Table of Contents for

Practical UNIX and Internet Security, 3rd Edition

S

S/Key codebook scheme, Codebooks

S/MIME, SMTP: Simple Mail Transfer Protocol (TCP Port 25)

sa command, Process Accounting: The acct/pacct File

sabotage, Authors

saboteurs, Introduction: Some Fundamental Questions (see intruders)

safe shutdown, accounts for, Accounts That Run a Single Command

SafeTP, FTP: File Transfer Protocol (TCP Ports 20 and 21)

Safeware: System Safety and Computers. A Guide to Preventing Accidents and Losses Caused by Technology (Leveson, Nancy G.), Computer-Related Risks

salt, Unix salt–Unix salt

Saltzer, Jerome, Secure Programming Techniques

Samba, Network Filesystems, Configuring the Samba Server, Configuring the Samba Server–Improving Samba Security, Configuring the Samba Server, Samba Server Security–Improving Samba Security, Connecting to the server, User authentication–User authentication, Authorization–Authorization, Data integrity and privacy, Samba Client Security

(see also SMB)

authorization, Authorization–Authorization

client security, Samba Client Security

configuring, Configuring the Samba Server

data integrity, Data integrity and privacy

security and, Samba Server Security–Improving Samba Security

server connections, Connecting to the server

user authentication, User authentication–User authentication

sanitizing media, Sanitizing Media Before Disposal–Sanitizing Printed Media

SANS (Systems Administration and Network Security), SANS Security Alert Consensus, Systems Administration and Network Security (SANS)

SANTA (Security Administrator Network Tool for Analysis), SATAN

SASL (Simple Authentication and Security Layer), Pluggable Authentication Modules (PAM)

SATAN (Security Administrator Tool for Analyzing Networks), Network Scanning, SATAN

savacct file, Process Accounting: The acct/pacct File

saved UIDs, Saved IDs

sbrk() system call, Design Principles

SC Magazine (InfoSecurity News), Security Periodicals

scanf() system call, Things to Avoid

scanners, telephone, Telephone scanning

SCCS (Source Code Control System), Building an Automatic Backup System

Schales, Doug, Tiger

Schiller, Jeffrey, Picking a Random Seed, Picking a Random Seed

Schneier, Bruce, Common Symmetric Key Algorithms, Cryptography Books, General Computer Security

Applied Cryptography: Protocols, Algorithms, and Source Code in C, Cryptography Books

Secrets and Lies: Digital Security in a Networked World, General Computer Security

Schroeder, M. D., Secure Programming Techniques

Schwartz, Randal L. (Learning Perl), Miscellaneous References

scp program, Networking and Unix

screensavers, Screensavers, Screensavers

back doors to, Screensavers

password-protected, Screensavers

script command, logging break-ins with, Rule #2: Document

SE Linux (Security Enhanced Linux), “Secure” Versions of Unix

secrecy, Authentication, data integrity, and secrecy (see confidentiality)

secret key algorithms, Cryptographic Algorithms and Functions (see symmetric key algorithms)

secret keys, Cryptographic Algorithms and Functions, Cryptographic Algorithms and Functions, Proving your identity, Limitations of Secure RPC

Secret Service, U.S., U.S. Secret Service (USSS)

Secrets and Lies: Digital Security in a Networked World (Schneier, Bruce), General Computer Security

Secure European System for Applications in a Multivendor Environment (SESAME), SESAME

secure file, Essential Log Files

Secure Hash Algorithms (SHA), Message Digest Functions

Secure NFS, Use Secure NFS

Secure RPC, Secure RPC (AUTH_DES)–Limitations of Secure RPC, Secure RPC Authentication–Setting the window, Setting the window, Setting Up Secure RPC with NIS–Limitations of Secure RPC, Using Secure RPC, Limitations of Secure RPC, What NIS+ Does, Using NIS+, Understanding NFS

authentication, Secure RPC Authentication–Setting the window

limitations of, Limitations of Secure RPC

logging in/out with, Using Secure RPC

NFS using, Understanding NFS

NIS+ using, What NIS+ Does, Using NIS+

with NIS/NIS+, Setting Up Secure RPC with NIS–Limitations of Secure RPC

and NTP, Setting the window

Secure Shell, SSH: The Secure Shell (TCP Port 22) (see SSH)

Secure Sockets Layer, Systems-based attacks (see SSL)

secure terminals, Secure Terminals: Limiting Where the Superuser Can Log In, Secure Terminals

Secure Tracking of Office Property (STOP), Tagging

secure Unix systems, “Secure” Versions of Unix

SecureID card, Token Cards

securenets file, Unintended Disclosure of Site Information with NIS

securetty file, Secure Terminals: Limiting Where the Superuser Can Log In

security, Preface–Unix “Security”?, Third-Party Security Tools, What Is Computer Security?, What Is an Operating System?, Security and Unix–The Failed P1003.1e/2c Unix Security Standard, Policies and Guidelines–Risk Management Means Common Sense, Types of Security–Types of Security, Have authority commensurate with responsibility, Defend in depth, Outsourcing Options–Final Words on Outsourcing, The Problem with Security Through Obscurity–Responsible Disclosure, Story: A Failed Site Inspection, Secure Programming Techniques, Account Names Revisited: Using Aliases for Increased Security, Discovering a Break-in, Computer Crime, Chapter 3: Policies and Guidelines, Paper Sources–Security Periodicals, Mailing Lists–SANS Security Alert Consensus, Web Sites–NIH, Usenet Groups, Software Resources–wuarchive ftpd, Organizations–Computer Emergency Response Team Coordination Center (CERT/CC)

breaches, responding to, Discovering a Break-in (see break-ins)

design principles for, Secure Programming Techniques

history of, Preface–Unix “Security”?

