Table of Contents for

Practical UNIX and Internet Security, 3rd Edition

A

absolute pathnames, Current Directory and Paths

Absolute Software Corporation, Laptop Recovery Software and Services

abuse account, Alternative contact strategies

access, Expectations, Controlling Physical Access, Auditing Access

open, Expectations

physical, to hardware, Controlling Physical Access, Auditing Access

access control, Types of Security, Types of Security, Types of Security, Controlling Access to Servers, NNTP: Network News Transport Protocol (TCP Port 119), X security–The xhost facility, Using NIS+, NIS+ Limitations, Restricted Filesystem with the chroot( ) Jail–Checking new software

access control lists, NNTP: Network News Transport Protocol (TCP Port 119) (see ACL)

file permissions, Types of Security (see permissions)

Internet servers, Controlling Access to Servers

NIS+ objects, Using NIS+, NIS+ Limitations

physical access to computers, Types of Security (see physical security)

restricted filesystems, Restricted Filesystem with the chroot( ) Jail–Checking new software

X Window System, X security–The xhost facility

access devices, Access Devices and Copyrighted Software

ACCESS function (RPC), The NFS Protocol

access() system call, Design Principles

access_log file, access_log Log File

accidents, Food and drink (see environmental dangers)

accounting, process, Process Accounting: The acct/pacct File–messages Log File

accounts, Logging in with Usernames and Passwords, Logging in with Usernames and Passwords, Entering your password, Smoking Joes, Password Synchronization: Using the Same Password on Many Machines, Viewing Accounts in the Network Database, Including or excluding specific accounts, Importing accounts without really importing accounts, Using netgroups to limit the importing of accounts, Accounts Without Passwords, Default Accounts–Other accounts, Other accounts, Other accounts, Accounts That Run a Single Command, Open Accounts–Potential problems with restricted shells, How to set up a restricted account with rsh, Group Accounts, Managing Dormant Accounts–Finding Dormant Accounts, Disabling an Account by Changing the Account’s Password, Changing the Account’s Login Shell, Finding Dormant Accounts, Finding Dormant Accounts, Protecting the root Account–Trusted computing base, Integrating One-Time Passwords with Unix, Joetest: a simple password cracker, Algorithm and Library Changes, Account Names Revisited: Using Aliases for Increased Security, Exception and activity reports, New accounts, Chapter 19: Defending Accounts

aliases for, Account Names Revisited: Using Aliases for Increased Security

changing login shell, Changing the Account’s Login Shell, Integrating One-Time Passwords with Unix

changing password, Disabling an Account by Changing the Account’s Password

created by intruders, New accounts

default, Default Accounts–Other accounts

demo, Other accounts

dormant, Managing Dormant Accounts–Finding Dormant Accounts

expiring, Finding Dormant Accounts

group, Group Accounts

historical, Finding Dormant Accounts

importing to NIS server, Including or excluding specific accounts, Importing accounts without really importing accounts, Using netgroups to limit the importing of accounts

Joes, Smoking Joes, Joetest: a simple password cracker

locking automatically, Entering your password

logging changes to, Exception and activity reports

names commonly attacked, Other accounts

names for, Logging in with Usernames and Passwords (see usernames)

open, Open Accounts–Potential problems with restricted shells, Algorithm and Library Changes

restricted, with rsh, How to set up a restricted account with rsh

root, protecting, Protecting the root Account–Trusted computing base

running single command, Accounts That Run a Single Command

security checklist for, Chapter 19: Defending Accounts

synchronized passwords on, Password Synchronization: Using the Same Password on Many Machines

viewing in network database, Viewing Accounts in the Network Database

without passwords, Accounts Without Passwords

acct file, Essential Log Files, Process Accounting: The acct/pacct File, Process Accounting: The acct/pacct File

acctcom program, Process Accounting: The acct/pacct File

accton command, Accounting with BSD and Linux

ACK bit, TCP

ACL (Access Control List), The Failed P1003.1e/2c Unix Security Standard, File Permissions, Access Control Lists, NNTP: Network News Transport Protocol (TCP Port 119)

indicated by + in file permission, File Permissions

NNTP with, NNTP: Network News Transport Protocol (TCP Port 119)

part of Unix security standard, The Failed P1003.1e/2c Unix Security Standard

ACM (Association for Computing Machinery), Cryptography Papers and Other Publications, Association for Computing Machinery (ACM)

active FTP, FTP active mode

activists, Authors, Authors

as authors of programmed threats, Authors

planting programmed threats, Authors

aculog file, Essential Log Files, aculog Log File

adb, gdb: Controlling a Process, gcore: Dumping Core

command, gdb: Controlling a Process

debugger, gcore: Dumping Core

add-on functionality, Add-on Functionality Breeds Problems–Add-on Functionality Breeds Problems

addresses, Internet Addresses, CIDR addresses

CIDR, CIDR addresses

Internet, Internet Addresses (see IP addresses)

Adleman, Leonard M., Public Key Algorithms, Cryptography Papers and Other Publications

