Red Hat Enterprise Linux 4: Security Guide
PrevNext

Index

Symbols

802.11x, Wireless Networks
and security, Wireless Networks

A

activating your subscription, Activate Your Subscription
Apache HTTP Server
cgi security, Restrict Permissions for Executable Directories
directives, Securing the Apache HTTP Server
introducing, Securing the Apache HTTP Server
attackers and risks, Attackers and Vulnerabilities

B

basic input output system
see BIOS
BIOS
non-x86 equivalents
passwords, Securing Non-x86 Platforms
security, BIOS and Boot Loader Security
passwords, BIOS Passwords
black hat hacker
see crackers
boot loaders
GRUB
password protecting, Password Protecting GRUB
security, Boot Loader Passwords

C

co-location services, Hardware Security
collecting evidence
see incident response
file auditing tools, Gathering Post-Breach Information
dd, Gathering Post-Breach Information
file, Gathering Post-Breach Information
find, Gathering Post-Breach Information
grep, Gathering Post-Breach Information
md5sum, Gathering Post-Breach Information
script, Investigating the Incident
stat, Gathering Post-Breach Information
strings, Gathering Post-Breach Information
common exploits and attacks, Common Exploits and Attacks
table, Common Exploits and Attacks
common ports
table, Common Ports
communication ports, Common Ports
communication tools
secure, Security Enhanced Communication Tools
GPG, Security Enhanced Communication Tools
OpenSSH, Security Enhanced Communication Tools
computer emergency response team, The Computer Emergency Response Team (CERT)
controls, Security Controls
administrative, Administrative Controls
physical, Physical Controls
technical, Technical Controls
conventions
document, Document Conventions
cracker
black hat hacker, Shades of Grey
crackers
definition, A Quick History of Hackers
cupsd, Identifying and Configuring Services

D

dd
collecting evidence with, Collecting an Evidential Image
file auditing using, Gathering Post-Breach Information
Demilitarized Zone, DMZs and iptables
Denial of Service (DoS)
distributed, Security Today
DMZ
see Demilitarized Zone
see networks

E

EFI Shell
security
passwords, Securing Non-x86 Platforms

F

file
file auditing using, Gathering Post-Breach Information
file auditing
tools, Gathering Post-Breach Information
find
file auditing using, Gathering Post-Breach Information
firewall types, Firewalls
network address translation (NAT), Firewalls
packet filter, Firewalls
proxy, Firewalls
firewalls, Firewalls
additional resources, Additional Resources
and connection tracking, iptables and Connection Tracking
and viruses, Viruses and Spoofed IP Addresses
iptables, Netfilter and iptables
personal, Personal Firewalls
policies, Basic Firewall Policies
stateful, iptables and Connection Tracking
types, Firewalls
FTP
anonymous access, Anonymous Access
anonymous upload, Anonymous Upload
greeting banner, FTP Greeting Banner
introducing, Securing FTP
TCP wrappers and, Use TCP Wrappers To Control Access
user accounts, User Accounts
vsftpd, Securing FTP

G

grep
file auditing using, Gathering Post-Breach Information
grey hat hacker
see hackers

H

hacker ethic, A Quick History of Hackers
hackers
black hat
see cracker
definition, A Quick History of Hackers
grey hat, Shades of Grey
white hat, Shades of Grey
hardware, Hardware and Network Protection
and security, Hardware Security
laptops, Hardware Security
servers, Hardware Security
workstations, Hardware Security

I

IDS
see intrusion detection systems
incident response
and legal issues, Legal Considerations
collecting evidence
using dd, Collecting an Evidential Image
computer emergency response team (CERT), The Computer Emergency Response Team (CERT)
creating a plan, Creating an Incident Response Plan
definition of, Defining Incident Response
gathering post-breach information, Gathering Post-Breach Information
implementation, Implementing the Incident Response Plan
introducing, Incident Response
investigation, Investigating the Incident
post-mortem, Investigating the Incident
reporting the incident, Reporting the Incident
restoring and recovering resources, Restoring and Recovering Resources
incident response plan, Creating an Incident Response Plan
insecure services, Insecure Services
rsh, Insecure Services
Telnet, Insecure Services
vsftpd, Insecure Services
introduction, Introduction
categories, using this manual, Introduction
other Red Hat Enterprise Linux manuals, Introduction
topics, Introduction
intrusion detection systems, Intrusion Detection
and log files, Host-based IDS
defining, Defining Intrusion Detection Systems
host-based, Host-based IDS
network-based, Network-based IDS
Snort, Snort
RPM Package Manager (RPM), RPM as an IDS
Tripwire, Tripwire
types, IDS Types
ip6tables, ip6tables
IPsec, IPsec
configuration, IPsec Network-to-Network configuration
host-to-host, IPsec Host-to-Host Configuration
host-to-host, IPsec Host-to-Host Configuration
installing, IPsec Installation
network-to-network, IPsec Network-to-Network configuration
phases, IPsec
iptables, Netfilter and iptables
additional resources, Additional Resources
and DMZs, DMZs and iptables
and viruses, Viruses and Spoofed IP Addresses
chains, Using iptables
FORWARD, FORWARD and NAT Rules
INPUT, Common iptables Filtering
OUTPUT, Common iptables Filtering
POSTROUTING, FORWARD and NAT Rules
PREROUTING, FORWARD and NAT Rules, DMZs and iptables
connection tracking, iptables and Connection Tracking
states, iptables and Connection Tracking
policies, Basic Firewall Policies
rules, Saving and Restoring iptables Rules
common, Common iptables Filtering
forwarding, FORWARD and NAT Rules
NAT, FORWARD and NAT Rules, DMZs and iptables
restoring, Saving and Restoring iptables Rules
saving, Saving and Restoring iptables Rules
stateful inspection, iptables and Connection Tracking
states, iptables and Connection Tracking
using, Using iptables