laws and, Computer Crime (see legal issues)

mailing lists regarding, Mailing Lists–SANS Security Alert Consensus

organizations regarding, Organizations–Computer Emergency Response Team Coordination Center (CERT/CC)

outsourcing, Outsourcing Options–Final Words on Outsourcing

policy of, What Is an Operating System?, Policies and Guidelines–Risk Management Means Common Sense, Chapter 3: Policies and Guidelines

published resources on, Paper Sources–Security Periodicals

responsibility for, Have authority commensurate with responsibility

risks, Story: A Failed Site Inspection (see risks)

simplified in four steps, Defend in depth

software for, Third-Party Security Tools, Software Resources–wuarchive ftpd

through obscurity, The Problem with Security Through Obscurity–Responsible Disclosure, Account Names Revisited: Using Aliases for Increased Security

types of, Types of Security–Types of Security

Unix and, Security and Unix–The Failed P1003.1e/2c Unix Security Standard

Usenet groups regarding, Usenet Groups

web sites regarding, Web Sites–NIH

security account, Alternative contact strategies

Security Administrator Network Tool for Analysis (SANTA), SATAN

Security Administrator Tool for Analyzing Networks, Network Scanning (see SATAN)

Security Alert Consensus mailing list, SANS Security Alert Consensus

Security Engineering (Anderson, Ross), General Computer Security

Security Enhanced Linux (SE Linux), “Secure” Versions of Unix

security experts, shortage of, Outsourcing Options

security holes, Keeping Secrets, Responsible Disclosure, The Problem with the Superuser, An example of a SUID attack: IFS and the /usr/lib/preserve hole

(see also back doors; threats)

preserve program, An example of a SUID attack: IFS and the /usr/lib/preserve hole

reporting, Responsible Disclosure

superuser account, The Problem with the Superuser

Security in Computing (Pfleeger, Charles P.), General Computer Security

security levels, kernel, BSD Kernel Security Levels

security response teams, Response Personnel? (see response teams)

security scanners, Network Scanning

security tools, Programmed Threats: Definitions, Security Scanners and Other Tools, Security Products and Services Information

published resources on, Security Products and Services Information

used as programmed threats, Programmed Threats: Definitions, Security Scanners and Other Tools

sed scripts, Trojan horses in, Trojan horses in mobile code

Seebass, Scott (UNIX System Administration Handbook), Unix Programming and System Administration

seeds, random number, Tips on Generating Random Numbers, Picking a Random Seed–A Good Random Seed Generator

Seger, Karl (Computer Crime: A Crimefighter’s Handbook), Computer Crime and Law

select() system call, The inetd Program

self-destruct sequences, Hardware Bugs

sendmail program, Networking and Unix, Adding authentication to TCP/IP with ident, Startup examples, SMTP: Simple Mail Transfer Protocol (TCP Port 25)–Overall security of Berkeley sendmail versus other MTAs, Configuration files, Configuration files, Configuration files, Security concerns with SMTP banners and commands, Delivery to programs, Overall security of Berkeley sendmail versus other MTAs–Overall security of Berkeley sendmail versus other MTAs, NIS Domains, Alternative contact strategies, Changes to startup files, Back Doors and Trap Doors, .forward, .procmailrc, .forward, .procmailrc, /etc/mail/aliases, aliases.dir, aliases.pag, and aliases.db, /etc/mail/aliases, aliases.dir, aliases.pag, and aliases.db

(see also email)

.forward file, Configuration files, .forward, .procmailrc

aliases, /etc/mail/aliases, aliases.dir, aliases.pag, and aliases.db

back door in, Back Doors and Trap Doors

configuration files, security and, Configuration files

disabling mail delivery to programs, Delivery to programs

DontBlameSendmail option, Configuration files

finding system administrator using, Alternative contact strategies

.forward file, Changes to startup files

options, security, Security concerns with SMTP banners and commands

run as daemon, Startup examples

same Internet/NIS domain, NIS Domains

security problems with, Overall security of Berkeley sendmail versus other MTAs–Overall security of Berkeley sendmail versus other MTAs

startup file attacks, .forward, .procmailrc

sendmail.cf file, Configuration files, Security concerns with SMTP banners and commands

sendmail.mc file, Security concerns with SMTP banners and commands

separation of duties principle, Least Privilege and Separation of Duties

sequence of commands, Design Principles

ser2net program, Monitoring the Intruder

serial interfaces, Serial Interfaces

Serial Line Internet Protocol, Modems and Unix (see SLIP)

serial numbers, logging, Informational material

serial ports, uucp user for, Users and Groups

Server Message Block, Network Filesystems (see SMB)

server statelessness, Understanding NFS

server vulnerability attacks, IP Security

server-side NFS security, Server-Side NFS Security–The showmount Command

servers, What Is a Deployment Environment?, Physical Security for Servers, Clients and Servers, Authentication and DNS, Understanding Unix Internet Servers and Services, Setting up an FTP server–Setting up anonymous FTP with the standard Unix FTP server, Using Xauthority magic cookies, Summary, Summary, NIS Fundamentals, Things to Do, Small Network of Workstations and a Server, Service Overloading–Service Overloading

backing up, Small Network of Workstations and a Server

bringing up securely, Summary

Internet, Understanding Unix Internet Servers and Services (see Internet servers)

load shedding, Things to Do

master/slave, NIS Fundamentals (see NIS)

nameserver, Authentication and DNS (see DNS)

overloading with requests, Service Overloading–Service Overloading

physical security of, Physical Security for Servers (see physical security)

run as root, Summary

setting up for FTP, Setting up an FTP server–Setting up anonymous FTP with the standard Unix FTP server

Xauthority, Using Xauthority magic cookies

service overloading, Service Overloading–Service Overloading

services, Entering your password (see denial of service attacks network services)

services file, TCP, The /etc/services File, The inetd Program

Services table (NIS+), NIS+ Tables and Other Objects

SESAME (Secure European System for Applications in a Multivendor Environment), SESAME

session hijacking, Telnet (TCP Port 23)

session IDs, Other IDs, Process groups and sessions

session keys, Cryptographic Algorithms and Functions, Proving your identity

SETATTR function (RPC), The NFS Protocol

setgid() system call, Other IDs, SUID and SGID, Tips on Writing SUID/SGID Programs

(see also SGID programs)

setlogmask() system call, Unix syslog

setpgrp() system call, Process groups and sessions

setrlimit() system call, Things to Avoid

setsid() system call, Process groups and sessions

setuid file, Real and Effective UIDs with the su Command

setuid() system call, SUID and SGID, Tips on Writing SUID/SGID Programs

(see also SUID programs)

SG (Signal Ground), The RS-232 Serial Protocol

SGID bit, Sticky Bits, SGID and Sticky Bits on Directories, SGID Bit on Files (System V-Derived Unix Only): Mandatory Record Locking, Use chown with caution

clearing with chown command, Use chown with caution

on directories, SGID and Sticky Bits on Directories

on files, SGID Bit on Files (System V-Derived Unix Only): Mandatory Record Locking

