Changeset 0afcfa88


Ignore:
Timestamp:
05/30/2005 09:58:46 PM (19 years ago)
Author:
Randy McMurchy <randy@…>
Branches:
10.0, 10.1, 11.0, 11.1, 11.2, 11.3, 12.0, 12.1, 6.1, 6.2, 6.2.0, 6.2.0-rc1, 6.2.0-rc2, 6.3, 6.3-rc1, 6.3-rc2, 6.3-rc3, 7.10, 7.4, 7.5, 7.6, 7.6-blfs, 7.6-systemd, 7.7, 7.8, 7.9, 8.0, 8.1, 8.2, 8.3, 8.4, 9.0, 9.1, basic, bdubbs/svn, elogind, gnome, kde5-13430, kde5-14269, kde5-14686, kea, ken/TL2024, ken/inkscape-core-mods, ken/tuningfonts, krejzi/svn, lazarus, lxqt, nosym, perl-modules, plabs/newcss, plabs/python-mods, python3.11, qt5new, rahul/power-profiles-daemon, renodr/vulkan-addition, systemd-11177, systemd-13485, trunk, upgradedb, xry111/intltool, xry111/llvm18, xry111/soup3, xry111/test-20220226, xry111/xf86-video-removal
Children:
fb3dd289
Parents:
99b1c520
Message:

Removed excess spaces from the ends of lines in the source files

git-svn-id: svn://svn.linuxfromscratch.org/BLFS/trunk/BOOK@4524 af4574ff-66df-0310-9fd7-8a98e5e911e0

Location:
postlfs/security
Files:
4 edited

Legend:

Unmodified
Added
Removed

  • postlfs/security/cracklib.xml

    r99b1c520 r0afcfa88  
    3333    <title>Introduction to Cracklib</title>
    3434
    35     <para>The <application>cracklib</application> package contains a 
    36     library used to enforce strong passwords by comparing user selected 
     35    <para>The <application>cracklib</application> package contains a
     36    library used to enforce strong passwords by comparing user selected
    3737    passwords to words in a chosen wordlist.</para>
    3838
    … …  
    7474    </itemizedlist>
    7575
    76     <para>You will also need to download a wordlist for use with 
    77     <application>cracklib</application>. There are two wordlists 
    78     to choose from at the following location.  Use the 
    79     <filename>cracklib</filename> word list for good security, or 
    80     opt for the <filename>allwords</filename> word list for 
    81     lightweight machines short on RAM. You can of course choose 
     76    <para>You will also need to download a wordlist for use with
     77    <application>cracklib</application>. There are two wordlists
     78    to choose from at the following location.  Use the
     79    <filename>cracklib</filename> word list for good security, or
     80    opt for the <filename>allwords</filename> word list for
     81    lightweight machines short on RAM. You can of course choose
    8282    any other word list that you have at your disposal.</para>
    8383
    8484    <itemizedlist spacing='compact'>
    8585      <listitem>
    86         <para>cracklib (&crackdict-size;) at <ulink 
     86        <para>cracklib (&crackdict-size;) at <ulink
    8787        url="http://www.cotse.com/tools/wordlists.htm"/></para>
    8888      </listitem>
    8989      <listitem>
    90         <para>allwords (&alldict-size;) at <ulink 
     90        <para>allwords (&alldict-size;) at <ulink
    9191        url="http://www.cotse.com/tools/wordlists.htm"/></para>
    9292      </listitem>
    … …  
    9999
    100100    <para>First, as the <systemitem class="username">root</systemitem>
    101     user, install the chosen word list for 
     101    user, install the chosen word list for
    102102    <application>cracklib</application>:</para>
    103103
    … …  
    108108
    109109    <para>The wordlist is linked to <filename>/usr/share/dict/words</filename>
    110     as historically, <filename>words</filename> is the primary wordlist in the 
    111     <filename class="directory">/usr/share/dict</filename> directory. 
    112     Additionally, the value of <command>hostname</command> is echoed to a file 
    113     called <filename>extra.words</filename>. This extra file is intended to be 
    114     a site specific list which includes easy to guess passwords such as company 
    115     or department names, user's names, product names, computer names, domain 
     110    as historically, <filename>words</filename> is the primary wordlist in the
     111    <filename class="directory">/usr/share/dict</filename> directory.
