Table of Contents for

Practical UNIX and Internet Security, 3rd Edition

E

earthquakes, Earthquakes

Eastlake, Donald, Picking a Random Seed

eavesdropping, Eavesdropping–Keyboard monitors, Wiretapping, Eavesdropping on 802.11 wireless LANs, Potential for eavesdropping and data theft, Protecting Against Eavesdropping–Eavesdropping countermeasures, Using Encryption to Protect IP Networks from Eavesdropping–Using Encryption to Protect IP Networks from Eavesdropping, Telnet (TCP Port 23), X security

IP packets, Using Encryption to Protect IP Networks from Eavesdropping–Using Encryption to Protect IP Networks from Eavesdropping, Telnet (TCP Port 23)

real-world example, Potential for eavesdropping and data theft

on wireless LANs, Eavesdropping on 802.11 wireless LANs

wiretapping, Wiretapping

X clients, X security

echo service, TCP, UDP, echo and chargen (TCP and UDP Ports 7 and 19)

editors, FSF and GNU, An example of a SUID attack: IFS and the /usr/lib/preserve hole, An example of a SUID attack: IFS and the /usr/lib/preserve hole, Hidden files and directories, Trojan horses in mobile code, .emacs, .exrc, .nexrc, .exrc, .nexrc, .exrc, .nexrc, Other initializations, Other initializations, Other initializations

Emacs, FSF and GNU, Hidden files and directories, .emacs, Other initializations

ex, An example of a SUID attack: IFS and the /usr/lib/preserve hole, .exrc, .nexrc, Other initializations

startup file attacks, .exrc, .nexrc

Trojan horses in files read by, Trojan horses in mobile code

vi, An example of a SUID attack: IFS and the /usr/lib/preserve hole, .exrc, .nexrc, Other initializations

edquota command, Using quotas

education in security, Concentrate on education, Defend in depth, Initial Training

EEI (Escrowed Encryption Initiative), Key Length with Symmetric Key Algorithms

EFF (Electronic Frontier Foundation), Electronic Frontier Foundation (EFF)

effective GIDs, Other IDs

effective UIDs, Real and Effective UIDs with the su Command, The su command and the utmp and wtmp files, Process real and effective UIDs

egress filters, Message Flooding

electrical fires, Smoke

electrical noise, effects on hardware, Electrical noise

electrical surges, Electrical noise (see power, surges)

electronic eavesdropping, Eavesdropping–Keyboard monitors

Electronic Frontier Foundation (EFF), Electronic Frontier Foundation (EFF)

Electronic Privacy Information Center (EPIC), Electronic Privacy Information Center (EPIC)

elliptic curve cryptosystems, Public Key Algorithms

Ellison, Carl, Cryptography as a Dual-Use Technology

Emacs editor, FSF and GNU, Hidden files and directories, .emacs, Other initializations

.emacs file, .emacs

email, Authentication and email, SMTP: Simple Mail Transfer Protocol (TCP Port 25)–Overall security of Berkeley sendmail versus other MTAs, SMTP: Simple Mail Transfer Protocol (TCP Port 25)–SMTP: Simple Mail Transfer Protocol (TCP Port 25), SMTP: Simple Mail Transfer Protocol (TCP Port 25), SMTP: Simple Mail Transfer Protocol (TCP Port 25), SMTP: Simple Mail Transfer Protocol (TCP Port 25), SMTP: Simple Mail Transfer Protocol (TCP Port 25), SMTP: Simple Mail Transfer Protocol (TCP Port 25), SMTP: Simple Mail Transfer Protocol (TCP Port 25)–Overall security of Berkeley sendmail versus other MTAs, SMTP relaying and bulk email (a.k.a. spam), Overflowing system mailboxes, Overflowing system mailboxes, Overflowing system mailboxes, Delivery to programs, POP, POPS: Post Office Protocol, and IMAP, IMAPS: Internet Message Access Protocol (TCP Ports 109, 110, 143, 993, 995), Mail, Back Doors and Trap Doors, Trojan horses in mobile code, Viruses, .forward, .procmailrc, /etc/mail/aliases, aliases.dir, aliases.pag, and aliases.db, /etc/mail/aliases, aliases.dir, aliases.pag, and aliases.db, Other files