SGID permission, chmod: Changing a File’s Permissions

SGID programs, SUID and SGID–Turning Off SUID and SGID in Mounted Filesystems, Problems with SUID, Finding All of the SUID and SGID Files–The Solaris ncheck command, Turning Off SUID and SGID in Mounted Filesystems, Tips on Writing SUID/SGID Programs–Tips on Writing SUID/SGID Programs, New SUID and SGID files

created by intruders, New SUID and SGID files

disabling (turning off), Turning Off SUID and SGID in Mounted Filesystems

finding all files for, Finding All of the SUID and SGID Files–The Solaris ncheck command

security problems with, Problems with SUID

writing, Tips on Writing SUID/SGID Programs–Tips on Writing SUID/SGID Programs

sh (Bourne shell), Conventions Used in This Book, Problems with SUID, An example of a SUID attack: IFS and the /usr/lib/preserve hole, Shell Features

(see also shells)

IFS variable used by, An example of a SUID attack: IFS and the /usr/lib/preserve hole

prompt, Conventions Used in This Book

SUID version of, Problems with SUID

SHA (Secure Hash Algorithms), Message Digest Functions

SHA-1 algorithm, A Good Random Seed Generator

shadow file, The shadow password and master password files, The /etc/passwd File, Which Files to Back Up?, Accounts Without Passwords, Shadow Password Files

shadow passwords, The /etc/passwd File, The shadow password and master password files, Disabling an Account by Changing the Account’s Password, Shadow Password Files

Shamir, Adi, Public Key Algorithms, Cryptography Papers and Other Publications

“A Method for Obtaining Digital Signatures”, Cryptography Papers and Other Publications

share command, Exporting NFS directories under System V: share and dfstab

shared libraries, protecting, Shared Libraries

shared systems, What Is a Deployment Environment?

sharetab file, Exporting NFS directories under System V: share and dfstab

shareware, viruses in, Viruses on the Distribution Disk

SHARITY client, Data integrity and privacy

shell escapes, Accounts That Run a Single Command, Potential problems with restricted shells

shell scripts, SUID, SUID Scripts–An example of a SUID attack: IFS and the /usr/lib/preserve hole

shell service, TCP

shells, The /etc/passwd File, Restricted shells–Potential problems with restricted shells, Changing the Account’s Login Shell, Integrating One-Time Passwords with Unix, Shell History, Trojan horses in mobile code, Shell Features, Creating Processes, Running the User’s Shell

changing for one-time passwords, Integrating One-Time Passwords with Unix

history files, Shell History

in passwd file, The /etc/passwd File

login, changing, Changing the Account’s Login Shell

protecting from attacks, Shell Features

restricted, Restricted shells–Potential problems with restricted shells

running, Running the User’s Shell

Trojan horses in, Trojan horses in mobile code

shells file, Changing the Account’s Login Shell

Shender, Alex, The Virtual Filesystem Interface

Shimomura, Tsutomu (Takedown: The Pursuit and Capture of Kevin Mitnick, America’s Most Wanted Computer Outlaw -- By the Man Who Did it), Understanding the Computer Security “Culture”

Shockwave Rider (Brunner, John), Understanding the Computer Security “Culture”

shoulder surfing, Authenticating with Passwords

showmount command, The showmount Command, Use showmount -e

showrev command, Package-Based Systems

shredders, paper, Sanitizing Printed Media

shutdown command, Accounts That Run a Single Command

shutdowns, Accounts That Run a Single Command, last program, Safely halting the system

logged by wtmp file, last program

safe, Accounts That Run a Single Command, Safely halting the system

accounts for, Accounts That Run a Single Command

SIGHUP signal, Catching Signals

SIGKILL signal, Catching Signals

Signal Ground (SG), The RS-232 Serial Protocol

signal-grounding attacks, Signal Grounding and Jamming

signals, Signals–Signals, Unix Signals and the kill Command–Killing Multiple Processes at the Same Time, Catching Signals

catching, Catching Signals

kill command and, Unix Signals and the kill Command–Killing Multiple Processes at the Same Time

signatures, data, Upgrading Distributed Applications, Upgrading Distributed Applications, Detecting Changes After the Fact, Checksums and Signatures

(see also digital signatures)

detecting file changes with, Detecting Changes After the Fact, Checksums and Signatures

RPM files having, Upgrading Distributed Applications

SIGSTOP signal, Catching Signals, Killing Rogue or Questionable Processes

SIGTERM signal, Safely halting the system, Unix Signals and the kill Command, Catching Signals

Simple Authentication and Security Layer (SASL), Pluggable Authentication Modules (PAM)

Simple Mail Transfer Protocol, SMTP: Simple Mail Transfer Protocol (TCP Port 25) (see SMTP)

Simple Network Management Protocol (SNMP), SNMP: Simple Network Management Protocol (UDP Ports 161 and 162)

Singh, Simon (The Code Book: The Science of Secrecy from Ancient Egypt to Quantum Cryptography), Cryptography Books

single-user mode, Sensitive Upgrades, Process #1: /etc/init

booting in, Process #1: /etc/init

upgrading in, Sensitive Upgrades

single-user reboot, Key Switches

site inspection, example of, Story: A Failed Site Inspection

slash (/), Current Directory and Paths, IFS attacks

as IFS separator, IFS attacks

pathnames beginning with, Current Directory and Paths

slave server, NIS Fundamentals, NIS Fundamentals

(see also NIS)

