Table of Contents for

Practical UNIX and Internet Security, 3rd Edition

D

DAC (Discretionary Access Controls), Groups and Group Identifiers (GIDs)

Daemen, Joan, Common Symmetric Key Algorithms

daemon user, Users and Groups

daemons, Clients and Servers

Dalheimer, Mattias K. (Running Linux), Unix Programming and System Administration

Dalton, Chris I., “Secure” Versions of Unix

DARPA, History of Unix (see ARPA)

data, Types of Security, Identifying assets, Identifying assets, Network-Based Authentication Systems, Legal Issues

(see also data protection; information)

backing up, Legal Issues (see backups)

confidentiality of, Network-Based Authentication Systems (see confidentiality)

encryption of, Identifying assets (see encryption)

integrity of, Types of Security (see integrity)

data bits, Baud and bps

Data Carrier Detect (DCD), The RS-232 Serial Protocol

data communication equipment (DCE), The RS-232 Serial Protocol

Data Encryption Algorithm (DEA), A Cryptographic Example

Data Encryption Standard, The traditional crypt ( ) algorithm (see DES)

data protection, Encryption, Protecting Your Data–Key Switches, Eavesdropping–Keyboard monitors, Sanitizing Media Before Disposal–Sanitizing Printed Media, Protecting Local Storage–Function keys, Unattended Terminals, Potential for eavesdropping and data theft, Why Make Backups?

(see also backups)

eavesdropping, Eavesdropping–Keyboard monitors

local storage, Protecting Local Storage–Function keys

real-world example, Potential for eavesdropping and data theft

sanitizing media before disposal, Sanitizing Media Before Disposal–Sanitizing Printed Media

theft, from, Encryption

unattended terminals, Unattended Terminals

Data Set Ready (DSR), The RS-232 Serial Protocol

data spoofing, IP Security

data terminal equipment (DTE), The RS-232 Serial Protocol

Data Terminal Ready (DTR), The RS-232 Serial Protocol

databases, What Is an Operating System?, Viewing Accounts in the Network Database, Viewing Accounts in the Network Database

(see also network authentication systems)

network, Viewing Accounts in the Network Database

system, What Is an Operating System?

date account, Accounts That Run a Single Command

Dawson, Terry (Running Linux), Unix Programming and System Administration

day-zero backup, Types of Backups (see level-zero backup)

daytime service, TCP, UDP

dbx debugger, gdb: Controlling a Process–gcore: Dumping Core

DCD (Data Carrier Detect), The RS-232 Serial Protocol

DCE (data communication equipment), The RS-232 Serial Protocol

DCE (Distributed Computing Environment), Unix Wars 2: SVR4 versus OSF/1, Kerboros DCE, Other naming services, Remote Procedure Call (RPC), DCE, Codebooks

dd command, Simple Local Copies, Preserving the Evidence

DDoS (Distributed Denial of Service) attacks, Service Overloading

DEA (Data Encryption Algorithm), A Cryptographic Example

deadlock, Design Principles

DEBUG command, SMTP, Security concerns with SMTP banners and commands

debugfs command, File Times, File Times, Tree structure attacks

DECnet, Adding authentication to TCP/IP with ident

decode aliases, Delivery to programs

decoy systems, Decoy Systems

decryption, Understanding Cryptography

default accounts, Default Accounts–Other accounts

default domain, Format of the hostname

defense in depth, Preface, Defend in depth (see multilevel security)

demo accounts, Other accounts

denial of service attacks, Role of This Book, Entering your password, IP Security, The inetd Program, The syslog.conf configuration file, Using syslog in a networked environment, Types of Attacks, Types of Attacks, Types of Attacks, Types of Attacks, Destructive Attacks, Overload Attacks, Soft Process Limits: Preventing Accidental Denial of Service, Network Denial of Service Attacks–Ping of Death and Other Malformed Traffic Attacks, Service Overloading, Chapter 24: Denial of Service Attacks and Solutions

accidental, Soft Process Limits: Preventing Accidental Denial of Service

automatic account lockout, Entering your password

causes of, Types of Attacks

destructive, Types of Attacks, Destructive Attacks

distributed (DDoS), Service Overloading

internal inetd services, The inetd Program

logging to /dev/console causing, The syslog.conf configuration file

on networks, Network Denial of Service Attacks–Ping of Death and Other Malformed Traffic Attacks

overload, Types of Attacks, Overload Attacks

security checklist for, Chapter 24: Denial of Service Attacks and Solutions

syslog causing, Using syslog in a networked environment

types of, Types of Attacks

Denning, Dorothy E. R. (Cryptography and Data Security), Cryptography Books

Denning, Peter J. (Computers Under Attack: Intruders, Worms, and Viruses), Computer Viruses and Programmed Threats