     112    Additionally, the value of <command>hostname</command> is echoed to a file
     113    called <filename>extra.words</filename>. This extra file is intended to be
     114    a site specific list which includes easy to guess passwords such as company
     115    or department names, user's names, product names, computer names, domain
    116116    names, etc.</para>
    117117
    … …  
    138138    <title>Command Explanations</title>
    139139
    140     <para><command>rm -v /lib/libcrack.so; ln -v -sf ... 
    141     /usr/lib/libcrack.so</command>: These two commands move the 
     140    <para><command>rm -v /lib/libcrack.so; ln -v -sf ...
     141    /usr/lib/libcrack.so</command>: These two commands move the
    142142    <filename class='symlink'>libcrack.so</filename>
    143     symlink from <filename class='directory'>/lib</filename> to 
     143    symlink from <filename class='directory'>/lib</filename> to
    144144    <filename class='directory'>/usr/lib</filename>.</para>
    145145
    … …  
    169169        <term><filename class='libraryfile'>libcrack.so</filename></term>
    170170        <listitem>
    171           <para>provide a fast dictionary lookup method for strong 
     171          <para>provide a fast dictionary lookup method for strong
    172172          password enforcement.</para>
    173173          <indexterm zone="cracklib libcrack">

  • postlfs/security/cyrus-sasl.xml

    r99b1c520 r0afcfa88  
    3030    <title>Introduction to Cyrus SASL</title>
    3131
    32     <para>The <application>Cyrus SASL</application> package contains a Simple 
    33     Authentication and Security Layer, a method for adding authentication 
    34     support to connection-based protocols. To use SASL, a protocol includes a 
    35     command for identifying and authenticating a user to a server and for 
    36     optionally negotiating protection of subsequent protocol interactions. If 
    37     its use is negotiated, a security layer is inserted between the protocol 
     32    <para>The <application>Cyrus SASL</application> package contains a Simple
     33    Authentication and Security Layer, a method for adding authentication
     34    support to connection-based protocols. To use SASL, a protocol includes a
     35    command for identifying and authenticating a user to a server and for
     36    optionally negotiating protection of subsequent protocol interactions. If
     37    its use is negotiated, a security layer is inserted between the protocol
    3838    and the connection.</para>
    3939
    … …  
    6666
    6767    <bridgehead renderas="sect4">Optional</bridgehead>
    68     <para><xref linkend="Linux_PAM"/>, 
    69     <xref linkend="openldap"/>, 
    70     <xref linkend="heimdal"/> or <xref linkend="mitkrb"/>, 
    71     <xref linkend="jdk"/>, 
    72     <xref linkend="mysql"/>, 
    73     <xref linkend="postgresql"/>, 
    74     <xref linkend="db"/>, 
    75     <xref linkend="gdbm"/>, 
    76     <xref linkend="courier"/>, 
    77     <ulink url="http://www.pdc.kth.se/kth-krb/">krb4</ulink>, 
    78     <ulink url="http://sqlite.org/">SQLite</ulink> and 
     68    <para><xref linkend="Linux_PAM"/>,
     69    <xref linkend="openldap"/>,
     70    <xref linkend="heimdal"/> or <xref linkend="mitkrb"/>,
     71    <xref linkend="jdk"/>,
     72    <xref linkend="mysql"/>,
     73    <xref linkend="postgresql"/>,
     74    <xref linkend="db"/>,
     75    <xref linkend="gdbm"/>,
     76    <xref linkend="courier"/>,
     77    <ulink url="http://www.pdc.kth.se/kth-krb/">krb4</ulink>,
     78    <ulink url="http://sqlite.org/">SQLite</ulink> and
    7979    <ulink url="http://dmalloc.com/">Dmalloc</ulink></para>
    8080
    … …  
    8484    <title>Installation of Cyrus SASL</title>
    8585
    86     <para>Install <application>Cyrus SASL</application> by 
     86    <para>Install <application>Cyrus SASL</application> by
    8787    running the following commands:</para>
    8888
    … …  
    107107    <title>Command Explanations</title>
    108108
    109     <para><parameter>--with-dbpath=/var/lib/sasl/sasldb2</parameter>: This 
     109    <para><parameter>--with-dbpath=/var/lib/sasl/sasldb2</parameter>: This
    110110    parameter forces the <command>saslauthd</command> database to be created
    111     in <filename class='directory'>/var/lib/sasl</filename> instead of 
     111    in <filename class='directory'>/var/lib/sasl</filename> instead of
    112112    <filename class='directory'>/etc</filename>.</para>
    113113
    114     <para><parameter>--with-saslauthd=/var/run</parameter>: This parameter 
    115     forces <command>saslauthd</command> to use the FHS compliant 
    116     directory <filename class='directory'>/var/run</filename> for variable 
