Table of Contents for

Practical UNIX and Internet Security, 3rd Edition

L

L-devices file, Connecting a Modem to Your Computer

Lai, Xuejia (“On the Design and Security of Block Ciphers”), Cryptography Papers and Other Publications

LaMacchia, Brian A., Limitations of Secure RPC, Cryptography Papers and Other Publications

“Computation of Discrete Logarithms in Prime Fields”, Cryptography Papers and Other Publications

LANs (Local Area Networks), Eavesdropping on 802.11 wireless LANs, Networking, IP: The Internet Protocol

laptops, Explosions, Extreme temperatures, Vibration, Laptops and Portable Computers, Locks, Tagging, Laptop Recovery Software and Services

locking, Locks

recovery from theft, Laptop Recovery Software and Services

ruggedized, Explosions

tagging, Tagging

temperature of, Extreme temperatures

theft prevention for, Laptops and Portable Computers

vibration protection for, Vibration

last program, Finding Dormant Accounts, Examining the utmp and wtmp files, last program, Pruning the wtmp file

lastcomm program, Process Accounting: The acct/pacct File, Accounting with BSD and Linux

lastlog file, Essential Log Files, lastlog File–lastlog File

laws, Computer Crime (see legal issues)

LDAP (Lightweight Directory Access Protocol), Using Network Authorization Systems, LDAP, Networking and Unix, Using Kerberos, LDAP–Setting up the LDAP clients, LDAP, LDAP: The Protocol, LDAP Integrity and Reliability, LDAP Integrity and Reliability, Authentication with LDAP, pam_ldap, Configuring Authentication with nss_ldap–Setting up the LDAP clients, Setting up the LDAP clients

authentication with, Authentication with LDAP

data integrity and, LDAP Integrity and Reliability

nss_ldap configuration, Configuring Authentication with nss_ldap–Setting up the LDAP clients

protocol for, LDAP: The Protocol

reliability and, LDAP Integrity and Reliability

TLS support for, Setting up the LDAP clients

using with Kerberos, Using Kerberos

using with PAM, pam_ldap

versions of, LDAP

Learning Perl (Schwartz, Randal L. and Phoenix, Tom), Miscellaneous References

leased telephone lines, Protection of Modems and Lines

least privilege principle, An example of a SUID attack: IFS and the /usr/lib/preserve hole, Least Privilege and Separation of Duties

legal issues, Kinds of eavesdropping, Legal Issues, Comparison Copies, Monitoring the Intruder, Worms, Your Legal Options After a Break-in–The Responsibility to Report Crime, Your Legal Options After a Break-in, Filing a Criminal Complaint–Federal jurisdiction, Choosing jurisdiction–Federal jurisdiction, Federal Computer Crime Laws, Hazards of Criminal Prosecution–Hazards of Criminal Prosecution, The Responsibility to Report Crime, The Responsibility to Report Crime, Criminal Hazards–Criminal Hazards, Access Devices and Copyrighted Software, Access Devices and Copyrighted Software, Pornography, Indecency, and Obscenity–Child pornography, Copyrighted Works, Chapter 25: Computer Crime, Computer Crime and Law

access device limitations, Access Devices and Copyrighted Software

avoiding computer abuse, The Responsibility to Report Crime

backups, Legal Issues

comparison copies and, Comparison Copies

compromised networks, risks of being prosecuted for, Criminal Hazards–Criminal Hazards

copyright laws, Access Devices and Copyrighted Software, Copyrighted Works

criminal complaints, filing, Filing a Criminal Complaint–Federal jurisdiction

criminal prosecution, disadvantages of, Hazards of Criminal Prosecution–Hazards of Criminal Prosecution

federal laws regarding computer crimes, Federal Computer Crime Laws

jurisdiction for computer crimes, Choosing jurisdiction–Federal jurisdiction

law enforcement, wiretapping by, Kinds of eavesdropping

license agreements for worms, Worms

monitoring intruders, Monitoring the Intruder

pornography, indecency, obscenity, Pornography, Indecency, and Obscenity–Child pornography

published resources on, Computer Crime and Law

recourses after a break-in, Your Legal Options After a Break-in–The Responsibility to Report Crime

responsibilities to report crime, The Responsibility to Report Crime

security checklist for, Chapter 25: Computer Crime

situations requiring legal action, Your Legal Options After a Break-in

Lenstra, Arjen, Key search attacks, Cryptography Papers and Other Publications

“The Number Field Sieve”, Cryptography Papers and Other Publications

Lenstra, H. W., Jr. (“The Number Field Sieve”), Cryptography Papers and Other Publications