Department of Justic (DOJ), Department of Justice (DOJ)

deployment environments, What Is a Deployment Environment?–What Is a Deployment Environment?

depository directories, FTP, Setting up anonymous FTP with the standard Unix FTP server

DES (Data Encryption Standard), The traditional crypt ( ) algorithm, A Cryptographic Example, A Cryptographic Example, Key Length with Symmetric Key Algorithms, Common Symmetric Key Algorithms, Using NIS+, Kerberos Authentication

example of, A Cryptographic Example

Kerberos using, Kerberos Authentication

key length of, Key Length with Symmetric Key Algorithms

NIS+, Using NIS+

weakness of, A Cryptographic Example

des command, A Cryptographic Example, A Cryptographic Example

DES Extended format, crypt16( ), DES Extended, and Modular Crypt Format

The Design and Implementation of the 4.4 BSD UNIX Operating System (McKusick, Marshall Kirk; Bostic, Keith; Karels, Michael; Quarterman, John), Unix Programming and System Administration

The Design of the UNIX Operating System (Bach, Maurice), Unix Programming and System Administration

destroying media, Sanitizing Media Before Disposal

destructive denial of service attacks, Types of Attacks, Destructive Attacks

detectors, Fire, Smoke, Smoke, Extreme temperatures, Humidity, Water, Environmental monitoring, Entrance through air ducts, Wiretapping, Exception and activity reports

cable tampering, Wiretapping

carbon monoxide, Smoke

fire alarms, Fire

humidity, Humidity

logging alarm systems, Exception and activity reports

motion, Entrance through air ducts

placement and monitoring of, Environmental monitoring

smoke, Smoke

temperature alarms, Extreme temperatures

water sensors, Water

/dev directory, SGID and Sticky Bits on Directories, Device Files, Device Files, Device Files, Picking a Random Seed, Picking a Random Seed, Picking a Random Seed, Back Doors and Trap Doors

/dev/audio device, Picking a Random Seed

/dev/console device, Device Files

/dev/kmem device, Device Files, Back Doors and Trap Doors

/dev/null device, Device Files

/dev/random device, Picking a Random Seed

/dev/swap device, SGID and Sticky Bits on Directories

/dev/urandom device, Picking a Random Seed

device files, Device Files–Unauthorized Device Files

devices, What the Superuser Can Do, Setting Up the Unix Device, BOOTP: Bootstrap Protocol, and DHCP: Dynamic Host Configuration Protocol (UDP Ports 67 and 68), SNMP: Simple Network Management Protocol (UDP Ports 161 and 162), Picking a Random Seed, Informational material, Back Doors and Trap Doors, World-readable backup devices, Access Devices and Copyrighted Software

access, legal definition of, Access Devices and Copyrighted Software

back door in, Back Doors and Trap Doors

backup, world-readable, World-readable backup devices

configuring on local area network, BOOTP: Bootstrap Protocol, and DHCP: Dynamic Host Configuration Protocol (UDP Ports 67 and 68)

logging information about, Informational material

managing with SNMP, SNMP: Simple Network Management Protocol (UDP Ports 161 and 162)

modem control, Setting Up the Unix Device

random number sources, Picking a Random Seed

superuser control of, What the Superuser Can Do

Devices file, Connecting a Modem to Your Computer

df -i command, inode problems

dfstab file, The example explained, Which Files to Back Up?

