Linux Security HOWTO 中英文对照(错误之处,请指出, 谢谢)

eTony · 发表于 2006-3-20 13:30:47

Linux Security HOWTO

Kevin Fenzi, kevin-securityhowto@tummy.com & Dave Wreski, dave@linuxsecurity.com

中文翻译:etony C.F.AN etony@tom.com

This document is a general overview of security issues that face the administrator of Linux systems. It covers general security philosophy and a number of specific examples of how to better secure your Linux system from intruders. Also included are pointers to security-related material and programs. Improvements, constructive criticism, additions and corrections are gratefully accepted. Please mail your feedback to both authors, with "Security HOWTO" in the subject.

本文档是面向Linux系统管理员的一般性概要文档. 它涵盖一般性安全哲学和一些针对入侵者, 如何使您的Linux系统更加安全的具体例子. 还包括一些安全相关的资料和程序. 很高兴收到您提出的改进, 建设性的批评, 内容添加和更正意见, 并表示感谢. 请将您的反馈意见以 "Security HOWTO" 为主题邮寄给两位作者.

1. Introduction 介绍

* 1.1 New Versions of this Document 本文档的最新版本
* 1.2 Feedback 反馈
* 1.3 Disclaimer 声明
* 1.4 Copyright Information 版权信息
* 1.5 中文版本

2. Overview 概述

* 2.1 Why Do We Need Security? 为什么我们需要安全?
* 2.2 How Secure Is Secure? 多安全才是安全?
* 2.3 What Are You Trying to Protect? 您在试图保护什么?
* 2.4 Developing A Security Policy 完善的安全策略
* 2.5 Means of Securing Your Site 保护您站点的方法
* 2.6 Organization of This Document 本文档的组织

3. Physical Security 物理安全

* 3.1 Computer locks 计算机锁定
* 3.2 BIOS Security BIOS 安全
* 3.3 Boot Loader Security 启动加载器的安全
* 3.4 xlock and vlock xlock 和 vlock
* 3.5 Security of local devices 本地设备安全
* 3.6 Detecting Physical Security Compromises 检测物理安全威胁

4. Local Security 本地安全

* 4.1 Creating New Accounts 创建账号
* 4.2 Root Security Root 安全

5. Files and File system Security 文件与文件系统安全

* 5.1 Umask Settings 设置 umask
* 5.2 File Permissions 文件权限
* 5.3 Integrity Checking 完整性检查
* 5.4 Trojan Horses 特洛伊木马

6. Password Security and Encryption 密码安全与加密

* 6.1 PGP and Public-Key Cryptography PGP 和公钥算法
* 6.2 SSL, S-HTTP and S/MIME
* 6.3 Linux IPSEC Implementations Linux IPSEC 工具
* 6.4 ssh (Secure Shell) and stelnet
* 6.5 PAM - Pluggable Authentication Modules 可插入认证模块
* 6.6 Cryptographic IP Encapsulation (CIPE) 加密IP封装 (CIPE)
* 6.7 Kerberos
* 6.8 Shadow Passwords. Shadow 密码
* 6.9 "Crack" and "John the Ripper"
* 6.10 CFS - Cryptographic File System and TCFS - Transparent Cryptographic File System CFS - 加密文件系统和 TCFS - 透明密码文件系统
* 6.11 X11, SVGA and display security 和显示安全

7. Kernel Security 内核安全

* 7.1 2.0 Kernel Compile Options 2.0 内核编译选项
* 7.2 2.2 Kernel Compile Options 2.2 内核编译选项
* 7.3 Kernel Devices 内核设备

8. Network Security 网络安全

* 8.1 Packet Sniffers 数据包嗅探
* 8.2 System services and tcp_wrappers 系统服务和 tcp_wrappers
* 8.3 Verify Your DNS Information 校验您的 DNS 信息
* 8.4 identd
* 8.5 Configuring and Securing the Postfix MTA Postfix MTA 的安全配置
* 8.6 SATAN, ISS, and Other Network Scanners 和其它网络扫描器
* 8.7 sendmail, qmail and MTA's
* 8.8 Denial of Service Attacks 拒绝服务攻击
* 8.9 NFS (Network File System) Security. NFS(网络文件系统)安全
* 8.10 NIS (Network Information Service) (formerly YP). 网络信息服务(以前的YP)
* 8.11 Firewalls 防火墙
* 8.12 IP Chains - Linux Kernel 2.2.x Firewalling
* 8.13 Netfilter - Linux Kernel 2.4.x Firewalling Linux 2.4.x防火墙
* 8.14 VPNs - Virtual Private Networks 虚拟专用网

9. Security Preparation (before you go on-line) 安全准备(连入网络之前)

* 9.1 Make a Full Backup of Your Machine 进行完整备份
* 9.2 Choosing a Good Backup Schedule 选择一个好的备份方案
* 9.3 Testing your backups 测试备份
* 9.4 Backup Your RPM or Debian File Database 备份RPM或Debian文件数据库
* 9.5 Keep Track of Your System Accounting Data
* 9.6 Apply All New System Updates.更新系统

10. What To Do During and After a Breakin 入侵发生了

* 10.1 Security Compromise Underway. 安全入侵起步.
* 10.2 Security Compromise has already happened 安全入侵发生了

11. Security Sources 安全资源

* 11.1 LinuxSecurity.com References
* 11.2 FTP Sites
* 11.3 Web Sites 网站
* 11.4 Mailing Lists 邮件列表
* 11.5 Books - Printed Reading Material 书 - 出版物

12. Glossary 术语表

13. Frequently Asked Questions 常见问题解答

14. Conclusion 结论

15. Acknowledgments 鸣谢

eTony · 发表于 2006-3-20 13:33:51

1. Introduction 介绍

This document covers some of the main issues that affect Linux security. General philosophy and net-born resources are discussed.

本文档涉及一些有关 Linux 安全的主题. 并将对常见安全哲学和网络资源进行讨论.

A number of other HOWTO documents overlap with security issues, and those documents have been pointed to wherever appropriate.

这里的讨论可能与其他一些文档的安全内容重复, 这在文档中做了相应的标注.

This document is not meant to be a up-to-date exploits document. Large numbers of new exploits happen all the time. This document will tell you where to look for such up-to-date information, and will give some general methods to prevent such exploits from taking place.

本文档并不是最新的漏洞文档. 每天都发生大量新的漏洞. 本文档将告诉你去什么地方查找相关的最新信息, 并给出防止这类漏洞发生的常用方法.
1.1 New Versions of this Document 本文档的最新版本

New versions of this document will be periodically posted to comp.os.linux.answers. They will also be added to the various sites that archive such information, including:

本文档的新版本将定期张贴到 comp.os.linux.answers. 并同时提交到各类网站, 这包括:

http://www.linuxdoc.org/

The very latest version of this document should also be available in various formats from:

本文档的最新版本的各种格式可以从以下地址获取:

* http://scrye.com/~kevin/lsh/
* http://www.linuxsecurity.com/docs/Security-HOWTO
* http://www.tummy.com/security-howto
* 简体中文版: http://debian.linuxsir.cn/book/lsh/etony/

1.2 Feedback 反馈

All comments, error reports, additional information and criticism of all sorts should be directed to:

所有评论, 错误报告, 其他信息以及批评, 请邮寄到: kevin-securityhowto@tummy.com

and

和

dave@linuxsecurity.com

Note: Please send your feedback to both authors. Also, be sure and include "Linux" "security", or "HOWTO" in your subject to avoid Kevin's spam filter.

注意: 请将反馈同时邮寄给两位作者. 同时, 确保在给Kevin的邮件以"Linux" "security", 或 "HOWTO" 主题.

中文翻译问题请邮寄到:

etony@tom.com
1.3 Disclaimer 声明

No liability for the contents of this document can be accepted. Use the concepts, examples and other content at your own risk. Additionally, this is an early version, possibly with many inaccuracies or errors.

没有义务对本文档的内容负责. 使用其中的概念, 例子和其他内容造成的后果自负. 另外, 本文的一个早期版本可能存在许多误差和错误.

A number of the examples and descriptions use the RedHat(tm) package layout and system setup. Your mileage may vary.

有些例子和描述使用的是 RedHat(tm) 软件包模式和系统设置. 这和您的情况可能有所不同.

As far as we know, only programs that, under certain terms may be used or evaluated for personal purposes will be described. Most of the programs will be available, complete with source, under GNU terms.

据我们所知, 只有程序在某些情况下出于个人目录的使用和评价会被介绍. 多数程序都可在 GNU 的条款下通过编译代码获取.
1.4 Copyright Information 版权信息

This document is copyrighted (c)1998-2000 Kevin Fenzi and Dave Wreski, and distributed under the following terms:

本文档的版权(c)1998-2000 归 Kevin Fenzi 和 Dave Wreski 所有. 并可在以下条款下分发:

* Linux HOWTO documents may be reproduced and distributed in whole or in part, in any medium, physical or electronic, as long as this copyright notice is retained on all copies. Commercial redistribution is allowed and encouraged; however, the authors would like to be notified of any such distributions.
* Linux HOWTO 文档的全部或部分在包含本版权信息的情况下可以在通过任何方式以物理, 或电子的方式进行复制和分发. 同样鼓励商业出版, 但是进行这类出版时, 希望告知作者.
* All translations, derivative works, or aggregate works incorporating any Linux HOWTO documents must be covered under this copyright notice. That is, you may not produce a derivative work from a HOWTO and impose additional restrictions on its distribution. Exceptions to these rules may be granted under certain conditions; please contact the Linux HOWTO coordinator at the address given below.
* 所有翻译, 衍生作品, 合并工作必须在本版权信息下进行. 就是说, 您不能对衍生作品强加另外的制约. 这些规则在某些情况下也许可以存在例外; 具体请与下边给出的地址联系.
* If you have questions, please contact Tim Bynum, the coordinator, at
* 如果您对此还有疑问, 请与本 Linux HOWTO 的联络人 Tim Bynum 联系,

tjbynum@metalab.unc.edu
1.5 中文版本

译者 etony C.F.AN 由于时间和水平有限, 以及对一些安全问题理解的偏差, 译文中应该会有很多谬误之处, 如果您能通过邮件或其它方式告知译者将不胜感谢, 如果有任何意见和建议, 本人也将非常乐意收到您的邮件 etony@tom.com.

如果可以, 建议您尽量阅读英文原版.

本文档的的最新中文版本您可以通过: http://debian.linuxsir.cn/book/lsh/etony/ 获取, 或通过邮件向译者索取.

eTony · 发表于 2006-3-20 13:37:38

2. Overview 概述

This document will attempt to explain some procedures and commonly-used software to help your Linux system be more secure. It is important to discuss some of the basic concepts first, and create a security foundation, before we get started.

本文档将试图给出一些操作步骤和常用软件以帮助您使系统更加安全. 在正式开始前, 首先谈论一些基本的概念, 以及创建一个安全的机制, 这非常重要.
2.1 Why Do We Need Security? 为什么我们需要安全?

In the ever-changing world of global data communications, inexpensive Internet connections, and fast-paced software development, security is becoming more and more of an issue. Security is now a basic requirement because global computing is inherently insecure. As your data goes from point A to point B on the Internet, for example, it may pass through several other points along the way, giving other users the opportunity to intercept, and even alter, it. Even other users on your system may maliciously transform your data into something you did not intend. Unauthorized access to your system may be obtained by intruders, also known as "crackers", who then use advanced knowledge to impersonate you, steal information from you, or even deny you access to your own resources. If you're wondering what the difference is between a "Hacker" and a "Cracker", see Eric Raymond's document, "How to Become A Hacker", available at http://www.tuxedo.org/~esr/faqs/hacker-howto.html.

全球每时每刻都在变化的数据通讯世界里, 低廉的互联网接入, 快速的软件开发, 使得安全越来越成为必须关注的问题. 由于全球性计算机固有的不安全, 这使其已经成为基本的需求. 例如, 当您的数据在互联网上从A传送到B时, 它有可能需要经过几个其他的点, 这就给了其他用户拦截, 甚至修改它的机会. 甚至可以将您系统中的数据篡改为您所不愿意的样子. 入侵者可以在未经授权的情况下访问您的系统, 这就是众所周知的"骇客". 然后用高超的技术来伪装成您, 窃取您的信息, 甚至使您无法使用自己的资源. 如果您想了解"黑客"与"骇客"之间的区别, 请参阅 EricRaymond 的文档 "如何成为一名黑客", 获取地址: http://www.tuxedo.org/~esr/faqs/hacker-howto.html.
2.2 How Secure Is Secure? 多安全才是安全?

First, keep in mind that no computer system can ever be completely secure. All you can do is make it increasingly difficult for someone to compromise your system. For the average home Linux user, not much is required to keep the casual cracker at bay. However, for high-profile Linux users (banks, telecommunications companies, etc), much more work is required.

首先, 牢记没有计算机系统是永远完全安全的. 您所能做的是增加入侵您的系统的难度. 作为一般的 Linux 家庭用户, 要求可能不是那么高. 但是, 对于公众性用户(比如银行, 电信公司等)则需要做更多的工作.

Another factor to take into account is that the more secure your system is, the more intrusive your security becomes. You need to decide where in this balancing act your system will still be usable, and yet secure for your purposes. For instance, you could require everyone dialing into your system to use a call-back modem to call them back at their home number. This is more secure, but if someone is not at home, it makes it difficult for them to login. You could also setup your Linux system with no network or connection to the Internet, but this limits its usefulness.

其它需要考虑的因素是 the more secure your system is, the more intrusive your security becomes. 其平衡点是, 保证系统应用的情况下, 尽可能的安全. 例如, 如果您的系统为家庭用户提供通过调制解调器拨入. 用户不在家时, 就不允许其拨入, 这样会更加安全. 您还可以将 Linux 系统配置为不接入网络, 或互联网, 但这样限制了它的用途.

If you are a medium to large-sized site, you should establish a security policy stating how much security is required by your site and what auditing is in place to check it. You can find a well-known security policy example at http://www.faqs.org/rfcs/rfc2196.html. It has been recently updated, and contains a great framework for establishing a security policy for your company.

如果您的系统承载大型网站, 则应当建立对应的安全策略, 以描述网站需要怎么的安全, 以及进行怎样的审计. 在 http://www.faqs.org/rfcs/rfc2196.html 处, 您可以获取一份知名的安全策略样本. 它最近进行了更新, 并可为贵公司建立安全策略提供了一个大型框架.
2.3 What Are You Trying to Protect? 您在试图保护什么?

Before you attempt to secure your system, you should determine what level of threat you have to protect against, what risks you should or should not take, and how vulnerable your system is as a result. You should analyze your system to know what you're protecting, why you're protecting it, what value it has, and who has responsibility for your data and other assets.

在试图要保护您的系统之前, 您应该确定要抵御什么样的威胁等级, 采取或不采取相应措施有怎样的风险, 并将会产生什么样的漏洞. 如果您分析了自己的系统, 则应当知道在保护什么, 为什么要保护它, 这样做的价值, 谁对您的数据和资源负责.

* Risk is the possibility that an intruder may be successful in attempting to access your computer. Can an intruder read or write files, or execute programs that could cause damage? Can they delete critical data? Can they prevent you or your company from getting important work done? Don't forget: someone gaining access to your account, or your system, can also impersonate you.

   风险是指入侵者成功访问您的系统的可能性. 入侵者是否能读取或写入文件, 或能否执行会造成破坏的程序? 能否删除重要数据? 是否会对您或您的公司完成重要工作造成影响? 不要忘记: 某些人能够登入您的账户, 或您的系统, 甚至会假冒您.

   Additionally, having one insecure account on your system can result in your entire network being compromised. If you allow a single user to login using a .rhosts file, or to use an insecure service such as tftp, you risk an intruder getting 'his foot in the door'. Once the intruder has a user account on your system, or someone else's system, it can be used to gain access to another system, or another account.

   另外, 不安全的账号会对您的整个网络造成威胁. 如果您允许用户使用 .rhosts 文件登录, 或使用不安全的服务, 例如 tftp, 您将受到入侵者"已将一只脚踏入门内"威胁, 一旦入侵者拥有了您系统中的一个账号, 或其它系统的, 就可以用于获取其它系统的访问权限, 或获取其它账号.
* Threat is typically from someone with motivation to gain unauthorized access to your network or computer. You must decide whom you trust to have access to your system, and what threat they could pose.

   威胁即典型的默认以非授权方式访问您的网络或计算机. 您必须确定谁被授权访问您的系统, 并且会造成什么样的威胁.

   There are several types of intruders, and it is useful to keep their different characteristics in mind as you are securing your systems.

   入侵者可以分为几种类型, 并且应当记住他们有着各自不同的特征, 这对保护您的系统非常有用.

      o The Curious - This type of intruder is basically interested in finding out what type of system and data you have.

         好奇 - 这类入侵者基本上是对您使用什么系统和拥有是什么数据感兴趣.
      o The Malicious - This type of intruder is out to either bring down your systems, or deface your web page, or otherwise force you to spend time and money recovering from the damage he has caused.

         恶意 - 这类入侵者主要是宕掉您的系统, 或篡改您的网页, 或其它迫使您花费时间或金钱来恢复他所造成的破坏.
      o The High-Profile Intruder - This type of intruder is trying to use your system to gain popularity and infamy. He might use your high-profile system to advertise his abilities.

         技巧型入侵者 - 这类入侵者想通过您的系统出名. 他们可能是想通过您的系统来证明他们的能力.
      o The Competition - This type of intruder is interested in what data you have on your system. It might be someone who thinks you have something that could benefit him, financially or otherwise.

         商业竞争 - 这类入侵者对系统中的数据感兴趣. 这可能那些人认为您的数据可以使其获益, 金钱上的或者其它.
      o The Borrowers - This type of intruder is interested in setting up shop on your system and using its resources for their own purposes. He typically will run chat or irc servers, porn archive sites, or even DNS servers.

         寄居型 - 这类入侵者只对利用您的资源感兴趣. 典型的是利用您的资源运行聊天或 irc 服务, 作为色情站点, 或DNS服务.
      o The Leapfrogger - This type of intruder is only interested in your system to use it to get into other systems. If your system is well-connected or a gateway to a number of internal hosts, you may well see this type trying to compromise your system.

         跳板 - 这类入侵者只是利用您的系统作为跳板来进入别的系统. 如果您的网络带宽不错, 或者是某些内部网络连入互联网的网关, 则您就会碰到这类入侵.

* Vulnerability describes how well-protected your computer is from another network, and the potential for someone to gain unauthorized access.

   漏洞描述如何在网络中保护好您的系统, 以及防止潜在的未经授权的访问.

   What's at stake if someone breaks into your system? Of course the concerns of a dynamic PPP home user will be different from those of a company connecting their machine to the Internet, or another large network.

   如果您的系统被入侵了怎么办? 当然PPP家庭用户和将计算机连入互联网或其它大型网络的公司是不同的.

   How much time would it take to retrieve/recreate any data that was lost? An initial time investment now can save ten times more time later if you have to recreate data that was lost. Have you checked your backup strategy, and verified your data lately?

   恢复/重建所有丢失的数据需要多少时间? 最初的时间投入可能会在您重建丢失的数据时节省数十倍的时间. 您是否核查了您的备份策略, 并确认已经将备份数据更新到了最新?

2.4 Developing A Security Policy 完善的安全策略

Create a simple, generic policy for your system that your users can readily understand and follow. It should protect the data you're safeguarding as well as the privacy of the users. Some things to consider adding are: who has access to the system (Can my friend use my account?), who's allowed to install software on the system, who owns what data, disaster recovery, and appropriate use of the system.

为您的系统创建一个简单的, 通用的, 并且您的用户可以真正理解并欣然执行的安全策略. 它将会为您的私人数据, 和用户的私人数据提供保障. 另外还需要考虑: 谁访问了本系统 (我的朋友可以使用我的账号吗?) 允许哪些人在系统中安装软件, 哪些人拥有了什么数据, 灾难补救, 以及系统的正确用途.

A generally-accepted security policy starts with the phrase

被广泛接受的安全策略

That which is not permitted is prohibited 未被允许的都是被禁止的

This means that unless you grant access to a service for a user, that user shouldn't be using that service until you do grant access. Make sure the policies work on your regular user account. Saying, "Ah, I can't figure out this permissions problem, I'll just do it as root" can lead to security holes that are very obvious, and even ones that haven't been exploited yet.

rfc1244 is a document that describes how to create your own network security policy.

rfc1281 is a document that shows an example security policy with detailed descriptions of each step.

Finally, you might want to look at the COAST policy archive at ftp://coast.cs.purdue.edu/pub/doc/policy to see what some real-life security policies look like.

这意味着除非您同意用户访问一项服务, 否则此用户在被授权前将不能使用这项服务. 确保您制定的安全策略可以制约您的用户. 说, "嗨, 我无法确定权限问题, 我将用 root 用户运行它" 可能会导致非常明显的安全漏洞, 使得任何人都可以入侵它.

rfc1244 是描述如何创建自己的网路安全策略的文档.

rfc1281 给出了安全策略各个步骤的详细描述的例子.