Lesk, Mike, The Birth of Unix

level-zero backup, Types of Backups

Leveson, Nancy G. (Safeware: System Safety and Computers. A Guide to Preventing Accidents and Losses Caused by Technology), Computer-Related Risks

Levy, Steven (Hackers: Heroes of the Computer Revolution), Understanding the Computer Security “Culture”

Leyland, Paul, Key search attacks

/lib directory, Other files

Libes, Don, Password Generators

license agreements, comparison copies and, Comparison Copies

lie-detector tests, of employees, Intensive Investigations

lightning, Protecting Computer Hardware, Lightning

Lightweight Directory Access Protocol, Using Network Authorization Systems (see LDAP)

limit command, Soft Process Limits: Preventing Accidental Denial of Service

LINK function (RPC), The NFS Protocol

link-level encryption, Using Encryption to Protect IP Networks from Eavesdropping

links, Directories and links–Directories and links, Directories and links, Directories and links, Tips on Writing SUID/SGID Programs

(see also symbolic links)

to directories, Directories and links

static, Tips on Writing SUID/SGID Programs

Linux, What This Book Is Not, Versions Covered in This Book, Versions Covered in This Book, Versions Covered in This Book, Versions Covered in This Book, “Secure” Versions of Unix, What Is a Deployment Environment?, Linux, Businesses adopt Unix, Businesses adopt Unix, Businesses adopt Unix, What the Future Holds, What the Future Holds, Software Quality, The shadow password and master password files, Using Network Authorization Systems, Pluggable Authentication Modules (PAM), What the Superuser Can Do, The sulog under Red Hat Linux, sudo: A More Restrictive su, Linux Capabilities–Linux Capabilities, The Virtual Filesystem Interface, The Virtual Filesystem Interface, The Virtual Filesystem Interface, File Times, File Permissions, Access Control Lists, Startup on different Unix systems, Access Control Lists with TCP Wrappers, Using a Host-Based Packet Firewall, Using a Host-Based Packet Firewall, The ipfw host-based firewall, SMTP: Simple Mail Transfer Protocol (TCP Port 25), Sun RPC’s portmapper (UDP and TCP Ports 111), /etc/logindevperm, /etc/exports–/usr/etc/exportfs, Set the portmon Variable, Samba Client Security, The Lesson of the Internet Worm, What he found, Package-Based Systems, Source code and patches, Specialized Backup Programs, Default Accounts, Setting up the chroot( ) environment, Finding Dormant Accounts, Secure Terminals, The sudo Program, Codebooks, Constraining Passwords, Immutable and Append-Only Files, Immutable and Append-Only Files, The chflags command, Kernel security level, BSD’s mtree and Periodic Security Scans, Packaging Tools, Integrity checking with RPM under Linux, Rotating Logs with newsyslog, Accounting with BSD and Linux, Monitoring the Intruder, Recovering from too many processes, Swapping to files, Using quotas, Reserved space, Tree structure attacks, Listing processes with versions of Unix derived from BSD, including Linux, Process real and effective UIDs, Unix Programming and System Administration

(see also System V Unix)

ACL support for, Access Control Lists

append-only files, Immutable and Append-Only Files

bug fixes, responsibility for, What This Book Is Not

capabilities system, Linux Capabilities–Linux Capabilities

chattr() system call, The chflags command

chroot wrapper, Setting up the chroot( ) environment

Cryptfs support for, The Virtual Filesystem Interface

current trends, What the Future Holds

debugfs command, File Times

default accounts for, Default Accounts

exim mailer program for, SMTP: Simple Mail Transfer Protocol (TCP Port 25)

expiring accounts, Finding Dormant Accounts

exporting NFS directories, /etc/exports–/usr/etc/exportfs

ext2fs filesystem, The Virtual Filesystem Interface, Reserved space, Tree structure attacks

FIFO file type, File Permissions

filesystem UID (FSUID), Process real and effective UIDs

filesystem, minfree amount, What the Superuser Can Do

filesystems, The Virtual Filesystem Interface

group disk quotas, Using quotas

for handheld computers, What the Future Holds

history of, Linux, Businesses adopt Unix

host-based firewall for, Using a Host-Based Packet Firewall, The ipfw host-based firewall

immutable files, Immutable and Append-Only Files

Kerberos client for, Using Network Authorization Systems

kernel security levels, Kernel security level

logrotate program, Rotating Logs with newsyslog

mobile versions of, What Is a Deployment Environment?