K

Kerberos
NIS, Use Kerberos Authentication

L

legal issues, Legal Considerations
lpd, Identifying and Configuring Services
lsof, Verifying Which Ports Are Listening

M

md5sum
file auditing using, Gathering Post-Breach Information

N

NAT
see Network Address Translation
Nessus, Nessus
Netfilter, Netfilter and iptables
additional resources, Additional Resources
Netfilter 6, ip6tables
netstat, Verifying Which Ports Are Listening
Network Address Translation, FORWARD and NAT Rules
with iptables, FORWARD and NAT Rules
network services, Available Network Services
buffer overflow
ExecShield, Risks To Services
identifying and configuring, Identifying and Configuring Services
risks, Risks To Services
buffer overflow, Risks To Services
denial-of-service, Risks To Services
script vulnerability, Risks To Services
network topologies, Secure Network Topologies
linear bus, Physical Topologies
ring, Physical Topologies
star, Physical Topologies
networks, Hardware and Network Protection
and security, Secure Network Topologies
de-militarized zones (DMZs), Network Segmentation and DMZs
hubs, Transmission Considerations
segmentation, Network Segmentation and DMZs
switches, Transmission Considerations
wireless, Wireless Networks
NFS, Securing NFS
and Sendmail, NFS and Sendmail
network design, Carefully Plan the Network
syntax errors, Beware of Syntax Errors
Nikto, Nikto
NIS
introducing, Securing NIS
IPTables, Assign Static Ports and Use IPTables Rules
Kerberos, Use Kerberos Authentication
NIS domain name, Use a Password-like NIS Domain Name and Hostname
planning network, Carefully Plan the Network
securenets, Edit the /var/yp/securenets File
static ports, Assign Static Ports and Use IPTables Rules
nmap, Verifying Which Ports Are Listening, Scanning Hosts with Nmap
command line version, Using Nmap

O

OpenSSH, Security Enhanced Communication Tools
scp, Security Enhanced Communication Tools
sftp, Security Enhanced Communication Tools
ssh, Security Enhanced Communication Tools
overview, Security Overview

P

password aging, Password Aging
password security, Password Security
aging, Password Aging
and PAM, Forcing Strong Passwords
auditing tools, Forcing Strong Passwords
Crack, Forcing Strong Passwords
John the Ripper, Forcing Strong Passwords
Slurpie, Forcing Strong Passwords
enforcement, Forcing Strong Passwords
in an organization, Creating User Passwords Within an Organization
methodology, Secure Password Creation Methodology
strong passwords, Creating Strong Passwords
passwords
within an organization, Creating User Passwords Within an Organization
pluggable authentication modules (PAM)
strong password enforcement, Forcing Strong Passwords
portmap, Identifying and Configuring Services
and IPTables, Protect portmap With IPTables
and TCP wrappers, Protect portmap With TCP Wrappers
ports
common, Common Ports
monitoring, Verifying Which Ports Are Listening
post-mortem, Investigating the Incident

R

registering your subscription, Activate Your Subscription
reporting the incident, Reporting the Incident
restoring and recovering resources, Restoring and Recovering Resources
patching the system, Patching the System
reinstalling the system, Reinstalling the System
risks
insecure services, Inherently Insecure Services
networks, Threats to Network Security
architectures, Insecure Architectures
open ports, Unused Services and Open Ports
patches and errata, Unpatched Services
servers, Threats to Server Security
inattentive administration, Inattentive Administration
workstations and PCs, Threats to Workstation and Home PC Security, Bad Passwords
applications, Vulnerable Client Applications
root, Allowing Root Access
allowing access, Allowing Root Access
disallowing access, Disallowing Root Access
limiting access, Limiting Root Access
and su, The su Command
and sudo, The sudo Command
with User Manager, The su Command
methods of disabling, Disallowing Root Access
changing the root shell, Disabling Root Logins
disabling SSH logins, Disabling Root SSH Logins
with PAM, Disabling Root Using PAM
root user
see root
RPM
and intrusion detection, RPM as an IDS
importing GPG key, Using the Red Hat Errata Website
verifying signed packages, Verifying Signed Packages, Installing Signed Packages

