A Guide to Linux Security

Purpose:

There are plenty of guides to Linux Security on the Internet. In fact, we will provide URL's to several of them later in this document. However, many of them are far too complex for beginners or the beginner guides just do not go far enough. What we intend to do is provide a guide that will help those not yet familiar with security as well as help those who know about security, but not how to implement it on Linux.

This guide was originally written for a talk on Linux Security presented to the Triangle Linux Users Group.

Contents:

• Introduction to Security -- Mike (and Jos?)
  • What is security?
  • Why does this stuff even matter?
  • Tradeoff: Usability vs Security
• General System Security -- Mike
  • A quick look at accounts
  • The root account
  • Passwords
  • Network services
  • Patches and updates
• Dialup System Security -- Mike
  • General security on dialup systems
  • Securing single-user systems
  • Dynamic DNS
• Linux Security in a Network -- Jos
  • Restricting who can connect to your system
  • Disabling Services
  • Minimizing security risks in a university network
  • Security on publicly accessible services
• Network Security -- Jos
  • Firewalls - Theory and Setup
  • DMZ's - Theory and Setup
• Tools -- Mike
  • Defense
    • Log Monitoring
    • Connection Monitoring
    • Host Based Intrusion Detection
    • Network Based Intrusion Detection
    • Detecting and recovering from a break-in
  • Attack
    • Vulnerability Analysis
      • Host Analysis
      • Remote Analysis and Port Scanners
    • Password Checkers
    • Buffer Overflows
    • Broken Trust
    • Trojans and Rootkits
    • Mitnick Logs
    • Attack Demonstrations
• Resources -- Both
  • Vendor Parches
  • Mailing Lists
  • Secure Programming
  • Web Pages
  • FTP Sites
• Misc -- Both
  • System availability - disaster recovery