     114    <para><parameter>--with-saslauthd=/var/run</parameter>: This parameter
     115    forces <command>saslauthd</command> to use the FHS compliant
     116    directory <filename class='directory'>/var/run</filename> for variable
    117117    run-time data.</para>
    118118
    … …  
    120120    with <application>OpenLDAP</application>.</para>
    121121
    122     <para><command>install -v -m644 ...</command>: These commands 
    123     install documentation which is not installed by the 
     122    <para><command>install -v -m644 ...</command>: These commands
     123    install documentation which is not installed by the
    124124    <command>make install</command> command.</para>
    125125
    126     <para><command>install -v -d -m700 /var/lib/sasl</command>: This directory 
    127     must exist when starting <command>saslauthd</command>. If you're not going 
     126    <para><command>install -v -d -m700 /var/lib/sasl</command>: This directory
     127    must exist when starting <command>saslauthd</command>. If you're not going
    128128    to be running the daemon, you may omit the creation of this directory.</para>
    129129
    … …  
    136136      <title>Config Files</title>
    137137
    138       <para><filename>/etc/saslauthd.conf</filename> (for LDAP configuration) 
    139       and <filename>/usr/lib/sasl2/Appname.conf</filename> (where "Appname" 
     138      <para><filename>/etc/saslauthd.conf</filename> (for LDAP configuration)
     139      and <filename>/usr/lib/sasl2/Appname.conf</filename> (where "Appname"
    140140      is the application defined name of the application)</para>
    141141
    … …  
    149149      <title>Configuration Information</title>
    150150
    151       <para>See <ulink 
     151      <para>See <ulink
    152152      url="file:///usr/share/doc/cyrus-sasl-&cyrus-sasl-version;/sysadmin.html"/>
    153       for information on what to include in the application configuration files. 
    154       See <ulink 
     153      for information on what to include in the application configuration files.
     154      See <ulink
    155155      url="file:///usr/share/doc/cyrus-sasl-&cyrus-sasl-version;/LDAP_SASLAUTHD"/>
    156156      for configuring <command>saslauthd</command> with LDAP.</para>
    … …  
    161161      <title>Init Script</title>
    162162
    163       <para>If you need to run the <command>saslauthd</command> daemon at system 
     163      <para>If you need to run the <command>saslauthd</command> daemon at system
    164164      startup, install the <filename>/etc/rc.d/init.d/cyrus-sasl</filename>
    165165      init script included in the <xref linkend="intro-important-bootscripts"/>
    … …  
    173173
    174174      <note>
    175         <para>You'll need to modify the init script and replace the 
    176         <option><replaceable>[authmech]</replaceable></option> parameter 
    177         to the <option>-a</option> switch with your desired authentication 
     175        <para>You'll need to modify the init script and replace the
     176        <option><replaceable>[authmech]</replaceable></option> parameter
     177        to the <option>-a</option> switch with your desired authentication
    178178        mechanism.</para>
    179179      </note>
    … …  
    193193      <seglistitem>
    194194        <seg>saslauthd, sasldblistusers2, and saslpasswd2</seg>
    195         <seg>libjavasasl.so, libsasl2.so, and SASL plugins/Java 
     195        <seg>libjavasasl.so, libsasl2.so, and SASL plugins/Java
    196196        classes</seg>
    197         <seg>/usr/include/sasl, /usr/lib/java, /usr/lib/sasl2, 
     197        <seg>/usr/include/sasl, /usr/lib/java, /usr/lib/sasl2,
    198198        /usr/share/doc/cyrus-sasl-&cyrus-sasl-version;, and /var/lib/sasl</seg>
    199199      </seglistitem>
    … …  
    228228        <term><command>saslpasswd2</command></term>
    229229        <listitem>
    230           <para>is used to set and delete a user's SASL password and 
     230          <para>is used to set and delete a user's SASL password and
    231231          mechanism specific secrets in the SASL password database.</para>
    232232          <indexterm zone="cyrus-sasl saslpasswd2">
    … …  
    239239        <term><filename class='libraryfile'>libsasl2.so</filename></term>
    240240        <listitem>
    241           <para>is a general purpose authentication library for server and 
     241          <para>is a general purpose authentication library for server and
    242242          client applications.</para>
    243243          <indexterm zone="cyrus-sasl libsasl2">

  • postlfs/security/firewalling.xml

    r99b1c520 r0afcfa88  
    1616  <title>Setting Up a Network Firewall</title>