S

security considerations
hardware, Hardware and Network Protection
network transmission, Transmission Considerations
physical networks, Hardware and Network Protection
wireless, Wireless Networks
security errata, Security Updates
applying changes, Applying the Changes
via Red Hat errata website, Using the Red Hat Errata Website
via Red Hat Network, Using Red Hat Network
when to reboot, Applying the Changes
security overview, Security Overview
conclusion, Conclusion
controls
see controls
defining computer security, What is Computer Security?
Denial of Service (DoS), Security Today
evolution of computer security, How did Computer Security Come about?
viruses, Security Today
sendmail, Identifying and Configuring Services
and NFS, NFS and Sendmail
introducing, Securing Sendmail
limiting DoS, Limiting a Denial of Service Attack
server security
Apache HTTP Server, Securing the Apache HTTP Server
cgi security, Restrict Permissions for Executable Directories
directives, Securing the Apache HTTP Server
FTP, Securing FTP
anonymous access, Anonymous Access
anonymous upload, Anonymous Upload
greeting banner, FTP Greeting Banner
TCP wrappers and, Use TCP Wrappers To Control Access
user accounts, User Accounts
vsftpd, Securing FTP
NFS, Securing NFS
network design, Carefully Plan the Network
syntax errors, Beware of Syntax Errors
NIS, Securing NIS
IPTables, Assign Static Ports and Use IPTables Rules
Kerberos, Use Kerberos Authentication
NIS domain name, Use a Password-like NIS Domain Name and Hostname
planning network, Carefully Plan the Network
securenets, Edit the /var/yp/securenets File
static ports, Assign Static Ports and Use IPTables Rules
overview of, Server Security
portmap, Securing Portmap
ports
monitoring, Verifying Which Ports Are Listening
Sendmail, Securing Sendmail
and NFS, NFS and Sendmail
limiting DoS, Limiting a Denial of Service Attack
TCP wrappers, Enhancing Security With TCP Wrappers
attack warnings, TCP Wrappers and Attack Warnings
banners, TCP Wrappers and Connection Banners
logging, TCP Wrappers and Enhanced Logging
xinetd, Enhancing Security With xinetd
managing resources with, Controlling Server Resources
preventing DoS with, Controlling Server Resources
SENSOR trap, Setting a Trap
services, Verifying Which Ports Are Listening
Services Configuration Tool, Identifying and Configuring Services
Snort, Snort
sshd, Identifying and Configuring Services
stat
file auditing using, Gathering Post-Breach Information
strings
file auditing using, Gathering Post-Breach Information
su
and root, The su Command
subscription registration, Activate Your Subscription
sudo
and root, The sudo Command

T

TCP wrappers
and FTP, Use TCP Wrappers To Control Access
and portmap, Protect portmap With TCP Wrappers
attack warnings, TCP Wrappers and Attack Warnings
banners, TCP Wrappers and Connection Banners
logging, TCP Wrappers and Enhanced Logging
Tripwire, Tripwire

U

updates
see security errata

V

Virtual Private Networks, Virtual Private Networks
IPsec, IPsec
configuration, IPsec Network-to-Network configuration
host-to-host, IPsec Host-to-Host Configuration
installing, IPsec Installation
viruses
trojans, Security Today
VLAD the Scanner, VLAD the Scanner
VPN, Virtual Private Networks
vulnerabilities
assessing with Nessus, Nessus
assessing with Nikto, Nikto
assessing with Nmap, Scanning Hosts with Nmap
assessing with VLAD the Scanner, VLAD the Scanner
assessment, Vulnerability Assessment
defining, Defining Assessment and Testing
establishing a methodology, Establishing a Methodology
testing, Defining Assessment and Testing

W

white hat hacker
see hackers
Wi-Fi networks
see 802.11x
wireless security, Wireless Networks
802.11x, Wireless Networks
workstation security, Workstation Security
BIOS, BIOS and Boot Loader Security
boot loaders
passwords, Boot Loader Passwords
evaluating
administrative control, Evaluating Workstation Security
BIOS, Evaluating Workstation Security
boot loaders, Evaluating Workstation Security
communications, Evaluating Workstation Security
passwords, Evaluating Workstation Security
personal firewalls, Evaluating Workstation Security

X

xinetd, Identifying and Configuring Services
managing resources with, Controlling Server Resources
preventing DoS with, Controlling Server Resources
SENSOR trap, Setting a Trap
PrevHomeNext
Common Ports Colophon