“A Method for Obtaining Digital Signatures”, Cryptography Papers and Other Publications

admintool command, Package-Based Systems

Advanced Encryption Standard (AES), Key Length with Symmetric Key Algorithms

Advanced Research Projects Agency (ARPA), History of Unix

air ducts, access through, Entrance through air ducts

AIX, Unix Wars 2: SVR4 versus OSF/1, Allowing only FTP access, Trusted path, Assigning Passwords to Users, The syslog.conf configuration file

file for new shells, Allowing only FTP access

history of, Unix Wars 2: SVR4 versus OSF/1

preventing users from changing passwords, Assigning Passwords to Users

silent ignore.* in syslog.conf, The syslog.conf configuration file

trusted path, Trusted path

alarms, Fire (see detectors)

Albitz, Paul (DNS and BIND), Unix Programming and System Administration

algorithmic attacks on encryption, Analytic attacks

aliases, SMTP: Simple Mail Transfer Protocol (TCP Port 25), SMTP: Simple Mail Transfer Protocol (TCP Port 25), Configuration files, Overflowing system mailboxes, Delivery to programs, Which Files to Back Up?, Account Names Revisited: Using Aliases for Increased Security, Back Doors and Trap Doors, /etc/mail/aliases, aliases.dir, aliases.pag, and aliases.db, /etc/mail/aliases, aliases.dir, aliases.pag, and aliases.db

account, Account Names Revisited: Using Aliases for Increased Security

decode, Delivery to programs

email, SMTP: Simple Mail Transfer Protocol (TCP Port 25), Back Doors and Trap Doors, /etc/mail/aliases, aliases.dir, aliases.pag, and aliases.db

back door using, Back Doors and Trap Doors

file for, SMTP: Simple Mail Transfer Protocol (TCP Port 25), Configuration files, Which Files to Back Up?, /etc/mail/aliases, aliases.dir, aliases.pag, and aliases.db

phantom email, avoiding with, Overflowing system mailboxes

All Tomorrow’s Parties (Gibson, William), Understanding the Computer Security “Culture”

Allman, Eric, SMTP: Simple Mail Transfer Protocol (TCP Port 25)

allow-transfers directive, DNS zone transfers

Amanda backup system, Users and Groups, Types of Backups, Network Backup Systems

amanda user, Users and Groups

Amateur Action Bulletin Board System, Amateur Action

American Civil Liberties Union v. Reno, Communications Decency Act

American Society for Industrial Security (ASIS), American Society for Industrial Security (ASIS)

Amoroso, Edward (Fundamentals of Computer Security Technology), General Computer Security

analog program, access_log Log File

analytic attacks on encryption, Analytic attacks

ancestor directories, detecting changes to, Ancestor directories

Anderson, Ross (Security Engineering), General Computer Security

ANI (Automatic Number Identification), Caller-ID and Automatic Number Identification, Additional Security for Modems

anlpasswd package, Constraining Passwords

anonymous FTP, Users and Groups, Anonymous FTP, Setting up anonymous FTP with the standard Unix FTP server–Setting up anonymous FTP with the standard Unix FTP server

ANSI, Software Quality, Coding Standards

C compiler, Coding Standards

C standards, Software Quality

answer mode, Originate and Answer

answer testing, modems, Answer testing

answerback terminal mode, Trojan horses and, Terminal-based Trojan horses

Apache web servers, Software Quality, Starting the Servers, Overall security of Berkeley sendmail versus other MTAs, The Lesson of the Internet Worm, Algorithm and Library Changes, access_log Log File, Service Overloading, Tripwire

always running, Starting the Servers

buffer overflows in, Software Quality

crypt() needed to verify passwords, Algorithm and Library Changes

logging from, access_log Log File

requests increasing forked processes, Service Overloading

security problems with, Overall security of Berkeley sendmail versus other MTAs

SSL library for, The Lesson of the Internet Worm

Tripwire for, Tripwire

APOP option (POP), POP, POPS: Post Office Protocol, and IMAP, IMAPS: Internet Message Access Protocol (TCP Ports 109, 110, 143, 993, 995)

append-only files, Immutable and Append-Only Files–Kernel security level

AppleTalk protocol, Adding authentication to TCP/IP with ident

application-level encryption, Using Encryption to Protect IP Networks from Eavesdropping

Applied Cryptography: Protocols, Algorithms, and Source Code in C (Schneier, Bruce), Cryptography Books

ar program, Simple Archives, Network Backup Systems

archiving information, The Role of Backups, The Role of Backups, Simple Archives

(see also backups)

arguments, checking, Coding Standards

arp command, Preserving the Evidence

ARP table, printing contents of, Preserving the Evidence

ARPA (Advanced Research Projects Agency), History of Unix

ARPANET network, The Internet

arpwatch program, Eavesdropping over local area networks (Ethernet and twisted pairs)

ASIS (American Society for Industrial Security), American Society for Industrial Security (ASIS)

assert macro, Coding Standards

assessing risks, Risk Assessment–Review Your Risks, Risk Management Means Common Sense

assets, Identifying assets, Identifying threats–Review Your Risks, The Physical Security Plan

identifying, Identifying assets

identifying threats to, Identifying threats–Review Your Risks

physical, The Physical Security Plan

Association for Computing Machinery, Cryptography Papers and Other Publications (see ACM)

asymmetric key algorithms, Cryptographic Algorithms and Functions, Cryptographic Algorithms and Functions