npasswd package, Constraining Passwords

Openwall patches, The Lesson of the Internet Worm

packaging tools, Packaging Tools

PAM, Pluggable Authentication Modules (PAM), Recovering from too many processes

resource limits, Recovering from too many processes

support for, Pluggable Authentication Modules (PAM)

periodic security-checking scripts, BSD’s mtree and Periodic Security Scans

portmapper program, Sun RPC’s portmapper (UDP and TCP Ports 111)

portmon variable, Set the portmon Variable

process accounting with, Accounting with BSD and Linux

ps command, Listing processes with versions of Unix derived from BSD, including Linux

published resources on, Unix Programming and System Administration

Red Hat, Businesses adopt Unix (see Red Hat Linux)

reliability of, What he found

RPM Package Manager, Package-Based Systems, Integrity checking with RPM under Linux

S/Key support, Codebooks

secure terminals, Secure Terminals

secure versions of, “Secure” Versions of Unix

server startup on, Startup on different Unix systems

shadow password file, The shadow password and master password files

smbfs support, Samba Client Security

software quality, Software Quality

source packages, Source code and patches

stateful inspection program, Using a Host-Based Packet Firewall

sudo program, sudo: A More Restrictive su, The sudo Program

sulog, scanning, The sulog under Red Hat Linux

swapping to files, Swapping to files

TCP Wrappers support, Access Control Lists with TCP Wrappers

ttywatch program, Monitoring the Intruder

VA, Businesses adopt Unix (see VA Linux)

versions of, Versions Covered in This Book, Versions Covered in This Book

X security, /etc/logindevperm

“no dump” file attribute, Specialized Backup Programs

Littman, Jonathan (The Fugitive Game: Online with Kevin Mitnick), Understanding the Computer Security “Culture”

Liu, Cricket (DNS and BIND), Unix Programming and System Administration

ln command, Directories and links

load shedding, Things to Do

local area networks, Networking (see LANs)

LOCAL authentication (NIS+), Using NIS+

local jurisdiction, Local jurisdiction

local storage, protecting, Protecting Local Storage–Function keys

lock program, Screensavers

lock-down, Eavesdropping over local area networks (Ethernet and twisted pairs)

locking accounts, Entering your password

locking files, chmod: Changing a File’s Permissions, Design Principles

locks, hardware, Locks

log books, Handwritten Logs–Informational material

log events, Auditing, Logging, and Forensics

log files, NTP: Network Time Protocol (UDP Port 123), Sudden changes in time, Immutable and Append-Only Files, Auditing, Logging, and Forensics–Essential Log Files, Unix Log File Utilities, Essential Log Files, Essential Log Files, Unix syslog, Rotating Logs with newsyslog–Rotating Logs with newsyslog, Swatch: A Log File Analysis Tool, lastlog File–lastlog File, utmp and wtmp Files–Pruning the wtmp file, utmp and wtmp Files–Pruning the wtmp file, utmp and wtmp Files, loginlog File, Process Accounting: The acct/pacct File, Process Accounting: The acct/pacct File, messages Log File, aculog Log File, sulog Log File, access_log Log File, Logging to a printer, Managing Log Files, Shell History, cron, Monitoring commands, Tracing a Connection, Analyzing the Log Files, Never Trust Anything Except Hardcopy, System initialization files

(see also history files; email, logging)

access_log, access_log Log File

acct, Process Accounting: The acct/pacct File

aculog, aculog Log File

analysis tools, Swatch: A Log File Analysis Tool

analyzing for intruders, Analyzing the Log Files

created during initialization, System initialization files

crontab, cron

hardcopy of, Logging to a printer, Never Trust Anything Except Hardcopy

immutable, Immutable and Append-Only Files

lastlog, lastlog File–lastlog File

list of, Essential Log Files

locations of, Unix Log File Utilities

loginlog, loginlog File

managing, Managing Log Files

messages, messages Log File

pacct, Process Accounting: The acct/pacct File

rotating, Rotating Logs with newsyslog–Rotating Logs with newsyslog

sulog, Essential Log Files, sulog Log File

syslog creating, Unix syslog

system clock and, NTP: Network Time Protocol (UDP Port 123), Sudden changes in time

utmp, utmp and wtmp Files–Pruning the wtmp file, Monitoring commands, Tracing a Connection

wtmp, utmp and wtmp Files–Pruning the wtmp file

wtmpx, utmp and wtmp Files

log server, Unix Log File Utilities

logcheck program, Swatch: A Log File Analysis Tool

logdaemon package, Specifying trusted hosts with /etc/hosts.equiv and ~/.rhosts

logger program, Unix syslog, Incorporating syslog into your own programs

logging, Types of Security, The su Log, Coding Standards, Auditing, Logging, and Forensics–Unix Log File Utilities, Essential Log Files, Unix syslog–Beware false syslog log entries, Rotating Logs with newsyslog–Rotating Logs with newsyslog, Swatch: A Log File Analysis Tool, utmp and wtmp Files–Pruning the wtmp file, Process Accounting: The acct/pacct File–messages Log File, Logging Network Services, Other Logs, Designing a Site-Wide Log Policy–Logging everything everywhere, Logging to a printer, Logging across the network, Logging everything everywhere, Logging everything everywhere, Logging everything everywhere, Handwritten Logs–Informational material, Unix Forensics–Network Setup, Mail, Rule #2: Document, System initialization files, The Responsibility to Report Crime, Chapter 21: Auditing, Logging, and Forensics

