Table of Contents for

Practical UNIX and Internet Security, 3rd Edition

F

failures, computer, Tips on Avoiding Security-Related Bugs, Tips on Avoiding Security-Related Bugs

(see also bugs)

Òfair useÓ provisions, copyright law, Copyrighted Works

Farmer, Dan, Network Scanning, Electronic Resources, COPS (Computer Oracle and Password System), SATAN

Fast File System, The Virtual Filesystem Interface (see FFS)

FAT filesystem, The Virtual Filesystem Interface

FAT32 filesystem, The Virtual Filesystem Interface

FBI (Federal Bureau of Investigation), Federal jurisdiction, Federal Bureau of Investigation (FBI)

fchmod() system call, chmod: Changing a File’s Permissions, Design Principles

fchow() system call, Design Principles

Federal Bureau of Investigation (FBI), Federal jurisdiction, Federal Bureau of Investigation (FBI)

federal jurisdiction, Federal jurisdiction

federal laws, Federal Computer Crime Laws

Ferbrache, David (The Pathology of Computer Viruses), Computer Viruses and Programmed Threats

FFS (Fast File System), UFS and the Fast File System–Directories and links, The Virtual Filesystem Interface, Reserved space

FG (Frame Ground), The RS-232 Serial Protocol

fget() system call, Things to Avoid

fgets() system call, The Lesson of the Internet Worm

fiber optic cables, Fiber optic cable

FIFO file type, File Permissions

file command, File Times

file descriptors, Things to Avoid

file handles, File Handles, File Handles

File Transfer Protocol, FTP: File Transfer Protocol (TCP Ports 20 and 21) (see FTP)

filenames, attacks through, Filename attacks

files, What Is an Operating System?, What Is an Operating System?, What Is an Operating System?, Understanding Filesystems, Understanding Filesystems, File contents, Inodes, Inodes, Inodes, Exploring with the ls Command, File Times, File Times, File Times, File Permissions, File Permissions, File Permissions, File Permissions, File Permissions, Directory Permissions, chmod: Changing a File’s Permissions, SGID Bit on Files (System V-Derived Unix Only): Mandatory Record Locking, Finding All of the SUID and SGID Files–The Solaris ncheck command, Device Files–Unauthorized Device Files, chown: Changing a File’s Owner–Use chown with caution, Design Principles, The Role of Backups, What Should You Back Up?, Large Service-Based Networks with Large Budget, Backing Up System Files–Building an Automatic Backup System, Software for Backups, Monitoring File Format, Trusted computing base, Integrity Management, Immutable and Append-Only Files–Kernel security level, Immutable and Append-Only Files–Kernel security level, Detecting Changes After the Fact–Checksums and Signatures, Comparison Copies–rdist, Checklists and Metadata, Checklists and Metadata, Checklists and Metadata, Checksums and Signatures, Checksums and Signatures, Auditing, Logging, and Forensics, Shell History, Changes in file contents, Changes to startup files, Hidden files and directories–Hidden files and directories, Hidden files and directories, Unowned files, Never Trust Anything Except Hardcopy, Trojan horses in mobile code, Startup File Attacks, World-writable user files and directories, Group-writable files, Destructive Attacks, Destructive Attacks, Swapping to files, Disk-full attacks, Hidden space, Chapter 6: Filesystems and Security, gcore: Dumping Core

access times of, File Times

append-only, Immutable and Append-Only Files–Kernel security level

backing up, Inodes (see backups)

beginning with dash, deleting, Directory Permissions

byte-by-byte comparisons of, Comparison Copies–rdist

change time, File Times

changing owner of, chown: Changing a File’s Owner–Use chown with caution

checklists for comparing, Checklists and Metadata

checksums detecting changes in, Checksums and Signatures

context-dependent (CDFs), Hidden files and directories

core, gcore: Dumping Core

critical, backing up, Backing Up System Files–Building an Automatic Backup System