最后, 您也许想查看一下位于 ftp://coast.cs.purdue.edu/pub/doc/policy 的 COAST 安全策略文档, 以了解真正的安全策略是怎么样的.
2.5 Means of Securing Your Site 保护您站点的方法

This document will discuss various means with which you can secure the assets you have worked hard for: your local machine, your data, your users, your network, even your reputation. What would happen to your reputation if an intruder deleted some of your users' data? Or defaced your web site? Or published your company's corporate project plan for next quarter? If you are planning a network installation, there are many factors you must take into account before adding a single machine to your network.

本文档将讨论各种可用于保护您的财产的手段: 您的计算机, 数据, 用户, 网路, 甚至声誉. 如果入侵者删除了您用户的数据将会对您的声誉产生什么样的影响? 或者将您的站点破坏掉呢? 或者将您公司下个季度的项目计划公布于众呢? 如果您想要进行网络安装, 那么在将计算机连入网络前, 有许多因素您必须要考虑到.

Even if you have a single dial up PPP account, or just a small site, this does not mean intruders won't be interested in your systems. Large, high-profile sites are not the only targets -- many intruders simply want to exploit as many sites as possible, regardless of their size. Additionally, they may use a security hole in your site to gain access to other sites you're connected to.

既使您是一个 PPP 拨号用户, 或只是一个小站点, 那也不意味着入侵者不对您的系统感兴趣. 大型的, 惹人注意的站点并不是唯一的目标 -- 许多入侵者只是简单的想尽可能的增加其入侵系统的数量. 并不考虑其大小. 另外, 他们可能利用您系统中的安全漏洞通过您的系统来访问其它站点.

Intruders have a lot of time on their hands, and can avoid guessing how you've obscured your system just by trying all the possibilities. There are also a number of reasons an intruder may be interested in your systems, which we will discuss later.

入侵者有的是时间, 可以尝试用各种可能的方法来入侵您的系统. 当然还有其它的原因致使入侵者对您的系统感兴趣, 这些我们稍后讨论.
Host Security 保护主机

Perhaps the area of security on which administrators concentrate most is host-based security. This typically involves making sure your own system is secure, and hoping everyone else on your network does the same. Choosing good passwords, securing your host's local network services, keeping good accounting records, and upgrading programs with known security exploits are among the things the local security administrator is responsible for doing. Although this is absolutely necessary, it can become a daunting task once your network becomes larger than a few machines.

或许管理员更加注意基于主机的安全内容. 这包括确保自己的系统是安全的, 并希望网络上的其它人也做的同样好. 选择安全的密码, 提高本地网络的安全性, 保持安全的账号记录, 对带有已知漏洞程序进行升级, 等等这些都是安全管理员的职责. 尽管这些都是绝对必要的, 如果您维护的是包含很多计算机的大型网络, 这同时也是一项艰巨的工作.
Local Network Security 保护本地网络

Network security is as necessary as local host security. With hundreds, thousands, or more computers on the same network, you can't rely on each one of those systems being secure. Ensuring that only authorized users can use your network, building firewalls, using strong encryption, and ensuring there are no "rogue" (that is, unsecured) machines on your network are all part of the network security administrator's duties.

This document will discuss some of the techniques used to secure your site, and hopefully show you some of the ways to prevent an intruder from gaining access to what you are trying to protect.

网络安全和主机安全同样重要. 与成百上千的计算机同处一个网络, 您无法确保每一台计算机都是安全的. 确保只有授权的用户才能使用您的网络, 构建防火墙, 使用高强度密码, 确保在您的网络中没有"危险"(即没有安全担保)的计算机, 等等这些都是网络管理员的职责所在.

本文档讨论用于安全化您的站点的技术, 并给出一些方案用于阻止入侵者获取您试图保护的资源.
Security Through Obscurity 不公开即安全

One type of security that must be discussed is "security through obscurity". This means, for example, moving a service that has known security vulnerabilities to a non-standard port in hopes that attackers won't notice it's there and thus won't exploit it. Rest assured that they can determine that it's there and will exploit it. Security through obscurity is no security at all. Simply because you may have a small site, or a relatively low profile, does not mean an intruder won't be interested in what you have. We'll discuss what you're protecting in the next sections.

"不公开即安全"是必须讨论的一类安全模型. 例如, 将含有已知安全漏洞的服务的监听端口改为非标准模式, 希望攻击者不会注意到, 因而不会攻击它. 但是必须清楚, 入侵者仍会做出正确的判断, 并对它进行攻击. 不公开即安全跟本就是不安全的. 例如您有一个小站点, 或者资源相对较少, 但并不意味着入侵者不会对您的资源感兴趣. 在下一章我们将讨论您需要保护的内容.
2.6 Organization of This Document 本文档的组织

This document has been divided into a number of sections. They cover several broad security issues. The first, Physical Security, covers how you need to protect your physical machine from tampering. The second, Local Security, describes how to protect your system from tampering by local users. The third, Files and Filesystem Security, shows you how to setup your file systems and permissions on your files. The next, Password Security and Encryption, discusses how to use encryption to better secure your machine and network. Kernel Security discusses what kernel options you should set or be aware of for a more secure system. Network Security, describes how to better secure your Linux system from network attacks. Security Preparation, discusses how to prepare your machine(s) before bringing them on-line. Next, What To Do During and After a Break-in, discusses what to do when you detect a system compromise in progress or detect one that has recently happened. In Security Resources, some primary security resources are enumerated. The Q and A section Frequently Asked Questions, answers some frequently-asked questions, and finally a conclusion in Conclusion.

本文档分为数个章节, 涵盖安全问题的数个部分. 第一章 Physical Security 物理安全, 讲述如何保护您的本地资源免受篡改. 第二章 Local Security 本地安全, 讲述如何保护您的系统免受本地用户的篡改. 第三章 Files and Filesystem Security 文件与文件系统安全, 讲述如何配置您的文件系统和文件的权限. 下一章 Password Security and Encryption密码安全与加密, 讨论如何使用密码, 使您的系统和网络更件安全. Kernel Security 内核安全, 讨论如何设置内核选项, 以及系统安全化的一些选择. Network Security 网络安全, 讲述使您的计算机在网络安全下更加安全. Security Preparation 安全准备, 讨论计算机连入网络前的准备. 下一章 What To Do During and After a Break-in 入侵发生了, 讨论当您发觉系统被攻击, 或者已经被入侵时的处理措施. 在 Security Resources 安全资源将给出一些主要的安全资源. Q 和 A 章节 Frequently Asked Questions 常见问题解答, 回答一些常见问题, 然后是结论章节 Conclusion 结论.

The two main points to realize when reading this document are:

阅读本文档时, 有两点需要注意:

* Be aware of your system. Check system logs such as /var/log/messages and keep an eye on your system, and

   了解您的系统. 检查系统日志, 如 /var/log/messages, 并且时刻注意您的系统, 和
* Keep your system up-to-date by making sure you have installed the current versions of software and have upgraded per security alerts. Just doing this will help make your system markedly more secure.

   确保您的系统中安装的软件更新到了最新版本并且升级了每个安全警告. 这样做有助于使您的系统更加安全.

eTony · 发表于 2006-3-20 13:38:16

3. Physical Security 物理安全

The first layer of security you need to take into account is the physical security of your computer systems. Who has direct physical access to your machine? Should they? Can you protect your machine from their tampering? Should you?

首先要考虑的安全问题就是您的计算机系统的物理安全. 谁可以直接物理接触您的机器? 合理吗? 您可以保护您的计算机不受他们的破坏吗? 应当这样吗?

How much physical security you need on your system is very dependent on your situation, and/or budget.

有多少您需要考虑的物理安全问题与您的职位和/或预算有关?

If you are a home user, you probably don't need a lot (although you might need to protect your machine from tampering by children or annoying relatives). If you are in a lab, you need considerably more, but users will still need to be able to get work done on the machines. Many of the following sections will help out. If you are in an office, you may or may not need to secure your machine off-hours or while you are away. At some companies, leaving your console unsecured is a termination offense.

如果您是家庭用户, 可能您就不需要对这些考虑太多(尽管您可能需要保护您的机器免受小孩子或亲戚的摆弄) 如果您是在实验室, 则需要考虑的多一些, 因为可能有很多用户需要在这台机器上工作. 下边的很多内容将会帮助您摆脱这种困境. 如果您是在办公室, 下班以后您可能需要/不需要对于机器的安全问题考虑太多. 在一些公司, 不允许在无安全保证的情况下离开终端.

Obvious physical security methods such as locks on doors, cables, locked cabinets, and video surveillance are all good ideas, but beyond the scope of this document.

很显然, 物理保护方法, 例如给门, 电缆上锁, 将设备锁在柜子里, 视频监控都是不错的办法, 但是这些超出了本文的范围.
3.1 Computer locks 计算机锁定

Many modern PC cases include a "locking" feature. Usually this will be a socket on the front of the case that allows you to turn an included key to a locked or unlocked position. Case locks can help prevent someone from stealing your PC, or opening up the case and directly manipulating/stealing your hardware. They can also sometimes prevent someone from rebooting your computer from their own floppy or other hardware.

很多现代的计算机都提供了"锁定"功能. 通常是在前部有一个插口, 用于给您的计算机加锁或解锁. 这有助于防止别人窃取您的计算机, 或直接操作/窃取您的硬件. 有时还可用于防止从其它软盘或硬件重新引导您的系统.

These case locks do different things according to the support in the motherboard and how the case is constructed. On many PC's they make it so you have to break the case to get the case open. On some others, they will not let you plug in new keyboards or mice. Check your motherboard or case instructions for more information. This can sometimes be a very useful feature, even though the locks are usually very low-quality and can easily be defeated by attackers with locksmithing.

这种装置, 根据主板的支持, 和锁的结构, 来完成不同的功能. 在很多PC上, 您必需打开锁才能启动计算机. 有些还能阻止您插入新的键盘或鼠标. 仔细检查一下您的主板和锁的结构. 有时这是非常有用的功能, 尽管通常锁的质量不是很好, 锁匠很容易就能将它破坏掉.

Some machines (most notably SPARC's and macs) have a dongle on the back that, if you put a cable through, attackers would have to cut the cable or break the case to get into it. Just putting a padlock or combo lock through these can be a good deterrent to someone stealing your machine.

有些机器(特别是 SPARC 和 mac)在后部有个加密狗, 如果用一条电缆将其固定, 那么攻击者要得手, 就必需切断线缆, 或将锁破坏掉. 配合使用扣锁或组合锁可以更好的起到防盗效果.
3.2 BIOS Security BIOS 安全

The BIOS is the lowest level of software that configures or manipulates your x86-based hardware. LILO and other Linux boot methods access the BIOS to determine how to boot up your Linux machine. Other hardware that Linux runs on has similar software (Open Firmware on Macs and new Suns, Sun boot PROM, etc...). You can use your BIOS to prevent attackers from rebooting your machine and manipulating your Linux system.

BIOS 是用于配置或维护您的 x86 硬件的底层软件. LILO 和其它 Linux 引导方法通过访问 BIOS 来判断如何引导您的 Linux 机器. 运行 Linux 的其它硬件也有相似的软件(Macs 上的 Open Firmware, Sun boot PROM, 等等...). 可以使用 BIOS 来阻止攻击者重新引导您的计算机和操作您的 Linux 系统.

Many PC BIOSs let you set a boot password. This doesn't provide all that much security (the BIOS can be reset, or removed if someone can get into the case), but might be a good deterrent (i.e. it will take time and leave traces of tampering). Similarly, on S/Linux (Linux for SPARC(tm) processor machines), your EEPROM can be set to require a boot-up password. This might slow attackers down.

很多 PC 的 BIOS 允许设定引导密码. 这并不能提供太多的安全保证(BIOS 可以复位, 或删除), 但也有一定的作用(即可以拖延时间, 和留下追踪线索). 同样, 在 S/Linux(基于 SPARC 的 Linux)上, EEPROM 可以设定引导密码. 这可以拖延攻击者的时间.

Another risk of trusting BIOS passwords to secure your system is the default password problem. Most BIOS makers don't expect people to open up their computer and disconnect batteries if they forget their password and have equipped their BIOSes with default passwords that work regardless of your chosen password. Some of the more common passwords include:

另一个依赖 BIOS 密码保护系统的风险是默认密码. 很多 BIOS 制造者并不希望他的用户在忘记密码时, 必需打开计算机, 短接电池, 为此他们为 BIOS 设置了您默认密码. 常用的一些包括:

j262 AWARD_SW AWARD_PW lkwpeter Biostar AMI Award bios BIOS setup cmos AMI!SW1 AMI?SW1 password hewittrand shift + s y x z

I tested an Award BIOS and AWARD_PW worked. These passwords are quite easily available from manufacturers' websites and http://astalavista.box.sk and as such a BIOS password cannot be considered adequate protection from a knowledgeable attacker.

我在一个 Award BIOS 和 AWARD_PW 上作过测试. 这些密码很容易从制造商的站点和 http://astalavista.box.sk 上获取, 并且并不能依赖 BIOS 密码保护您的计算机免受经验丰富的攻击者的损害.

Many x86 BIOSs also allow you to specify various other good security settings. Check your BIOS manual or look at it the next time you boot up. For example, some BIOSs disallow booting from floppy drives and some require passwords to access some BIOS features.

许多 x86 的 BIOS 还允许您具体指定一些其它安全设定. 查看您的BIOS手册或在下次引导的时候看一下. 例如,一些 BIOS 可以设置为不允许从软驱启动, 有些可设置为在访问BIOS时需要提供密码.

Note: If you have a server machine, and you set up a boot password, your machine will not boot up unattended. Keep in mind that you will need to come in and supply the password in the event of a power failure. ;(

注意: 如果您有一台服务器, 并设置了引导密码, 那么没有人的参与, 机器将无法引导. 记住这需要你亲临现场输入密码.
3.3 Boot Loader Security 启动加载器的安全

The various Linux boot loaders also can have a boot password set. LILO, for example, has password and restricted settings; password requires password at boot time, whereas restricted requires a boot-time password only if you specify options (such as single) at the LILO prompt.

各种Linux启动加载器也可以设置引导密码. 例如, LILO, 就用 password 和 restricted 设置; password 在引导时要输入密码, 而 restricted 则是在 LILO 提示符使用某种引导选项(比如 single)时才需要密码

>From the lilo.conf man page:

>源自 lilo.conf 联机手册:

password=password
               The per-image option `password=...' (see below) applies to all images.
               这个per-image选项 `password=...' 用于所有映像.

restricted
               The per-image option `restricted' (see below) applies to all images.
               个per-image选项 `restricted' 用于所有映像.

         password=password
               Protect the image by a password.
               使用密码保护映像.

         restricted
               A password is only required to boot the image if
               parameters are specified  on  the  command  line
               (e.g. single).
               当命令行(如 single)指定参数启动时,
               使用该映像需要密码.

Keep in mind when setting all these passwords that you need to remember them.

Also remember that these passwords will merely slow the determined attacker. They won't prevent someone from booting from a floppy, and mounting your root partition. If you are using security in conjunction with a boot loader, you might as well disable booting from a floppy in your computer's BIOS, and password-protect the BIOS.

牢记, 您设定的每个密码都应牢记在心.

还要记住, 这些密码只能减缓攻击. 并不能阻止从软盘引导, 然后挂载您的根分区. 如果要使启动加载器更安全, 您需要在BIOS中禁用从软盘引导, 并设置BIOS密码保护.

Also keep in mind that the /etc/lilo.conf will need to be mode "600" (readable and writing for root only), or others will be able to read your passwords!

还要牢记, 需要将 /etc/lilo.conf 权限设置为 "600"(只有 root 用户可以读写), 否则, 其它用户将可以读取您的密码.

If anyone has security-related information from a different boot loader, we would love to hear it. (grub, silo, milo, linload, etc).

如果有人能提供其它启动加载器的安全相关信息, 我们将非常乐意接受. (grub, silo, milo, linload, etc).

Note: If you have a server machine, and you set up a boot password, your machine will not boot up unattended. Keep in mind that you will need to come in and supply the password in the event of a power failure. ;(

注: 如果您拥有一台服务器, 并且设置了引导密码, 在没有人员干预的情况下将无法引导. 要牢记, 每次重新引导您都需要亲临现场输入密码.
3.4 xlock and vlock xlock 和 vlock

If you wander away from your machine from time to time, it is nice to be able to "lock" your console so that no one can tamper with, or look at, your work. Two programs that do this are: xlock and vlock.

如果您经常从您的计算机前走开, 那么在离开时"锁定"您的控制台, 以防止别人篡改, 或偷窥您的工作. 有两个可以实现这一功能的程序: xlock 和 vlock.

xlock is a X display locker. It should be included in any Linux distributions that support X. Check out the man page for it for more options, but in general you can run xlock from any xterm on your console and it will lock the display and require your password to unlock.

xlock是一个基于 X 的锁定程序. 每个支持 X 的发行版都应该提供了这一程序. 通常在虚拟终端的 xterm 中直接运行 xlock, 就可以锁定屏幕, 解锁则需要输入密码才行, 更多参数需要参阅它的联机手册.

vlock is a simple little program that allows you to lock some or all of the virtual consoles on your Linux box. You can lock just the one you are working in or all of them. If you just lock one, others can come in and use the console; they will just not be able to use your virtual console until you unlock it. vlock ships with RedHat Linux, but your mileage may vary.

vlock 是个简单的小程序, 可是用于锁定你计算机的某个或所有虚拟控制台. 您可以用它锁定您正在使用的, 或所有的控制台. 如果只锁定一个, 则其它的仍能进入和使用; 只是在您解锁前不能使用您锁定的终端而已. vlock 是从 RedHat 移植来的, 但是现在比较通用了.

Of course locking your console will prevent someone from tampering with your work, but won't prevent them from rebooting your machine or otherwise disrupting your work. It also does not prevent them from accessing your machine from another machine on the network and causing problems.

当然, 锁定您的控制台可以阻止其它人窥视您的工作, 但是并不能阻止重启您的机器或搞乱您的工作. 也不能阻止他们通过网络访问您的机器.

More importantly, it does not prevent someone from switching out of the X Window System entirely, and going to a normal virtual console login prompt, or to the VC that X11 was started from, and suspending it, thus obtaining your privileges. For this reason, you might consider only using it while under control of xdm.

更重要的是, 它不能阻止直接切换 X 窗口系统到虚拟终端登录, 或重起一个 X 窗口, 然后获取您的权限. 因此, 您应当考虑只在使用 xdm 时使用这种锁定方式.
3.5 Security of local devices 本地设备安全

If you have a webcam or a microphone attached to your system, you should consider if there is some danger of a attacker gaining access to those devices. When not in use, unplugging or removing such devices might be an option. Otherwise you should carefully read and look at any software with provides access to such devices.

如果您的系统上安装了 webcam 或麦克风, 则应当考虑它们是否会为骇客入侵您的系统提供了方便之门. 当不使用时, 应当拔掉或卸载这些设备. 否则, 您则应当小心检查能够访问这些设备的软件.
3.6 Detecting Physical Security Compromises 检测物理安全威胁

The first thing to always note is when your machine was rebooted. Since Linux is a robust and stable OS, the only times your machine should reboot is when you take it down for OS upgrades, hardware swapping, or the like. If your machine has rebooted without you doing it, that may be a sign that an intruder has compromised it. Many of the ways that your machine can be compromised require the intruder to reboot or power off your machine.

首先要注意您的系统上次重启的时间. 因为Linux是一个健壮而稳定的操作系统. 只有当您升级系统或更换硬件或做类似的工作时才应重启系统. 如果系统在您不知道的情况下重启了, 这可能说明被侵入了. 很多入侵方式需要重起或关闭您的机器.

Check for signs of tampering on the case and computer area. Although many intruders clean traces of their presence out of logs, it's a good idea to check through them all and note any discrepancy.

仔细检查留下的痕迹. 尽管很多入侵者会清除他们入侵踪迹, 但是仔细的检查, 看看是否留下蛛丝马迹, 仍不失为一个好主意.

It is also a good idea to store log data at a secure location, such as a dedicated log server within your well-protected network. Once a machine has been compromised, log data becomes of little use as it most likely has also been modified by the intruder.

同时应当在安全的地方存储日志数据, 比如在您的网络最安全的部分构建一个日志服务器. 因为一旦有机器被入侵, 日志数据也有可能被修改, 而变得没有什么用处了.

The syslog daemon can be configured to automatically send log data to a central syslog server, but this is typically sent unencrypted, allowing an intruder to view data as it is being transferred. This may reveal information about your network that is not intended to be public. There are syslog daemons available that encrypt the data as it is being sent.

syslog 守护进程可以配置为自动发送日志数据到 syslog 中心服务器, 但是这通常是未加密的, 入侵者有可能在数据传输时截获这些数据. 这可能会泄漏您网络的一些机密信息. 现在已经开发出可以加密传输数据的 syslog 守护进程了.

Also be aware that faking syslog messages is easy -- with an exploit program having been published. Syslog even accepts net log entries claiming to come from the local host without indicating their true origin.

还应当注意伪装 syslog 信息是相当简单的 -- 已经有这类漏洞程序公布了. syslog 甚至会接收来自网络, 但是声明为本地主机的信息, 并不对其真正的源地址进行检测.