SLIP (Serial Line Internet Protocol), Modems and Unix, IP: The Internet Protocol

SMB (Server Message Block), Network Filesystems, Understanding SMB–Improving Samba Security, SMB History, Protocols–File access, Name service, Authentication, File access, Configuring the Samba Server

authentication, Authentication

file access for, File access

history of, SMB History

name service for, Name service

protocols for, Protocols–File access

Samba implementation of, Configuring the Samba Server (see Samba)

smb.conf file, Configuring the Samba Server, Configuring the Samba Server

smbclient, Samba Client Security

smbpasswd program, User authentication

smoke detectors, Smoke

smoke, damaging hardware, Smoke

smoking, effects on hardware, Smoke

SMTP (Simple Mail Transfer Protocol), Authentication and email, SMTP: Simple Mail Transfer Protocol (TCP Port 25)–Overall security of Berkeley sendmail versus other MTAs, SMTP: Simple Mail Transfer Protocol (TCP Port 25), SMTP: Simple Mail Transfer Protocol (TCP Port 25), SMTP: Simple Mail Transfer Protocol (TCP Port 25), SMTP: Simple Mail Transfer Protocol (TCP Port 25)–Overall security of Berkeley sendmail versus other MTAs, Security concerns with SMTP banners and commands–Security concerns with SMTP banners and commands, Security concerns with SMTP banners and commands–Security concerns with SMTP banners and commands, SMTP relaying and bulk email (a.k.a. spam)

banners, security and, Security concerns with SMTP banners and commands–Security concerns with SMTP banners and commands

commands, security and, Security concerns with SMTP banners and commands–Security concerns with SMTP banners and commands

relaying, SMTP relaying and bulk email (a.k.a. spam)

security and, SMTP: Simple Mail Transfer Protocol (TCP Port 25), SMTP: Simple Mail Transfer Protocol (TCP Port 25)–Overall security of Berkeley sendmail versus other MTAs

TLS for encryption with, SMTP: Simple Mail Transfer Protocol (TCP Port 25), SMTP: Simple Mail Transfer Protocol (TCP Port 25)

smtp service, TCP

SNA (System Network Architecture), Adding authentication to TCP/IP with ident

sniffers, Add-on Functionality Breeds Problems, Users, Passwords, and Authentication, Authenticating with Passwords, IP Security, Using Encryption to Protect IP Networks from Eavesdropping, Telnet (TCP Port 23), Telnet (TCP Port 23), One-Time Passwords

(see also eavesdropping)

network, IP Security

packet, Using Encryption to Protect IP Networks from Eavesdropping, Telnet (TCP Port 23)

password, Users, Passwords, and Authentication, Authenticating with Passwords, One-Time Passwords

SNMP (Simple Network Management Protocol), UDP, SNMP: Simple Network Management Protocol (UDP Ports 161 and 162)

snoop program, Monitoring Your Network with tcpdump, Monitoring the Intruder

Snort system, Snort

snprintf() system call, Things to Avoid

Snyder, Garth (UNIX System Administration Handbook), Unix Programming and System Administration

So, Bryan (“An Empirical Study of the Reliability of UNIX Utilities”), Miscellaneous References

social engineering attacks, Sanitizing Printed Media, IP Security

socket, Unix syslog, Unix syslog

UDP, Unix syslog

Unix domain, Unix syslog

SOCKS, Things to Do

socks service, TCP

soft process limits, Soft Process Limits: Preventing Accidental Denial of Service

software, Preface, Third-Party Security Tools, The Birth of Unix, Expectations, Software Quality–Add-on Functionality Breeds Problems, Software Quality, Types of Security, Types of Security, Setting up anonymous FTP with the standard Unix FTP server, Setting up anonymous FTP with the standard Unix FTP server, NIS+ Limitations, One Bug Can Ruin Your Whole Day . . ., An Empirical Study of the Reliability of Unix Utilities–Where’s the beef?, Tips on Avoiding Security-Related Bugs, Design Principles, Design Principles, Design Principles, Coding Standards–Before You Finish, Before You Finish, Software Management Systems–CVS, Software Management Systems, Software Management Systems, Updating System Software–Sensitive Upgrades, The Role of Backups, What Should You Back Up?, What Should You Back Up?, Software for Backups–Network Backup Systems, Other accounts, Checking new software, Other Logs, Informational material, Rule #3: Plan Ahead, Monitoring the Intruder, Programmed Threats: Definitions, Programmed Threats: Definitions, Back Doors and Trap Doors, Viruses, Other files, Access Devices and Copyrighted Software, Access Devices and Copyrighted Software, Mandatory blocking, Viruses on the Distribution Disk–Security Bugs That Never Get Fixed, Buggy Software–Buggy Software, Hacker Challenges, Security Bugs That Never Get Fixed, Processes and Programs, Processes and Programs, Security Products and Services Information, Software Resources–wuarchive ftpd

(see also programming)

access to, Expectations, Types of Security

backing up, What Should You Back Up? (see backups)

backups, Software for Backups–Network Backup Systems

bugs in, An Empirical Study of the Reliability of Unix Utilities–Where’s the beef?, Buggy Software–Buggy Software

checking new, Checking new software, Back Doors and Trap Doors

coding standards for, Coding Standards–Before You Finish

consistency of, Types of Security

copyrighted, legal issues regarding, Access Devices and Copyrighted Software

data corruption by, The Role of Backups

default accounts for, Other accounts

design principles for, Design Principles

development files, protecting, Other files

digital signatures distributed with, Software Management Systems

distributed through mirror sites, Software Management Systems

documentation for, Design Principles

filtering, for schools, Mandatory blocking

hacker challenges and, Hacker Challenges

integrity-checking, NIS+ Limitations

log files created by, Other Logs

malicious, Programmed Threats: Definitions (see programmed threats)

management systems, Software Management Systems–CVS

monitoring, Monitoring the Intruder

obtained from outside sources, Programmed Threats: Definitions, Viruses

operating systems, Preface (see specific operating systems)

patches for, logging, Informational material

processes and, Processes and Programs

published resources on, Security Products and Services Information

quality of, Software Quality–Add-on Functionality Breeds Problems

race conditions, Design Principles

running as superuser, One Bug Can Ruin Your Whole Day . . .