(see also sendmail program)

alias back door, Back Doors and Trap Doors

aliases, SMTP: Simple Mail Transfer Protocol (TCP Port 25), /etc/mail/aliases, aliases.dir, aliases.pag, and aliases.db

authentication and, Authentication and email

delivered to programs, Delivery to programs

encrypting, SMTP: Simple Mail Transfer Protocol (TCP Port 25)

end-user programs for (MUAs), SMTP: Simple Mail Transfer Protocol (TCP Port 25)

logging, Mail

mail programs for (MTAs), SMTP: Simple Mail Transfer Protocol (TCP Port 25)–SMTP: Simple Mail Transfer Protocol (TCP Port 25)

overflowing system mailboxes, Overflowing system mailboxes

phantom, monitoring, Overflowing system mailboxes

protecting queue and delivery areas, Other files

retrieving from server, POP, POPS: Post Office Protocol, and IMAP, IMAPS: Internet Message Access Protocol (TCP Ports 109, 110, 143, 993, 995)

security and, SMTP: Simple Mail Transfer Protocol (TCP Port 25)–Overall security of Berkeley sendmail versus other MTAs

SMTP service for, SMTP: Simple Mail Transfer Protocol (TCP Port 25)–Overall security of Berkeley sendmail versus other MTAs

startup file attacks, .forward, .procmailrc

Trojan horses in, Trojan horses in mobile code

unwanted (spam), SMTP: Simple Mail Transfer Protocol (TCP Port 25), SMTP relaying and bulk email (a.k.a. spam)

viruses, SMTP: Simple Mail Transfer Protocol (TCP Port 25), Viruses

embedded edit commands, Other initializations

embedded Unix systems, What Is a Deployment Environment?

embezzlers, planting programmed threats, Authors

emergency response organizations, Emergency Response Organizations (see response teams)

employees, Identifying threats, Identifying threats, The Cost of Loss, The Probability of a Loss, The Cost of Prevention, The Role of Policy, Remember that employees are people too, Remember that employees are people too, Concentrate on education, Defend in depth, Other Contingencies, Other Contingencies, Sanitizing Printed Media, Personnel Security–Summary, Background Checks, Intensive Investigations, Intensive Investigations, Initial Training, Performance Reviews and Monitoring, Performance Reviews and Monitoring, Least Privilege and Separation of Duties, Least Privilege and Separation of Duties, Least Privilege and Separation of Duties, Least Privilege and Separation of Duties, Departure, Departure, Other People, Other People, Authors, The Responsibility to Report Crime, Your Employees?, Chapter 9: Personnel Security

(see also users)

absenteeism of, Other Contingencies

background checks of, Background Checks, Other People

confidential information about, Remember that employees are people too

cost of losing, The Cost of Loss, The Probability of a Loss

departure of, Departure

education in security, Concentrate on education, Defend in depth, Initial Training

investigations of, Intensive Investigations

irreplaceable, Least Privilege and Separation of Duties

key, Least Privilege and Separation of Duties

least privilege principle and, Least Privilege and Separation of Duties

loss of, Other Contingencies, Departure

mistakes made by, Remember that employees are people too

monitoring for stress, Performance Reviews and Monitoring

notifying of security policies, The Responsibility to Report Crime

passwords compromised by, The Cost of Prevention

performance reviews of, Performance Reviews and Monitoring

polygraph tests of, Intensive Investigations

printed information about, Sanitizing Printed Media

role in security, The Role of Policy

security checklist for, Chapter 9: Personnel Security

security regarding, Personnel Security–Summary

security threats caused by, Identifying threats, Authors

separation of duties and, Least Privilege and Separation of Duties

temporary, Other People

trusting, Your Employees?

encryption, Keeping Secrets, Password Synchronization: Using the Same Password on Many Machines, Writing Down Passwords, The Unix Encrypted Password System–The shadow password and master password files, Unix salt–Unix salt, Kerboros DCE, The Virtual Filesystem Interface, The Virtual Filesystem Interface, Understanding Cryptography, Understanding Cryptography, Understanding Cryptography, A Cryptographic Example, A Cryptographic Example, Cryptographic Algorithms and Functions–Systems-based attacks, Cryptographic Algorithms and Functions–Cryptographic Algorithms and Functions, Systems-based attacks, Public Key Algorithms–Known versus published methods, Encrypted messaging, Known versus published methods, Encryption, Eavesdropping, Protecting Backups, Eavesdropping countermeasures, Additional Security for Modems, Using Encryption to Protect IP Networks from Eavesdropping, Using Encryption to Protect IP Networks from Eavesdropping, Using Encryption to Protect IP Networks from Eavesdropping, SSH: The Secure Shell (TCP Port 22), SMTP: Simple Mail Transfer Protocol (TCP Port 25), Proving your identity, Proving your identity, Limitations of Secure RPC, User authentication, Tips on Using Passwords, Physical security for backups, Data security for backups, Encrypting Your Backups, Algorithm and Library Changes–Algorithm and Library Changes, Chapter 7: Cryptography Basics, Cryptography Books–Cryptography Papers and Other Publications

