Cari di RHE Linux 
    Red Hat Enterprise Linux Manual
Daftar Isi
(Sebelumnya) 5 : Chapter 5. Diagnosing and ...6 : Chapter 1. Security Overvi ... (Berikutnya)

Security Guide

A Guide to Securing Red Hat Enterprise Linux

Edition 4

Red Hat Engineering Content Services

Legal Notice

Copyright © 2011 Red Hat, Inc.
Based on the Fedora Security Guide (current version at http://docs.fedoraproject.org/en-US/Fedora/16/html/Security_Guide/index.html), written by Johnray Fuller, Eric Christensen, Adam Ligas, and other Fedora Project contributors.
The text of and illustrations in this document are licensed by Red Hat under a Creative Commons Attribution-Share Alike 3.0 Unported license ("CC-BY-SA"). An explanation of CC-BY-SA is available at http://creativecommons.org/licenses/by-sa/3.0/. In accordance with CC-BY-SA, if you distribute this document or an adaptation of it, you must provide the URL for the original version.
Red Hat, as the licensor of this document, waives the right to enforce, and agrees not to assert, Section 4d of CC-BY-SA to the fullest extent permitted by applicable law.
Red Hat, Red Hat Enterprise Linux, the Shadowman logo, JBoss, MetaMatrix, Fedora, the Infinity Logo, and RHCE are trademarks of Red Hat, Inc., registered in the United States and other countries.
Linux® is the registered trademark of Linus Torvalds in the United States and other countries.
Java® is a registered trademark of Oracle and/or its affiliates.
XFS® is a trademark of Silicon Graphics International Corp. or its subsidiaries in the United States and/or other countries.
MySQL® is a registered trademark of MySQL AB in the United States, the European Union and other countries.
All other trademarks are the property of their respective owners.


