Table of Contents for
Practical UNIX and Internet Security, 3rd Edition

Version ebook / Retour

Cover image for bash Cookbook, 2nd Edition Practical UNIX and Internet Security, 3rd Edition by Alan Schwartz Published by O'Reilly Media, Inc., 2003
  1. Cover
  2. Practical Unix & Internet Security, 3rd Edition
  3. A Note Regarding Supplemental Files
  4. Preface
  5. Unix “Security”?
  6. Scope of This Book
  7. Which Unix System?
  8. Conventions Used in This Book
  9. Comments and Questions
  10. Acknowledgments
  11. A Note to Would-Be Attackers
  12. I. Computer Security Basics
  13. 1. Introduction: Some Fundamental Questions
  14. What Is Computer Security?
  15. What Is an Operating System?
  16. What Is a Deployment Environment?
  17. Summary
  18. 2. Unix History and Lineage
  19. History of Unix
  20. Security and Unix
  21. Role of This Book
  22. Summary
  23. 3. Policies and Guidelines
  24. Planning Your Security Needs
  25. Risk Assessment
  26. Cost-Benefit Analysis and Best Practices
  27. Policy
  28. Compliance Audits
  29. Outsourcing Options
  30. The Problem with Security Through Obscurity
  31. Summary
  32. II. Security Building Blocks
  33. 4. Users, Passwords, and Authentication
  34. Logging in with Usernames and Passwords
  35. The Care and Feeding of Passwords
  36. How Unix Implements Passwords
  37. Network Account and Authorization Systems
  38. Pluggable Authentication Modules (PAM)
  39. Summary
  40. 5. Users, Groups, and the Superuser
  41. Users and Groups
  42. The Superuser (root)
  43. The su Command: Changing Who You Claim to Be
  44. Restrictions on the Superuser
  45. Summary
  46. 6. Filesystems and Security
  47. Understanding Filesystems
  48. File Attributes and Permissions
  49. chmod: Changing a File’s Permissions
  50. The umask
  51. SUID and SGID
  52. Device Files
  53. Changing a File’s Owner or Group
  54. Summary
  55. 7. Cryptography Basics
  56. Understanding Cryptography
  57. Symmetric Key Algorithms
  58. Public Key Algorithms
  59. Message Digest Functions
  60. Summary
  61. 8. Physical Security for Servers
  62. Planning for the Forgotten Threats
  63. Protecting Computer Hardware
  64. Preventing Theft
  65. Protecting Your Data
  66. Story: A Failed Site Inspection
  67. Summary
  68. 9. Personnel Security
  69. Background Checks
  70. On the Job
  71. Departure
  72. Other People
  73. Summary
  74. III. Network and Internet Security
  75. 10. Modems and Dialup Security
  76. Modems: Theory of Operation
  77. Modems and Security
  78. Modems and Unix
  79. Additional Security for Modems
  80. Summary
  81. 11. TCP/IP Networks
  82. Networking
  83. IP: The Internet Protocol
  84. IP Security
  85. Summary
  86. 12. Securing TCP and UDP Services
  87. Understanding Unix Internet Servers and Services
  88. Controlling Access to Servers
  89. Primary Unix Network Services
  90. Managing Services Securely
  91. Putting It All Together: An Example
  92. Summary
  93. 13. Sun RPC
  94. Remote Procedure Call (RPC)
  95. Secure RPC (AUTH_DES)
  96. Summary
  97. 14. Network-Based Authentication Systems
  98. Sun’s Network Information Service (NIS)
  99. Sun’s NIS+
  100. Kerberos
  101. LDAP
  102. Other Network Authentication Systems
  103. Summary
  104. 15. Network Filesystems
  105. Understanding NFS
  106. Server-Side NFS Security
  107. Client-Side NFS Security
  108. Improving NFS Security
  109. Some Last Comments on NFS
  110. Understanding SMB
  111. Summary
  112. 16. Secure Programming Techniques
  113. One Bug Can Ruin Your Whole Day . . .
  114. Tips on Avoiding Security-Related Bugs
  115. Tips on Writing Network Programs
  116. Tips on Writing SUID/SGID Programs
  117. Using chroot( )
  118. Tips on Using Passwords
  119. Tips on Generating Random Numbers
  120. Summary
  121. IV. Secure Operations
  122. 17. Keeping Up to Date
  123. Software Management Systems
  124. Updating System Software
  125. Summary
  126. 18. Backups