Some things to check for in your logs:

在日志中需要注意的一些事情:

* Short or incomplete logs.
* 过短的或不完整的日志.
* Logs containing strange timestamps.
* 含有奇怪的时间戳的日志
* Logs with incorrect permissions or ownership.
* 权限或所有者不正确的日志.
* Records of reboots or restarting of services.
* 有关重新引导, 或重启服务的记录.
* missing logs.
* 缺失的日志.
* su entries or logins from strange places.
* 有关 su 的或从陌生的地方登录的内容.

We will discuss system log data later in the HOWTO.

在 HOWTO 的后部我们将对此进行详细讨论.

eTony · 发表于 2006-3-20 13:46:36

4. Local Security 本地安全

The next thing to take a look at is the security in your system against attacks from local users. Did we just say local users? Yes!

下边要考虑的安全问题是防止本地用户对系统的攻击. 你是说本地用户? 是的!

Getting access to a local user account is one of the first things that system intruders attempt while on their way to exploiting the root account. With lax local security, they can then "upgrade" their normal user access to root access using a variety of bugs and poorly setup local services. If you make sure your local security is tight, then the intruder will have another hurdle to jump.

入侵者要得到 root 账号, 首先要做的事情就是获取本地用户列表. 在松散的本地安全环境里, 可以通过各种 bug 或差劲的本地服务设置将普通用户提升为 root. 如果您确保本地安全设置的不错的话, 则入侵者就需要另觅他途了.

Local users can also cause a lot of havoc with your system even (especially) if they really are who they say they are. Providing accounts to people you don't know or for whom you have no contact information is a very bad idea.

本地用户还会引起很多问题, 即使(特别是)就是真实的用户. 如果您不知道这些账号给了哪些人, 或者不了解他们的详细信息, 那真是糟透了.
4.1 Creating New Accounts 创建账号

You should make sure you provide user accounts with only the minimal requirements for the task they need to do. If you provide your son (age 10) with an account, you might want him to only have access to a word processor or drawing program, but be unable to delete data that is not his.

应当确保提供给用户的账户的权限不能超越他们的需求. 比如要给您的儿子(10岁大)建一个账号, 只想让他使用字处理程序或绘画程序, 那就无权删除不属于他的数据.

Several good rules of thumb when allowing other people legitimate access to your Linux machine:

下边是一些用户控制用户权限的很棒的规则:

* Give them the minimal amount of privileges they need.
* 赋予他们所需权限的最小值.
* Be aware when/where they login from, or should be logging in from.
* 注意登录时间和地点, 或其允许登录的地点.
* Make sure you remove inactive accounts, which you can determine by using the 'last' command and/or checking log files for any activity by the user.
* 确保已经删除了闲置的账号, 您可以使用 'last' 命令和/或通过检查日志文件来确定哪些账号正在使用.
* The use of the same userid on all computers and networks is advisable to ease account maintenance, and permits easier analysis of log data.
* 应该在所有的机器和网络上使用同样的用户ID, 这有助于账号管理和日志数据分析.
* The creation of group user-id's should be absolutely prohibited. User accounts also provide accountability, and this is not possible with group accounts.
* 绝对禁止创建公用账号, 用户账号是要承担责任的, 这样就没有办法区分了.

Many local user accounts that are used in security compromises have not been used in months or years. Since no one is using them they, provide the ideal attack vehicle.

长时间不用的一些本地账号, 很可能会成为理想的安全漏洞.
4.2 Root Security Root 安全

The most sought-after account on your machine is the root (superuser) account. This account has authority over the entire machine, which may also include authority over other machines on the network. Remember that you should only use the root account for very short, specific tasks, and should mostly run as a normal user. Even small mistakes made while logged in as the root user can cause problems. The less time you are on with root privileges, the safer you will be.

在系统中最受欢迎的账号莫属 root (超级用户)了. 此账户是整个机器的管理者, 甚至可能是整个网络的管理员. 记住您应当尽可能少的使用 root, 尽量使用普通用户. 即使使用 root 登录产生的很小的失误, 也会引发严重问题. 您使用 root 的次数约少, 则越安全.

Several tricks to avoid messing up your own box as root:

可以避免使用 root 的一些小技巧:

* When doing some complex command, try running it first in a non-destructive way...especially commands that use globing: e.g., if you want to do rm foo*.bak, first do ls foo*.bak and make sure you are going to delete the files you think you are. Using echo in place of destructive commands also sometimes works.
* 使用一些复杂的命令时, 首先以非破坏的方式运行...特别是全局命令: 比如您想 rm foo*.bak, 首先 ls foo*.bak, 确保列出的文件和你要删除的文件相符. 在破坏命令中使用 echo 也很有必要.
* Provide your users with a default alias to the rm command to ask for confirmation for deletion of files.
* 为 rm 设置别名, 删除文件时需要确认.
* Only become root to do single specific tasks. If you find yourself trying to figure out how to do something, go back to a normal user shell until you are sure what needs to be done by root.
* 仅切换到 root 用户, 完成特定工作. 当您不太清楚如何完成某些任务时, 在确认确实需要 root 用户来完成前, 不要切换用户.
* The command path for the root user is very important. The command path (that is, the PATH environment variable) specifies the directories in which the shell searches for programs. Try to limit the command path for the root user as much as possible, and never include . (which means "the current directory") in your PATH. Additionally, never have writable directories in your search path, as this can allow attackers to modify or place new binaries in your search path, allowing them to run as root the next time you run that command.
* root 的搜索命令的路径也很重要. 搜索命令的路径(就是环境变量 PATH) 特指在 shell 中搜索程序的目录. 尽量限制 root 的搜索路径, 并确保在 PATH 中不包含 . (指"当前目录"). 此外, 在确保搜索路径都为不可写, 否则的话入侵者将有机会修改或替换搜索路径中的二进制文件, 下次您就可能以 root 运行这些命令.
* Never use the rlogin/rsh/rexec suite of tools (called the r-utilities) as root. They are subject to many sorts of attacks, and are downright dangerous when run as root. Never create a .rhosts file for root.
* 从不以 root 用户使用 rlogin/rsh/rexec 工具集(即, r-套件). 这些工具很容易受到攻击, 并且以 root 运行是相当危险的. 禁止为 root 用户创建 .rhosts 文件.
* The /etc/securetty file contains a list of terminals that root can login from. By default (on Red Hat Linux) this is set to only the local virtual consoles(vtys). Be very wary of adding anything else to this file. You should be able to login remotely as your regular user account and then su if you need to (hopefully over ssh or other encrypted channel), so there is no need to be able to login directly as root.
* /etc/securetty 文件包含 root 可以使用的终端列表. 默认情况下(在 Red Hat Linux 中)只是设为本地虚拟终端(vtys). 注意在这个文件中添加的内容. 您应当用普通用户远程登录, 然后在需要时(希望使用的是 ssh 或类似加密管道)su 到 root 用户, 这样就不必以 root 用户直接登录了.
* Always be slow and deliberate running as root. Your actions could affect a lot of things. Think before you type!
* 使用 root 前要经过周密的考虑. 您的操作可能会影响范围很大. 三思而行.

If you absolutely positively need to allow someone (hopefully very trusted) to have root access to your machine, there are a few tools that can help. sudo allows users to use their password to access a limited set of commands as root. This would allow you to, for instance, let a user be able to eject and mount removable media on your Linux box, but have no other root privileges. sudo also keeps a log of all successful and unsuccessful sudo attempts, allowing you to track down who used what command to do what. For this reason sudo works well even in places where a number of people have root access, because it helps you keep track of changes made.

如果您决定允许别人(非常信任的人)在您的计算机上使用 root 权限. 下边这些工具将对您有所帮助. sudo 允许用户使用一些只有 root 的命令. 例如, 这样可以令没有 root 权限的用户拥有弹出或加载媒介的权限. sudo 也会将成功或不成功的 sudo 操作记录下来, 这样您就可以知道哪些人使用了哪些命令做了什么. 因此可以使用 sudo 分配一些 root 权限, 并能跟踪效果.

Although sudo can be used to give specific users specific privileges for specific tasks, it does have several shortcomings. It should be used only for a limited set of tasks, like restarting a server, or adding new users. Any program that offers a shell escape will give root access to a user invoking it via sudo. This includes most editors, for example. Also, a program as innocuous as /bin/cat can be used to overwrite files, which could allow root to be exploited. Consider sudo as a means for accountability, and don't expect it to replace the root user and still be secure.

虽然 sudo 可以根据任务分发权限, 它也有些不足之处. 它只适用于一些有限的任务, 比如重启服务, 添加新用户. Any program that offers a shell escape will give root access to a user invoking it via sudo. 例如, 这包括很多编辑器. 同时, /bin/cat 类似的程序, 也可用于覆盖文件, 这是一个漏洞. 使用 sudo 也有风险, 不要以为用它代替 root 就安全了.

eTony · 发表于 2006-3-20 13:57:05

5. Files and File system Security 文件与文件系统安全

A few minutes of preparation and planning ahead before putting your systems on-line can help to protect them and the data stored on them.

在系统接入网络前的几分钟准备和计划有助于保护您的系统和系统上存储的数据.

* There should never be a reason for users' home directories to allow SUID/SGID programs to be run from there. Use the nosuid option in /etc/fstab for partitions that are writable by others than root. You may also wish to use nodev and noexec on users' home partitions, as well as /var, thus prohibiting execution of programs, and creation of character or block devices, which should never be necessary anyway.
* 禁止在用户目录下运行设置了 SUID/SGID 的程序. 在 /etc/fstab 中, 对允许 root 以外用户写入的分区添加 nosuid 选项. 也应当对用户家目录, 以及 /var所在分区使用 nodev 和 noexec 选项. 这样就能杜绝程序运行, 创建字符和块设备, 这些也是不允许的.
* If you are exporting file-systems using NFS, be sure to configure /etc/exports with the most restrictive access possible. This means not using wild cards, not allowing root write access, and exporting read-only wherever possible.
* 如果您使用 NFS 文件系统, 则要确保对配置文/etc/exports设置了正确的权限. 比如不允许使用外接卡, 不允许 root 写操作, 全部设为只读.
* Configure your users' file-creation umask to be as restrictive as possible. See umask settings.
* 配置您的用户创建文件的 umask值, 尽量对其限制. 参阅 umask settings.
* If you are mounting file systems using a network file system such as NFS, be sure to configure /etc/exports with suitable restrictions. Typically, using `nodev', `nosuid', and perhaps `noexec', are desirable.
* 如果您加载了如 NFS 的网络文件系统, 应当确保 /etc/exports 中权限设置正确. 比如是使用 `nodev', `nosuid', 如果可能要使用 `noexec' 选项.
* Set file system limits instead of allowing unlimited as is the default. You can control the per-user limits using the resource-limits PAM module and /etc/pam.d/limits.conf. For example, limits for group users might look like this:
* 设置文件系统, 取消默认允许的 unlimited. 您可以控制每个用户限制使用限制资源PAM模块和 /etc/pam.d/limits.conf. 例如, 象下边这样限制 users 组:

                        @users    hard  core 0
                        @users    hard  nproc 50
                        @users    hard  rss    5000

   This says to prohibit the creation of core files, restrict the number of processes to 50, and restrict memory usage per user to 5M.

   这样就可以禁止创建 core 文件, 限制进程数为50, 限制每个用户的内存使用为 5M.

   You can also use the /etc/login.defs configuration file to set the same limits.

   也可以使用 /etc/login.defs 配置文件进行同样的限制.
* The /var/log/wtmp and /var/run/utmp files contain the login records for all users on your system. Their integrity must be maintained because they can be used to determine when and from where a user (or potential intruder) has entered your system. These files should also have 644 permissions, without affecting normal system operation.
* /var/log/wtmp 和 /var/run/utmp 文件中包含了系统中所有用户的登录记录. 可以用于确定什么时候, 有用户(或入侵者)从何处登入了您的系统, 所以系统应该提供这一功能. 这些文件的权限应该设置为 644, 这对一般的系统操作没有影响.
* The immutable bit can be used to prevent accidentally deleting or overwriting a file that must be protected. It also prevents someone from creating a hard link to the file. See the chattr(1) man page for information on the immutable bit.
* 其不可修改属性可以防止必须保护的文件被意外删除, 或被覆盖. 也可以防止创建文件的硬链接. 有关不可修改位的详细信息参阅联机手册 chattr(1).
* SUID and SGID files on your system are a potential security risk, and should be monitored closely. Because these programs grant special privileges to the user who is executing them, it is necessary to ensure that insecure programs are not installed. A favorite trick of crackers is to exploit SUID-root programs, then leave a SUID program as a back door to get in the next time, even if the original hole is plugged.

   您系统中的 SUID 和 SGID 文件存在潜在的威胁, 应该引起您的密切注意. 因为这些文件授予了运行它们的用户特别的权限, 系统中尽量不要存在这类文件. 即使修补了原来的漏洞, 在系统中保留 SUID-root 也不亚于定时炸弹, 入侵者对这类程序最感兴趣.

   Find all SUID/SGID programs on your system, and keep track of what they are, so you are aware of any changes which could indicate a potential intruder. Use the following command to find all SUID/SGID programs on your system:

   找出系统中所有的 SUID/SGID 程序, 并对其进行跟踪, 时刻警惕和入侵者相关的任何变动, 使用下面的命令查找系统中的所有 SUID/SGID 程序:

                        root#  find / -type f \( -perm -04000 -o -perm -02000 \)

   The Debian distribution runs a job each night to determine what SUID files exist. It then compares this to the previous night's run. You can look in /var/log/setuid* for this log.

   这样, Debian发行版每天晚上都运行一项作业来监测存在哪些 SUID 文件. 并与前天晚上的相比较. 在 /var/log/setuid* 中记录的相关记录.

   You can remove the SUID or SGID permissions on a suspicious program with chmod, then restore them back if you absolutely feel it is necessary.

   可以使用 chmod 删除容易引起问题程序的 SUID 或 SGID 权限, 在确实必要时再恢复其设置.
* World-writable files, particularly system files, can be a security hole if a cracker gains access to your system and modifies them. Additionally, world-writable directories are dangerous, since they allow a cracker to add or delete files as he wishes. To locate all world-writable files on your system, use the following command:

                        root# find / -perm -2 ! -type l -ls

   and be sure you know why those files are writable. In the normal course of operation, several files will be world-writable, including some from /dev, and symbolic links, thus the ! -type l which excludes these from the previous find command.

* 全局可写文件, 特别是系统文件, 如果一个骇客入侵了您的系统并修改它们, 这将是一个安全漏洞. 另外, 全局可写目录也很危险, 因为这将允许骇客添加或删除文件. 可以用下面的命令找出您系统中的所有全局可写文件:

                        root# find / -perm -2 ! -type l -ls

   并确保知道这些文件为什么可写. 在正常运行过程中, 有些文件将会变为可写状态, 这包括/dev下的一些文件, 符号链接, 因此前面的find命令包含了 ! -type l 选项.

*

   Unowned files may also be an indication an intruder has accessed your system. You can locate files on your system that have no owner, or belong to no group with the command:

   无宿主文件也说明入侵者访问了您的系统. 您应该找出您系统中的无宿主文件, 或不属于任何组的文件:

                        root# find / -nouser -o -nogroup -print

* Finding .rhosts files should be a part of your regular system administration duties, as these files should not be permitted on your system. Remember, a cracker only needs one insecure account to potentially gain access to your entire network. You can locate all .rhosts files on your system with the following command:

   找出 .rhosts 文件, 应当是您作为管理员职责的一部分, 因为这些文件是不允许在系统中存在的. 牢记, 骇客仅需一个不安全的账号就可能获取整个网络. 可以用下边的命令找出系统中所有的.rhosts文件:

                     root# find /home -name .rhosts -print

*

   Finally, before changing permissions on any system files, make sure you understand what you are doing. Never change permissions on a file because it seems like the easy way to get things working. Always determine why the file has that permission before changing it.

   最后, 在修改任何系统文件的权限前, 确保已经明了您在做什么. 从不要因为觉得这样工作起来更方便, 而改变系统文件的权限. 在修改文件权限前, 应该清楚为什么设置这样的权限.

5.1 Umask Settings 设置 umask

The umask command can be used to determine the default file creation mode on your system. It is the octal complement of the desired file mode. If files are created without any regard to their permissions settings, the user could inadvertently give read or write permission to someone that should not have this permission. Typical umask settings include 022, 027, and 077 (which is the most restrictive). Normally the umask is set in /etc/profile, so it applies to all users on the system. The file creation mask can be calculated by subtracting the desired value from 777. In other words, a umask of 777 would cause newly-created files to contain no read, write or execute permission for anyone. A mask of 666 would cause newly-created files to have a mask of 111. For example, you may have a line that looks like this:

umask 命令可以用于设置您系统中创建文件的默认权限. 它是八进制文件权限的补数. 如果不考虑文件创建的权限, 那么用户不经心的创建的文件可能赋予其它用户对于此文件不应该有的读或写权限. 典型的 umask 设定包括 022, 027, 和 077 (高约束性). 一般情况下, 由 /etc/profile 文件提供 umask 设定, 这对系统中的所有用户有效.用 777 减去 umask 值可以得到创建文件的对应权限. 也就是说, umask 值为 777 就意味着创建的文件, 任何用户都不会拥有读, 写, 或执行权限. umask为 666 时,创建的文件权限应该为 111. 例如, 您应该设置形如下边的内容:

                  # Set the user's default umask
                  umask 033

Be sure to make root's umask 077, which will disable read, write, and execute permission for other users, unless explicitly changed using chmod. In this case, newly-created directories would have 744 permissions, obtained by subtracting 033 from 777. Newly-created files using the 033 umask would have permissions of 644.

务必将 root 的 umask 设为 077, 这将禁止其它用户读, 写, 和执行 root 创建的文件, 除非使用 chmod 修改其权限. 这种情况下, 创建的目录的权限将为744, 即 777 减去 033. umask 为 033, 创建的文件权限则为 644.

If you are using Red Hat, and adhere to their user and group ID creation scheme (User Private Groups), it is only necessary to use 002 for a umask. This is due to the fact that the default configuration is one user per group.

如果您使用的是 Red Hat, 并使用其用户和组 ID 创建策略(用户私有组), 则应当将 umask 设为 002. 这是由于默认设置每个用户拥有一个组.
5.2 File Permissions 文件权限

It's important to ensure that your system files are not open for casual editing by users and groups who shouldn't be doing such system maintenance.

确保您的系统文件没有对偶尔登录的没有维护任务的用户和组开放写权限.

Unix separates access control on files and directories according to three characteristics: owner, group, and other. There is always exactly one owner, any number of members of the group, and everyone else.

Unix 根据宿主, 组, 和其它来分别定义对文件和目录的访问控制.

A quick explanation of Unix permissions:

下边是Unix权限的一个简单解释:

Ownership - Which user(s) and group(s) retain(s) control of the permission settings of the node and parent of the node

所有权 - 哪个(些)用户和组拥有设定节点和父节点的权限

Permissions - Bits capable of being set or reset to allow certain types of access to it. Permissions for directories may have a different meaning than the same set of permissions on files.

权限 - 用于设定或重新设定访问类型的位. 同样的目录权限和文件权限相比, 意义稍有不同.

Read:读

* To be able to view contents of a file 可以浏览文件的内容
* To be able to read a directory 可以读取目录

Write:写

* To be able to add to or change a file 可以添加或修改文件
* To be able to delete or move files in a directory 可以删除或移动目录下的文件

Execute:执行

* To be able to run a binary program or shell script 可以运行二进制程序或 shell 脚本
* To be able to search in a directory, combined with read permission 可以与读权限相结合, 对目录进行搜索.

Save Text Attribute: (For directories) 保存文本属性: (对于目录)

The "sticky bit" also has a different meaning when applied to directories than when applied to files. If the sticky bit is set on a directory, then a user may only delete files that the he owns or for which he has explicit write permission granted, even when he has write access to the directory. This is designed for directories like /tmp, which are world-writable, but where it may not be desirable to allow any user to delete files at will. The sticky bit is seen as a t in a long directory listing.

"粘贴位" 当应用于目录时, 与应用于文件, 也有不同的意义, 如果对目录设置粘贴位, 则用户仅可以删除其宿主授予写权限的文件, 即使是制拥有对目录的写权限. 例如 /tmp 目录, 它是全局可写的, 但是此处不可以设置为任何人都可以随意删除文件. 粘贴位在目录权限处显示为 t.

SUID Attribute: (For Files) SUID属性: (对于文件)

This describes set-user-id permissions on the file. When the set user ID access mode is set in the owner permissions, and the file is executable, processes which run it are granted access to system resources based on user who owns the file, as opposed to the user who created the process. This is the cause of many "buffer overflow" exploits.

这是有关文件设置用户 ID 权限的描述. 当宿主权限设置为用户 ID 访问模式时, 并且文件为可执行文件, 则其运行进程将会被授予基于宿主的访问系统资源的权限. 这会引发很多"缓存溢出"问题.

SGID Attribute: (For Files) SGID属性: (对于文件)

If set in the group permissions, this bit controls the "set group id" status of a file. This behaves the same way as SUID, except the group is affected instead. The file must be executable for this to have any effect.

