit and Security

Course Overview

The course is intended for those who need to find out what UINX is and where the different components are located, with a specific security objective in mind. In conjunction with an explanation of the technology, the prime risks and defences will be pointed out. The course also serves as a useful general introduction to UNIX.

Having acquired a high level understanding of UNIX, you will learn how to assess security hands on. All aspects are covered, both business and technical. You will hear commentary on certain real disasters that have happened to high profile companies in the past.

Planning for audits and discussion of suitable tests forms a substantial part of the course. Delegates will get a chance to run audit and security related commands. See what the administrators do. Find out how you could script your own TRIPWIRE.

Though the course is designed specifically for a SUN Solaris installation, it will serve as a good general overview for any flavour of UNIX.

Audience

Delegates who will benefit most from this course are typically computer auditors, security specialists and security conscious managers.

Prerequisites

Delegates should have had some experience of using UNIX beforehand and be able to enter simple shell commands, like ls and more, in a terminal environment. Shell programming and C programming experience would be an advantage.

Course Outline

Introduction

• The popularity of UNIX, UNIX attributes, UNIX security, the structure of the UNIX system

Processes

• The ps command, daemon processes, cron daemon, validating executables

Startup and Shutdown

• Shutdown, booting UNIX, Init states, rc scripts, fsck

The UNIX Filesystem

• File system structure (SVR4), File and directory permissions, locating a UNIX file - the find command, disk management information

Managing users

• Logging in, the super user /etc/passwd and /etc/shadow, control files in /etc affecting users and user sessions, password quality controls, session records, groups, profiles, Managing application systems - users, groups and file accesses

Secure inter server working

• Network services, the services file, inetd.conf, examples of insecure services

System compromise - detection and response

• Programmed threats, determine if your system has been compromised
• Steps for recovering from a UNIX root compromise
• software tools