  127. Why Make Backups?
  128. Backing Up System Files
  129. Software for Backups
  130. Summary
  131. 19. Defending Accounts
  132. Dangerous Accounts
  133. Monitoring File Format
  134. Restricting Logins
  135. Managing Dormant Accounts
  136. Protecting the root Account
  137. One-Time Passwords
  138. Administrative Techniques for Conventional Passwords
  139. Intrusion Detection Systems
  140. Summary
  141. 20. Integrity Management
  142. The Need for Integrity
  143. Protecting Integrity
  144. Detecting Changes After the Fact
  145. Integrity-Checking Tools
  146. Summary
  147. 21. Auditing, Logging, and Forensics
  148. Unix Log File Utilities
  149. Process Accounting: The acct/pacct File
  150. Program-Specific Log Files
  151. Designing a Site-Wide Log Policy
  152. Handwritten Logs
  153. Managing Log Files
  154. Unix Forensics
  155. Summary
  156. V. Handling Security Incidents
  157. 22. Discovering a Break-in
  158. Prelude
  159. Discovering an Intruder
  160. Cleaning Up After the Intruder
  161. Case Studies
  162. Summary
  163. 23. Protecting Against Programmed Threats
  164. Programmed Threats: Definitions
  165. Damage
  166. Authors
  167. Entry
  168. Protecting Yourself
  169. Preventing Attacks
  170. Summary
  171. 24. Denial of Service Attacks and Solutions
  172. Types of Attacks
  173. Destructive Attacks
  174. Overload Attacks
  175. Network Denial of Service Attacks
  176. Summary
  177. 25. Computer Crime
  178. Your Legal Options After a Break-in
  179. Criminal Hazards
  180. Criminal Subject Matter
  181. Summary
  182. 26. Who Do You Trust?
  183. Can You Trust Your Computer?
  184. Can You Trust Your Suppliers?
  185. Can You Trust People?
  186. Summary
  187. VI. Appendixes
  188. A. Unix Security Checklist
  189. Preface
  190. Chapter 1: Introduction: Some Fundamental Questions
  191. Chapter 2: Unix History and Lineage
  192. Chapter 3: Policies and Guidelines
  193. Chapter 4: Users, Passwords, and Authentication
  194. Chapter 5: Users, Groups, and the Superuser
  195. Chapter 6: Filesystems and Security
  196. Chapter 7: Cryptography Basics
  197. Chapter 8: Physical Security for Servers
  198. Chapter 9: Personnel Security
  199. Chapter 10: Modems and Dialup Security
  200. Chapter 11: TCP/IP Networks
  201. Chapter 12: Securing TCP and UDP Services
  202. Chapter 13: Sun RPC
  203. Chapter 14: Network-Based Authentication Systems
  204. Chapter 15: Network Filesystems
  205. Chapter 16: Secure Programming Techniques
  206. Chapter 17: Keeping Up to Date
  207. Chapter 18: Backups
  208. Chapter 19: Defending Accounts
  209. Chapter 20: Integrity Management
  210. Chapter 21: Auditing, Logging, and Forensics
  211. Chapter 22: Discovering a Break-In
  212. Chapter 23: Protecting Against Programmed Threats
  213. Chapter 24: Denial of Service Attacks and Solutions
  214. Chapter 25: Computer Crime
  215. Chapter 26: Who Do You Trust?
  216. Appendix A: Unix Security Checklist
  217. Appendix B: Unix Processes
  218. Appendixes C, D, and E: Paper Sources, Electronic Sources, and Organizations
  219. B. Unix Processes
  220. About Processes
  221. Signals
  222. Controlling and Examining Processes
  223. Starting Up Unix and Logging In
  224. C. Paper Sources
  225. Unix Security References
  226. Other Computer References
  227. D. Electronic Resources
  228. Mailing Lists
  229. Web Sites
  230. Usenet Groups
  231. Software Resources
  232. E. Organizations
  233. Professional Organizations
  234. U.S. Government Organizations
  235. Emergency Response Organizations
  236. Index
  237. Index
  238. Index
  239. Index
  240. Index
  241. Index
  242. Index
  243. Index
  244. Index
  245. Index
  246. Index
  247. Index
  248. Index
  249. Index
  250. Index
  251. Index
  252. Index
  253. Index
  254. Index
  255. Index
  256. Index
  257. Index
  258. Index
  259. Index
  260. Index
  261. Index
  262. Index
  263. About the Authors
  264. Colophon
  265. Copyright