    1717
    18   <para>Before you read this part of the chapter, you should have 
     18  <para>Before you read this part of the chapter, you should have
    1919  already installed iptables as described in the previous section.</para>
    2020
    … …  
    2222    <title>Introduction to Firewall Creation</title>
    2323
    24     <para>The general purpose of a firewall is to protect a computer or 
     24    <para>The general purpose of a firewall is to protect a computer or
    2525    a network against malicious access.</para>
    2626
    27     <para>In a perfect world, every daemon or service on every machine 
    28     is perfectly configured and immune to flaws such as buffer overflows 
    29     or other problems regarding its security. Furthermore, you trust 
    30     every user accessing your services. In this world, you do not need 
     27    <para>In a perfect world, every daemon or service on every machine
     28    is perfectly configured and immune to flaws such as buffer overflows
     29    or other problems regarding its security. Furthermore, you trust
     30    every user accessing your services. In this world, you do not need
    3131    to have a firewall.</para>
    3232
    33     <para>In the real world however, daemons may be misconfigured and 
    34     exploits against essential services are freely available. You may 
    35     wish to choose which services are accessible by certain machines or 
    36     you may wish to limit which machines or applications are allowed 
    37     external access. Alternatively, you may simply not trust some of 
    38     your applications or users. You are probably connected to the 
     33    <para>In the real world however, daemons may be misconfigured and
     34    exploits against essential services are freely available. You may
     35    wish to choose which services are accessible by certain machines or
     36    you may wish to limit which machines or applications are allowed
     37    external access. Alternatively, you may simply not trust some of
     38    your applications or users. You are probably connected to the
    3939    Internet. In this world, a firewall is essential.</para>
    4040
    41     <para>Don't assume however, that having a firewall makes careful 
    42     configuration redundant, or that it makes any negligent 
    43     misconfiguration harmless. It doesn't prevent anyone from exploiting 
    44     a service you intentionally offer but haven't recently updated or 
    45     patched after an exploit went public.  Despite having a firewall, you 
    46     need to keep applications and daemons on your system properly 
    47     configured and up to date.  A firewall is not a cure all, but should 
     41    <para>Don't assume however, that having a firewall makes careful
     42    configuration redundant, or that it makes any negligent
     43    misconfiguration harmless. It doesn't prevent anyone from exploiting
     44    a service you intentionally offer but haven't recently updated or
     45    patched after an exploit went public.  Despite having a firewall, you
     46    need to keep applications and daemons on your system properly
     47    configured and up to date.  A firewall is not a cure all, but should
    4848    be an essential part of your overall security startegy.</para>
    4949
    … …  
    5858      <title><xref linkend="fw-persFw"/></title>
    5959
    60       <para>This is a hardware device or software program commercially 
    61       sold by companies such as Symantec which claims that it secures 
    62       a home or desktop computer with Internet access. This type of 
    63       firewall is highly relevant for users who do not know how their 
    64       computers might be accessed via the Internet or how to disable 
    65       that access, especially if they are always online and connected 
     60      <para>This is a hardware device or software program commercially
     61      sold by companies such as Symantec which claims that it secures
     62      a home or desktop computer with Internet access. This type of
     63      firewall is highly relevant for users who do not know how their
     64      computers might be accessed via the Internet or how to disable
     65      that access, especially if they are always online and connected
    6666      via broadband links.</para>
    6767
    … …  
    7272
    7373      <para>This is a system placed between the Internet and an intranet.
    74       To minimize the risk of compromising the firewall itself, it should 
     74      To minimize the risk of compromising the firewall itself, it should
    7575      generally have only one role&mdash;that of protecting the intranet.