security bugs in, Security Bugs That Never Get Fixed

security-related, Third-Party Security Tools, Software Resources–wuarchive ftpd

specifications, importance of, Tips on Avoiding Security-Related Bugs

stolen (pirated), Setting up anonymous FTP with the standard Unix FTP server, Access Devices and Copyrighted Software

stored via FTP, Setting up anonymous FTP with the standard Unix FTP server

system, updating, Updating System Software–Sensitive Upgrades

testing, Software Quality, Before You Finish

threads and, Processes and Programs

toolkit for break-ins, Rule #3: Plan Ahead

tools in Unix, The Birth of Unix

trusting, Viruses on the Distribution Disk–Security Bugs That Never Get Fixed

Solaris, What This Book Is Not, Versions Covered in This Book, Versions Covered in This Book, Versions Covered in This Book, “Secure” Versions of Unix, Unix Wars 2: SVR4 versus OSF/1, Changing your password, The shadow password and master password files, Using Network Authorization Systems, Pluggable Authentication Modules (PAM), The /etc/group file, The sulog under Solaris, The Virtual Filesystem Interface, Exploring with the ls Command, File Permissions, File Permissions, Access Control Lists, Sticky Bits, SGID and Sticky Bits on Directories, The Solaris ncheck command, Startup on different Unix systems, Access Control Lists with TCP Wrappers, Using a Host-Based Packet Firewall, Sun RPC’s portmapper (UDP and TCP Ports 111), /etc/logindevperm, Monitoring Your Network with tcpdump, Sun’s portmap/rpcbind, RPC Authentication, AUTH_KERB, Setting the window, The MOUNT Protocol, Exporting NFS directories under System V: share and dfstab, Set the portmon Variable, Understanding SMB, The Lesson of the Internet Worm, drand48( ), lrand48( ), and mrand48( ), Package-Based Systems, Encrypting Your Backups, Accounts Without Passwords, Codebooks, Tripwire, utmp and wtmp Files, loginlog File, Monitoring the Intruder, Too many processes, Swapping to files, Tree structure attacks

(see also System V Unix)

ACL support for, Access Control Lists

AUTH_SYS and AUTH_UNIX, RPC Authentication

bug fixes, responsibility for, What This Book Is Not

clri command, Tree structure attacks

Cryptfs support for, The Virtual Filesystem Interface

Door construct, Exploring with the ls Command, File Permissions

exporting NFS directories with, Exporting NFS directories under System V: share and dfstab

extra file permission character, File Permissions

Fingerprints Database, Tripwire

group passwords and, The /etc/group file

history of, Unix Wars 2: SVR4 versus OSF/1

host-based firewall for, Using a Host-Based Packet Firewall

Kerberos client and server support, AUTH_KERB

Kerberos client for, Using Network Authorization Systems

loginlog file, loginlog File

mountd daemon, The MOUNT Protocol

ncheck command, The Solaris ncheck command

nonexecutable stack, The Lesson of the Internet Worm

package management commands, Package-Based Systems

PAM support for, Pluggable Authentication Modules (PAM)

passwd command, -r option supported, Changing your password

password file, printing, Accounts Without Passwords

portmon variable, Set the portmon Variable

process limit, Too many processes

random number generators, drand48( ), lrand48( ), and mrand48( )

rpcbind program, Sun RPC’s portmapper (UDP and TCP Ports 111), Sun’s portmap/rpcbind

S/Key support, Codebooks

Secure RPC time window, Setting the window

secure version of, “Secure” Versions of Unix

server startup on, Startup on different Unix systems

SGID and sticky bits for directories, SGID and Sticky Bits on Directories

SGID bit used for file locking, Sticky Bits

shadow password file, The shadow password and master password files

SMB support, Understanding SMB

snoop program, Monitoring Your Network with tcpdump

su log, scanning, The sulog under Solaris

swapping to files, Swapping to files

TCP wrappers support, Access Control Lists with TCP Wrappers

ttywatch program, Monitoring the Intruder

ufsdump program, Encrypting Your Backups

versions of, Versions Covered in This Book

wtmpx log file, utmp and wtmp Files

X security, /etc/logindevperm

Solstice PC-NetLink, Configuring the Samba Server

Source Code Control System (SCCS), Building an Automatic Backup System

source code, keeping secret, Keeping Secrets, Keeping Secrets

(see also programming; software)

source-based software management systems, Source-Based Systems, Upgrading Distributed Applications, Upgrading Distributed Applications

backing out of upgrades, Upgrading Distributed Applications

upgrading with, Upgrading Distributed Applications

space bit, Baud and bps

spaces, in passwords, Good Passwords: Locked Doors

Spafford, Gene, IP Security, Network Scanning, Tripwire, Electronic Resources, COPS (Computer Oracle and Password System), Tripwire

Spaf’s first principle, Have authority commensurate with responsibility

spam, email, Authentication and email, SMTP: Simple Mail Transfer Protocol (TCP Port 25), SMTP relaying and bulk email (a.k.a. spam)

sparse files, Software for Backups

Speciner, Mike (Network Security: Private Communications in a Public World), Network Technology and Security

spies, Kinds of eavesdropping, Authors

industrial, Kinds of eavesdropping

planting programmed threats, Authors

spoofing, IP Security, The TCP Wrappers configuration language, Trusted path

IP, IP Security, The TCP Wrappers configuration language

network connection, Trusted path

sprinkler systems, Fire

sprintf() system call, The Lesson of the Internet Worm, Things to Avoid

square brackets ([]), indicating optional syntax, Conventions Used in This Book

sscanf() system call, Things to Avoid

ssh keys, using for passwords, Password Synchronization: Using the Same Password on Many Machines

ssh program, Verifying your new password, Networking and Unix, Clients and Servers

SSH protocol, SSH: The Secure Shell (TCP Port 22)–Client authentication with SSH, Host authentication with SSH–Host authentication with SSH, Client authentication with SSH, Tunneling X with SSH

client authentication with, Client authentication with SSH

host authentication with, Host authentication with SSH–Host authentication with SSH

tunneling X with, Tunneling X with SSH

ssh service, TCP

.ssh/authorized_keys file, Network Setup, Back Doors and Trap Doors

back door in, Back Doors and Trap Doors

.ssh/known_hosts file, Network Setup

sshd binary, back door in, Back Doors and Trap Doors

sshd user, Users and Groups

sshd_config file, SSH: The Secure Shell (TCP Port 22), Client authentication with SSH

ssh_config file, SSH: The Secure Shell (TCP Port 22)

SSL (Secure Sockets Layer), Systems-based attacks, Message Digest Functions

attacks on, Systems-based attacks

MD5, use of, Message Digest Functions

SSL/TLS, SMTP: Simple Mail Transfer Protocol (TCP Port 25), HTTP, HTTPS: HyperText Transfer Protocol (TCP Ports 80, 443)

staff, Personnel Security (see employees)

stale file handles, File Handles

Stallings, William (Cryptography and Network Security: Principles and Practices), Network Technology and Security