Modems: Theory of Operation

Modems are devices that let computers transmit information over ordinary telephone lines. The word explains how the device works: modem is an acronym for “modulator/demodulator.” Modems translate a stream of information into a series of tones (modulation) at one end of the telephone line, and translate the tones back into the serial stream at the other end of the connection (demodulation). Most modems are bidirectional —every modem contains both a modulator and a demodulator, so a data transfer can take place in both directions simultaneously.

Modems have a flexibility that is unparalleled by other communications technologies. Because modems work with standard telephone lines, and use the public telephone network to route their conversations, any computer that is equipped with a modem and a telephone line can communicate with any other computer that has a modem and a telephone line, anywhere in the world. Modems thus bypass firewalls, packet filters, and intrusion detection systems.

What’s more, even in this age of corporate LANs, cable modems, and DSL links, dialup modems are still the single most common way that people access the Internet. This trend is likely to continue through the first decade of the 21st century because dialup access is dramatically cheaper to offer than high-speed, always-on services.

Serial Interfaces

Information inside most computers moves in packets of 8, 16, 32, or 64 bits at a time, using 8, 16, 32, or 64 individual wires. When information leaves a computer, however, it is often organized into a series of single bits that are transmitted sequentially. Often, these bits are grouped into 8-bit bytes for purposes of error checking or special encoding. Serial interfaces transmit information as a series of pulses over a single wire. A special pulse called the start bit signifies the start of each character. The data is then sent down the wire, one bit at a time, after which another special pulse called the stop bit is sent (see Figure 10-1) .

A serial interface sending the letter K (ASCII 75)

Figure 10-1. A serial interface sending the letter K (ASCII 75)

Because a serial interface can be set up with only three wires (transmit data, receive data, and ground), it’s often used with terminals. With additional wires, serial interfaces can be used to control modems, allowing computers to make and receive telephone calls.

The RS-232 Serial Protocol

One of the most common serial interfaces is based on the RS-232 standard. This standard was developed to allow individuals to use remote computer systems over dialup telephone lines with remote terminals. The standard includes provisions for a remote terminal that is connected to a modem that places a telephone call, a modem that answers the telephone call, and a computer that is connected to that modem. The terminal can be connected directly to the computer, eliminating the need for two modems, through the use of a special device called a null modem adapter. Sometimes this device is built directly into a cable, in which case the cable is called a null modem cable.

Tip

Universal Serial Bus (USB), Firewire, and even Ethernet are all high-speed serial systems that use low-level serial protocols to transport packets from which higher-level protocols are built. This chapter does not concern itself with these serial interfaces.

The basic configuration of a terminal and a computer connected by two modems is shown in Figure 10-2.

A terminal and a computer connected by two modems

Figure 10-2. A terminal and a computer connected by two modems

The computer and terminal are called data terminal equipment (DTE), while the modems are called data communication equipment (DCE). The standard RS-232 connector is a 25-pin D-shell type connector; only 9 pins are used to connect the DTE and DCE sides together.

Of these nine pins, only transmit data (pin 2), receive data (pin 3), and signal ground (pin 7) are needed for directly wired communications. Five pins (2, 3, 7, 8, and 20) are needed for proper operation of modems (although most also use pins 4 and 5). Frame ground (pin 1) was originally used to connect electrically the physical frame (chassis) of the DCE and the frame of the DTE to reduce electrical hazards and static.