    7676      Although not completely risk free, the tasks of doing the routing and
    77       IP masquerading (rewriting IP headers of the packets it routes from 
    78       clients with private IP addresses onto the Internet so that they seem 
    79       to come from the firewall itself) are commonly considered relatively 
     77      IP masquerading (rewriting IP headers of the packets it routes from
     78      clients with private IP addresses onto the Internet so that they seem
     79      to come from the firewall itself) are commonly considered relatively
    8080      secure.</para>
    8181
    … …  
    8585      <title><xref linkend="fw-busybox"/></title>
    8686
    87       <para>This is often an old computer you may have retired and nearly 
    88       forgotten, performing masquerading or routing functions, but offering 
    89       non-firewall services such as a web-cache or mail.  This may be used 
    90       for home networks, but is not be considered as secure as a firewall 
    91       only machine because the combination of server and router/firewall on 
     87      <para>This is often an old computer you may have retired and nearly
     88      forgotten, performing masquerading or routing functions, but offering
     89      non-firewall services such as a web-cache or mail.  This may be used
     90      for home networks, but is not be considered as secure as a firewall
     91      only machine because the combination of server and router/firewall on
    9292      one machine raises the complexity of the setup.</para>
    9393
    … …  
    9595
    9696    <sect3>
    97       <title>Firewall with a Demilitarized Zone [Not Further 
     97      <title>Firewall with a Demilitarized Zone [Not Further
    9898      Described Here]</title>
    9999
    100       <para>This box performs masquerading or routing, but grants public 
    101       access to some branch of your network which, because of public IP's 
    102       and a physically separated structure, is essentially a separate 
    103       network with direct Internet access. The servers on this network are 
    104       those which must be easily accessible from both the Internet and 
    105       intranet. The firewall protects both networks. This type of firewall 
     100      <para>This box performs masquerading or routing, but grants public
     101      access to some branch of your network which, because of public IP's
     102      and a physically separated structure, is essentially a separate
     103      network with direct Internet access. The servers on this network are
     104      those which must be easily accessible from both the Internet and
     105      intranet. The firewall protects both networks. This type of firewall
    106106      has a minimum of three network interfaces.</para>
    107107
    … …  
    111111      <title>Packetfilter</title>
    112112
    113       <para>This type of firewall does routing or masquerading, but does 
    114       not maintain a state table of ongoing communication streams. It is 
    115       fast, but quite limited in its ability to block inappropriate packets 
     113      <para>This type of firewall does routing or masquerading, but does
     114      not maintain a state table of ongoing communication streams. It is
     115      fast, but quite limited in its ability to block inappropriate packets
    116116      without blocking desired packets.</para>
    117117
    … …  
    124124
    125125    <caution>
    126       <para>This introduction on how to setup a firewall is not a 
    127       complete guide to securing systems. Firewalling is a complex 
    128       issue that requires careful configuration. The scripts quoted 
    129       here are simply intended to give examples of how a firewall 
    130       works. They are not intended to fit into any particular 
    131       configuration and may not provide complete protection from 
     126      <para>This introduction on how to setup a firewall is not a
     127      complete guide to securing systems. Firewalling is a complex
     128      issue that requires careful configuration. The scripts quoted
     129      here are simply intended to give examples of how a firewall
     130      works. They are not intended to fit into any particular
     131      configuration and may not provide complete protection from
    132132      an attack.</para>
    133133
    134       <para>Customization of these scripts for your specific situation 
    135       will be necessary for an optimal configuration, but you should 
    136       make a serious study of the iptables documentation and creating 
    137       firewalls in general before hacking away. Have a look at the 
    138       list of <xref linkend="fw-library"/> at the end of this section for 
    139       more details. There you will find a list of URLs that contain quite 
     134      <para>Customization of these scripts for your specific situation
     135      will be necessary for an optimal configuration, but you should
     136      make a serious study of the iptables documentation and creating
     137      firewalls in general before hacking away. Have a look at the
     138      list of <xref linkend="fw-library"/> at the end of this section for
     139      more details. There you will find a list of URLs that contain quite
    140140      comprehensive information about building your own firewall.</para>
    141141    </caution>
    142142
    143     <para>The firewall configuration script installed in the last section 
    144     differs from the standard configuration script. It only has two of 
    145     the standard targets: start and status. The other targets are clear 
     143    <para>The firewall configuration script installed in the last section
     144    differs from the standard configuration script. It only has two of
     145    the standard targets: start and status. The other targets are clear
    146146    and lock. For instance when you run:</para>
    147147
    148148<screen role="root"><userinput>/etc/rc.d/init.d/iptables start</userinput></screen>
    149149
    150     <para>the firewall will be restarted just as it is upon system startup. 
    151     The status target will present a list of all currently implemented 
    152     rules. The clear target turns off all firewall rules and the lock 
    153     target will block all packets in and out of the computer with the 
     150    <para>the firewall will be restarted just as it is upon system startup.