dfstab script, Exporting NFS directories under System V: share and dfstab

DHCP protocol, BOOTP: Bootstrap Protocol, and DHCP: Dynamic Host Configuration Protocol (UDP Ports 67 and 68)

dictionary attack, The traditional crypt ( ) algorithm

diff program, Source code and patches

differential backup, Types of Backups

differential cryptanalysis, Cryptanalysis

differential fault analysis, Cryptanalysis

differential power analysis, Cryptanalysis

differential timing analysis, Cryptanalysis

Diffie, Whitfield, Attacks on Symmetric Encryption Algorithms, Public Key Algorithms, Cryptography Papers and Other Publications, Cryptography Papers and Other Publications

“New Directions in Cryptography”, Cryptography Papers and Other Publications

“The First Ten Years of Public-Key Cryptography”, Cryptography Papers and Other Publications

Diffie-Hellman exponential key exchange system, Public Key Algorithms, Secure RPC (AUTH_DES), Secure RPC (AUTH_DES), Secure RPC Authentication, Secure RPC Authentication, Limitations of Secure RPC

Digital Millennium Copyright Act (DMCA), Copyrighted Works

Digital Signature Algorithm (DSA), Public Key Algorithms

Digital Signature Standard (DSS), Public Key Algorithms, Message Digest Functions

digital signatures, Cryptographic Algorithms and Functions, Public Key Algorithms, Public Key Algorithms, Public Key Algorithms, Uses for Public Key Encryption, Digital signatures, Message Digest Functions, Message Digest Algorithms at Work, Uses of Message Digest Functions, HMAC, Software Management Systems, Upgrading Distributed Applications

(see also signatures, data)

distributed with software, Software Management Systems

DSA (Digital Signature Algorithm), Public Key Algorithms

DSS (Digital Signature Standard), Public Key Algorithms, Message Digest Functions

HMAC as alternative to, HMAC

message digest algorithms used for, Message Digest Algorithms at Work, Uses of Message Digest Functions

public key cryptography used with, Uses for Public Key Encryption, Digital signatures

RSA as basis for, Public Key Algorithms

directories, Directories and links–Directories and links, Directories and links, Current Directory and Paths, Current Directory and Paths, Current Directory and Paths, Directory Permissions, Calculating octal file permissions, SGID and Sticky Bits on Directories, Turning Off SUID and SGID in Mounted Filesystems, Primary Unix Network Services, Setting up anonymous FTP with the standard Unix FTP server, Sun RPC, Read-Only Filesystems, Ancestor directories, Hidden files and directories, World-writable user files and directories, Tree structure attacks–Tree structure attacks

(see also files)

ancestor, detecting changes to, Ancestor directories

CDFs (context-dependent files), Hidden files and directories

current, Current Directory and Paths

FTP depositories, Setting up anonymous FTP with the standard Unix FTP server

home, Current Directory and Paths, Primary Unix Network Services

security of, Primary Unix Network Services

links to, Directories and links

mounted, Turning Off SUID and SGID in Mounted Filesystems

nested, tree structure attacks on, Tree structure attacks–Tree structure attacks

NFS, Sun RPC (see NFS)

permissions for, Directory Permissions, Calculating octal file permissions

SGID and sticky bits on, SGID and Sticky Bits on Directories

world-writable, World-writable user files and directories

directory services, LDAP (see Kerberos system LDAP NIS NIS+)

dired mode, GNU Emacs, Hidden files and directories

Disappearing Cryptography (Wayner, Peter), Cryptography Books

disaster planning, Planning for the Forgotten Threats, The Disaster Recovery Plan

Disaster Recovery Journal, Security Periodicals

discard service, TCP, UDP

Discretionary Access Controls (DAC), Groups and Group Identifiers (GIDs)

disk drives, Sanitizing Media Before Disposal, Types of Backups, Read-Only Filesystems, Read-Only Filesystems, Local copies, Informational material, Destructive Attacks, Destructive Attacks, Disk Attacks–Tree structure attacks, Using partitions to protect your users, Using quotas, Reserved space, Hidden space