Stallman, Richard, Introduction: Some Fundamental Questions, Introduction: Some Fundamental Questions, FSF and GNU

standalone firewall appliance, Controlling Access to Servers

standards, security policy, Standards, Compliance Audits

Starnes, W. Wyatt, Tripwire

start bit, Serial Interfaces, Baud and bps

startup command, Accounting with System V

startup files, What Is an Operating System?, Changes to startup files, Startup File Attacks–Other initializations

attacks through, Startup File Attacks–Other initializations

modified by intruders, Changes to startup files

stat command, Directory Permissions

stateful inspection, firewalls, Using a Host-Based Packet Firewall

stateless servers (NFS), Connectionless and stateless, Connectionless and stateless

static electricity, Electrical noise

static links, Tips on Writing SUID/SGID Programs

Steele, Guy L., Jr. (C, a Reference Manual), Unix Programming and System Administration

Sterling, Bruce (The Hacker Crackdown: Law and Disorder on the Electronic Frontier), Understanding the Computer Security “Culture”

sticky bit permission, chmod: Changing a File’s Permissions

sticky bits, Sticky Bits–SGID and Sticky Bits on Directories, SGID and Sticky Bits on Directories, Use chown with caution

clearing with chown command, Use chown with caution

on directories, SGID and Sticky Bits on Directories

Stoll, Cliff (The Cuckoo’s Egg), Understanding the Computer Security “Culture”

STOP (Secure Tracking of Office Property), Tagging

stop bit, Serial Interfaces, Baud and bps

storage, local, Protecting Local Storage–Function keys

strcat() system call, Things to Avoid

strcpy() system call, The Lesson of the Internet Worm, Things to Avoid

streadd() system call, Things to Avoid

stream algorithms, Symmetric Key Algorithms

strecpy() system call, Things to Avoid

Stripp, Alan (Code Breakers: The Inside Story of Bletchley Park), Cryptography Books

strncat() system call, Things to Avoid

strncpy() system call, Things to Avoid

strtrns() system call, Things to Avoid

students, programmed threats authored by, Authors

stunnel, Data integrity and privacy

su command, Verifying your new password, The su Command: Changing Who You Claim to Be–sudo: A More Restrictive su, Becoming the Superuser, Becoming the Superuser, Use su with Caution, Using su to Run Commands from Scripts, Restricting su–Restricting su, The su Log, sudo: A More Restrictive su, Secure Terminals: Limiting Where the Superuser Can Log In, Essential Log Files, The su command and the utmp and wtmp files, sulog Log File, “No more processes”

becoming superuser with, Becoming the Superuser, Secure Terminals: Limiting Where the Superuser Can Log In

log of failed attempts, The su Log

logging by, Essential Log Files

logging to sulog file, sulog Log File

restrictions on, Restricting su–Restricting su

running commands from scripts, Using su to Run Commands from Scripts

running with exec command, “No more processes”

security precautions for, Use su with Caution

sudo program as alternative to, sudo: A More Restrictive su

using while superuser, Becoming the Superuser

utmp and wtmp files and, The su command and the utmp and wtmp files

su file, sulog Log File

subnetting, Classical network addresses

substitution ciphers, Roots of Cryptography

sudo program, sudo: A More Restrictive su, The sudo Program

sudoers file, sudo: A More Restrictive su

SUID bit, Sticky Bits, Use chown with caution

SUID permission, chmod: Changing a File’s Permissions

SUID programs, Real and Effective UIDs with the su Command, SUID and SGID–Turning Off SUID and SGID in Mounted Filesystems, Problems with SUID, SUID Scripts–An example of a SUID attack: IFS and the /usr/lib/preserve hole, An example of a SUID attack: IFS and the /usr/lib/preserve hole, Finding All of the SUID and SGID Files–The Solaris ncheck command, Turning Off SUID and SGID in Mounted Filesystems, Tips on Writing SUID/SGID Programs–Tips on Writing SUID/SGID Programs, Limiting users, New SUID and SGID files, Back Doors and Trap Doors

back door via, Back Doors and Trap Doors

chroot() system call and, Limiting users

created by intruders, New SUID and SGID files

disabling (turning off), Turning Off SUID and SGID in Mounted Filesystems

finding all files for, Finding All of the SUID and SGID Files–The Solaris ncheck command

security problems with, Problems with SUID, An example of a SUID attack: IFS and the /usr/lib/preserve hole

shell scripts, SUID Scripts–An example of a SUID attack: IFS and the /usr/lib/preserve hole

writing, Tips on Writing SUID/SGID Programs–Tips on Writing SUID/SGID Programs

sulog file, The sulog under Berkeley Unix, Essential Log Files, Essential Log Files, sulog Log File

sum command, Checksums and Signatures

Sun NIS, Sun’s Network Information Service (NIS) (see NIS)

Sun NIS+, Sun’s NIS+ (see NIS+)

Sun RPC, Sun RPC–AUTH_KERB (see RPC)

SUN-DES-1 authentication, The xhost facility

SunOS, Versions Covered in This Book, The Unix Wars: Why Berkeley 4.2 over System V, SGID and Sticky Bits on Directories, Specifying trusted hosts with /etc/hosts.equiv and ~/.rhosts, Tree structure attacks

history of, The Unix Wars: Why Berkeley 4.2 over System V

SGID and sticky bits for directories, SGID and Sticky Bits on Directories

trusted hosts and, Specifying trusted hosts with /etc/hosts.equiv and ~/.rhosts

unlink command, Tree structure attacks

versions of, Versions Covered in This Book

SunRay systems, What Is a Deployment Environment?