1801 Varsity Drive
 RaleighNC 27606-2072 USA
 Phone: +1 919 754 3700
 Phone: 888 733 4281
 Fax: +1 919 754 3701

Daftar Isi

Abstract

This book assists users and administrators in learning the processes and practices of securing workstations and servers against local and remote intrusion, exploitation and malicious activity.
Focused on Red Hat Enterprise Linux but detailing concepts and techniques valid for all Linux systems, this guide details the planning and the tools involved in creating a secured computing environment for the data center, workplace, and home.
With proper administrative knowledge, vigilance, and tools, systems running Linux can be both fully functional and secured from most common intrusion and exploit methods.
Preface
1. Document Conventions
1.1. Typographic Conventions
1.2. Pull-quote Conventions
1.3. Notes and Warnings
2. We Need Feedback!
1. Security Overview
1.1. Introduction to Security
1.1.1. What is Computer Security?
1.1.2. SELinux
1.1.3. Security Controls
1.1.4. Conclusion
1.2. Vulnerability Assessment
1.2.1. Thinking Like the Enemy
1.2.2. Defining Assessment and Testing
1.2.3. Evaluating the Tools
1.3. Attackers and Vulnerabilities
1.3.1. A Quick History of Hackers
1.3.2. Threats to Network Security
1.3.3. Threats to Server Security
1.3.4. Threats to Workstation and Home PC Security
1.4. Common Exploits and Attacks
1.5. Security Updates
1.5.1. Updating Packages
1.5.2. Verifying Signed Packages
1.5.3. Installing Signed Packages
1.5.4. Applying the Changes
2. Securing Your Network
2.1. Workstation Security
2.1.1. Evaluating Workstation Security
2.1.2. BIOS and Boot Loader Security
2.1.3. Password Security
2.1.4. Administrative Controls
2.1.5. Session Locking
2.1.6. Available Network Services
2.1.7. Personal Firewalls
2.1.8. Security Enhanced Communication Tools
2.2. Server Security
2.2.1. Securing Services With TCP Wrappers and xinetd
2.2.2. Securing Portmap
2.2.3. Securing NIS
2.2.4. Securing NFS
2.2.5. Securing the Apache HTTP Server
2.2.6. Securing FTP
2.2.7. Securing Postfix
2.2.8. Securing Sendmail
2.2.9. Verifying Which Ports Are Listening
2.2.10. Disable Source Routing
2.2.11. Reverse Path Filtering
2.3. Single Sign-on (SSO)
2.4. Pluggable Authentication Modules (PAM)
2.5. Kerberos
2.6. TCP Wrappers and xinetd
2.6.1. TCP Wrappers
2.6.2. TCP Wrappers Configuration Files
2.6.3. xinetd
2.6.4. xinetd Configuration Files
2.6.5. Additional Resources
2.7. Virtual Private Networks (VPNs)
2.7.1. How Does a VPN Work?
2.7.2. Openswan
2.8. Firewalls
2.8.1. Netfilter and IPTables
2.8.2. Basic Firewall Configuration
2.8.3. Using IPTables
2.8.4. Common IPTables Filtering
2.8.5. FORWARD and NAT Rules
2.8.6. Malicious Software and Spoofed IP Addresses
2.8.7. IPTables and Connection Tracking
2.8.8. IPv6
2.8.9. IPTables
3. Encryption
3.1. Data at Rest
3.1.1. Full Disk Encryption
3.1.2. File Based Encryption
3.2. Data in Motion
3.2.1. Virtual Private Networks
3.2.2. Secure Shell
3.2.3. OpenSSL Intel AES-NI Engine
3.2.4. LUKS Disk Encryption
3.2.5. Using GNU Privacy Guard (GnuPG)
4. General Principles of Information Security
4.1. Tips, Guides, and Tools
5. Secure Installation
5.1. Disk Partitions
5.2. Utilize LUKS Partition Encryption
6. Software Maintenance
6.1. Install Minimal Software
6.2. Plan and Configure Security Updates
6.3. Adjusting Automatic Updates
6.4. Install Signed Packages from Well Known Repositories
7. Federal Standards and Regulations
7.1. Introduction
7.2. Federal Information Processing Standard (FIPS)
7.2.1. Enabling FIPS Mode
7.3. National Industrial Security Program Operating Manual (NISPOM)
7.4. Payment Card Industry Data Security Standard (PCI DSS)
7.5. Security Technical Implementation Guide
8. References
A. Encryption Standards
A.1. Synchronous Encryption
A.1.1. Advanced Encryption Standard - AES
A.1.2. Data Encryption Standard - DES
A.2. Public-key Encryption
A.2.1. Diffie-Hellman
A.2.2. RSA
A.2.3. DSA
A.2.4. SSL/TLS
A.2.5. Cramer-Shoup Cryptosystem
A.2.6. ElGamal Encryption
B. Revision History

Preface

1. Document Conventions

This manual uses several conventions to highlight certain words and phrases and draw attention to specific pieces of information.
In PDF and paper editions, this manual uses typefaces drawn from the Liberation Fonts set. The Liberation Fonts set is also used in HTML editions if the set is installed on your system. If not, alternative but equivalent typefaces are displayed. Note: Red Hat Enterprise Linux 5 and later includes the Liberation Fonts set by default.