(see also media)

destructive attacks to, Destructive Attacks

difficulty of sanitizing, Sanitizing Media Before Disposal

filling up, as overload attack, Disk Attacks–Tree structure attacks

Firewire-based, Local copies

hidden space on, Hidden space

logging information about, Informational material

partitioning, Using partitions to protect your users

partitions, backups by, Types of Backups

quotas for, Using quotas

reserved space on, Reserved space

write-protect switches for, Read-Only Filesystems, Read-Only Filesystems

Distributed Computing Environment, Other naming services, Remote Procedure Call (RPC) (see DCE)

Distributed Denial of Service (DDoS) attacks, Service Overloading

DMCA (Digital Millennium Copyright Act), Copyrighted Works

DNS (Domain Name System), Name Service–Other naming services, Authentication and DNS–Authentication and DNS, Authentication and DNS, Authentication and DNS, Authentication and DNS, Authentication and DNS, Domain Name System (DNS) (TCP and UDP Port 53)–DNS best practices, Domain Name System (DNS) (TCP and UDP Port 53), DNS zone transfers, DNS zone transfers–DNS best practices, DNS nameserver attacks–DNS nameserver attacks, DNS nameserver attacks, DNSSEC, DNS best practices

attacks on, Authentication and DNS

client flooding, Authentication and DNS

dynamic, DNS nameserver attacks

nameserver attacks, DNS nameserver attacks–DNS nameserver attacks

nameserver cache poisoning, Authentication and DNS

Public Key Infrastructure (PKI), DNSSEC

rogue servers, Authentication and DNS

security and, Authentication and DNS–Authentication and DNS, DNS zone transfers–DNS best practices

security precautions for, DNS best practices

zone transfers, Domain Name System (DNS) (TCP and UDP Port 53), DNS zone transfers

DNS and BIND (Albitz, Paul and Liu, Cricket), Unix Programming and System Administration

DNSSEC, DNSSEC

Dobbertin, Hans, Tripwire

documentation, What This Book Is, The Problem with Security Through Obscurity, Design Principles, Logging to a printer, Handwritten Logs–Informational material, Rule #2: Document, Never Trust Anything Except Hardcopy

of break-in, Rule #2: Document

log books, Handwritten Logs–Informational material

log files, hardcopy of, Logging to a printer, Never Trust Anything Except Hardcopy

manuals, What This Book Is, The Problem with Security Through Obscurity

software, Design Principles

DOJ (Department of Justice), Department of Justice (DOJ)

dollar sign ($), as Unix Bourne or Korn shell prompt, Conventions Used in This Book

domain name, Format of the hostname, Looking up information by domain

Domain Name System, Name Service (see DNS)

domain service, TCP, UDP

domain socket, Unix syslog

domainname command, NIS Domains

domains (NIS), NIS Domains

dormant accounts, Managing Dormant Accounts–Finding Dormant Accounts, Disabling an Account by Changing the Account’s Password, Finding Dormant Accounts–Finding Dormant Accounts, Finding Dormant Accounts

disabling automatically, Finding Dormant Accounts

disabling by changing password, Disabling an Account by Changing the Account’s Password

finding, Finding Dormant Accounts–Finding Dormant Accounts

dot (.) directory, Directories and links, Exploring with the ls Command

dot-dot (..) directory, Directories and links, Exploring with the ls Command

double reverse lookup, Authentication and DNS

downtime, logging, Exception and activity reports

dpkg package management system, Source code and patches

drand48() system call, drand48( ), lrand48( ), and mrand48( )

Dreyfus, Suelette (Underground), Understanding the Computer Security “Culture”

drinks, effects on hardware, Food and drink

DSA (Digital Signature Algorithm), Public Key Algorithms

DSR (Data Set Ready), The RS-232 Serial Protocol

DSS (Digital Signature Standard), Public Key Algorithms, Message Digest Functions

DTE (data terminal equipment), The RS-232 Serial Protocol

DTR (Data Terminal Ready), The RS-232 Serial Protocol

du command, Disk-full attacks

due care, Best Practices (see best practices)

dump program, Specialized Backup Programs, Encrypting Your Backups, Preserving the Evidence

DUMP request, The MOUNT Protocol

dumpster diving, Sanitizing Printed Media

duress code, Token Cards

dust, effects on hardware, Dust

DVD, mounted read-only, Read-Only Filesystems

dynamic DNS, DNS nameserver attacks