sunrpc service, TCP, UDP

Superincreasing Knapsack Problem, Analytic attacks

superuser, Unix “Security”?, “Secure” Versions of Unix, Conventions Used in This Book, The Failed P1003.1e/2c Unix Security Standard, Changing your password, Verifying your new password, Changing another user’s password, Changing another user’s password, Users and Groups, User Identifiers (UIDs), The /etc/group file, The Superuser (root)–The Problem with the Superuser, The Superuser (root), The Superuser (root), What the Superuser Can Do, What the Superuser Can’t Do, Any Username Can Be a Superuser, The Problem with the Superuser, The su Command: Changing Who You Claim to Be, Becoming the Superuser, Use su with Caution, Use su with Caution, Restricting su, Restricting su, Final caution, Final caution, sudo: A More Restrictive su, Restrictions on the Superuser–Linux Capabilities, Linux Capabilities, File Times, File Times, chmod: Changing a File’s Permissions, Problems with SUID, SUID Scripts, chown: Changing a File’s Owner, chgrp: Changing a File’s Group, Setting Up the Unix Device, Privilege testing, Overall security of Berkeley sendmail versus other MTAs, DNS best practices, NTP: Network Time Protocol (UDP Port 123), Summary, NFS and root, Use Root Ownership, Configuring the Samba Server, One Bug Can Ruin Your Whole Day . . ., One Bug Can Ruin Your Whole Day . . ., The Lesson of the Internet Worm–The Lesson of the Internet Worm, The superuser account, Protecting the root Account–Trusted computing base, sulog Log File, Alternative contact strategies, What the Superuser Can and Cannot Do–What the Superuser Can and Cannot Do, Chapter 5: Users, Groups, and the Superuser

abilities of, What the Superuser Can and Cannot Do–What the Superuser Can and Cannot Do

becoming with su command, The su Command: Changing Who You Claim to Be, Becoming the Superuser, Restricting su

becoming with SUID csh, Problems with SUID

bugs giving access to, The Lesson of the Internet Worm–The Lesson of the Internet Worm

capabilities of, What the Superuser Can Do

changing file group, chgrp: Changing a File’s Group

changing file owner, chown: Changing a File’s Owner

changing file permissions, chmod: Changing a File’s Permissions

changing file times, File Times

changing system clock, File Times

changing user passwords, Verifying your new password, Changing another user’s password

compartmentalization as alternative to, Linux Capabilities

fingering, Alternative contact strategies

kermit program and, Privilege testing

logging attempts to become, sulog Log File (see sulog file)

MAC systems not having, The Superuser (root)

modem devices owned by, Setting Up the Unix Device

nameserver owned by, DNS best practices

NFS ownership, Use Root Ownership

NFS protocol and, NFS and root

NTP running as, NTP: Network Time Protocol (UDP Port 123)

password for, Changing your password, The superuser account

forgetting, Changing your password

as point of attack, Unix “Security”?

Posix P1003.1e/2c restrictions for, The Failed P1003.1e/2c Unix Security Standard

privileges removed by secure Unix, “Secure” Versions of Unix

programs running as, One Bug Can Ruin Your Whole Day . . .

prompt for, Conventions Used in This Book

protecting account for, Protecting the root Account–Trusted computing base

restricting abilities of, The Superuser (root)

restrictions on, What the Superuser Can’t Do, Restrictions on the Superuser–Linux Capabilities

Samba daemons run as, Configuring the Samba Server

security checklist for, Chapter 5: Users, Groups, and the Superuser

security implications of, One Bug Can Ruin Your Whole Day . . .

security precautions for, Final caution, Final caution

security problems with, The Problem with the Superuser

sendmail running as, Overall security of Berkeley sendmail versus other MTAs

servers run as, Summary

stealing, Use su with Caution

SUID scripts run as, SUID Scripts

Trojan horse compromising, Use su with Caution

UID for, User Identifiers (UIDs)

username for, Any Username Can Be a Superuser

using passwd command, Changing another user’s password

using privileges with sudo command, sudo: A More Restrictive su

wheel group and, The /etc/group file, Restricting su

suppliers, Can You Trust Your Suppliers? (see vendors)

surge suppressors, Lightning

SVR4 Unix, Unix Wars 2: SVR4 versus OSF/1, The /etc/group file, Setting up the chroot( ) environment, Setting up the chroot( ) environment, Finding Dormant Accounts, Secure Terminals, Assigning Passwords to Users, Shadow Password Files, Password Aging and Expiration, last program, Accounting with System V

(see also System V Unix)

chroot() system call and, Setting up the chroot( ) environment

expiring accounts, Finding Dormant Accounts

group passwords and, The /etc/group file

history of, Unix Wars 2: SVR4 versus OSF/1

password aging, Password Aging and Expiration

preventing users from changing passwords, Assigning Passwords to Users

process accounting with, Accounting with System V

restricting root account to console, Secure Terminals

shadow password file, Shadow Password Files

wtmp file, viewing, last program

swap partition, SGID and Sticky Bits on Directories

swap space, running out of, Swap Space Problems–Swapping to files

swapping, Swap Space Problems

Swatch program, Swatch: A Log File Analysis Tool, Swatch

sweeping telephone lines, Eavesdropping countermeasures

symbolic links, Directories and links, File Permissions, Setting up the chroot( ) environment, Read-Only Filesystems

(see also links)

avoiding in restricted filesystems, Setting up the chroot( ) environment

permissions and, File Permissions

read-only partitions and, Read-Only Filesystems

SYMLINK function (RPC), The NFS Protocol

symmetric key algorithms, Cryptographic Algorithms and Functions–Systems-based attacks, Cryptographic Algorithms and Functions, Symmetric Key Algorithms, Symmetric Key Algorithms, Cryptographic Strength of Symmetric Algorithms, Key Length with Symmetric Key Algorithms–Key Length with Symmetric Key Algorithms, Common Symmetric Key Algorithms, Attacks on Symmetric Encryption Algorithms, Cryptanalysis, Public Key Algorithms

attacks on, Attacks on Symmetric Encryption Algorithms

block algorithms, Symmetric Key Algorithms

common types of, Common Symmetric Key Algorithms

cryptographic strength of, Cryptographic Strength of Symmetric Algorithms

key length and, Key Length with Symmetric Key Algorithms–Key Length with Symmetric Key Algorithms, Public Key Algorithms

security problems with, Cryptographic Algorithms and Functions

stream algorithms, Symmetric Key Algorithms

verifying with peer review, Cryptanalysis

SYN bit, TCP

SYN flood attacks, Hardening Against Attacks, Clogging (SYN Flood Attacks)

sync account, Accounts That Run a Single Command

sync command, Accounts That Run a Single Command

sync() system call, Device Files

synchronization of passwords, Password Synchronization: Using the Same Password on Many Machines