如果设置到组权限, 此位将控制文件的"设置组 ID"状态. 这与 SUID 相似, 只是影响到组. 要想生效, 文件应该为可执行的.

SGID Attribute: (For directories) SGID属性: (对于目录)

If you set the SGID bit on a directory (with chmod g+s directory), files created in that directory will have their group set to the directory's group. 如果对目录设置了 SGID 位(chmod g+s directory), 则在此目录下创建的文件将会拥有目录相同的组.

You - The owner of the file 文件的宿主

Group - The group you belong to 文件的宿组

Everyone - Anyone on the system that is not the owner or a member of the group 系统中除宿主和组成员以外的其它人

File Example: 例如:

         -rw-r--r--  1 kevin  users       114 Aug 28  1997 .zlogin
         1st bit - directory?          (no)
         2nd bit - read by owner?       (yes, by kevin)
            3rd bit - write by owner?       (yes, by kevin)
            4th bit - execute by owner?    (no)
            5th bit - read by group?       (yes, by users)
               6th bit - write by group?       (no)
               7th bit - execute by group?    (no)
               8th bit - read by everyone?    (yes, by everyone)
                  9th bit - write by everyone?    (no)
                  10th bit - execute by everyone?  (no)

The following lines are examples of the minimum sets of permissions that are required to perform the access described. You may want to give more permission than what's listed here, but this should describe what these minimum permissions on files do:

下边是权限最小设定的例子. 可能您要赋予的权限比这些要多, 但下边是对最低权限的描述:

-r--------  Allow read access to the file by owner
            允许文件的宿主读取
--w-------  Allows the owner to modify or delete the file
            允许文件宿主修改或删除文件
            (Note that anyone with write permission to the directory
               the file is in can overwrite it and thus delete it)
               (注意拥有目录写权限的任何人都可以将其覆盖, 也就是删除它)
---x------  The owner can execute this program, but not shell scripts,
               which still need read permission
               宿主可以执行次程序, 如果是shell脚本, 还需要读权限.
---s------  Will execute with effective User ID = to owner
            以宿主的ID执行
--------s-  Will execute with effective Group ID = to group
            以宿组的ID执行
-rw------T  No update of "last modified time".  Usually used for swap
               files禁止更新"最后修改时间", 通常用于 swap 文件.
---t------  No effect.  (formerly sticky bit)
            没有影响(以前的粘贴位)

Directory Example:

         drwxr-xr-x  3 kevin  users       512 Sep 19 13:47 .public_html/
         1st bit - directory?          (yes, it contains many files)
         2nd bit - read by owner?       (yes, by kevin)
            3rd bit - write by owner?       (yes, by kevin)
            4th bit - execute by owner?    (yes, by kevin)
            5th bit - read by group?       (yes, by users
               6th bit - write by group?       (no)
               7th bit - execute by group?    (yes, by users)
               8th bit - read by everyone?    (yes, by everyone)
                  9th bit - write by everyone?    (no)
                  10th bit - execute by everyone?  (yes, by everyone)

The following lines are examples of the minimum sets of permissions that are required to perform the access described. You may want to give more permission than what's listed, but this should describe what these minimum permissions on directories do:

下边是对目录最小权限设定的例子的描述. 可能您需要赋予更多权限, 下边的仅仅是对目录最小权限的描述:

dr--------  The contents can be listed, but file attributes can't be read
            可以列印目录内容, 但是不能获取文件权限
d--x------  The directory can be entered, and used in full execution
               paths
               可以使用完整路径进入目录
dr-x------  File attributes can be read by owner
            宿主可以读去文件属性
d-wx------  Files can be created/deleted, even if the directory
               isn't the current one
               可以在目录下创建/删除文件, 即使不是当前目录.
d------x-t  Prevents files from deletion by others with write
               access. Used on /tmp
               阻止有写权限的人删除文件. 用于 /tmp
d---s--s--  No effect
            没有影响

System configuration files (usually in /etc) are usually mode 640 (-rw-r-----), and owned by root. Depending on your site's security requirements, you might adjust this. Never leave any system files writable by a group or everyone. Some configuration files, including /etc/shadow, should only be readable by root, and directories in /etc should at least not be accessible by others.

系统配置文件(通常在 /etc 目录下)通常设为 640(-rw-r-----), 并且宿主为 root. 根据您的站点的安全需求, 对此进行调整. 禁止将系统文件设置为组或任何人可写. 有些配置文件, 包括 /etc/shadow, 应当只对 root 可读, 并且 /etc 下的目录至少不能被其它人访问.

SUID Shell Scripts SUID shell 脚本

SUID shell scripts are a serious security risk, and for this reason the kernel will not honor them. Regardless of how secure you think the shell script is, it can be exploited to give the cracker a root shell. SUID shell 脚本是一个安全隐患, 因此内核并不信任这一设定. 不管您认定 shell 脚本如何的安全, 它都可被骇客利用来获取 root shell.

5.3 Integrity Checking 完整性检查

Another very good way to detect local (and also network) attacks on your system is to run an integrity checker like Tripwire, Aide or Osiris. These integrety checkers run a number of checksums on all your important binaries and config files and compares them against a database of former, known-good values as a reference. Thus, any changes in the files will be flagged.

使用 Tripwire, Aide 或 Osiris 等完整性检查工具, 是另一中非常好的监测本地(或网络)被入侵的方法. 完整检查工具对您系统中的重要二进制文件, 配置文件生成检验码, 并和以前存储在数据库中的被认为是无误的值相比较. 因此, 这些文件出现任何变动都会显示出来.

It's a good idea to install these sorts of programs onto a floppy, and then physically set the write protect on the floppy. This way intruders can't tamper with the integrety checker itself or change the database. Once you have something like this setup, it's a good idea to run it as part of your normal security administration duties to see if anything has changed.

将这类软件安装在软盘上是个不错的注意, 然后对软件设置写保护. 这样入侵者就无法篡改完整检查工具本身, 或修改数据库. 一旦您做了如此设置, 就可以把对系统的完整性检查作为正常安全管理职责的一部分.

You can even add a crontab entry to run the checker from your floppy every night and mail you the results in the morning. Something like:

也可以将每天晚上运行检查器的作业加入 crontab, 并在早上将结果 mail 给您. 形如:

                  # set mailto
                  MAILTO=kevin
                  # run Tripwire
                  15 05 * * * root /usr/local/adm/tcheck/tripwire

will mail you a report each morning at 5:15am.

就会在每天早上 5:15 将报告mail给您.

Integrity checkers can be a godsend to detecting intruders before you would otherwise notice them. Since a lot of files change on the average system, you have to be careful what is cracker activity and what is your own doing.

完整性检查工具简直检查入侵的至宝. 由于许多文件每天都会产生变化, 因此在设置检查器的检查对象时一定要小心.

You can find the freely available unsusported version of Tripwire at http://www.tripwire.org, free of charge. Manuals and support can be purchased.

您可以在 http://www.tripwire.org下载没有技术支持的免费版本, 手册和技术支持则需要付费.

Aide can be found at http://www.cs.tut.fi/~rammer/aide.html.

Aide 可以在 http://www.cs.tut.fi/~rammer/aide.html处找到.

Osiris can be found at http://www.shmoo.com/osiris/.

Osiris 可以在 http://www.shmoo.com/osiris/ 处找到.
5.4 Trojan Horses 特洛伊木马

"Trojan Horses" are named after the fabled ploy in Homer's "Iliad". The idea is that a cracker distributes a program or binary that sounds great, and encourages other people to download it and run it as root. Then the program can compromise their system while they are not paying attention. While they think the binary they just pulled down does one thing (and it might very well), it also compromises their security.

"特洛伊木马"源自荷马寓言中的"伊利亚特". 特指骇客发布一个功能听上去不错的程序或二进制代码, 并鼓励用户去下载, 程序需要以 root 权限运行. 然后程序就会在不注意的时候入侵其系统. 当用户认为他们下载的程序正在完成一项工作(可能还很不错)时, 正在牺牲系统的安全.

You should take care of what programs you install on your machine. RedHat provides MD5 checksums and PGP signatures on its RPM files so you can verify you are installing the real thing. Other distributions have similar methods. You should never run any unfamiliar binary, for which you don't have the source, as root! Few attackers are willing to release source code to public scrutiny.

应当十分注意在机器上安装的程序. Red Hat 提供其 RPM 文件的了 MD5 检验码和 PGP 签名, 这样您就可以对您安装的软件进行检验. 其它发行版也提供了相似的方法. 您不应当运行任何不熟悉的, 没有提供源代码的程序. 因为很少有骇客会向公共安全社区发布其源代码.

Although it can be complex, make sure you are getting the source for a program from its real distribution site. If the program is going to run as root, make sure either you or someone you trust has looked over the source and verified it.

尽管可能比较复杂, 确保您是从程序的真正发布站点获取的源代码. 如果程序需要以 root 运行, 还要确保您或您信任的人阅读程序代码, 并进行了验证.

eTony · 发表于 2006-3-20 14:09:37

6. Password Security and Encryption 密码安全与加密

One of the most important security features used today are passwords. It is important for both you and all your users to have secure, unguessable passwords. Most of the more recent Linux distributions include passwd programs that do not allow you to set a easily guessable password. Make sure your passwd program is up to date and has these features.

现在使用的最重要的安全功能就是密码. 拥有安全的, 难以猜测的密码对于您和您的用户来说是非常重要的. 现在大多数的 Linux 发行版都提供了 passwd 程序, 以防止您设置过于简单的密码. 注意及时升级您的 passwd 程序, 以获得更多功能.

In-depth discussion of encryption is beyond the scope of this document, but an introduction is in order. Encryption is very useful, possibly even necessary in this day and age. There are all sorts of methods of encrypting data, each with its own set of characteristics.

有关加密的深入讨论, 超出了本文的范围, 但是做一些介绍还是有必要的. 在这个年代加密是非常有用的, 甚至是必须的. 现在有各种各样的加密方法, 每种都各有特点.

Most Unicies (and Linux is no exception) primarily use a one-way encryption algorithm, called DES (Data Encryption Standard) to encrypt your passwords. This encrypted password is then stored in (typically) /etc/passwd (or less commonly) /etc/shadow. When you attempt to login, the password you type in is encrypted again and compared with the entry in the file that stores your passwords. If they match, it must be the same password, and you are allowed access. Although DES is a two-way encryption algorithm (you can code and then decode a message, given the right keys), the variant that most Unixes use is one-way. This means that it should not be possible to reverse the encryption to get the password from the contents of /etc/passwd (or /etc/shadow).

大多数的 Unix(Linux 也不例外)主要使用一种称为 DES(Data Encryption Standard) 的单向加密算法来对密码进行加密. 这种经过加密的密码(通常)被存储在 /etc/passwd (至少通常是) /etc/shadow中. 当您登录时, 键入的密码再次被加密, 然后与文件中存储的对应被加密的密码相比较. 只有密码相同才会匹配, 就会允许登录. 尽管 DES 是一个双向加密算法(您可以使用对应的密钥进行加密解密), 但是 Unix 使用的是单向变体. 这就意味着, 由 /etc/passwd (或/etc/shadow) 中存储的被加密的密码获取源密码是不可能的.

Brute force attacks, such as "Crack" or "John the Ripper" (see Section crack ) can often guess passwords unless your password is sufficiently random. PAM modules (see below) allow you to use a different encryption routine with your passwords (MD5 or the like). You can use Crack to your advantage, as well. Consider periodically running Crack against your own password database, to find insecure passwords. Then contact the offending user, and instruct him to change his password.

暴力攻击, 例如 "Crack" 或 "John the Ripper"(参阅 crack ) 通常为进行密码猜测. PAM 模块(下边会提到)允许您使用不同的加密算法(MD5, 或类似的). 您可以用 Crack 对您的密码进行测试. 应当考虑经常使用 Crack 测试您的密码数据库, 以发现不安全的密码. 然后联系相关用户, 通知其修改密码.

You can go to http://consult.cern.ch/writeup/security/security_3.html for information on how to choose a good password.

在 http://consult.cern.ch/writeup/security/security_3.html 处提供了有关如何选择密码的信息.
6.1 PGP and Public-Key Cryptography PGP 和公钥算法

Public-key cryptography, such as that used for PGP, uses one key for encryption, and one key for decryption. Traditional cryptography, however, uses the same key for encryption and decryption; this key must be known to both parties, and thus somehow transferred from one to the other securely.

公钥算法, 例如常用的 PGP, 使用不同的密钥进行加密解密. 但传统加密算法, 使用同一密钥进行加密解密; 这样密钥就必须为双方所知, 因此, 密钥的安全传输就成了问题.

To alleviate the need to securely transmit the encryption key, public-key encryption uses two separate keys: a public key and a private key. Each person's public key is available by anyone to do the encryption, while at the same time each person keeps his or her private key to decrypt messages encrypted with the correct public key.

为了减少安全传输密钥的负担, 公钥加密分别使用两个密钥: 公钥和私钥. 任何人都可以获取别人的公钥用于加密, 同时用自己的私钥进行解密使用对应公钥加密了的信息.

There are advantages to both public key and private key cryptography, and you can read about those differences in the RSA Cryptography FAQ, listed at the end of this section.

有关公钥和私钥算法的优点, 您可以在本段的结尾处找到. the RSA Cryptography FAQ, 处列出了它们的不同.

PGP (Pretty Good Privacy) is well-supported on Linux. Versions 2.6.2 and 5.0 are known to work well. For a good primer on PGP and how to use it, take a look at the PGP FAQ: http://www.pgp.com/service/export/faq/55faq.cgi

PGP(Pretty Good Privacy) 在 Linux 上提供了很好的支持. 2.6.2 和 5.0 版都是不错的版本. 有关 PGP 的基本优点, 以及其使用方法, 请参阅 PGP 的 FAQ: http://www.pgp.com/service/export/faq/55faq.cgi

Be sure to use the version that is applicable to your country. Due to export restrictions by the US Government, strong-encryption is prohibited from being transferred in electronic form outside the country.

确保使用的是可以获取本地支持的版本. 根据美国政府出口限制, 电子产品中的高强加密是禁止出口到别的国家的.

US export controls are now managed by EAR (Export Administration Regulations). They are no longer governed by ITAR.

美国出口控制现在通过 EAR 管理(Export Administration Regulations). 而不再是 ITAR.

There is also a step-by-step guide for configuring PGP on Linux available at http://mercury.chem.pitt.edu/~an ... r1997/article7.html. It was written for the international version of PGP, but is easily adaptable to the United States version. You may also need a patch for some of the latest versions of Linux; the patch is available at ftp://metalab.unc.edu/pub/Linux/apps/crypto.

在 http://mercury.chem.pitt.edu/~an ... r1997/article7.html 处提供了一个在 Linux 上配置 PGP 的入门指南. 这是针对 PGP 的国际版的, 同样适用于美国版本. 如果您使用 Linux 上的最新版本, 可能需要补丁 ftp://metalab.unc.edu/pub/Linux/apps/crypto.

There is a project maintaining a free re-implementation of pgp with open source. GnuPG is a complete and free replacement for PGP. Because it does not use IDEA or RSA it can be used without any restrictions. GnuPG is in compliance with OpenPGP. See the GNU Privacy Guard web page for more information: http://www.gnupg.org/.

现在有一个开放源代码的 pgp 重新实现. GnuPG 是一个完整的, PGP 的免费替代品. 因为它不使用 IDEA 或 RSA, 因此在使用上就没有限制. GnuPG 遵从 OpenPGP. 有关 GNU Privacy Guard 的更多信息, 请访问其主页: http://www.gnupg.org/.

More information on cryptography can be found in the RSA cryptography FAQ, available at http://www.rsa.com/rsalabs/newfaq/. Here you will find information on such terms as "Diffie-Hellman", "public-key cryptography", "digital certificates", etc.

RSA 密码学的 FAQ 中提供了有关密码学的更多信息, http://www.rsa.com/rsalabs/newfaq/. 在 "Diffie-Hellman", "public-key cryptography", "digital certificates", 等部分, 您可以找到相关信息.
6.2 SSL, S-HTTP and S/MIME

Often users ask about the differences between the various security and encryption protocols, and how to use them. While this isn't an encryption document, it is a good idea to explain briefly what each protocol is, and where to find more information.

用户经常会问到各种安全和加密协议之间的不同, 以及它们的使用方法. 尽管这不是专门讲述加密的文档, 简要的解释一下每种协议, 以及如何获取更多信息还是必要的.

* SSL: - SSL, or Secure Sockets Layer, is an encryption method developed by Netscape to provide security over the Internet. It supports several different encryption protocols, and provides client and server authentication. SSL operates at the transport layer, creates a secure encrypted channel of data, and thus can seamlessly encrypt data of many types. This is most commonly seen when going to a secure site to view a secure online document with Communicator, and serves as the basis for secure communications with Communicator, as well as many other Netscape Communications data encryption. More information can be found at http://www.consensus.com/security/ssl-talk-faq.html. Information on Netscape's other security implementations, and a good starting point for these protocols is available at http://home.netscape.com/info/security-doc.html. It's also worth noting that the SSL protocol can be used to pass many other common protocols, "wrapping" them for security. See http://www.quiltaholic.com/rickk/sslwrap/

   SSL: - SSL, 安全接口层, 是由 Netscape 开发的一种加密方案, 用于在互联网上提供安全服务. 它支持多种不同的加密协议, 并提供客户端和服务器授权. SSL 处于传输层, 为数据创建一个安全加密通道, 因此可以无缝的把多种类型的数据进行加密. 这种情况在您浏览安全站点的文档时经常会碰到. 更多信息参阅 http://www.consensus.com/security/ssl-talk-faq.html. 有关 Netscape 其它安全工具的信息, 以及有关协议一些不错的入门文章请查询 http://home.netscape.com/info/security-doc.html. SSL 协议可以用于包装其它协议, 使之更安全, 也很值得注意. 参阅 http://www.quiltaholic.com/rickk/sslwrap/
* S-HTTP: - S-HTTP is another protocol that provides security services across the Internet. It was designed to provide confidentiality, authentication, integrity, and non-repudiability [cannot be mistaken for someone else] while supporting multiple key-management mechanisms and cryptographic algorithms via option negotiation between the parties involved in each transaction. S-HTTP is limited to the specific software that is implementing it, and encrypts each message individually. [ From RSA Cryptography FAQ, page 138]

   S-HTTP: - S-HTTP 是另一种在互联网上提供安全服务的协议. 其目的是提供机密的, 认证的, 完整的, 不可否认的支持多种密钥管理规范的机制, 并且由交易双方协商确定加密算法. S-HTTP 被限制为特别软件, 对信息进行单个加密.
* S/MIME: - S/MIME, or Secure Multipurpose Internet Mail Extension, is an encryption standard used to encrypt electronic mail and other types of messages on the Internet. It is an open standard developed by RSA, so it is likely we will see it on Linux one day soon. More information on S/MIME can be found at http://home.netscape.com/assist/security/smime/overview.html.

   S/MIME: - S/MIME, 多用途互联网邮件扩展, 是用于电子邮件和其它信息类型的加密标准. 它是由 RSA 开发的开放标准, 所以, 我们将会在 Linux 看到这一应用. 有关 S/MIME 的更多信息参阅 http://home.netscape.com/assist/security/smime/overview.html.

6.3 Linux IPSEC Implementations Linux IPSEC 工具

Along with CIPE, and other forms of data encryption, there are also several other implementations of IPSEC for Linux. IPSEC is an effort by the IETF to create cryptographically-secure communications at the IP network level, and to provide authentication, integrity, access control, and confidentiality. Information on IPSEC and Internet draft can be found at http://www.ietf.org/html.charters/ipsec-charter.html. You can also find links to other protocols involving key management, and an IPSEC mailing list and archives.

还有一些基于 Linux 系统的 IPSEC 工具, 支持 CIPE , 以及其它一些数据加密形式. IPSEC 是 IETF 开发的用于在 IP 网络层创建加密安全通讯, 提供认证, 完整性, 访问控制, 以及机密性. 有关 IPSEC 和互联网草案的更多信息, 查阅 http://www.ietf.org/html.charters/ipsec-charter.html. 您还可以找到有关其它相关密钥管理协议的链接, 以及 IPSEC 邮件列表和归档.

The x-kernel Linux implementation, which is being developed at the University of Arizona, uses an object-based framework for implementing network protocols called x-kernel, and can be found at http://www.cs.arizona.edu/xkernel/hpcc-blue/linux.html. Most simply, the x-kernel is a method of passing messages at the kernel level, which makes for an easier implementation.

x-kernel Linux 工具, 这个由亚利桑那州大学开发的工具, 使用了称作 x-kernel 的基于对象的框架网络协议, 参阅 http://www.cs.arizona.edu/xkernel/hpcc-blue/linux.html. 简单的讲, x-kernel 就是一个在内核级别传输信息的方法.

Another freely-available IPSEC implementation is the Linux FreeS/WAN IPSEC. Their web page states,

"These services allow you to build secure tunnels through untrusted networks. Everything passing through the untrusted net is encrypted by the IPSEC gateway machine and decrypted by the gateway at the other end. The result is Virtual Private Network or VPN. This is a network which is effectively private even though it includes machines at several different sites connected by the insecure Internet."