critical, deleting, Destructive Attacks

deleted accidentally, The Role of Backups

deleted as destructive attack, Destructive Attacks

detecting changes to, Detecting Changes After the Fact–Checksums and Signatures

device, Device Files–Unauthorized Device Files

format of, monitoring, Monitoring File Format

group for, File Permissions

group-writable, Group-writable files

hidden, Exploring with the ls Command, Hidden files and directories–Hidden files and directories

history, Shell History

immutable, Immutable and Append-Only Files–Kernel security level

information about (metadata), Understanding Filesystems

inodes storing information about, Inodes

integrity of, Integrity Management (see integrity)

locating largest, Disk-full attacks

locking, chmod: Changing a File’s Permissions, Design Principles

mandatory, chmod: Changing a File’s Permissions

log, Auditing, Logging, and Forensics (see log files)

magic number in, File Permissions

metadata, comparing, Checklists and Metadata

modification times of, File Times, Large Service-Based Networks with Large Budget, Checklists and Metadata, Never Trust Anything Except Hardcopy

modified by intruders, Changes in file contents, Changes to startup files

owner of, File Permissions

permissions for, Inodes (see permissions)

security checklist for, Chapter 6: Filesystems and Security

SGID bit on, SGID Bit on Files (System V-Derived Unix Only): Mandatory Record Locking

signatures detecting changes in, Checksums and Signatures

startup, Startup File Attacks (see startup files)

SUID/SGID, finding, Finding All of the SUID and SGID Files–The Solaris ncheck command

swapping to, Swapping to files

system configuration, What Is an Operating System?

system database, What Is an Operating System?

system startup, What Is an Operating System?

Trojan horses in, Trojan horses in mobile code

trusted computing base (TCB) of, Trusted computing base

types of, File Permissions, File Permissions

unlinked, hidden space used by, Hidden space

unowned, Unowned files

which to back up, What Should You Back Up?

world-writable, World-writable user files and directories

zero-filled bytes (holes) in, Software for Backups

filesystems, What the Superuser Can Do, Filesystems and Security–Current Directory and Paths, Understanding Filesystems, Understanding Filesystems, Understanding Filesystems, Understanding Filesystems, UFS and the Fast File System–Directories and links, UFS and the Fast File System–Directories and links, The Virtual Filesystem Interface, The Virtual Filesystem Interface, The Virtual Filesystem Interface, The Virtual Filesystem Interface, The Virtual Filesystem Interface, Turning Off SUID and SGID in Mounted Filesystems, Turning Off SUID and SGID in Mounted Filesystems, Summary, Network Filesystems, Restricted Filesystem with the chroot( ) Jail–Checking new software, quot command, Reserved space, Chapter 6: Filesystems and Security, Chapter 15: Network Filesystems

(see also directories)

Cryptfs, The Virtual Filesystem Interface

cryptographic, Understanding Filesystems, The Virtual Filesystem Interface

encrypted, The Virtual Filesystem Interface

Fast File System, UFS and the Fast File System–Directories and links

journaling, Understanding Filesystems

list of, available on Unix, The Virtual Filesystem Interface

mounted, Turning Off SUID and SGID in Mounted Filesystems

network, Understanding Filesystems, Network Filesystems

(see also NFS; SMB)

remote network, Turning Off SUID and SGID in Mounted Filesystems

replicated (RAID), Understanding Filesystems

reserved space on, Reserved space

restricted, Restricted Filesystem with the chroot( ) Jail–Checking new software

security checklist for, Chapter 6: Filesystems and Security, Chapter 15: Network Filesystems

summarizing usage per user, quot command

superuser control of, What the Superuser Can Do

UFS, UFS and the Fast File System–Directories and links

virtual filesystem interface, The Virtual Filesystem Interface

filter files (mail), .forward, .procmailrc

filtering software, Mandatory blocking, Mandatory blocking

filtering, on-demand, The ipfw host-based firewall

find command, Finding All of the SUID and SGID Files, Finding All of the SUID and SGID Files, Finding All of the SUID and SGID Files, Simple listing, Hidden files and directories, Filename attacks, Filename attacks, Disk-full attacks