     151    The status target will present a list of all currently implemented
     152    rules. The clear target turns off all firewall rules and the lock
     153    target will block all packets in and out of the computer with the
    154154    exception of the loopback interface.</para>
    155155
    156     <para>The main startup firewall is located in the file 
    157     <filename>/etc/rc.d/rc.iptables</filename>. The sections below provide 
     156    <para>The main startup firewall is located in the file
     157    <filename>/etc/rc.d/rc.iptables</filename>. The sections below provide
    158158    three different approaches that can be used for a system.</para>
    159159
    160160    <note>
    161161      <para>You should always run your firewall rules from a script.
    162       This ensures consistency and a record of what was done. It also 
    163       allows retention of comments that are essential for understanding 
     162      This ensures consistency and a record of what was done. It also
     163      allows retention of comments that are essential for understanding
    164164      the rules long after they were written.</para>
    165165    </note>
    … …  
    168168      <title>Personal Firewall</title>
    169169
    170       <para>A Personal Firewall is designed to let you access all the 
    171       services offered on the Internet, but keep your box secure and 
     170      <para>A Personal Firewall is designed to let you access all the
     171      services offered on the Internet, but keep your box secure and
    172172      your data private.</para>
    173173
    174       <para>Below is a slightly modified version of Rusty Russell's 
    175       recommendation from the <ulink 
     174      <para>Below is a slightly modified version of Rusty Russell's
     175      recommendation from the <ulink
    176176      url="http://www.netfilter.org/documentation/HOWTO/packet-filtering-HOWTO.html">
    177       Linux 2.4 Packet Filtering HOWTO</ulink>. It is still applicable 
     177      Linux 2.4 Packet Filtering HOWTO</ulink>. It is still applicable
    178178      to the Linux 2.6 kernels.</para>
    179179
    … …  
    183183# Begin $rc_base/rc.iptables
    184184
    185 # Insert connection-tracking modules 
     185# Insert connection-tracking modules
    186186# (not needed if built into the kernel)
    187187modprobe ip_tables
    … …  
    207207echo 0 &gt; /proc/sys/net/ipv4/conf/all/send_redirects
    208208
    209 # Drop Spoofed Packets coming in on an interface, where responses 
     209# Drop Spoofed Packets coming in on an interface, where responses
    210210# would result in the reply going out a different interface.
    211211echo 1 &gt; /proc/sys/net/ipv4/conf/all/rp_filter
    … …  
    217217echo 2 &gt; /proc/sys/net/ipv4/ip_dynaddr
    218218
    219 # disable Explicit Congestion Notification 
     219# disable Explicit Congestion Notification
    220220# too many routers are still ignorant
    221221echo 0 &gt; /proc/sys/net/ipv4/tcp_ecn
    … …  
    238238iptables -A INPUT  -i lo -j ACCEPT
    239239
    240 # Free output on any interface to any ip for any service 
     240# Free output on any interface to any ip for any service
    241241# (equal to -P ACCEPT)
    242242iptables -A OUTPUT -j ACCEPT
    243243
    244244# Permit answers on already established connections
    245 # and permit new connections related to established ones 
     245# and permit new connections related to established ones
    246246# (e.g. port mode ftp)
    247247iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
    … …  
    253253EOF</userinput></screen>
    254254
    255       <para>This script is quite simple, it drops all traffic coming 
    256       in into your computer that wasn't initiated from your box, but 
    257       as long as you are simply surfing the Internet you are unlikely 
     255      <para>This script is quite simple, it drops all traffic coming
     256      in into your computer that wasn't initiated from your box, but
     257      as long as you are simply surfing the Internet you are unlikely
    258258      to exceed its limits.</para>
    259259
    260       <para>If you frequently encounter certain delays at accessing 
     260      <para>If you frequently encounter certain delays at accessing
    261261      ftp-servers, take a look at <xref linkend="fw-BB-4"/>.</para>
    262262
    263       <para>Even if you have daemons or services running on your system, 
    264       these will be inaccessible everywhere but from your computer itself. 
    265       If you want to allow access to services on your machine, such as 
    266       <command>ssh</command> or <command>ping</command>, take a look at 
     263      <para>Even if you have daemons or services running on your system,
     264      these will be inaccessible everywhere but from your computer itself.