还有一个免费的 IPSEC 工具, 叫做 Linux FreeS/WAN IPSEC. 其网页上声称,

这些服务允许您在不可信任的网络上构建安全通道. 对通过的数据使用 IPSEC 网关进行加密, 而由另一端的网关解密. 就是事实上的虚拟私有网络,或叫做VPN. 这是一个有效的私有网络, 尽管其要通过不安全的互联网上的不同站点."

It's available for download from http://www.xs4all.nl/~freeswan/, and has just reached 1.0 at the time of this writing.

可以从 http://www.xs4all.nl/~freeswan/ 处下载, 当前版本是1.0.

As with other forms of cryptography, it is not distributed with the kernel by default due to export restrictions.

和密码学的其它形式不一样, 根据出口限制, 其不能和内核一同分发.
6.4 ssh (Secure Shell) and stelnet

ssh and stelnet are suites of programs that allow you to login to remote systems and have a encrypted connection.

ssh 和 stelnet工具集用于使用加密连接登录远程系统,

openssh is a suite of programs used as a secure replacement for rlogin, rsh and rcp. It uses public-key cryptography to encrypt communications between two hosts, as well as to authenticate users. It can be used to securely login to a remote host or copy data between hosts, while preventing man-in-the-middle attacks (session hijacking) and DNS spoofing. It will perform data compression on your connections, and secure X11 communications between hosts.

openssh 提供了一套用于取代 rlogin, rsh 和 rcp 的工具. 它使用公钥算法在两台主机间加密通讯, 和认证用户. 可用于远程主机的安全登录或两台主机间的数据传送, 以防止中间人攻击和 DNS 欺骗. 也可提供两台主机间的数据压缩和安全 X11 通讯.

There are several ssh implementiations now. The original commercial implementation by Data Fellows can be found at The ssh home page can be found at http://www.datafellows.com.

现在有几种 ssh 工具. 在 ssh 的主页上 http://www.datafellows.com 可以找到 Data Fellows 提供的原始的商业版本.

The excellent Openssh implementation is based on a early version of the datafellows ssh and has been totally reworked to not include any patented or proprietary pieces. It is free and under a BSD license. It can be found at: http://www.openssh.com.

优秀的 Openssh 是基于 datafellows ssh 的早期版本的完全重写, 不包含任何专利和私有代码的版本.

There is also a open source project to re-implement ssh from the ground up called "psst...". For more information see: http://www.net.lut.ac.uk/psst/

还有一个开源的项目, 从根本上重新实现了ssh, 叫做 "psst...". 更多信息参阅: http://www.net.lut.ac.uk/psst/

You can also use ssh from your Windows workstation to your Linux ssh server. There are several freely available Windows client implementations, including the one at http://guardian.htu.tuwien.ac.at/therapy/ssh/ as well as a commercial implementation from DataFellows, at http://www.datafellows.com.

您也可以使用 ssh 从 Windows 工作站登录到 Linux ssh 服务器. 有包括 http://guardian.htu.tuwien.ac.at/therapy/ssh/ 在内的基于Windows 平台的开源客户端, 也有 DataFellows 提供的商业客户端 http://www.datafellows.com.

SSLeay is a free implementation of Netscape's Secure Sockets Layer protocol, developed by Eric Young. It includes several applications, such as Secure telnet, a module for Apache, several databases, as well as several algorithms including DES, IDEA and Blowfish.

SSLeay 是一个由 Eric Young 开发的免费的工具, 用于 Netscape 的 SSL 协议. 它提供了几个应用程序, 如 Secure telnet, 一个用于 Apache 的模块, 几个数据库, 以及包括 DES, IDEA 和 Blowfish 在内的几种算法.

Using this library, a secure telnet replacement has been created that does encryption over a telnet connection. Unlike SSH, stelnet uses SSL, the Secure Sockets Layer protocol developed by Netscape. You can find Secure telnet and Secure FTP by starting with the SSLeay FAQ, available at http://www.psy.uq.oz.au/~ftp/Crypto/.

使用这一共享库, 可以构建一个安全的 telnet, 在 telnet 上进行加密传输. 与 SSH 不同, stelnet 使用 SSL, Netscape 提供的安全接口层协议. 您可以从 SSLeay FAQ http://www.psy.uq.oz.au/~ftp/Crypto/的开始部分, 找到 Secure telnet 和 Secure FTP.

SRP is another secure telnet/ftp implementation. From their web page:

SRP 是另一个安全的 telnet/ftp 工具. 在其网页中写道:

"The SRP project is developing secure Internet software for free worldwide use. Starting with a fully-secure Telnet and FTP distribution, we hope to supplant weak networked authentication systems with strong replacements that do not sacrifice user-friendliness for security. Security should be the default, not an option!"

"SRP 项目是为了开发开源的安全互联网软件, 以一个完全安全的 Telnet 和 FTP 开始, 我们希望在不牺牲易用性的前提下, 取代不安全的网络认证系统. 安全应该是默认的, 而不是可选项."

For more information, go to http://www-cs-students.stanford.edu/~tjw/srp/

更多信息, 请浏览 http://www-cs-students.stanford.edu/~tjw/srp/
6.5 PAM - Pluggable Authentication Modules 可插入认证模块

Newer versions of the Red Hat Linux and Debian Linux distributions ship with a unified authentication scheme called "

AM". PAM allows you to change your authentication methods and requirements on the fly, and encapsulate all local authentication methods without recompiling any of your binaries. Configuration of PAM is beyond the scope of this document, but be sure to take a look at the PAM web site for more information. http://www.kernel.org/pub/linux/libs/pam/index.html.

新版的 Red Hat Linux 和 Debian Linux 都引入了称作 "

AM" 的统一认证方案. PAM 允许您临时修改认证方法和需求, 而不必重新编译所有本地的认证方法. 配置 PAM 超出了本文档的范围, 但是有必要浏览一下 PAM 的网站以获取更多信息. http://www.kernel.org/pub/linux/libs/pam/index.html.

Just a few of the things you can do with PAM:

您仅可以通过 PAM 完成以下工作:

* Use encryption other than DES for your passwords. (Making them harder to brute-force decode)
* 可以使用除包括 DES 的更多的加密方法.(这使得暴力破解更加困难)
* Set resource limits on all your users so they can't perform denial-of-service attacks (number of processes, amount of memory, etc)
* 对您的所有用户设置资源限制, 这样他们就不能进行拒绝服务攻击了(进程数, 内存量, 等等)
* Enable shadow passwords (see below) on the fly
* 临时启用 shadow 密码
* allow specific users to login only at specific times from specific places
* 允许特定用户仅在特定时间从特定位置登录.

Within a few hours of installing and configuring your system, you can prevent many attacks before they even occur. For example, use PAM to disable the system-wide usage of .rhosts files in user's home directories by adding these lines to /etc/pam.d/rlogin:

经过几个小时的安装和配置您的系统, 您可以阻止大多数的攻击. 例如, 使用 PAM 可以禁止用户在其家目录下使用 .rhosts, 只需在文件 /etc/pam.d/rlogin 中加入下边的内容即可:

                  #
                  # Disable rsh/rlogin/rexec for users
                  #
                  login auth required pam_rhosts_auth.so no_rhosts

6.6 Cryptographic IP Encapsulation (CIPE) 加密IP封装 (CIPE)

The primary goal of this software is to provide a facility for secure (against eavesdropping, including traffic analysis, and faked message injection) subnetwork interconnection across an insecure packet network such as the Internet.

此软件的主要目的是为跨互联网的子网间提供安全(防止窃听, 包括流量分析, 和虚假信息入注)的数据包通讯.

CIPE encrypts the data at the network level. Packets traveling between hosts on the network are encrypted. The encryption engine is placed near the driver which sends and receives packets.

CIPE 在网络层对数据进行加密. 在网络上的主机间传送的数据包是经过加密的. 加密引擎被置于靠近发送和接收数据包的驱动附近.

This is unlike SSH, which encrypts the data by connection, at the socket level. A logical connection between programs running on different hosts is encrypted.

和 SSH 不同, 它是在 socket 层加密数据的. 位于不同主机间程序的逻辑连接的数据是加密的.

CIPE can be used in tunnelling, in order to create a Virtual Private Network. Low-level encryption has the advantage that it can be made to work transparently between the two networks connected in the VPN, without any change to application software.

CIPE 可以用于创建虚拟专用网的通道. 低级加密的优点是可以用于 VPN 连接间的数据透明传输.

Summarized from the CIPE documentation:

源自CIPE的总结:

The IPSEC standards define a set of protocols which can be used (among other things) to build encrypted VPNs. However, IPSEC is a rather heavyweight and complicated protocol set with a lot of options, implementations of the full protocol set are still rarely used and some issues (such as key management) are still not fully resolved. CIPE uses a simpler approach, in which many things which can be parameterized (such as the choice of the actual encryption algorithm used) are an install-time fixed choice. This limits flexibility, but allows for a simple (and therefore efficient, easy to debug...) implementation.

IPSEC 标准定义了一套用于(也可做其它用途)构建加密的 VPN 协议. 但是, IPSEC 是一个相当重要和提供了很多选项的复杂协议, 具备完整协议设定的工具还很少, 并且有些问题(比如密钥管理)仍然还未得到解决. CIPE 使用一个相对简单的方法, 这样很多东西都可以参数化(比如对具体加密算法的选择), 在安装时加以选择. 这些灵活性, 使得应用更加简单(因此更加容易纠错).

Further information can be found at 更多信息, 请访问 http://www.inka.de/~bigred/devel/cipe.html

As with other forms of cryptography, it is not distributed with the kernel by default due to export restrictions.

和其它的加密形式一样, 由于出口的限制, 默认情况下, 是不和内核一同发布的.
6.7 Kerberos

Kerberos is an authentication system developed by the Athena Project at MIT. When a user logs in, Kerberos authenticates that user (using a password), and provides the user with a way to prove her identity to other servers and hosts scattered around the network.

Kerberos 是由麻省理工学院的 Athena Project 开发的一个认证系统. 当用户登录时, Kerberos 对用户(使用密码)进行认证, 并为用户提供一种来向网络上的其它服务器或主机证明自己的身份的方法.

This authentication is then used by programs such as rlogin to allow the user to login to other hosts without a password (in place of the .rhosts file). This authentication method can also used by the mail system in order to guarantee that mail is delivered to the correct person, as well as to guarantee that the sender is who he claims to be.

这种认证可用于编程, 比如 rlogin 允许用户不必提供密码(在 .rhosts 文件中)就登入其它的主机. 这种方法还可以用于邮件系统, 以确保邮件被正确的传递, 并能保证邮件发送者的身份.

Kerberos and the other programs that come with it, prevent users from "spoofing" the system into believing they are someone else. Unfortunately, installing Kerberos is very intrusive, requiring the modification or replacement of numerous standard programs.

Kerberos 以及使用它的程序, 可以防止源自"欺骗"系统的用户被误认. 不幸的是, 安装 Kerberos 相当麻烦, 需要修改或替换很多标准程序.

You can find more information about kerberos by looking at the kerberos FAQ, and the code can be found at http://nii.isi.edu/info/kerberos/.

在 the kerberos FAQ 上您可以找到有关 kerberos 的很多信息, 代码则可以在 http://nii.isi.edu/info/kerberos/ 上找到.

[From: Stein, Jennifer G., Clifford Neuman, and Jeffrey L. Schiller. "Kerberos: An Authentication Service for Open Network Systems.开放网络系统的认证服务" USENIX Conference Proceedings, Dallas, Texas, Winter 1998.]

Kerberos should not be your first step in improving security of your host. It is quite involved, and not as widely used as, say, SSH.

Kerberos 不应当是您在改进主机安全方面的第一步. 如果不是大面积应用, 应该首选 SSH.
6.8 Shadow Passwords. Shadow 密码

Shadow passwords are a means of keeping your encrypted password information secret from normal users. Recent versions of both Red Hat and Debian Linux use shadow passwords by default, but on other systems, encrypted passwords are stored in /etc/passwd file for all to read. Anyone can then run password-guesser programs on them and attempt to determine what they are. Shadow passwords, by contrast, are saved in /etc/shadow, which only privileged users can read. In order to use shadow passwords, you need to make sure all your utilities that need access to password information are recompiled to support them. PAM (above) also allows you to just plug in a shadow module; it doesn't require re-compilation of executables. You can refer to the Shadow-Password HOWTO for further information if necessary. It is available at http://metalab.unc.edu/LDP/HOWTO/Shadow-Password-HOWTO.html It is rather dated now, and will not be required for distributions supporting PAM.

Shadow 密码就意味着对普通用户保守您密码加密信息的机密性. Red Hat 和 Debian Linux 的最新版本都默认启用了 shadow 密码, 不过别的发行版仍然使用所有用户都可见的 /etc/passwd 保存加密的密码. 任何人都可以对其使用密码猜测程序, 来猜测其内容. 与之相对应, shadow 密码被存储在 /etc/shadow 中, 并且其只对特权用户可见. 要使用 shadow 密码, 您需要确保所有需要访问密码信息的工具都被编译了对它的支持. PAM (上边提到的)也允许您只插入一个 shadow 模块; 而不比重新编译. 更多信息您可以参考 Shadow-Password HOWTO. 其位于 http://metalab.unc.edu/LDP/HOWTO/Shadow-Password-HOWTO.html 它已经不再被更新, 分发支持 PAM 也不再需要它.
6.9 "Crack" and "John the Ripper"

If for some reason your passwd program is not enforcing hard-to-guess passwords, you might want to run a password-cracking program and make sure your users' passwords are secure.

如果由于某些原因, 您的 passwd 程序不能自动提高密码强度, 那么您也许需要运行密码破解程序来确保您的用户的密码的安全性.

Password cracking programs work on a simple idea: they try every word in the dictionary, and then variations on those words, encrypting each one and checking it against your encrypted password. If they get a match they know what your password is.

密码破解程序工作思路非常简单: 他们尝试字典中的每个词, 并对这些词加以变换, 对其进行加密, 然后同您加密了的密码相比较. 如果匹配, 则就得到了密码.

There are a number of programs out there...the two most notable of which are "Crack" and "John the Ripper" ( http://www.openwall.com/john/) . They will take up a lot of your CPU time, but you should be able to tell if an attacker could get in using them by running them first yourself and notifying users with weak passwords. Note that an attacker would have to use some other hole first in order to read your /etc/passwd file, but such holes are more common than you might think.

有很多这类程序... 其中最著名的是 "Crack" 和 "John the Ripper" ( http://www.openwall.com/john/). 它们将会耗费您很多的 CPU 时间, 因此如果一个攻击者进入您的系统, 先于您运行它们, 找出用户的弱密码, 您应当会有所察觉. 注意, 攻击者可能会利用其它的漏洞首先读取 /etc/passwd 文件, 而这一漏洞比您想象的更加常见.

Because security is only as strong as the most insecure host, it is worth mentioning that if you have any Windows machines on your network, you should check out L0phtCrack, a Crack implementation for Windows. It's available from http://www.l0pht.com

因为安全强度取决于最不安全的主机, 应当注意如果您在网络中有一台 Windows 主机, 您应当使用一下 L0phtCrack 进行密码检查, 一个应用于 Windows 的骇客程序. 它可以从 http://www.l0pht.com 处获得.
6.10 CFS - Cryptographic File System and TCFS - Transparent Cryptographic File System CFS - 加密文件系统和 TCFS - 透明密码文件系统

CFS is a way of encrypting entire directory trees and allowing users to store encrypted files on them. It uses an NFS server running on the local machine. RPMS are available at http://www.zedz.net/redhat/, and more information on how it all works is at ftp://ftp.research.att.com/dist/mab/.

CFS 是一种加密整个目录树的方法, 并允许用户存储加密的文件. 它使用运行在本地的NFS服务器. http://www.zedz.net/redhat/ 处提供RPMS包, 有关其工作原理的更多信息参阅 ftp://ftp.research.att.com/dist/mab/.

TCFS improves on CFS by adding more integration with the file system, so that it's transparent to users that the file system that is encrypted. More information at: http://www.tcfs.it/.

TCFS 是 CFS 的改进版, 和文件系统结合的更加紧密, 以至于加密了的文件系统对用户来说是透明的. 更多信息: http://www.tcfs.it/.

It also need not be used on entire file systems. It works on directory trees as well.

它并不需要使用整个文件系统. 可以仅应用于目录树.
6.11 X11, SVGA and display security 和显示安全
X11

It's important for you to secure your graphical display to prevent attackers from grabbing your passwords as you type them, reading documents or information you are reading on your screen, or even using a hole to gain root access. Running remote X applications over a network also can be fraught with peril, allowing sniffers to see all your interaction with the remote system.

增强您图形显示的安全性非常重要, 以阻止攻击者在您键入时抓取密码, 读取文档, 或您屏幕上显示的信息, 甚至利用漏洞获取 root 权限. 通过网络, 运行远程的 X 应用程序也充满了危险, 嗅探器可以获取您与远程系统交互的所有信息.

X has a number of access-control mechanisms. The simplest of them is host-based: you use xhost to specify the hosts that are allowed access to your display. This is not very secure at all, because if someone has access to your machine, they can xhost + their machine and get in easily. Also, if you have to allow access from an untrusted machine, anyone there can compromise your display.

X 提供了一些访问控制机制. 其中最简单的就是基于主机: 您使用 xhost 指定可以访问的主机. 这并不十分安全, 因为如果有人入侵了您的计算机, 简单运行xhost + their machine 一下就行了. 还有, 如果您允许了一台不被信任的机器访问, 那么其上任何用户都可获得权限.

When using xdm (X Display Manager) to log in, you get a much better access method: MIT-MAGIC-COOKIE-1. A 128-bit "cookie" is generated and stored in your .Xauthority file. If you need to allow a remote machine access to your display, you can use the xauth command and the information in your .Xauthority file to provide access to only that connection. See the Remote-X-Apps mini-howto, available at http://metalab.unc.edu/LDP/HOWTO/mini/Remote-X-Apps.html.

当使用 xdm(X Display Manager) 登录时, 就有了一个更好的访问方法: MIT-MAGIC-COOKIE-1. 会生成一个 128 位的 "cookie" 存储在 .Xauthority 文件中. 如果您需要允许一台远程主机访问您的桌面, 可以使用 xauth命令, 生成存储在 .Xauthority 中信息, 为远程连接提供权限. 更多信息请参阅 Remote-X-Apps mini-howto, http://metalab.unc.edu/LDP/HOWTO/mini/Remote-X-Apps.html.

You can also use ssh (see ssh , above) to allow secure X connections. This has the advantage of also being transparent to the end user, and means that no unencrypted data flows across the network.

您也可以使用 ssh (参阅前面的 ssh )建立安全的 X 连接. 其优点是, 在此网络上传输的数据是加密的, 而且对终端用户透明.

You can also disable any remote connections to your X server by using the '-nolisten tcp' options to your X server. This will prevent any network connections to your server over tcp sockets.

您也可以通过对 X 服务器使用 '-nolisten tcp' 选项, 禁止任何远程连接您的 X 服务器. 这将会阻止通过 tcp 接口连接您的 X 服务器.

Take a look at the Xsecurity man page for more information on X security. The safe bet is to use xdm to login to your console and then use ssh to go to remote sites on which you wish to run X programs.

更多有关 X 安全的信息, 查询一下 Xsecurity 的联机手册. 比较安全的做法是, 使用 xdm 控制台登录, 令允许运行 X 程序的远程站点使用 ssh 登录.
SVGA

SVGAlib programs are typically SUID-root in order to access all your Linux machine's video hardware. This makes them very dangerous. If they crash, you typically need to reboot your machine to get a usable console back. Make sure any SVGA programs you are running are authentic, and can at least be somewhat trusted. Even better, don't run them at all.

SVGAlib 是典型的 SUID-root, 用于访问您 Linux 机器的显卡. 这是非常不安全的. 如果它们崩溃了, 您要返回控制台, 则只有重启系统了. 确保您运行的 SVGA 程序是可靠的, 至少要确保在某种程度上是可以信任的. 根本不运行它们就更好了.
GGI (Generic Graphics Interface project)通用图形界面项目

The Linux GGI project is trying to solve several of the problems with video interfaces on Linux. GGI will move a small piece of the video code into the Linux kernel, and then control access to the video system. This means GGI will be able to restore your console at any time to a known good state. They will also allow a secure attention key, so you can be sure that there is no Trojan horse login program running on your console. http://synergy.caltech.edu/~ggi/

Linux GGI 项目的目标是解决几个 Linux 上的图形界面的问题. GGI 在 Linux 内核中植入一些代码, 以控制对图形系统的访问. 这就意味着 GGI 将可以在任何时候将您的控制台恢复到最佳状态. 它还将允许使用安全事项密钥, 这样您就可以保证在您的控制台上没有运行特洛伊木马 login 程序. http://synergy.caltech.edu/~ggi/

eTony · 发表于 2006-3-20 14:19:04

7. Kernel Security 内核安全

This is a description of the kernel configuration options that relate to security, and an explanation of what they do, and how to use them.

这是有关内核安全相关配置选项的描述, 以及相关解释, 和使用方法.