(see also public key algorithms)

Asynchronous Transfer Mode (ATM), IP: The Internet Protocol

@ Large (Freedman, David H. and Mann, Charles C.), Computer Crime and Law

at program, The at program, CPU overload attacks

at sign (@), in xhost list, The xhost facility

AT&T System V, Which Unix System? (see System V Unix)

Athena, Project, Kerberos, Kerberos

(see also Kerberos system)

atime, Inodes, File Times

Atkins, Derek, Key search attacks

Atkins, E. Todd, Swatch: A Log File Analysis Tool, Swatch

ATM (Asynchronous Transfer Mode), IP: The Internet Protocol

attackers, computer, Introduction: Some Fundamental Questions (see intruders)

audio device, Picking a Random Seed

audit IDs, Other IDs, Essential Log Files

audit trail, Auditing, Logging, and Forensics, Auditing, Logging, and Forensics

(see also log files)

auditing, Types of Security, Compliance Audits, Auditing Access, Network-Based Authentication Systems, Auditing, Logging, and Forensics, Auditing, Logging, and Forensics, Essential Log Files, Chapter 21: Auditing, Logging, and Forensics

(see also logging)

C2 audit, Essential Log Files

compliance audit, Compliance Audits

security checklist for, Chapter 21: Auditing, Logging, and Forensics

transaction audit, Network-Based Authentication Systems

user access to equipment, Auditing Access

auth service, TCP, Identification Protocol (TCP Port 113)

authd service, Things to Do

authdes_win variable, Setting the window

authentication, Standards, Authenticating Users–Entering your password, Public Key Authentication, Pluggable Authentication Modules (PAM)–Pluggable Authentication Modules (PAM), Message Digest Functions–Attacks on Message Digest Functions, Improving Authentication–Adding authentication to TCP/IP with ident, Authentication and email, ¡April Fools! authentication and Netnews, Adding authentication to TCP/IP with ident–Adding authentication to TCP/IP with ident, Host authentication with SSH–Host authentication with SSH, Client authentication with SSH, TACACS and TACACS+ (UDP Port 49), The xhost facility, RPC Authentication–AUTH_KERB, Secure RPC Authentication–Setting the window, Proving your identity, Limitations of Secure RPC, Network-Based Authentication Systems, Kerberos Authentication–Kerberos 4 versus Kerberos 5, Authentication with LDAP, Authentication, User authentication–User authentication, Authorization–Authorization, Chapter 4: Users, Passwords, and Authentication, Chapter 14: Network-Based Authentication Systems

email and, Authentication and email

ident, for TCP/IP, Adding authentication to TCP/IP with ident–Adding authentication to TCP/IP with ident

IP services, Improving Authentication–Adding authentication to TCP/IP with ident

Kerberos, Kerberos Authentication–Kerberos 4 versus Kerberos 5

LDAP, Authentication with LDAP

of logins, TACACS and TACACS+ (UDP Port 49)

message digests, Message Digest Functions–Attacks on Message Digest Functions

Netnews messages, ¡April Fools! authentication and Netnews

for network systems, Network-Based Authentication Systems (see network authentication systems)

PAM, Pluggable Authentication Modules (PAM)–Pluggable Authentication Modules (PAM)

public key, Public Key Authentication, Proving your identity, Limitations of Secure RPC

RPC, RPC Authentication–AUTH_KERB

Samba, User authentication–User authentication, Authorization–Authorization

Secure RPC, Secure RPC Authentication–Setting the window

security checklist for, Chapter 4: Users, Passwords, and Authentication, Chapter 14: Network-Based Authentication Systems

SMB, Authentication

SSH client, Client authentication with SSH

SSH host, Host authentication with SSH–Host authentication with SSH

standards for, Standards

xhost facility, The xhost facility

authenticators, Unix Usernames, Unix Usernames

(see also passwords)

Authenticode, Message Digest Functions

authorization, Authorization (see authentication)

authwarnings option, sendmail, Security concerns with SMTP banners and commands

AUTH_DES authentication, AUTH_DES, Secure RPC (AUTH_DES)–Limitations of Secure RPC, Use Secure NFS

AUTH_KERB authentication, AUTH_KERB

AUTH_NONE authentication, AUTH_NONE

AUTH_UNIX authentication, AUTH_UNIX, Remove Group-Write Permission for Files and Directories, Use Secure NFS

autologout shell variable, Built-in shell autologout

Automatic Number Identification, Preface (see ANI)

automatic systems, Building an Automatic Backup System, Abusing Automatic Mechanisms–Issues with NFS

abuse of, Abusing Automatic Mechanisms–Issues with NFS

for backups, Building an Automatic Backup System

Auto_Mounter table (NIS+), NIS+ Tables and Other Objects

availability of services, Types of Security

awareness, security, Preface (see security, user awareness of)

awk scripts, Trojan horses in, Trojan horses in mobile code