     265      If you want to allow access to services on your machine, such as
     266      <command>ssh</command> or <command>ping</command>, take a look at
    267267      <xref linkend="fw-busybox"/>.</para>
    268268
    … …  
    272272      <title>Masquerading Router</title>
    273273
    274       <para>A true Firewall has two interfaces, one connected to an 
    275       intranet, in this example <emphasis role="strong">eth0</emphasis>, 
    276       and one connected to the Internet, here <emphasis 
    277       role="strong">ppp0</emphasis>. To provide the maximum security 
    278       for the firewall itself, make sure that there are no unnecessary 
     274      <para>A true Firewall has two interfaces, one connected to an
     275      intranet, in this example <emphasis role="strong">eth0</emphasis>,
     276      and one connected to the Internet, here <emphasis
     277      role="strong">ppp0</emphasis>. To provide the maximum security
     278      for the firewall itself, make sure that there are no unnecessary
    279279      servers running on it such as <application>X11</application> et
    280       al. As a general principle, the firewall itself should not access 
    281       any untrusted service (Think of a remote server giving answers that 
    282       makes a daemon on your system crash, or, even worse, that implements 
     280      al. As a general principle, the firewall itself should not access
     281      any untrusted service (Think of a remote server giving answers that
     282      makes a daemon on your system crash, or, even worse, that implements
    283283      a worm via a buffer-overflow).</para>
    284284
    … …  
    338338echo 2 &gt; /proc/sys/net/ipv4/ip_dynaddr
    339339
    340 # Disable Explicit Congestion Notification 
     340# Disable Explicit Congestion Notification
    341341# Too many routers are still ignorant
    342342echo 0 &gt; /proc/sys/net/ipv4/tcp_ecn
    … …  
    368368iptables -t nat -A POSTROUTING -o ppp+ -j MASQUERADE
    369369
    370 # Log everything for debugging 
     370# Log everything for debugging
    371371# (last of all rules, but before policy rules)
    372372iptables -A INPUT   -j LOG --log-prefix "FIREWALL:INPUT  "
    … …  
    374374iptables -A OUTPUT  -j LOG --log-prefix "FIREWALL:OUTPUT "
    375375
    376 # Enable IP Forwarding 
     376# Enable IP Forwarding
    377377echo 1 &gt; /proc/sys/net/ipv4/ip_forward</literal>
    378378EOF</userinput></screen>
    379379
    380       <para>With this script your intranet should be reasonably secure 
    381       against external attacks. No one should be able to setup a new 
    382       connection to any internal service and, if it's masqueraded, 
    383       makes your intranet invisible to the Internet. Furthermore, your 
    384       firewall should be relatively safe because there are no services 
     380      <para>With this script your intranet should be reasonably secure
     381      against external attacks. No one should be able to setup a new
     382      connection to any internal service and, if it's masqueraded,
     383      makes your intranet invisible to the Internet. Furthermore, your
     384      firewall should be relatively safe because there are no services
    385385      running that a cracker could attack.</para>
    386386
    387387      <note>
    388         <para>If the interface you're connecting to the Internet 
    389         doesn't connect via ppp, you will need to change 
    390         <replaceable>ppp+</replaceable> to the name of the interface, 
    391         e.g. <emphasis role="strong">eth1</emphasis>, which you are 
     388        <para>If the interface you're connecting to the Internet
     389        doesn't connect via ppp, you will need to change
     390        <replaceable>ppp+</replaceable> to the name of the interface,
     391        e.g. <emphasis role="strong">eth1</emphasis>, which you are
    392392        using.</para>
    393393      </note>
    … …  
    398398      <title>BusyBox</title>
    399399
    400       <para>This scenario isn't too different from the <xref 
    401       linkend="fw-masqRouter"/>, but additionally offers some 
    402       services to your intranet. Examples of this can be when 
    403       you want to administer your firewall from another host on 
     400      <para>This scenario isn't too different from the <xref
     401      linkend="fw-masqRouter"/>, but additionally offers some
     402      services to your intranet. Examples of this can be when
     403      you want to administer your firewall from another host on
    404404      your intranet or use it as a proxy or a name server.</para>
    405405
    406406      <note>
    407         <para>Outlining a true concept of how to protect a server that 
    408         offers services on the Internet goes far beyond the scope of 
    409         this document. See the references at the end of this section 
     407        <para>Outlining a true concept of how to protect a server that
     408        offers services on the Internet goes far beyond the scope of
     409        this document. See the references at the end of this section
    410410        for more information.</para>
    411411      </note>
    412412
    413413      <para>Be cautious. Every service you have enabled makes your
    414       setup more complex and your firewall less secure. You are 