As the kernel controls your computer's networking, it is important that it be very secure, and not be compromised. To prevent some of the latest networking attacks, you should try to keep your kernel version current. You can find new kernels at ftp://ftp.kernel.org or from your distribution vendor.

因为您的计算机网络是由内核控制的, 所以它的安全和不被入侵非常重要. 为了阻止最新的网络攻击, 您应当尽量保持内核版本最新. 可以从 ftp://ftp.kernel.org 或您的供应商处获取最新版的内核.

There is also a international group providing a single unified crypto patch to the mainstream Linux kernel. This patch provides support for a number of cryptographic subsystems and things that cannot be included in the mainstream kernel due to export restrictions. For more information, visit their web page at: http://www.kerneli.org

也有国际组织为主流 Linux 内核提供专用的加密支持补丁. 这一补丁提供了对一些密码子系统的支持, 由于出口限制, 将不会包含在主流内核中的发行. 更多信息, 请访问它们的网站: http://www.kerneli.org
7.1 2.0 Kernel Compile Options 2.0 内核编译选项

For 2.0.x kernels, the following options apply. You should see these options during the kernel configuration process. Many of the comments here are from ./linux/Documentation/Configure.help, which is the same document that is referenced while using the Help facility during the make config stage of compiling the kernel.

下边是针对于 2.0.x 内核的应用选项. 在配置过程中, 您会看到这些选项. 很多内容来自 ./linux/Documentation/Configure.help, 这与在内核编译的 make config 阶段使用 Help 功能获取的文档相一致.

* Network Firewalls (CONFIG_FIREWALL) 网络防火墙

   This option should be on if you intend to run any firewalling or masquerading on your Linux machine. If it's just going to be a regular client machine, it's safe to say no.

   如果您要在机器上运行防火墙或伪装, 应当启用这一选项. 如果只是作为一般的客户机使用, 禁用即可.
* IP: forwarding/gatewaying (CONFIG_IP_FORWARD)

   If you enable IP forwarding, your Linux box essentially becomes a router. If your machine is on a network, you could be forwarding data from one network to another, and perhaps subverting a firewall that was put there to prevent this from happening. Normal dial-up users will want to disable this, and other users should concentrate on the security implications of doing this. Firewall machines will want this enabled, and used in conjunction with firewall software.

   如果要启用 IP 转发, 您的 Linux 机器将可以作为路由器. 如果是网络的一个节点, 则可以转发由一个网络到另一网络的数据, 也许这正是作为防火墙所防止发生的. 普通的拨号用户可能需要禁用这一选项, 而其它用户应当仔细考虑这一选项的安全应用. 防火墙应当启用这一选项, 与防火墙软件结合使用.

   You can enable IP forwarding dynamically using the following command:

   您可以使用下边的命令启用 IP 动态转发:

               root#  echo 1 > /proc/sys/net/ipv4/ip_forward

   and disable it with the command: 用下边的命令将其禁用:

               root#  echo 0 > /proc/sys/net/ipv4/ip_forward

   Keep in mind the files in /proc are "virtual" files and the shown size of the file might not reflect the data output from it.

   要记住, /proc 下的文件是"虚拟的"文件, 列出的文件的大小并不能反映它包含的数据的真正大小.
* IP: syn cookies (CONFIG_SYN_COOKIES)

   a "SYN Attack" is a denial of service (DoS) attack that consumes all the resources on your machine, forcing you to reboot. We can't think of a reason you wouldn't normally enable this. In the 2.2.x kernel series this config option merely allows syn cookies, but does not enable them. To enable them, you have to do:

   "SYN攻击"是一种拒绝服务(DoS)攻击, 消耗您的所有资源, 强迫您重启机器. 我们无法想像您在此情况下不启用这一选项的理由. 在 2.2.x 内核中, 这一选项仅仅 syn cookies 功能, 但并没有启用. 用下面的命令启用:

                        root# echo 1 > /proc/sys/net/ipv4/tcp_syncookies <

>

* IP: Firewalling (CONFIG_IP_FIREWALL)

   This option is necessary if you are going to configure your machine as a firewall, do masquerading, or wish to protect your dial-up workstation from someone entering via your PPP dial-up interface.

   如果您要将机器配置为防火墙, 进行伪装(masquerading), 或希望保护您的通过 PPP 拨号连入的拨号工作站, 则这一选项是必须的.
* IP: firewall packet logging (CONFIG_IP_FIREWALL_VERBOSE)

   This option gives you information about packets your firewall received, like sender, recipient, port, etc.

   此选项会为您提供有关防火墙接收的数据包的信息, 如发送, 接收, 端口, 等等.
* IP: Drop source routed frames 丢弃源路由桢 (CONFIG_IP_NOSR)

   This option should be enabled. Source routed frames contain the entire path to their destination inside of the packet. This means that routers through which the packet goes do not need to inspect it, and just forward it on. This could lead to data entering your system that may be a potential exploit.

   应当启用这一选项. 源路由帧包含到达目标的全部路径. 这就意味着经过路由的数据包不必对其进行检查, 仅仅转发它就行了. 这样会导致进入您系统的数据存在潜在的漏洞.
* IP: masquerading (CONFIG_IP_MASQUERADE) If one of the computers on your local network for which your Linux box acts as a firewall wants to send something to the outside, your box can "masquerade" as that host, i.e., it forewords the traffic to the intended destination, but makes it look like it came from the firewall box itself. See http://www.indyramp.com/masq for more information.

   如果您本地网络的一台计算机, 它的防火墙是一台 Linux 计算机, 要向外发送数据, 计算机可以伪装成那台主机, 也就是说, 它进行数据转发, 但是, 看上去源自防火墙本身. 更多信息参阅 http://www.indyramp.com/masq.
* IP: ICMP masquerading (CONFIG_IP_MASQUERADE_ICMP) This option adds ICMP masquerading to the previous option of only masquerading TCP or UDP traffic.

   这一选项仅仅为前边的选项增加了 ICMP 伪装.
* IP: transparent proxy support (CONFIG_IP_TRANSPARENT_PROXY) This enables your Linux firewall to transparently redirect any network traffic originating from the local network and destined for a remote host to a local server, called a "transparent proxy server". This makes the local computers think they are talking to the remote end, while in fact they are connected to the local proxy. See the IP-Masquerading HOWTO and http://www.indyramp.com/masq for more information.

   此选项使您的 Linu x防火墙可以透明的重定向任何网络数据源自本地网络, 目标为远程主机, 称作"透明代理服务器". 这使得本地计算机以为正在直接与远端会话, 而实际上是与本地代理连接. 更多信息, 参阅 IP-Masquerading HOWTO 和 http://www.indyramp.com/masq
* IP: always defragment (CONFIG_IP_ALWAYS_DEFRAG)

   Generally this option is disabled, but if you are building a firewall or a masquerading host, you will want to enable it. When data is sent from one host to another, it does not always get sent as a single packet of data, but rather it is fragmented into several pieces. The problem with this is that the port numbers are only stored in the first fragment. This means that someone can insert information into the remaining packets that isn't supposed to be there. It could also prevent a teardrop attack against an internal host that is not yet itself patched against it.

   通常, 这一选项是禁用的, 但是, 如果您要构建防火墙, 或一台伪装(masquerading)主机, 可能需要启用它. 当数据由一台主机发送到另一台主机时, 并不总是作为单个的数据包, 有时会被分做多片. 这时, 端口号仅存储在第一片中. 这就意味着可能会被塞入数据包. 这一选项也能防止针对没有打补丁的内部主机的泪滴(teardrop)攻击.
* Packet Signatures (CONFIG_NCPFS_PACKET_SIGNING)

   This is an option that is available in the 2.2.x kernel series that will sign NCP packets for stronger security. Normally you can leave it off, but it is there if you do need it.

   这是在 2.2.x 系列内核中的一个选项, 通过对 NCP 数据包签名, 以增强安全性. 通常可以将其关闭, 除非您确实需要它.
* IP: Firewall packet netlink device (CONFIG_IP_FIREWALL_NETLINK)

   This is a really neat option that allows you to analyze the first 128 bytes of the packets in a user-space program, to determine if you would like to accept or deny the packet, based on its validity.

   这确实是一个很牛的选项, 允许您在用户空间对数据包的前 128 个字节进行分析, 确定是接收数据包还是拒绝.

7.2 2.2 Kernel Compile Options 2.2 内核编译选项

For 2.2.x kernels, many of the options are the same, but a few new ones have been developed. Many of the comments here are from ./linux/Documentation/Configure.help, which is the same document that is referenced while using the Help facility during the make config stage of compiling the kernel. Only the newly- added options are listed below. Consult the 2.0 description for a list of other necessary options. The most significant change in the 2.2 kernel series is the IP firewalling code. The ipchains program is now used to install IP firewalling, instead of the ipfwadm program used in the 2.0 kernel.

对于 2.2.x 内核, 很多选项都是相同的, 也有一些新的选项. 这里提及的很多内容都源自 ./linux/Documentation/Configure.help, 它也是在编译内核的make config 阶段使用 Help 功能调出的参考文档. 这里只列出最新的选项. 其它一些选项, 请查阅 2.0 文档. 在 2.2 系列内核中最重要的改变是 IP firewalling 代码. 使用 ipchains 取代了 2.0 内核中的 ipfwadm.

* Socket Filtering (CONFIG_FILTER)

   For most people, it's safe to say no to this option. This option allows you to connect a user-space filter to any socket and determine if packets should be allowed or denied. Unless you have a very specific need and are capable of programming such a filter, you should say no. Also note that as of this writing, all protocols were supported except TCP.

   对于多数人来说, 可以禁用这一选项. 它允许将用户空间过滤器连接到任何接口, 以确定数据包是否可以接受. 除非您有非常具体的需求, 并且有能力编写这样的过滤器, 否则您应当禁用这一选项. 还要注意, 此时它还不支持 TCP 协议.
* Port Forwarding

   Port Forwarding is an addition to IP Masquerading which allows some forwarding of packets from outside to inside a firewall on given ports. This could be useful if, for example, you want to run a web server behind the firewall or masquerading host and that web server should be accessible from the outside world. An external client sends a request to port 80 of the firewall, the firewall forwards this request to the web server, the web server handles the request and the results are sent through the firewall to the original client. The client thinks that the firewall machine itself is running the web server. This can also be used for load balancing if you have a farm of identical web servers behind the firewall.

   Information about this feature is available from http://www.monmouth.demon.co.uk/ipsubs/portforwarding.html (to browse the WWW, you need to have access to a machine on the Internet that has a program like lynx or Netscape). For general info, please see ftp://ftp.compsoc.net/users/steve/ipportfw/linux21/

   端口转发是 IP 伪装的一个附加功能, 其允许在特定端口向防火墙内转发数据包. 这项功能非常有用, 比如, 您在防火墙或伪装主机内建了一个 web 服务器, 这样外部网络就可以访问它了. 一个外部客户端可以发送一个请求到防火墙的80端口, 防火墙将请求转发给 web 服务器, web 服务器处理这一请求, 并将结果通过防火墙反馈给原始客户端. 客户端将会认为在防火墙本身提供 web 服务. 如果您在防火墙后面运行这一个完全相同的web服务器群, 这也可用于负载均衡.

   可以从 http://www.monmouth.demon.co.uk/ipsubs/portforwarding.html (您可以通过装有 lynx 或 Netscape 一类程序的计算机访问这一站点)获取有关这一特性的更多信息. 一般信息可以访问 ftp://ftp.compsoc.net/users/steve/ipportfw/linux21/
* Socket Filtering (CONFIG_FILTER)

   Using this option, user-space programs can attach a filter to any socket and thereby tell the kernel that it should allow or disallow certain types of data to get through the socket. Linux socket filtering works on all socket types except TCP for now. See the text file ./linux/Documentation/networking/filter.txt for more information.

   使用这一选项，用户空间程序可以将一个过滤器附到任何接口上, 以告诉内核通过此接口的哪些数据可以运行通过, 哪些是应该禁止的. Linux 接口过滤器的现在可以工作在除了 TCP 的任何接口上. 更多信息请参阅文件 ./linux/Documentation/networking/filter.txt.
* IP: Masquerading

   The 2.2 kernel masquerading has been improved. It provides additional support for masquerading special protocols, etc. Be sure to read the IP Chains HOWTO for more information.

   2.2 内核的伪装有所改进. 它提供了对伪装特定协议的附加支持, 等等. 更多信息参阅 IP Chains HOWTO.

7.3 Kernel Devices 内核设备

There are a few block and character devices available on Linux that will also help you with security.

Linux 上提供了一些块设备和字符设备帮助您增强安全性.

The two devices /dev/random and /dev/urandom are provided by the kernel to provide random data at any time.

内核提供的两个设备 /dev/random 和 /dev/urandom 用于在随时提供随机数据.

Both /dev/random and /dev/urandom should be secure enough to use in generating PGP keys, ssh challenges, and other applications where secure random numbers are required. Attackers should be unable to predict the next number given any initial sequence of numbers from these sources. There has been a lot of effort put in to ensuring that the numbers you get from these sources are random in every sense of the word.

/dev/random 和 /dev/urandom 对于生成 PGP 密钥, ssh 挑战码, 和其它需要安全随机数的应用来说, 都够安全. 攻击者应该是无法干预由初始系列数生成随机数. 经过了很多努力, 以确保根据源生成的随机数, 确确实实是随即的.

The only difference between the two devices, is that /dev/random runs out of random bytes and it makes you wait for more to be accumulated. Note that on some systems, it can block for a long time waiting for new user-generated entropy to be entered into the system. So you have to use care before using /dev/random. (Perhaps the best thing to do is to use it when you're generating sensitive keying information, and you tell the user to pound on the keyboard repeatedly until you print out "OK, enough".)

两个设备之间的唯一不同是, /dev/random 在用完随机字节后会出现长时间的等待. 注意在有些系统上, 等待生成新的随机数需要很长的时间. 所以您要小心使用 /dev/random. (可能最好是当您在生成敏感密钥信息时才使用它, 告诉用户反复敲击键盘直到打印出 "OK, enough".)

/dev/random is high quality entropy, generated from measuring the inter-interrupt times etc. It blocks until enough bits of random data are available.

/dev/random 是高质量的图谱, 通过间隔时间等等生成. 直到生成足够的随机数才停止等待.

/dev/urandom is similar, but when the store of entropy is running low, it'll return a cryptographically strong hash of what there is. This isn't as secure, but it's enough for most applications.

/dev/urandom 基本相似, 但是当存储大量图谱进行低级运算时, 它将返回一个足够强度的密码哈希(hash)值. 这对于大多数应用来说, 是足够安全的.

You might read from the devices using something like:

您可以使用下边的命令读取设备中的信息:

         root#  head -c 6 /dev/urandom | mimencode

This will print six random characters on the console, suitable for password generation. You can find mimencode in the metamail package.

这将会在控制台打印出六个随机字符, 可以用于生成密码. 您可以在 metamail 联机手册中找到 mimencode.

See /usr/src/linux/drivers/char/random.c for a description of the algorithm.

有关算法的描述, 参阅 /usr/src/linux/drivers/char/random.c

Thanks to Theodore Y. Ts'o, Jon Lewis, and others from Linux-kernel for helping me (Dave) with this.

感谢 Theodore Y. Ts'o, Jon Lewis, 和其它人, 帮助我(Dave)有关内核的这些内容.

eTony · 发表于 2006-3-20 14:24:21

8. Network Security 网络安全

Network security is becoming more and more important as people spend more and more time connected. Compromising network security is often much easier than compromising physical or local security, and is much more common.

随着人们在网上花费的时间越来越多,网络安全变得越来越重要. 危害网络安全的通常比威胁物理和本地安全更加简单, 并且更加常见.

There are a number of good tools to assist with network security, and more and more of them are shipping with Linux distributions.

有很多不错的工具用于保证网络安全, 并且越来越多的被移植到 Linux 发行版中.
8.1 Packet Sniffers 数据包嗅探

One of the most common ways intruders gain access to more systems on your network is by employing a packet sniffer on a already compromised host. This "sniffer" just listens on the Ethernet port for things like passwd and login and su in the packet stream and then logs the traffic after that. This way, attackers gain passwords for systems they are not even attempting to break into. Clear-text passwords are very vulnerable to this attack.

入侵者最常用的获取您的网络中其它系统的访问权限的方法是在已经入侵的主机上安装数据包嗅探器. "嗅探器"仅仅监听以太网端口以获取数据流中类似 passwd , login 和 su 的内容, 并将其记录下来. 这样,攻击者就可获取系统密码, 甚至包括没有尝试入侵的系统. 明文密码对于这类攻击非常脆弱.

Example: Host A has been compromised. Attacker installs a sniffer. Sniffer picks up admin logging into Host B from Host C. It gets the admins personal password as they login to B. Then, the admin does a su to fix a problem. They now have the root password for Host B. Later the admin lets someone telnet from his account to Host Z on another site. Now the attacker has a password/login on Host Z.

例如: 主机 A 被入侵了. 攻击者在上面安装了一个嗅探器. 嗅探器抓取管理员从主机 C 登录到主机 B 的信息. 然后管理员执行了一个 su 去完成一个问题修复. 这时就得到了主机B的root密码. 稍后, 管理员让人使用其账号 telnet 到主机Z. 这样攻击者也获取了主机 Z 的登录密码.

In this day and age, the attacker doesn't even need to compromise a system to do this: they could also bring a laptop or pc into a building and tap into your net.

长此以往, 攻击者甚至不必入侵系统就可完成这些工作: they could also bring a laptop or pc into a building and tap into your net.

Using ssh or other encrypted password methods thwarts this attack. Things like APOP for POP accounts also prevents this attack. (Normal POP logins are very vulnerable to this, as is anything that sends clear-text passwords over the network.)

使用 ssh 或其它加密密码的方法可以对抗这种攻击. 针对 POP 的 APOP 账号也能抵抗这种攻击. (普通的POP登录是非常脆弱的, 因为它是在网络上明文传送密码.)
8.2 System services and tcp_wrappers 系统服务和 tcp_wrappers

Before you put your Linux system on ANY network the first thing to look at is what services you need to offer. Services that you do not need to offer should be disabled so that you have one less thing to worry about and attackers have one less place to look for a hole.

在您的计算机连入任何网络前, 首先要检查一下您需要启动什么服务. 您不需要启动的服务应该禁止掉, 这样您就少一点事情担忧, 攻击者可用漏洞也就更少了.

There are a number of ways to disable services under Linux. You can look at your /etc/inetd.conf file and see what services are being offered by your inetd. Disable any that you do not need by commenting them out (# at the beginning of the line), and then sending your inetd process a SIGHUP.

在 Linux 下有很多方法禁用服务. 您可以查看一下 /etc/inetd.conf 文件, 看看 inetd 提供了哪些服务. 禁用掉哪些您不想对外提供的(在对应行首加上#), 然后对您的 inetd 进程发送一个 SIGHUP 指令.

You can also remove (or comment out) services in your /etc/services file. This will mean that local clients will also be unable to find the service (i.e., if you remove ftp, and try and ftp to a remote site from that machine it will fail with an "unknown service" message). It's usually not worth the trouble to remove services from /etc/services, since it provides no additional security. If a local person wanted to use ftp even though you had commented it out, they would make their own client that used the common FTP port and would still work fine.

您还可以删除(或注释掉) /etc/services 文件中的服务. 这就意味这本地客户端不能发现这一服务(例如, 您删除了 ftp, 然后从这台主机试图 ftp 远程站点, 将会因"未知服务"失败). 通常不用麻烦的从 /etc/services 中删除服务, 因为它并不能提供更多的安全. 如果本地用户要使用 ftp, 即使您注释掉了, 他们也可以同过对客户端指定FTP端口来正常使用.

Some of the services you might want to leave enabled are:

通常需要禁用的一些服务:

* ftp
* telnet (or ssh)
* mail, such as pop-3 or imap
* identd

If you know you are not going to use some particular package, you can also delete it entirely. rpm -e packagename under the Red Hat distribution will erase an entire package. Under Debian dpkg --remove does the same thing.

如果您不想使用某些软件包, 也可以将其完全删除.在 Red Hat 发行版下使用 rpm -e packagename 删除软件包. 在Debian下则是 dpkg --remove.

Additionally, you really want to disable the rsh/rlogin/rcp utilities, including login (used by rlogin), shell (used by rcp), and exec (used by rsh) from being started in /etc/inetd.conf. These protocols are extremely insecure and have been the cause of exploits in the past.

另外, 您确实应该一开始就要从 /etc/inetd.conf 中禁用 rsh/rlogin/rcp 工具集, 包括登录(使用 rlogin), shell(使用 rcp), 以及执行(使用 rsh). 这些协议是极其不安全的, 过去出现了很多漏洞.