-0 option, Filename attacks

-ls option, Simple listing

-size option, Disk-full attacks

attacks on, Filename attacks

-H option, Hidden files and directories

-print option, Finding All of the SUID and SGID Files

type -f option, Finding All of the SUID and SGID Files

-xdev option, Finding All of the SUID and SGID Files

finger account, Accounts That Run a Single Command

finger command, Networking and Unix, finger (TCP Port 79)–Disabling finger, Disabling finger, Accounts That Run a Single Command, lastlog File, Examining the utmp and wtmp files, Monitoring commands, Alternative contact strategies

disabling, Disabling finger

finding contact information with, Alternative contact strategies

login times displayed by, lastlog File

running when not logged in, Accounts That Run a Single Command

finger service, TCP

fingerd program, The Lesson of the Internet Worm–The Lesson of the Internet Worm, The Lesson of the Internet Worm

(see also Internet worm program)

fingerprint of files or keys, Cryptographic Algorithms and Functions (see message digest functions)

Fingerprints Database, Tripwire

fire, The Disaster Recovery Plan, Fire–Smoke, Fire hazards

firewalls, Telephone firewalls, Firewalls and Physical Isolation, Controlling Access to Servers, Controlling Access to Servers, Using a Host-Based Packet Firewall, Using a Host-Based Packet Firewall, Using a Host-Based Packet Firewall, Using a Host-Based Packet Firewall, DNS nameserver attacks, Monitoring Your Host with netstat, Sun’s portmap/rpcbind, Unintended Disclosure of Site Information with NIS, Account Names Revisited: Using Aliases for Increased Security, Firewalls

account aliases and, Account Names Revisited: Using Aliases for Increased Security

host-based program, Controlling Access to Servers, Using a Host-Based Packet Firewall

IP networks, Firewalls and Physical Isolation

kernel-level, Using a Host-Based Packet Firewall

mailing list for, Firewalls

nameservers and, DNS nameserver attacks

for NIS sites, Unintended Disclosure of Site Information with NIS

packet-level, Using a Host-Based Packet Firewall

portmapper program and, Sun’s portmap/rpcbind

standalone appliance for, Controlling Access to Servers

stateful inspection of, Using a Host-Based Packet Firewall

telephone, Telephone firewalls

verifying proper operation of, Monitoring Your Host with netstat

Firewalls and Internet Security (Bellovin, Steve and Cheswick, Bill), Network Technology and Security

Firewire-based disk drive, Local copies

FIRST (Forum of Incident Response and Security Teams), Resuming Operation, FIRST, Forum of Incident and Response Security Teams (FIRST)

flooding, client, Authentication and DNS

floors, raised, access through, Raised floors and dropped ceilings

folders, Directories and links (see directories links)

fonts used in this book, Conventions Used in This Book

food, effects on hardware, Food and drink

forensics, Unix Forensics–Network Setup, Unix Forensics, Chapter 21: Auditing, Logging, and Forensics

(see also logging)

security checklist for, Chapter 21: Auditing, Logging, and Forensics

fork bombs, Too many processes

fork() system call, Design Principles, Creating Processes

Forrester, Justin, What he found

Forum of Incident Response and Security Teams, Forum of Incident and Response Security Teams (FIRST) (see FIRST)

.forward file, Changes to startup files, .forward, .procmailrc

Frame Ground (FG), The RS-232 Serial Protocol

fraud, One-Way Phone Lines

Fredricksen, Lars (“An Empirical Study of the Reliability of UNIX Utilities”), Miscellaneous References