sysadmsh program, Password Generators

sysctl command, BSD Kernel Security Levels

syslog facility, The su Log, The Lesson of the Internet Worm, Things to Avoid, Unix Log File Utilities, Unix syslog–Beware false syslog log entries, Unix syslog, Unix syslog, The syslog message, The syslog message, The syslog message, The syslog.conf configuration file–The syslog.conf configuration file, Using syslog in a networked environment, Using syslog in a networked environment, Incorporating syslog into your own programs, Beware false syslog log entries, Where to Log–Logging everything everywhere

alternatives to, Using syslog in a networked environment

argument length checked by, Things to Avoid

buffer overruns in, The Lesson of the Internet Worm

configuration file, The syslog.conf configuration file–The syslog.conf configuration file

false log entries, Beware false syslog log entries

files used by, Unix syslog

library for, Unix syslog

list of facilities in, The syslog message

messages generated by, The syslog message

in networked environment, Using syslog in a networked environment

priorities for, The syslog message

programming with, Incorporating syslog into your own programs

where to log, Where to Log–Logging everything everywhere

syslog file, What TCP Wrappers does, Essential Log Files

syslog service, UDP

syslog.conf file, Unix syslog, The syslog.conf configuration file–The syslog.conf configuration file

syslogd file, Unix syslog

systat service, systat (TCP Port 11)

system, What Is an Operating System?, What Is an Operating System?, What Is an Operating System?, Types of Security, Trust, Backing Up System Files–Building an Automatic Backup System, Accounts That Run a Single Command, Safely halting the system, Safely halting the system, CPU overload attacks

(see also specific operating systems)

auditing activity on, Types of Security

backing up critical files, Backing Up System Files–Building an Automatic Backup System

configuration files, What Is an Operating System?

CPU overload attacks, CPU overload attacks

database files, What Is an Operating System?

safe shutdown, Accounts That Run a Single Command, Safely halting the system

startup files, What Is an Operating System?

trust in, Trust

system administrator, Adding Up the Numbers, Changing your password, The /etc/group file, The umask, Sanitizing Media Before Disposal, Restricting FTP with the standard Berkeley FTP server, Overflowing system mailboxes, The Role of Backups, The Role of Backups, Default Accounts, The sudo Program, How to Contact the System Administrator of a Computer You Don’t Know–Alternative contact strategies, Your System Administrator?, Unix Programming and System Administration

(see also superuser)

adm account for, Default Accounts

blocking system accounts from, Restricting FTP with the standard Berkeley FTP server

changing password for, Changing your password

cooperating with intruders, Adding Up the Numbers

errors by, The Role of Backups

listed in wheel group, The /etc/group file

mail aliases for, Overflowing system mailboxes

published resources for, Unix Programming and System Administration

remote, contacting regarding break-in, How to Contact the System Administrator of a Computer You Don’t Know–Alternative contact strategies

sanitizing backup tapes, Sanitizing Media Before Disposal

setting umask, The umask

sudo program used by multiple administrators, The sudo Program

trusting, Your System Administrator?

system calls, Conventions Used in This Book, Conventions Used in This Book, Design Principles, Coding Standards, Coding Standards

(see also specific system calls)

checking arguments to, Coding Standards

checking return codes from, Coding Standards

failures of, Design Principles

format used in book, Conventions Used in This Book

system clock, File Times, NTP: Network Time Protocol (UDP Port 123)–An NTP example, Sudden changes in time, Setting the window, Picking a Random Seed

changing, File Times

for random seeds, Picking a Random Seed

Secure RPC timestamp, Setting the window

sudden time changes in, Sudden changes in time

synchronizing, NTP: Network Time Protocol (UDP Port 123)–An NTP example

system files, Read-Only Filesystems, System initialization files, Writable system files and directories

initialization files, System initialization files

read-only access to, Read-Only Filesystems

world-writable, Writable system files and directories

system libraries, protecting, Other files

system manuals, What This Book Is (see manuals)

System Network Architecture (SNA), Adding authentication to TCP/IP with ident

system software, updating, Updating System Software–Sensitive Upgrades

system users, Users and Groups

System V Unix, Which Unix System?, Versions Covered in This Book, Versions Covered in This Book, Unix goes commercial–Unix Wars 2: SVR4 versus OSF/1, Restricting su, Secure Terminals: Limiting Where the Superuser Can Log In, File Permissions, chmod: Changing a File’s Permissions, The umask, SGID Bit on Files (System V-Derived Unix Only): Mandatory Record Locking, Device Files, Connecting a Modem to Your Computer, Startup on different Unix systems, Exporting NFS directories under System V: share and dfstab, drand48( ), lrand48( ), and mrand48( ), Accounts Without Passwords, Setting up the chroot( ) environment, Password Generators, lastlog File, utmp and wtmp Files, utmp and wtmp Files, loginlog File, Accounting with System V, sulog Log File, Listing processes with Solaris and other Unix systems derived from System V, Process #1: /etc/init, Unix Security References

(see also Linux; Solaris; SVR4 Unix)

chroot() system call and, Setting up the chroot( ) environment

default umask value, The umask

device file permissions, Device Files

exporting NFS directories, Exporting NFS directories under System V: share and dfstab

FIFO file type, File Permissions

history of, Unix goes commercial–Unix Wars 2: SVR4 versus OSF/1

inittab program, Process #1: /etc/init

loginlog file, loginlog File

logins recorded in lastlog, lastlog File

modems and, Connecting a Modem to Your Computer

password files, Accounts Without Passwords

password generators, Password Generators

permission options for, chmod: Changing a File’s Permissions

process accounting with, Accounting with System V

ps command, Listing processes with Solaris and other Unix systems derived from System V

published resources for, Unix Security References

random number generators, drand48( ), lrand48( ), and mrand48( )

Release 4, Versions Covered in This Book (see SVR4 Unix)

server startup on, Startup on different Unix systems

SGID bit on files, SGID Bit on Files (System V-Derived Unix Only): Mandatory Record Locking

su command and, Restricting su

sulog file settings, sulog Log File

terminal security on, Secure Terminals: Limiting Where the Superuser Can Log In

utmp and wtmp log files, utmp and wtmp Files

wtmpx log file, utmp and wtmp Files

system() system call, An example of a SUID attack: IFS and the /usr/lib/preserve hole, Things to Avoid, Tips on Writing SUID/SGID Programs

Systems Administration and Network Security, Systems Administration and Network Security (SANS) (see SANS)

systems-based crytpographic attacks, Systems-based attacks