You should check /etc/rc.d/rc[0-9].d (on Red Hat; /etc/rc[0-9].d on Debian), and see if any of the servers started in those directories are not needed. The files in those directories are actually symbolic links to files in the directory /etc/rc.d/init.d (on Red Hat; /etc/init.d on Debian). Renaming the files in the init.d directory disables all the symbolic links that point to that file. If you only wish to disable a service for a particular run level, rename the appropriate symbolic link by replacing the upper-case S with a lower-case s, like this:

您应当检查一下 /etc/rc.d/rc[0-9].d(Red Hat 系统; 在 Debian 系统上是/etc/rc[0-9].d)目录, 看是否启动了一些不需要的服务. 这些目录下的文件实际上是指向 /etc/rc.d/init.d(Red Hat 系统; 在Debian系统上是 /etc/init.d)的一些符号连接. 将 init.d 目录下的文件重命名, 将会使指向它的所有符号连接失效. 如果只是想在某个运行级上禁用一个服务, 重命名对应的符号连接, 将大写字母 S 改为小写字母 s 即可, 如:

         root#  cd /etc/rc6.d
         root#  mv S45dhcpd s45dhcpd

If you have BSD-style rc files, you will want to check /etc/rc* for programs you don't need.

如果使用的是 BSD 风格的 rc 文件, 则需要检查一下 /etc/rc* 看哪些程序是不需要的.

Most Linux distributions ship with tcp_wrappers "wrapping" all your TCP services. A tcp_wrapper (tcpd) is invoked from inetd instead of the real server. tcpd then checks the host that is requesting the service, and either executes the real server, or denies access from that host. tcpd allows you to restrict access to your TCP services. You should make a /etc/hosts.allow and add in only those hosts that need to have access to your machine's services.

tcp_wrappers 被移植到了很多发行版用于 "wrapping" 所有的TCP服务. tcp_wrapper(tcpd) 是通过 inetd 被调用的, 而不是实际的服务. tcpd 这时检查主机被请求的服务, 然后要么执行真正的服务, 要么拒绝这台主机的访问. tcpd 允许您对 TCP 服务的访问进行限制. 您应当创建一个 /etc/hosts.allow 文件, 在其中添加可以访问您的服务的主机.

If you are a home dial up user, we suggest you deny ALL. tcpd also logs failed attempts to access services, so this can alert you if you are under attack. If you add new services, you should be sure to configure them to use tcp_wrappers if they are TCP-based. For example, a normal dial-up user can prevent outsiders from connecting to his machine, yet still have the ability to retrieve mail, and make network connections to the Internet. To do this, you might add the following to your /etc/hosts.allow:

如果您是家庭拨号用户, 我们建议您将所有(ALL)都禁止. tcpd 也会记录失败的访问服务尝试. 这样就可出现攻击时, 对您发出警告. 如果要添加新的服务, 应当确保将其配置为使用 tcp_wrappers, 如果是基于 TCP 的服务的话. 例如, 普通的拨号用户应当阻止对其机器的外部连接, 但仍能检索邮件, 访问互联网. 完成这些, 您应当在 /etc/hosts.allow 中加入如下内容:

ALL: 127.

And of course /etc/hosts.deny would contain:

当然, /etc/hosts.deny 中应该添加:

ALL: ALL

which will prevent external connections to your machine, yet still allow you from the inside to connect to servers on the Internet.

这将阻止外部连接访问您的机器, 但仍然允许您从内部连接互联网上的服务器.

Keep in mind that tcp_wrappers only protects services executed from inetd, and a select few others. There very well may be other services running on your machine. You can use netstat -ta to find a list of all the services your machine is offering.

牢记 tcp_wrappers 只能保护通过 inetd 运行的服务, 以及其它一些有限的服务. 可能在您的机器上还运行了其它服务.可以通过 netstat -ta 找出您的机器提供的所有服务的列表.
8.3 Verify Your DNS Information 校验您的 DNS 信息

Keeping up-to-date DNS information about all hosts on your network can help to increase security. If an unauthorized host becomes connected to your network, you can recognize it by its lack of a DNS entry. Many services can be configured to not accept connections from hosts that do not have valid DNS entries.

及时更新您网络中所有主机的 DNS 信息, 这有助于您提高安全性. 如果一台没有验证主机连入了您的网络. 则您可以通过在 DNS 中缺少对应记录来识别出来. 很多服务可以配置为不接收没有有效 DNS 记录的主机的连入.
8.4 identd

identd is a small program that typically runs out of your inetd server. It keeps track of what user is running what TCP service, and then reports this to whoever requests it.

identd 是一个典型独立于 inetd 服务的小程序. 其跟踪什么用户运行了何种 TCP 服务, 并报告给查询的人.

Many people misunderstand the usefulness of identd, and so disable it or block all off site requests for it. identd is not there to help out remote sites. There is no way of knowing if the data you get from the remote identd is correct or not. There is no authentication in identd requests.

很多人错误的理解了 identd 的用途, 将其禁用, 或禁止了所有站点对其的访问请求. identd 不是用于协助远程站点的. 事实上如果您能从远程 identd 获取数据, 也无法判断其对错. 在 identd 中没有认证机制.

Why would you want to run it then? Because it helps you out, and is another data-point in tracking. If your identd is un compromised, then you know it's telling remote sites the user-name or uid of people using TCP services. If the admin at a remote site comes back to you and tells you user so-and-so was trying to hack into their site, you can easily take action against that user. If you are not running identd, you will have to look at lots and lots of logs, figure out who was on at the time, and in general take a lot more time to track down the user.

那么, 为什么您想要运行它呢? 因为他可以帮助您, 并且它是另一个跟踪的数据点. 如果您的 identd 未被入侵, 那么可以从它获取正在使用 TCP 服务的远方站点的用户名或用户 ID. 如果远方站点的管理员联系您, 告诉您用户 so-and-so (讨厌的家伙)要黑他们的网站, 那么您可以很容易的找出这个用户. 如果您没有运行 identd, 则需要查询大量的日志, 来找出是谁在那个时间使用了系统, 并还要花费更多的时间跟踪这个用户.

The identd that ships with most distributions is more configurable than many people think. You can disable it for specific users (they can make a .noident file), you can log all identd requests (We recommend it), you can even have identd return a uid instead of a user name or even NO-USER.

identd 被移植到了很多发行版中, 比人们想像的更容易配置. 可以对某个用户禁用(他们可以创建 .noident 文件), 您可以记录所有的 identd 请求(我们建议这样), 甚至可以令 identd 返回一个用户 ID 而不是用户名, 甚至NO-USER.
8.5 Configuring and Securing the Postfix MTA Postfix MTA 的安全配置

The Postfix mail server was written by Wietse Venema, author of Postfix and several other staple Internet security products, as an "attempt to provide an alternative to the widely-used Sendmail program. Postfix attempts to be fast, easy to administer, and hopefully secure, while at the same time being sendmail compatible enough to not upset your users."

Postfix 邮件服务器是 Wietse Venema 编写的, 他是 Postfix 和其它一些重要的互联网安全产品的作者, "试图提供一个大范围应用的 Sendmail 程序的替代品. Postfix 将更快, 更容易管理, 更安全, 同时与Sendmail 相兼容, 因而不会影响您的用户

Further information on postfix can be found at the Postfix home and in the Configuring and Securing Postfix.

更多信息参阅 Postfix 主页和 Postfix 的配置及安全.
8.6 SATAN, ISS, and Other Network Scanners 和其它网络扫描器

There are a number of different software packages out there that do port and service-based scanning of machines or networks. SATAN, ISS, SAINT, and Nessus are some of the more well-known ones. This software connects to the target machine (or all the target machines on a network) on all the ports they can, and try to determine what service is running there. Based on this information, you can tell if the machine is vulnerable to a specific exploit on that server.

除了这里列举的还有很多的软件包, 用于主机或网络端口和服务扫描. SATAN, ISS, SAINT, 和 Nessus 是其中比较著名的. 软件连接目标主机(或一个网络的所有主机)的所有端口, 并尝试判断运行了什么服务.

SATAN (Security Administrator's Tool for Analyzing Networks) is a port scanner with a web interface. It can be configured to do light, medium, or strong checks on a machine or a network of machines. It's a good idea to get SATAN and scan your machine or network, and fix the problems it finds. Make sure you get the copy of SATAN from metalab or a reputable FTP or web site. There was a Trojan copy of SATAN that was distributed out on the net. http://www.trouble.org/~zen/satan/satan.html. Note that SATAN has not been updated in quite a while, and some of the other tools below might do a better job.

SATAN (用于分析网络的管理员的安全工具)是一个 web 接口的端口扫描器. 可以配置为完成计算机的或网络上所有计算机的少量的, 中等的, 或强式检查. 设置 SATAN, 扫描您的计算机或网络, 并修复发现的问题是个不错的主意. 确保您是由 metalab 或正规的 FTP 或 web 站点获取的 SATAN 拷贝. 现在网络上发现了有带木马的 SATAN 传播. http://www.trouble.org/~zen/satan/satan.html. 注意 SATAN 很久没有更新了, 并且有很多此类工具性能更好.

ISS (Internet Security Scanner) is another port-based scanner. It is faster than Satan, and thus might be better for large networks. However, SATAN tends to provide more information.

ISS (互联网安全扫描器)是另一个端口扫描器. 比 Satan 速度要快, 因此更适用于大型网络. 但是 SATAN 可以提供更多的信息.

Abacus is a suite of tools to provide host-based security and intrusion detection. Look at it's home page on the web for more information. http://www.psionic.com/abacus/

Abacus 是一套用于提供基于主机安全和入侵检测的工具. 更多信息可以访问其主页. http://www.psionic.com/abacus/

SAINT is a updated version of SATAN. It is web-based and has many more up-to-date tests than SATAN. You can find out more about it at: http://www.wwdsi.com/~saint

SAINT 是 SATAN 的更新版本. 它是基于网页的, 目前来说和 SATAN 相比经过更多的测试. 你可以在 http://www.wwdsi.com/~saint 找到它.

Nessus is a free security scanner. It has a GTK graphical interface for ease of use. It is also designed with a very nice plug in setup for new port-scanning tests. For more information, take a look at: http://www.nessus.org

Nessus 是一个开源的安全扫描器. 提供了 GTK 图形接口, 更易使用. 它也提供了一个很棒的插件, 用户端口扫描测试. 更多信息, 查阅: http://www.nessus.org
Detecting Port Scans 监测端口扫描

There are some tools designed to alert you to probes by SATAN and ISS and other scanning software. However, if you liberally use tcp_wrappers, and look over your log files regularly, you should be able to notice such probes. Even on the lowest setting, SATAN still leaves traces in the logs on a stock Red Hat system.

也有一些工具用于识别 SATAN 和 ISS 和其它扫描软件的探测. 但是, 如果您使用 tcp_wrappers, 并经常查看您的日志文件, 您应该能注意到这类探测. 即使最低的设定, SATAN 也会在标准的 Red Hat 系统的日志中留下蛛丝马迹.

There are also "stealth" port scanners. A packet with the TCP ACK bit set (as is done with established connections) will likely get through a packet-filtering firewall. The returned RST packet from a port that _had no established session_ can be taken as proof of life on that port. I don't think TCP wrappers will detect this.

还有一些"隐形"端口扫描器. 设定了 TCP ACK 位的数据包可以通过数据包过滤的防火墙. 由一个端口返回的 RST 数据包 _had no established session_ 可以表明这个端口是活着的. 我不认为 TCP wrappers 能监测到这个.

You might also look at SNORT, which is a free IDS (Intrusion Detection System), which can detect other network intrusions. http://www.snort.org

您还可以考虑一下 SNORT, 这是一个开源的 IDS(入侵检测系统),可以监测出其它网络的入侵. http://www.snort.org
8.7 sendmail, qmail and MTA's

One of the most important services you can provide is a mail server. Unfortunately, it is also one of the most vulnerable to attack, simply due to the number of tasks it must perform and the privileges it typically needs.

mail 服务应该是您能提供最重要的服务.不幸的是, 它也是最易受到攻击, 仅仅是由于它所必须完成的任务数量和典型所需权限.

If you are using sendmail it is very important to keep up on current versions. sendmail has a long long history of security exploits. Always make sure you are running the most recent version from http://www.sendmail.org.

如果使用 sendmail, 及时更新非常重要. sendmail 的安全漏洞历史非常悠久. 确保您使用的是源自 http://www.sendmail.org 的最新版本.

Keep in mind that sendmail does not have to be running in order for you to send mail. If you are a home user, you can disable sendmail entirely, and simply use your mail client to send mail. You might also choose to remove the "-bd" flag from the sendmail startup file, thereby disabling incoming requests for mail. In other words, you can execute sendmail from your startup script using the following instead:

牢记要发送邮件并不一定要运行 sendmail. 如果您是家庭用户, 可以直接禁用 sendmail, 而是使用邮件客户端发送邮件. 也可以选择删除 sendmail 启动脚本的 "-bd" 标志, 这样就可以禁止邮件的连入请求. 也就说, 您对启动脚本中执行 sendmail 内容做如下修改:

                  # /usr/lib/sendmail -q15m

This will cause sendmail to flush the mail queue every fifteen minutes for any messages that could not be successfully delivered on the first attempt.

这会使 sendmail 每 15 分钟刷新一次邮件队列, 这样首次分发尝试将不可能成功.

Many administrators choose not to use sendmail, and instead choose one of the other mail transport agents. You might consider switching over to qmail. qmail was designed with security in mind from the ground up. It's fast, stable, and secure. Qmail can be found at http://www.qmail.org

很多管理员选择不使用 sendmail, 而选择其它邮件传输代理. 您可以考虑迁移到 qmail. qmail 是一开始设计时就考虑了安全问题. 快速, 稳定, 安全. 可以在 http://www.qmail.org 处找到 qmail.

In direct competition to qmail is "postfix", written by Wietse Venema, the author of tcp_wrappers and other security tools. Formerly called vmailer, and sponsored by IBM, this is also a mail transport agent written from the ground up with security in mind. You can find more information about postfix at http://www.postfix.org

qmail 的直接竞争对手是 "postfix", 由Wietse Venema编写, 他也是 tcp_wrappers 和其它一些安全工具的作者. 以前叫 vmailer, 由IBM资助, 也是一个一开始就考虑了安全因素的邮件传输代理. 有关 postfix 的更多信息, 请查阅 http://www.postfix.org
8.8 Denial of Service Attacks 拒绝服务攻击

A "Denial of Service" (DoS) attack is one where the attacker tries to make some resource too busy to answer legitimate requests, or to deny legitimate users access to your machine.

"拒绝服务"(DoS)攻击是指攻击者试图使某些资源过于繁忙, 以致无法响应合法用户的请求, 或者拒绝合法用户访问您的系统.

Denial of service attacks have increased greatly in recent years. Some of the more popular and recent ones are listed below. Note that new ones show up all the time, so this is just a few examples. Read the Linux security lists and the bugtraq list and archives for more current information.

拒绝服务攻击最近几年急剧增加.下边列出一些流行的和最新的攻击. 注意新型的攻击不断出现, 这里仅仅一些例子. 更多最新信息阅读 Linux 安全列表, bugtraq 列表和归档.

* SYN Flooding - SYN flooding is a network denial of service attack. It takes advantage of a "loophole" in the way TCP connections are created. The newer Linux kernels (2.0.30 and up) have several configurable options to prevent SYN flood attacks from denying people access to your machine or services. See Kernel Security for proper kernel protection options.

   SYN Flooding - SYN 洪流是一种网络拒绝服务攻击. 最新的Linux内核 (2.0.30 和以上)提供几个配置选项用于防止 SYN 洪流攻击禁止用户访问您的机器或服务. 合适的 Linux 保护选项, 参阅< ref id="kernel-security" name="Kernel 安全">.
* Pentium "F00F" Bug - It was recently discovered that a series of assembly codes sent to a genuine Intel Pentium processor would reboot the machine. This affects every machine with a Pentium processor (not clones, not Pentium Pro or PII), no matter what operating system it's running. Linux kernels 2.0.32 and up contain a work around for this bug, preventing it from locking your machine. Kernel 2.0.33 has an improved version of the kernel fix, and is suggested over 2.0.32. If you are running on a Pentium, you should upgrade now!

   Pentium "F00F" Bug - 这是最新发现的发送一系统汇编代码到真正的 Intel Pentium 处理器, 会引起机器重启. 这会影响使用Pentium处理器的所有计算机 (不是兼容处理器, 不是 Pentium Pro 或 PII), 不论其使用的是什么操作系统. Linux 2.0.32 或更高内核包含了针对这一缺陷的功能, 防止您的计算机被锁定. 2.0.33 内核是针对 2.0.32 内核的一个修正改善版本. 如果您使用的是 Pentium 处理器, 那么现在您需要升级了!
* Ping Flooding - Ping flooding is a simple brute-force denial of service attack. The attacker sends a "flood" of ICMP packets to your machine. If they are doing this from a host with better bandwidth than yours, your machine will be unable to send anything on the network. A variation on this attack, called "smurfing", sends ICMP packets to a host with your machine's return IP, allowing them to flood you less detectably. You can find more information about the "smurf" attack at http://www.quadrunner.com/~chuegen/smurf.txt

   Ping Flooding - Ping flooding 是简单的暴力拒绝服务攻击. 攻击者向您的机器发送"大量"的 ICM P数据包. 如果攻击者使用的攻击计算机的带宽优于您的带宽, 您的计算机将无法向网络传送任何数据. "smurfing" 是这类攻击的一个变种, 发送返回地址为您的计算机的ICMP数据包到主机, 使他们难以察觉的进行洪流. 有关 "smurf" 攻击的更多信息, 参阅 http://www.quadrunner.com/~chuegen/smurf.txt

   If you are ever under a ping flood attack, use a tool like tcpdump to determine where the packets are coming from (or appear to be coming from), then contact your provider with this information. Ping floods can most easily be stopped at the router level or by using a firewall.

   如果您曾经遭受国 ping 洪流攻击, 使用类似 tcpdump 的攻击就可发现这些数据包源自何方 (看上去源自何方), 把这些信息反馈给您的提供商. Ping 洪流在路由级, 或使用防火墙可以很容易的禁止掉.

* Ping o' Death - The Ping o' Death attack sends ICMP ECHO REQUEST packets that are too large to fit in the kernel data structures intended to store them. Because sending a single, large (65,510 bytes) "ping" packet to many systems will cause them to hang or even crash, this problem was quickly dubbed the "

ing o' Death." This one has long been fixed, and is no longer anything to worry about.

   Ping o' Death - 死亡之 Ping 攻击发送 ICMP ECHO REQUEST 数据包, 其超过了存储它的内核数据结构规定大小. 因为发送了单个, 巨型(65,510 字节) "ping" 包, 可以引起很多系统挂起, 甚至崩溃, 因此这个问题被称作"死亡之 ping". 这个问题很久以前就被修复了, 无需再担心.
* Teardrop / New Tear - One of the most recent exploits involves a bug present in the IP fragmentation code on Linux and Windows platforms. It is fixed in kernel version 2.0.33, and does not require selecting any kernel compile-time options to utilize the fix. Linux is apparently not vulnerable to the "newtear" exploit.

   Teardrop / New Tear - 最近发现的在 Linux 和 Windows 平台上, 出现在IP段中的缺陷. 在 2.0.33 内核中得以修复, 使用这一修复, 在编译时不需要任何选项. Linux 对 "newtear" 漏洞并不敏感.

You can find code for most exploits, and a more in-depth description of how they work, at http://www.rootshell.com using their search engine.

您可以使用 http://www.rootshell.com 的搜索引擎找到很多漏洞的代码, 和其工作原理的更详细的描述
8.9 NFS (Network File System) Security. NFS(网络文件系统)安全

NFS is a very widely-used file sharing protocol. It allows servers running nfsd and mountd to "export" entire file systems to other machines using NFS filesystem support built in to their kernels (or some other client support if they are not Linux machines). mountd keeps track of mounted file systems in /etc/mtab, and can display them with showmount.

NFS 是应用非常广泛的文件共享协议. 它允许服务器通过运行 nfsd 和 mountd 以向其它内核中内建支持的 NFS 文件系统的机器 (或其它非Linux机器上支持的客户端) "抛出(export)" 整个文件系统. mountd 跟踪由 /etc/mtab 中加载的文件系统, 并可通过 showmount 展示出来.

Many sites use NFS to serve home directories to users, so that no matter what machine in the cluster they login to, they will have all their home files.

很多站点使用 NFS 为用户提供家目录服务, 这样, 不论用户登录集群中的哪台计算机, 都可获取其所有的家目录文件.

There is some small amount of security allowed in exporting file systems. You can make your nfsd map the remote root user (uid=0) to the nobody user, denying them total access to the files exported. However, since individual users have access to their own (or at least the same uid) files, the remote root user can login or su to their account and have total access to their files. This is only a small hindrance to an attacker that has access to mount your remote file systems.

在抛出的文件系统中存在一些安全问题. 您可以使 nfsd 映射远程 root 用户(uid=0) 到 nobody 用户, 拒绝它们访问抛出的文件系统. 但是, 因为个人用户可以访问它们自己 (至少 UID 相同)的文件,远程 root 用户可以登录或 su 到他们的账号, 就可以获取对他们的文件的完全权限. 这对加载了您远程文件系统的攻击者来说只是一个小小的障碍.

If you must use NFS, make sure you export to only those machines that you really need to. Never export your entire root directory; export only directories you need to export.

如果您必须使用 NFS, 确保您只对必须的机器抛出文件系统. 绝对不要抛出您的整个根目录; 只抛出您需要抛出的目录.