(see also forensics; log files)

across networks, Logging across the network

break-ins, Rule #2: Document

C2 audit, Essential Log Files

criminal investigations, and, The Responsibility to Report Crime

critical messages from, Logging everything everywhere

failed passwords, Logging everything everywhere

failed su attempts, The su Log

from third-party software, Other Logs

handwritten logs, Handwritten Logs–Informational material

to hardcopy device, Logging to a printer

individual users, Unix Forensics–Network Setup

network services, Logging Network Services

newsyslog program, Rotating Logs with newsyslog–Rotating Logs with newsyslog

outgoing mail, Mail

policy for, Designing a Site-Wide Log Policy–Logging everything everywhere

process accounting, Process Accounting: The acct/pacct File–messages Log File

security checklist for, Chapter 21: Auditing, Logging, and Forensics

Swatch program, Swatch: A Log File Analysis Tool

syslog facility, Unix syslog–Beware false syslog log entries

what not to log, Logging everything everywhere

who is logged in, utmp and wtmp Files–Pruning the wtmp file

logging in, FTP: File Transfer Protocol (TCP Ports 20 and 21), Allowing only FTP access, TACACS and TACACS+ (UDP Port 49), Using Secure RPC, Initial login–Initial login, Restricting Logins, Managing Dormant Accounts–Finding Dormant Accounts, lastlog File–lastlog File, loginlog File, Startup File Attacks–Other initializations, Starting Up Unix and Logging In–Running the User’s Shell

authentication of, TACACS and TACACS+ (UDP Port 49)

failed attempts, logging, loginlog File

FTP, FTP: File Transfer Protocol (TCP Ports 20 and 21), Allowing only FTP access

access without, Allowing only FTP access

Kerberos system, Initial login–Initial login

preventing for dormant accounts, Managing Dormant Accounts–Finding Dormant Accounts

recorded in log file, lastlog File–lastlog File

restricting, Restricting Logins

with Secure RPC, Using Secure RPC

startup file attacks, Startup File Attacks–Other initializations

logging out, Built-in shell autologout, Using Secure RPC

automatic, Built-in shell autologout

with Secure RPC, Using Secure RPC

logic bombs, Programmed Threats: Definitions, Logic Bombs, Viruses on the Distribution Disk

login file, Secure Terminals, Changes to startup files, .login, .profile, /etc/profile

login program, The Unix Encrypted Password System, Using NIS+, Trusted path, Back Doors and Trap Doors

back doors in, Back Doors and Trap Doors

trusted path for, Trusted path

login service, TCP

logindevperm file, /etc/logindevperm

loginlog file, Essential Log Files, loginlog File, loginlog File

logins command, Accounts Without Passwords

.logout file, Using Secure RPC

long distance service, Protection of Modems and Lines

LOOKUP function (RPC), The NFS Protocol

loopback encryption, The Virtual Filesystem Interface

losses, The Cost of Loss, The Probability of a Loss, The Cost of Prevention, Adding Up the Numbers–Adding Up the Numbers, The Disaster Recovery Plan

(see also disaster planning)

calculating cost of, The Cost of Loss

calculating cost of prevention, The Cost of Prevention

determining whether to protect against, Adding Up the Numbers–Adding Up the Numbers

estimating probability of, The Probability of a Loss

lp user, Users and Groups

lpd system, /etc/hosts.lpd file

lrand48() system call, drand48( ), lrand48( ), and mrand48( )

ls command, Exploring with the ls Command–File Times, File Times, File Permissions, Directory Permissions, Sticky Bits, Checklists and Metadata, Simple listing, Simple listing, Changes to startup files, Changes to startup files, Hidden files and directories

-d option, Simple listing

-i option, Simple listing

-c option, Changes to startup files

file permissions listed by, File Permissions

file times displayed by, File Times

-H option, Hidden files and directories

indicating SUID/SGID programs, Sticky Bits

-l option, Changes to startup files

listing files with control characters, Directory Permissions

lsof command, Monitoring Your Host with netstat, Limitation of netstat and lsof, Discovering an Intruder, Tracing a Connection, Hidden space, lsof: Examining a Process

lstat() system call, Coding Standards