1.1. Typographic Conventions

Four typographic conventions are used to call attention to specific words and phrases. These conventions, and the circumstances they apply to, are as follows.
Mono-spaced Bold
Used to highlight system input, including shell commands, file names and paths. Also used to highlight keys and key combinations. For example:
To see the contents of the file my_next_bestselling_novel in your current working directory, enter the cat my_next_bestselling_novel command at the shell prompt and press Enter to execute the command.
The above includes a file name, a shell command and a key, all presented in mono-spaced bold and all distinguishable thanks to context.
Key combinations can be distinguished from an individual key by the plus sign that connects each part of a key combination. For example:
Press Enter to execute the command.
Press Ctrl+Alt+F2 to switch to a virtual terminal.
The first example highlights a particular key to press. The second example highlights a key combination: a set of three keys pressed simultaneously.
If source code is discussed, class names, methods, functions, variable names and returned values mentioned within a paragraph will be presented as above, in mono-spaced bold. For example:
File-related classes include filesystem for file systems, file for files, and dir for directories. Each class has its own associated set of permissions.
Proportional Bold
This denotes words or phrases encountered on a system, including application names; dialog box text; labeled buttons; check-box and radio button labels; menu titles and sub-menu titles. For example:
Choose SystemPreferencesMouse from the main menu bar to launch Mouse Preferences. In the Buttons tab, click the Left-handed mouse check box and click Close to switch the primary mouse button from the left to the right (making the mouse suitable for use in the left hand).
To insert a special character into a gedit file, choose ApplicationsAccessoriesCharacter Map from the main menu bar. Next, choose SearchFind . . . . . . from the Character Map menu bar, type the name of the character in the Search field and click Next. The character you sought will be highlighted in the Character Table. Double-click this highlighted character to place it in the Text to copy field and then click the Copy button. Now switch back to your document and choose EditPaste from the gedit menu bar.
The above text includes application names; system-wide menu names and items; application-specific menu names; and buttons and text found within a GUI interface, all presented in proportional bold and all distinguishable by context.
Mono-spaced Bold Italic or Proportional Bold Italic
Whether mono-spaced bold or proportional bold, the addition of italics indicates replaceable or variable text. Italics denotes text you do not input literally or displayed text that changes depending on circumstance. For example:
To connect to a remote machine using ssh, type ssh username@domain.name at a shell prompt. If the remote machine is example.com and your username on that machine is john, type ssh [email protected].
The mount -o remount file-system command remounts the named file system. For example, to remount the /home file system, the command is mount -o remount /home.
To see the version of a currently installed package, use the rpm -q package command. It will return a result as follows: package-version-release.
Note the words in bold italics above - username, domain.name, file-system, package, version and release. Each word is a placeholder, either for text you enter when issuing a command or for text displayed by the system.
Aside from standard usage for presenting the title of a work, italics denotes the first use of a new and important term. For example:
Publican is a DocBook publishing system.

1.2. Pull-quote Conventions

Terminal output and source code listings are set off visually from the surrounding text.
Output sent to a terminal is set in mono-spaced roman and presented thus:
books Desktop   documentation  drafts  mss photos   stuff  svnbooks_tests  Desktop1  downloads  images  notes  scripts  svgs
Source-code listings are also set in mono-spaced roman but add syntax highlighting as follows:
package org.jboss.book.jca.ex1;import javax.naming.InitialContext;public class ExClient{   public static void main(String args[]) throws Exception   {  InitialContext iniCtx = new InitialContext();  Object ref = iniCtx.lookup("EchoBean");  EchoHome   home   = (EchoHome) ref;  Echo   echo   = home.create();  System.out.println("Created Echo");  System.out.println("Echo.echo('Hello') = " + echo.echo("Hello"));   }}

1.3. Notes and Warnings

Finally, we use three visual styles to draw attention to information that might otherwise be overlooked.

Note

Notes are tips, shortcuts or alternative approaches to the task at hand. Ignoring a note should have no negative consequences, but you might miss out on a trick that makes your life easier.

Important

Important boxes detail things that are easily missed: configuration changes that only apply to the current session, or services that need restarting before an update will apply. Ignoring a box labeled 'Important' will not cause data loss but may cause irritation and frustration.

Warning

Warnings should not be ignored. Ignoring warnings will most likely cause data loss.

2. We Need Feedback!

If you find a typographical error in this manual, or if you have thought of a way to make this manual better, we would love to hear from you! Please submit a report in Bugzilla: http://bugzilla.redhat.com/ against the product Red Hat Enterprise Linux.
When submitting a bug report, be sure to mention the manual's identifier: doc-Security_Guide and version number: 6.
If you have a suggestion for improving the documentation, try to be as specific as possible when describing it. If you have found an error, please include the section number and some of the surrounding text so we can find it easily.
(Sebelumnya) 5 : Chapter 5. Diagnosing and ...6 : Chapter 1. Security Overvi ... (Berikutnya)