(see also cryptography)

algorithms, Keeping Secrets, A Cryptographic Example, Cryptographic Algorithms and Functions–Systems-based attacks, Cryptographic Algorithms and Functions–Cryptographic Algorithms and Functions, Public Key Algorithms–Known versus published methods, Known versus published methods, Proving your identity

cryptographic strength of, Known versus published methods

public key, Cryptographic Algorithms and Functions–Cryptographic Algorithms and Functions, Public Key Algorithms–Known versus published methods, Proving your identity

symmetric key, Cryptographic Algorithms and Functions–Systems-based attacks

application-level, Using Encryption to Protect IP Networks from Eavesdropping

attacks on, A Cryptographic Example (see key search attacks)

authentication with, Proving your identity

of backups, Protecting Backups, Data security for backups, Encrypting Your Backups

DCE and, Kerboros DCE

eavesdropping, protecting from, Eavesdropping

of email, Encrypted messaging, SMTP: Simple Mail Transfer Protocol (TCP Port 25)

end-to-end, Using Encryption to Protect IP Networks from Eavesdropping

of filesystems, The Virtual Filesystem Interface

keys, Understanding Cryptography, Systems-based attacks

link-level, Using Encryption to Protect IP Networks from Eavesdropping

loopback, The Virtual Filesystem Interface

for modems, Eavesdropping countermeasures, Additional Security for Modems

of backups[encryption, Physical security for backups

backups), Physical security for backups

of passwords, Password Synchronization: Using the Same Password on Many Machines, Writing Down Passwords, The Unix Encrypted Password System–The shadow password and master password files, User authentication, Tips on Using Passwords, Algorithm and Library Changes–Algorithm and Library Changes

Samba, User authentication

published resources on, Cryptography Books–Cryptography Papers and Other Publications

salt and, Unix salt–Unix salt

Secure RPC not providing, Limitations of Secure RPC

security checklist for, Chapter 7: Cryptography Basics

SSH protocol and, SSH: The Secure Shell (TCP Port 22)

as theft precaution, Encryption

end-to-end encryption, Using Encryption to Protect IP Networks from Eavesdropping

Engert, Kai, Data integrity and privacy

enterprise networks, Networking

environment variables, An example of a SUID attack: IFS and the /usr/lib/preserve hole, Things to Avoid, Tips on Writing SUID/SGID Programs, Tips on Writing SUID/SGID Programs, PATH attacks, IFS attacks, Other initializations

IFS, An example of a SUID attack: IFS and the /usr/lib/preserve hole, Tips on Writing SUID/SGID Programs, IFS attacks

not using when programming, Things to Avoid

PATH, Tips on Writing SUID/SGID Programs, PATH attacks

startup attacks and, Other initializations

environmental dangers, What Is Computer Security?, Protecting Computer Hardware, Fire–Smoke, Smoke, Dust, Earthquakes, Explosions, Extreme temperatures, Bugs (biological), Electrical noise, Lightning, Vibration, Humidity, Water, Food and drink, Verify your backups, The Role of Backups

backups erased by, Verify your backups

carbon monoxide, Smoke

dust, Dust

earthquakes, Earthquakes

electrical noise, Electrical noise

explosions, Explosions

fire, Fire–Smoke

food and beverages, accidents with, Food and drink

humidity, Humidity

insects, Bugs (biological)

lightning, Protecting Computer Hardware, Lightning

temperature extremes, Extreme temperatures

vibrations, Vibration

water, Water

envp, Things to Avoid

EPIC (Electronic Privacy Informatin Center), Electronic Privacy Information Center (EPIC)

equipment, Protecting Computer Hardware (see hardware)

escape sequences, modems and, Originate testing

Escrowed Encryption Initiative (EEI), Key Length with Symmetric Key Algorithms

espionage, Authors

/etc directory, What Is an Operating System?, What Is an Operating System?, The /etc/passwd File, The Unix Encrypted Password System, The /etc/group file, Connecting a Modem to Your Computer, Connecting a Modem to Your Computer, The /etc/hosts file, The /etc/services File, The inetd Program, Primary Unix Network Services, Primary Unix Network Services, FTP: File Transfer Protocol (TCP Ports 20 and 21), Restricting FTP with the standard Berkeley FTP server, DNS best practices, /etc/hosts.lpd file, Proving your identity, Creating passwords for users, Setting up netgroups, Which Files to Back Up?, Accounts Without Passwords, Accounts Without Passwords, Accounts Without Passwords, Setting up the chroot( ) environment, Group Accounts, Changing the Account’s Login Shell, Secure Terminals, Secure Terminals, Shadow Password Files, Shadow Password Files, utmp and wtmp Files–Pruning the wtmp file, Monitoring commands, Tracing a Connection, Changes to startup files, Hidden files and directories, Back Doors and Trap Doors, Back Doors and Trap Doors, .login, .profile, /etc/profile, System initialization files, System initialization files, Writable system files and directories, Process priority and niceness, Process #1: /etc/init, Process #1: /etc/init, Process #1: /etc/init, Process #1: /etc/init