See the NFS HOWTO for more information on NFS, available at http://metalab.unc.edu/mdw/HOWTO/NFS-HOWTO.html

有关NFS的更多信息, 参阅 NFS HOWTO http://metalab.unc.edu/mdw/HOWTO/NFS-HOWTO.html
8.10 NIS (Network Information Service) (formerly YP). 网络信息服务(以前的YP)

Network Information service (formerly YP) is a means of distributing information to a group of machines. The NIS master holds the information tables and converts them into NIS map files. These maps are then served over the network, allowing NIS client machines to get login, password, home directory and shell information (all the information in a standard /etc/passwd file). This allows users to change their password once and have it take effect on all the machines in the NIS domain.

网络信息服务(以前的YP)是一种对机器群分发信息的方式. NIS 主机处理信息表, 并转换为 NIS 映射文件. 这些映射文件通过网络提供, 允许 NIS 客户机获取登录, 密码, 家目录和 shell 信息(所有的信息都在标准的 /etc/passwd 文件中). 允许用户修改密码, 并会在 NIS 域的所有机器上生效.

NIS is not at all secure. It was never meant to be. It was meant to be handy and useful. Anyone that can guess the name of your NIS domain (anywhere on the net) can get a copy of your passwd file, and use "crack" and "John the Ripper" against your users' passwords. Also, it is possible to spoof NIS and do all sorts of nasty tricks. If you must use NIS, make sure you are aware of the dangers.

NIS 并不十分安全. 它也从未如此承诺. 只是为了方便和有用. 能猜测您的NIS域名称的任何人 (网上的任何地方)都可以获取 passwd 文件的拷贝, 使用 "crack" 和 "John the Ripper" 进行暴力破解密码. 也可以伪装 NIS, 做很多卑鄙的事情. 如果您必须使用 NIS, 应当清楚您的危险.

There is a much more secure replacement for NIS, called NIS+. Check out the NIS HOWTO for more information: http://metalab.unc.edu/mdw/HOWTO/NIS-HOWTO.html

有一个更安全的 NIS 替代品, 叫做 NIS+. 检查 NIS HOWTO 获取更多信息: http://metalab.unc.edu/mdw/HOWTO/NIS-HOWTO.html
8.11 Firewalls 防火墙

Firewalls are a means of controlling what information is allowed into and out of your local network. Typically the firewall host is connected to the Internet and your local LAN, and the only access from your LAN to the Internet is through the firewall. This way the firewall can control what passes back and forth from the Internet and your LAN.

防火墙意味着控制哪些信息允许进入和输出您的本地网络. 典型的防火墙主机是将互联网同您的本地网络相连, 并仅允许您的本地网络通过防火墙访问互联网. 通过这种方式, 防火墙可以控制互联网和本地网之间的数据流.

There are a number of types of firewalls and methods of setting them up. Linux machines make pretty good firewalls. Firewall code can be built right into 2.0 and higher kernels. The user-space tools ipfwadm for 2.0 kernels and ipchains for 2.2 kernels, allows you to change, on the fly, the types of network traffic you allow. You can also log particular types of network traffic.

有很多种防火墙和方法对其进行配置. Linux 主机可以配置成相当好的防火墙. 防火墙代码可以内置到 2.0 或更高内核. 用户空间工具 2.0 内核的 ipfwadm, 和 2.2 内核的 ipchains 允许您随时修改允许通过网络流量类型. 您还可以记录特定的网络流量类型.

Firewalls are a very useful and important technique in securing your network. However, never think that because you have a firewall, you don't need to secure the machines behind it. This is a fatal mistake. Check out the very good Firewall-HOWTO at your latest metalab archive for more information on firewalls and Linux. http://metalab.unc.edu/mdw/HOWTO/Firewall-HOWTO.html

防火墙对于安全化您的网络来说是非常有用, 和重要的技术. 但是, 从不要因为您有防火墙, 而不对其后的主机进行安全化设置. 这是一种致命的错误. 查看非常棒的 Firewall-HOWTO 以获取有关防火墙和Linux的更多相关信息. http://metalab.unc.edu/mdw/HOWTO/Firewall-HOWTO.html

More information can also be found in the IP-Masquerade mini-howto: http://metalab.unc.edu/mdw/HOWTO/mini/IP-Masquerade.html

More information on ipfwadm (the tool that lets you change settings on your firewall, can be found at it's home page: http://www.xos.nl/linux/ipfwadm/

If you have no experience with firewalls, and plan to set up one for more than just a simple security policy, the Firewalls book by O'Reilly and Associates or other online firewall document is mandatory reading. Check out http://www.ora.com for more information. The National Institute of Standards and Technology have put together an excellent document on firewalls. Although dated 1995, it is still quite good. You can find it at http://csrc.nist.gov/nistpubs/800-10/main.html. Also of interest:

如果您对防火墙不是很有经验, 但是要设置一个或多个基于稍微复杂的安全策略的防火墙. 可以从 O'Reilly 提供的有关防火墙的图书, 或其它一些在线防火墙文档获取帮助. 检查 http://www.ora.com 获取更多信息. National Institute of Standards and Technology 已经组织了一些非常优秀的防火墙文档. 尽管是 1995 年的, 但还是不错的: http://csrc.nist.gov/nistpubs/800-10/main.html. 下边这些也不错:

* The Freefire Project -- a list of freely-available firewall tools, available at http://sites.inka.de/sites/lina/freefire-l/index_en.html
* SunWorld Firewall Design -- written by the authors of the O'Reilly book, this provides a rough introduction to the different firewall types. It's available at http://www.sunworld.com/swol-01-1996/swol-01-firewall.html
* Mason - the automated firewall builder for Linux. This is a firewall script that learns as you do the things you need to do on your network! More info at: http://www.pobox.com/~wstearns/mason/

8.12 IP Chains - Linux Kernel 2.2.x Firewalling

Linux IP Firewalling Chains is an update to the 2.0 Linux firewalling code for the 2.2 kernel. It has many more features than previous implementations, including:

Linux IP Firewalling Chains 是 2.2 内核中, 对 2.0 Linux 防火墙代码的更新. 比以前的版本增加了更多的功能, 包括:

* More flexible packet manipulations 更灵活的数据包操作
* More complex accounting 更复杂的记账功能
* Simple policy changes possible atomically 简单的策略修改
* Fragments can be explicitly blocked, denied, etc. 可以对数据段进行阻塞, 禁止, 等待.
* Logs suspicious packets. 记录可疑数据包.
* Can handle protocols other than ICMP/TCP/UDP. 处理更多的协议.

If you are currently using ipfwadm on your 2.0 kernel, there are scripts available to convert the ipfwadm command format to the format ipchains uses.

如果您正在2.0内核上使用 ipfwadm, 有些脚本可用于将 ipfwadm 命令格式转换为 ipchains.

Be sure to read the IP Chains HOWTO for further information. It is available at http://www.adelaide.net.au/~rustcorp/ipfwchains/ipfwchains.html

更多信息请参阅 IP Chains HOWTO. http://www.adelaide.net.au/~rustcorp/ipfwchains/ipfwchains.html
8.13 Netfilter - Linux Kernel 2.4.x Firewalling Linux 2.4.x防火墙

In yet another set of advancements to the kernel IP packet filtering code, netfilter allows users to set up, maintain, and inspect the packet filtering rules in the new 2.4 kernel.

尽管还有其它改进中的内核IP数据包过滤代码, netfilter 允许用户设置, 维护, 检查新的 2.4 内核的数据包过滤规则

The netfilter subsystem is a complete rewrite of previous packet filtering implementations including ipchains and ipfwadm. Netfilter provides a large number of improvements, and it has now become an even more mature and robust solution for protecting corporate networks.

netfilter 系统是对以前的数据包过滤工具包括 ipchains 和 ipfwadm 的完全重写. netfilter 更加完善, 它现在甚至已经成为完善的强健的保护公司网络的解决方案.

iptables

is the command-line interface used to manipulate the firewall tables within the kernel.

iptables

是用于操作内核中的防火墙列表的命令行接口.

Netfilter provides a raw framework for manipulating packets as they traverse through various parts of the kernel. Part of this framework includes support for masquerading, standard packet filtering, and now more complete network address translation. It even includes improved support for load balancing requests for a particular service among a group of servers behind the firewall.

Netfilter 提供了一个原始框架, 用于实现对通过内核的各个部分的数据包的操作. 这个框架包括支持伪装, 标准数据包过滤, 更加完善的网络地址翻译. 甚至包含了改进负载均衡需求, 特别是防火墙后的对于某服务提供了服务器群.

The stateful inspection features are especially powerful. Stateful inspection provides the ability to track and control the flow of communication passing through the filter. The ability to keep track of state and context information about a session makes rules simpler and tries to interpret higher-level protocols.

状态检查特性特别有用. 状态检查提供了跟踪和控制经过过滤器的信息流的能力. 这种跟踪有关会话的状态和信息内容的能力可以是规则简单化, 并可理解更高级的协议.

Additionally, small modules can be developed to perform additional specific functions, such as passing packets to programs in userspace for processing then reinjecting back into the normal packet flow. The ability to develop these programs in userspace reduces the level of complexity that was previously associated with having to make changes directly at the kernel level.

另外,可以开发小型模块用于完成附加的特定功能, 比如把数据包传到用户空间进行处理, 然后重新插入正常的数据流. 这可用于开发用户空间程序, 以减少在内核级进行直接数据处理的复杂程度.

Other IP Tables references include:

其它的IP表参考包括:

* Oskar Andreasson IP Tables Tutorial -- Oskar Andreasson speaks with LinuxSecurity.com about his comprehensive IP Tables tutorial and how this document can be used to build a robust firewall for your organization.

   Oskar Andreasson IP Tables Tutorial -- Oskar Andreasson 在 LinuxSecurity.com 上讲述了他的IP表指导, 以及如何利用该文档为您的组织构建一个健壮的防火墙.
* Hal Burgiss Introduces Linux Security Quick-Start Guides -- Hal Burgiss has written two authoritative guides on securing Linux, including managing firewalling.
* Netfilter Homepage -- The netfilter/iptables homepage.

   Netfilter 主页 -- netfilter/iptables 的主页.
* Linux Kernel 2.4 Firewalling Matures: netfilter -- This LinuxSecurity.com article describes the basics of packet filtering, how to get started using iptables, and a list of the new features available in the latest generation of firewalling for Linux.

   Linux Kernel 2.4 智能防火墙: netfilter -- 这篇 LinuxSecurity.com的文档描述了基本数据包的过滤, 如何使用 iptables 开始工作, 并给出了这个新一代 Linux 防火墙的新功能列表.

8.14 VPNs - Virtual Private Networks 虚拟专用网

VPN's are a way to establish a "virtual" network on top of some already-existing network. This virtual network often is encrypted and passes traffic only to and from some known entities that have joined the network. VPNs are often used to connect someone working at home over the public Internet to an internal company network.

VPN's 是一种在现存网络上建立虚拟网络的方法. 这种虚拟网络通常是加密的, 并且该网络只允许已知网络加入. VPNs通常用于将家庭用户通过公共互联网连入一个公司的内部网络.

If you are running a Linux masquerading firewall and need to pass MS PPTP (Microsoft's VPN point-to-point product) packets, there is a Linux kernel patch out to do just that. See: ip-masq-vpn.

如果您正在使用 Linux 伪装(masquerading)防火墙, 并需要通过 MS PPTP 数据包(微软的VPN点对点产品), 则需要一个 Linux 内核补丁来解决这一问题.参阅 ip-masq-vpn.

There are several Linux VPN solutions available:

这里有几款 Linux VPN 方案:

* vpnd. See the http://sunsite.auc.dk/vpnd/.
* Free S/Wan, available at http://www.xs4all.nl/~freeswan/
* ssh can be used to construct a VPN. See the VPN mini-howto for more information.
* vps (virtual private server) at http://www.strongcrypto.com.
* yawipin at http://yavipin.sourceforge.net

See also the section on IPSEC for pointers and more information.

更多信息可以参阅 IPSEC 部分.

eTony · 发表于 2006-3-20 14:33:58

9. Security Preparation (before you go on-line) 安全准备(连入网络之前)

Ok, so you have checked over your system, and determined it's as secure as feasible, and you're ready to put it online. There are a few things you should now do in order to prepare for an intrusion, so you can quickly disable the intruder, and get back up and running.

Ok, 检查一下整个系统, 确保它尽可能的安全, 然后准备连入网络. 为了抵御入侵, 您需要做一些工作, 这样您可以快速驱逐入侵者, 并恢复系统.
9.1 Make a Full Backup of Your Machine 进行完整备份

Discussion of backup methods and storage is beyond the scope of this document, but here are a few words relating to backups and security:

讨论备份方法和存储超出了本文的范围, 但是对备份和安全做简要介绍还是必要的:

If you have less than 650mb of data to store on a partition, a CD-R copy of your data is a good way to go (as it's hard to tamper with later, and if stored properly can last a long time), you will of course need at least 650MB of space to make the image. Tapes and other re-writable media should be write-protected as soon as your backup is complete, and then verified to prevent tampering. Make sure you store your backups in a secure off-line area. A good backup will ensure that you have a known good point to restore your system from.

如果一个分区上的数据少于 650mb, 将其备份到光盘上是个不错的主意(这样就很难被篡改了, 并可以保存比较久的时间), 当然您需要至少650MB的空间制作映像. 磁带和其它可写媒介在备份完毕后, 应当设置写保护, 以防止被篡改. 确保您备份数据到安全的非在线区域. 好的备份可以确保您拥有一个不错的系统恢复点.
9.2 Choosing a Good Backup Schedule 选择一个好的备份方案

A six-tape cycle is easy to maintain. This includes four tapes for during the week, one tape for even Fridays, and one tape for odd Fridays. Perform an incremental backup every day, and a full backup on the appropriate Friday tape. If you make some particularly important changes or add some important data to your system, a full backup might well be in order.

六磁带循环备份是非常容易维护的. 这包括工作日的四磁带备份, 每个周五的一次备份, 奇数周五的一次备份. 每天进行增量备份, 然后每周五进行完整备份. 如果有特别重大的变动, 或在系统中添加了重要数据, 应该进行一次完整备份.
9.3 Testing your backups 测试备份

You should do periodic tests of your backups to make sure they are working as you might expect them to. Restores of files and checking against the real data, sizes and listings of backups, and reading old backups should be done on a regular basis.

您应当测试您以前所做的备份, 确保它们如您希望的那样正常. 恢复文件, 检查其实际数据, 大小,等, 检查老的备份是否正常.
9.4 Backup Your RPM or Debian File Database 备份RPM或Debian文件数据库

In the event of an intrusion, you can use your RPM database like you would use tripwire, but only if you can be sure it too hasn't been modified. You should copy the RPM database to a floppy, and keep this copy off-line at all times. The Debian distribution likely has something similar.

如果发生入侵, 您可以使用您的 RPM 数据, 比如使用 tripwire, 但是要确保它没有被修改. 应当复制 RPM 数据库到软盘上, 并设置写保护. Debian 发行版也是类似.

The files /var/lib/rpm/fileindex.rpm and /var/lib/rpm/packages.rpm most likely won't fit on a single floppy. But if compressed, each should fit on a seperate floppy.

文件/var/lib/rpm/fileindex.rpm 和 /var/lib/rpm/packages.rpm 对于单张软盘来说可能太大了. 但是可以进行分卷压缩.

Now, when your system is compromised, you can use the command:

现在, 如果发生了入侵, 使用下边的命令

root# rpm -Va

to verify each file on the system. See the rpm man page, as there are a few other options that can be included to make it less verbose. Keep in mind you must also be sure your RPM binary has not been compromised.

来校验系统中的每个文件. 参阅 rpm 的联机手册, 还有一些其它选项可以使其更加精简. 牢记还要要确保您的 RPM 没有被入侵.

This means that every time a new RPM is added to the system, the RPM database will need to be rearchived. You will have to decide the advantages versus drawbacks.

这就意味着每次在系统中安装新的 RPM, RPM 数据库就应该进行归档. You will have to decide the advantages versus drawbacks.
9.5 Keep Track of Your System Accounting Data 跟踪系统账号数据

It is very important that the information that comes from syslog not be compromised. Making the files in /var/log readable and writable by only a limited number of users is a good start.

syslog 中没有被修改的系统记账信息也很重要. 应当令 /var/log 目录下的文件只对部分用户可读可写.

Be sure to keep an eye on what gets written there, especially under the auth facility. Multiple login failures, for example, can indicate an attempted break-in.

务必留意特别是在 auth 里边写入的内容. 多次登录失败, 例如, 应该被标记为非法入侵.

Where to look for your log file will depend on your distribution. In a Linux system that conforms to the "Linux Filesystem Standard", such as Red Hat, you will want to look in /var/log and check messages, mail.log, and others.

您的日志文件的位置和您使用的发行版有关. 在一个 Linux 系统中, 按照"Linux文件系统标准", 例如 Red Hat, messages mail.log等一些文件应该位于 /var/log 下.

You can find out where your distribution is logging to by looking at your /etc/syslog.conf file. This is the file that tells syslogd (the system logging daemon) where to log various messages.

您可以通过查看 /etc/syslog.conf 文件来确定您使用的发行版的日志文件的位置. 这个文件设定 syslogd (系统日志守护进程)在什么地方保存日志文件.

You might also want to configure your log-rotating script or daemon to keep logs around longer so you have time to examine them. Take a look at the logrotate package on recent Red Hat distributions. Other distributions likely have a similar process.

您可能还想配置轮询日志脚本, 或守护进程保持日志循环保存, 这样就可以进行测试. 检查一下 Red Hat 最近版本中的 logrotate 软件包. 其它发行版也有类似的进程.

If your log files have been tampered with, see if you can determine when the tampering started, and what sort of things appeared to be tampered with. Are there large periods of time that cannot be accounted for? Checking backup tapes (if you have any) for untampered log files is a good idea.

如果您的日志文件被篡改了, 看看是否能确定是什么时候开始的, 是那种类型的篡改. 是不是有很长时间没有正常记录了? 检查一下没有篡改的磁带备份日志文件.

Intruders typically modify log files in order to cover their tracks, but they should still be checked for strange happenings. You may notice the intruder attempting to gain entrance, or exploit a program in order to obtain the root account. You might see log entries before the intruder has time to modify them.

入侵者为了隐藏其踪迹, 通常要修改日志文件, 但是某些奇怪的现象仍能表明他们的入侵. 您应该注意到入侵者试图获取登录权, 或对程序进行 crack, 以获取 root 权限!

You should also be sure to separate the auth facility from other log data, including attempts to switch users using su, login attempts, and other user accounting information.

您还应当确保 auth 类程序的日志同别的分开, 包括通过使用 su 试图切换用户, 试图登录, 以及其它用户账号信息.

If possible, configure syslog to send a copy of the most important data to a secure system. This will prevent an intruder from covering his tracks by deleting his login/su/ftp/etc attempts. See the syslog.conf man page, and refer to the @ option.

如果可能, 配置 syslog 发送大多数重要数据的一个拷贝到一个安全系统. 这样可以阻止入侵者通过删除他的 login/su/ftp/ 等等尝试, 来掩盖其行踪. 查阅 syslog.conf 的联机手册, 参考 @ 选项.

There are several more advanced syslogd programs out there. Take a look at http://www.core-sdi.com/ssyslog/ for Secure Syslog. Secure Syslog allows you to encrypt your syslog entries and make sure no one has tampered with them.

这里有些高级的 syslogd 程序. 查看一下 http://www.core-sdi.com/ssyslog/ 的 Secure Syslog. Secure Syslog 允许您加密系统日志内容, 并确保没有人对其进行篡改.

Another syslogd with more features is syslog-ng. It allows you a lot more flexibility in your logging and also can has your remote syslog streams to prevent tampering.

syslog-ng 是另一个拥有更多功能的 syslogd. 它更加灵活, 甚至可以阻止您的远程系统日志流不被篡改.

Finally, log files are much less useful when no one is reading them. Take some time out every once in a while to look over your log files, and get a feeling for what they look like on a normal day. Knowing this can help make unusual things stand out.

最后, 日志文件没有人查看, 那么它的用处就不大了. 经常的查看日志, 并总结一下在正常情况下它应该是什么样子. 了解这些可以使您很容易注意到不寻常的事情的发生.
9.6 Apply All New System Updates.更新系统

Most Linux users install from a CD-ROM. Due to the fast-paced nature of security fixes, new (fixed) programs are always being released. Before you connect your machine to the network, it's a good idea to check with your distribution's ftp site and get all the updated packages since you received your distribution CD-ROM. Many times these packages contain important security fixes, so it's a good idea to get them installed.

很多 Linux 用户都是通过 CD-ROM 安装系统的. 由于安全修复的及时性, 经常会发布新(修复)程序. 在将机器连入网络之前, 最好检查一下您使用的发行版的 ftp 站点, 并下载使用的发行版 CD-ROM 发行以后所有的更新包. 通常这些软件包包含了重要的安全修复, 所以最好安装它们.

		自动登录	找回密码
密码			注册

Linux Security HOWTO 中英文对照(错误之处,请指出, 谢谢)

浏览过的版块