Because only 8 pins of the 25-pin RS-232 connector are used, the computer industry has largely moved to smaller connectors that follow the 9-pin RS-232-C standard. Most PCs are equipped with this 9-pin RS-232-C connector, shown in Figure 10-3.

The standard 9-pin RS-232-C connector

Figure 10-3. The standard 9-pin RS-232-C connector

The pinouts for the 25-pin RS-232 and 9-pin RS-232-C are both summarized in Table 10-1.

Table 10-1. RS-232 pin assignments for a 25-pin connector

25-pin RS-232 location

9-pin RS-232-C location

Code

Name

Description

1

n/a

FG

Frame Ground

Chassis ground of equipment. (Note: this pin is historical; modern systems don’t connect the electrical ground of different components together because such a connection causes more problems than it solves.)

2

3

TD (or TxD)

Transmit Data

Data transmitted from the computer or terminal to the modem.

3

2

RD (or RxD)

Receive Data

Data transmitted from the modem to the computer.

4

7

RTS

Request to Send

Tells the modem when it can transmit data. Sometimes the computer is busy and needs to have the modem wait before the next character is transmitted. Used for “hardware flow control.”

5

8

CTS

Clear to Send

Tells the computer when it’s OK to transmit data. Sometimes the modem is busy and needs to have the computer wait before the next character is transmitted. Used for “hardware flow control.”

6

6

DSR

Data Set Ready

Tells the computer that the modem is turned on. The computer should not send the modem commands if this signal is not present.

7

5

SG

Signal Ground

Reference point for all signal voltages.

8

1

DCD

Data Carrier Detect

Tells the computer that the modem is connected by telephone with another modem. Unix may use this signal to tell it when to display a login: banner.

20

4

DTR

Data Terminal Ready

Tells the modem that the computer is turned on and ready to accept connections. The modem should not answer the telephone—and it should automatically hang up on an established conversation—if this signal is not present.

22

9

RI

Ring Indicator

Tells the computer that the telephone isringing.

A number of nonstandard RS-232 connectors are also in use. The Apple Macintosh computer uses a circular 9-pin DIN connector, and there are several popular (and incompatible) systems for using RJ-11 and RJ-45 modular jacks.

In general, you should avoid using any RS-232 system that does not carry all eight signals between the data set and the data terminal in a dialup environment.

Originate and Answer

Modern modems can both place and receive telephone calls. After a connection between two modems is established, information that each modem receives on the TD pin is translated into a series of tones that are sent down the telephone line. Likewise, each modem takes the tones that it receives through its telephone connection, passes them through a series of filters and detectors, and eventually translates them back into data that is transmitted on the RD pin.

To allow modems to transmit and receive information at the same time, different tones are used for each direction of data transfer. By convention, the modem that places the telephone call runs in originate mode and uses one set of tones, while the modem that receives the telephone call operates in answer mode and uses another set of tones.

High-speed modems have additional electronics inside them that perform data compression before the data is translated into tones. Some high-speed standards automatically reallocate their audio spectrum as the call progresses to maximize signal clarity and thus maximize data transfer speed. Others allocate a high-speed channel to the answering modem and a low-speed channel to the originating modem, with provisions for swapping channels should the need arise.

Baud and bps

Early computer modems commonly operated at 110 or 300 baud, transmitting information at a rate of 10 or 30 characters per second, respectively. Today most analog modems sold deliver the theoretical maximum download speed of 56 Kbps.[101] Special modems on digital ISDN lines can deliver 128 Kbps.

Five to twelve bits are required to transmit a “standard” character, depending on whether we make upper-/lowercase available, transmit check-bits, and so on. A multibyte character code may require many times that for each character. The standard ISO 8859-1 character set requires eight bits per character, and simple ASCII requires seven bits. Computer data transmitted over a serial line usually consists of one start bit, seven or eight data bits, one parity or space bit, and one stop bit. The number of characters per second (cps) is thus usually equal to the number of bits per second divided by 10.



[101] The 56 Kb speed is the maximum theoretical speed because the U.S. phone system digitizes voice calls at 56 Kb samples per second. Thus, this is the maximum, but this is often not achievable in practice.