Free Software Foundation (FSF), FSF and GNU

FreeBSD, What This Book Is Not, What This Book Is Not, Versions Covered in This Book, Versions Covered in This Book, Versions Covered in This Book, NetBSD, FreeBSD, and OpenBSD, NetBSD, FreeBSD, and OpenBSD, Second-Generation Commercial Unix Systems, The shadow password and master password files, Pluggable Authentication Modules (PAM), The su Log, The sulog under Berkeley Unix, BSD Kernel Security Levels, The Virtual Filesystem Interface, Access Control Lists, The ipfw host-based firewall, Source code and patches, CVS, Accounts Without Passwords, Codebooks

(see also BSD Unix)

ACL support for, Access Control Lists

bug fixes, responsibility for, What This Book Is Not, What This Book Is Not

Cryptfs support for, The Virtual Filesystem Interface

CVS used by, CVS

history of, NetBSD, FreeBSD, and OpenBSD, Second-Generation Commercial Unix Systems

host-based firewall for, The ipfw host-based firewall

kernel security levels on, BSD Kernel Security Levels

master password file, The shadow password and master password files

PAM support for, Pluggable Authentication Modules (PAM)

password file, printing, Accounts Without Passwords

S/Key support, Codebooks

source-based management systems, Source code and patches

su log, The su Log

sulog, scanning, The sulog under Berkeley Unix

Freedman, David H. (@ Large), Computer Crime and Law

fscanf() system call, Things to Avoid

fsck program, Hidden files and directories, Tree structure attacks

FSF (Free Software Foundation), FSF and GNU

FSINFO function (RPC), The NFS Protocol

fsirand program, Limit Exported and Mounted Filesystems, Use fsirand

FSSTAT function (RPC), The NFS Protocol

fstab file, Which Files to Back Up?, Back Doors and Trap Doors

fstat() system call, Design Principles

FSUID (filesystem UID), Process real and effective UIDs

FTP (File Transfer Protocol), Users and Groups, Networking and Unix, TCP, FTP: File Transfer Protocol (TCP Ports 20 and 21), Anonymous FTP, FTP active mode, FTP active mode–FTP passive mode, FTP active mode, Setting up an FTP server–Setting up anonymous FTP with the standard Unix FTP server, Restricting FTP with the standard Berkeley FTP server, Setting up anonymous FTP with the standard Unix FTP server–Setting up anonymous FTP with the standard Unix FTP server, Setting up anonymous FTP with the standard Unix FTP server, Setting up anonymous FTP with the standard Unix FTP server, Setting up anonymous FTP with the standard Unix FTP server, Allowing only FTP access, Setting up the chroot( ) environment, Limiting users

active mode, FTP active mode

allowing without logging in, Allowing only FTP access

anonymous, Users and Groups, Anonymous FTP, Setting up anonymous FTP with the standard Unix FTP server–Setting up anonymous FTP with the standard Unix FTP server

bounce attack, FTP active mode

chroot() system call and, Setting up the chroot( ) environment

~ftp/bin directory, Setting up anonymous FTP with the standard Unix FTP server

~ftp/etc directory, Setting up anonymous FTP with the standard Unix FTP server

~ftp/pub directory, Setting up anonymous FTP with the standard Unix FTP server

passive mode, FTP active mode–FTP passive mode

restricted filesystems and, Limiting users

restricting accounts with, Restricting FTP with the standard Berkeley FTP server

setting up server, Setting up an FTP server–Setting up anonymous FTP with the standard Unix FTP server

ftp user, Users and Groups

ftpd server, FTP: File Transfer Protocol (TCP Ports 20 and 21), Setting up an FTP server, Changing the Account’s Login Shell, Back Doors and Trap Doors

ftpusers file, Restricting FTP with the standard Berkeley FTP server

ftruncate() system call, File Permissions

The Fugitive Game: Online with Kevin Mitnick (Littman, Jonathan), Understanding the Computer Security “Culture”

full backup, Types of Backups

function keys, passwords programmed to, Function keys

functionality, add-on, Add-on Functionality Breeds Problems–Add-on Functionality Breeds Problems

Fundamentals of Computer Security Technology (Amoroso, Edward), General Computer Security

Fuzz program tests, What he found