attacker changing owner of, Back Doors and Trap Doors

/etc/default/login file, Secure Terminals

/etc/exports file, Writable system files and directories

/etc/fsck program, Hidden files and directories

/etc/fstab file, Back Doors and Trap Doors

/etc/ftpd, FTP: File Transfer Protocol (TCP Ports 20 and 21) (see ftpd server)

/etc/ftpusers file, Restricting FTP with the standard Berkeley FTP server

/etc/group file, What Is an Operating System?, The /etc/group file, Group Accounts

/etc/hosts file, The /etc/hosts file

/etc/hosts.lpd file, /etc/hosts.lpd file

/etc/inetd, The inetd Program (see inetd program)

/etc/inetd.conf file, Primary Unix Network Services

/etc/init program, Process #1: /etc/init

/etc/inittab file, Which Files to Back Up?, Process #1: /etc/init

(see also inittab program)

/etc/keystore file, Proving your identity

/etc/named.conf file, DNS best practices

/etc/passwd file, What Is an Operating System?, The /etc/passwd File, The Unix Encrypted Password System, Accounts Without Passwords, Process #1: /etc/init

/etc/profile file, Changes to startup files, .login, .profile, /etc/profile

/etc/publickey file, Creating passwords for users

/etc/rc directory, Primary Unix Network Services, System initialization files

/etc/rc script, Process #1: /etc/init

/etc/remote file, Connecting a Modem to Your Computer

/etc/renice, Process priority and niceness (see renice command)

/etc/secure/passwd file, Accounts Without Passwords

/etc/security/passwd.adjunct file, Shadow Password Files

/etc/services file, The /etc/services File

/etc/shadow file, Accounts Without Passwords, Shadow Password Files

/etc/shells file, Changing the Account’s Login Shell

/etc/ttys file, Connecting a Modem to Your Computer, Secure Terminals

/etc/utmp file, utmp and wtmp Files–Pruning the wtmp file, Monitoring commands, Tracing a Connection

/etc/yp/makedbm program, Setting up netgroups

making files unwritable in, System initialization files

in restricted filesystems, Setting up the chroot( ) environment

ethereal program, Monitoring the Intruder

Ethernet, addresses for random seeds, Picking a Random Seed

Ethers table (NIS+), NIS+ Tables and Other Objects

EUID, Process real and effective UIDs (see effective UIDs)

ex editor, An example of a SUID attack: IFS and the /usr/lib/preserve hole, .exrc, .nexrc, Other initializations

exceptions, Creating Processes

exec command, “No more processes”

exec service, TCP

exec() system call, File Permissions, Design Principles

execl() system call, Tips on Writing SUID/SGID Programs

execlp() system call, Tips on Writing SUID/SGID Programs

execute permission, File Permissions, Directory Permissions, chmod: Changing a File’s Permissions

directories, Directory Permissions

files, File Permissions

execv() system call, Tips on Writing SUID/SGID Programs

execve() system call, Tips on Writing SUID/SGID Programs

execvp() system call, Tips on Writing SUID/SGID Programs

exim program, SMTP: Simple Mail Transfer Protocol (TCP Port 25)

explosions, Explosions

EXPN command, SMTP, Security concerns with SMTP banners and commands, Security concerns with SMTP banners and commands, Security concerns with SMTP banners and commands

exponential key exchange system, Secure RPC Authentication

export controls and cryptography, Cryptographic Programs and Export Controls

EXPORT request, The MOUNT Protocol

exportfs command, /usr/etc/exportfs

exports file, /etc/exports–/usr/etc/exportfs, Which Files to Back Up?, Changes to the /etc/hosts.equiv file, Changes to the /etc/hosts.equiv file, Writable system files and directories

.exrc file, .exrc, .nexrc

ext2fs filesystem (Linux), The Virtual Filesystem Interface, Reserved space, Tree structure attacks

ext3fs filesystem, The Virtual Filesystem Interface

external data representation, Remote Procedure Call (RPC) (see XDR)

extortionists, Authors, Authors

authoring programmed threats, Authors

planting programmed threats, Authors