    415       exposed to the risks of misconfigured services or running 
    416       a service with an exploitable bug. A firewall should generally 
    417       not run any extra services.  See the introduction to the 
     414      setup more complex and your firewall less secure. You are
     415      exposed to the risks of misconfigured services or running
     416      a service with an exploitable bug. A firewall should generally
     417      not run any extra services.  See the introduction to the
    418418      <xref linkend="fw-masqRouter"/> for some more details.</para>
    419419
    420       <para>If you want to add services such as internal samba or 
     420      <para>If you want to add services such as internal samba or
    421421      name servers that do not need to access the Internet themselves,
    422       the additional statements are quite simple and should still be 
     422      the additional statements are quite simple and should still be
    423423      acceptable from a security standpoint. Just add the following lines
    424424      into the script <emphasis>before</emphasis> the logging rules.</para>
    … …  
    427427iptables -A OUTPUT -o ! ppp+  -j ACCEPT</literal></screen>
    428428
    429       <para>If daemons, such as squid, have to access the Internet 
    430       themselves, you could open OUTPUT generally and restrict 
     429      <para>If daemons, such as squid, have to access the Internet
     430      themselves, you could open OUTPUT generally and restrict
    431431      INPUT.</para>
    432432
    … …  
    434434iptables -A OUTPUT -j ACCEPT</literal></screen>
    435435
    436       <para>However, it is generally not advisable to leave OUTPUT 
    437       unrestricted. You lose any control over trojans who would like 
    438       to "call home", and a bit of redundancy in case you've 
    439       (mis-)configured a service so that it broadcasts its existence 
     436      <para>However, it is generally not advisable to leave OUTPUT
     437      unrestricted. You lose any control over trojans who would like
     438      to "call home", and a bit of redundancy in case you've
     439      (mis-)configured a service so that it broadcasts its existence
    440440      to the world.</para>
    441441
    442442      <para>To accomplish this, you should restrict INPUT and OUTPUT
    443       on all ports except those that it's absolutely necessary to have 
    444       open. Which ports you have to open depends on your needs: mostly 
    445       you will find them by looking for failed accesses in your log 
     443      on all ports except those that it's absolutely necessary to have
     444      open. Which ports you have to open depends on your needs: mostly
     445      you will find them by looking for failed accesses in your log
    446446      files.</para>
    447447
    … …  
    464464        </listitem>
    465465        <listitem>
    466           <para>You want to be able to ping your box to 
     466          <para>You want to be able to ping your box to
    467467          ensure it's still alive:</para>
    468468
    … …  
    472472        </listitem>
    473473        <listitem>
    474           <para><anchor id='fw-BB-4' xreflabel="BusyBox example number 4"/>If 
    475           you are frequently accessing ftp servers or enjoy chatting, you might 
    476           notice certain delays because some implementations of these daemons 
    477           have the feature of querying an identd on your system to obtain 
    478           usernames. Although there's really little harm in this, having an 
    479           identd running is not recommended because many security experts feel 
     474          <para><anchor id='fw-BB-4' xreflabel="BusyBox example number 4"/>If
     475          you are frequently accessing ftp servers or enjoy chatting, you might
     476          notice certain delays because some implementations of these daemons
     477          have the feature of querying an identd on your system to obtain
     478          usernames. Although there's really little harm in this, having an
     479          identd running is not recommended because many security experts feel
    480480          the service gives out too much additional information.</para>
    481481
    482           <para>To avoid these delays you could reject the requests 
     482          <para>To avoid these delays you could reject the requests
    483483          with a 'tcp-reset':</para>
    484484
    … …  
    488488        <listitem>
    489489          <para>To log and drop invalid packets (packets
    490           that came in after netfilter's timeout or some types of 
     490          that came in after netfilter's timeout or some types of
    491491          network scans):</para>
    492492
    … …  
    504504iptables -A INPUT -i ppp+ -s 192.168.0.0/16 -j DROP</literal></screen>
    505505
    506           <para>There are other addresses that you may also want to 
    507           drop: 0.0.0.0/8, 127.0.0.0/8, 224.0.0.0/3 (multicast and 
     506          <para>There are other addresses that you may also want to
     507          drop: 0.0.0.0/8, 127.0.0.0/8, 224.0.0.0/3 (multicast and
    508508          experimental), 169.254.0.0/16 (Link Local Networks), and
    509509          192.0.2.0/24 (IANA defined test network).</para>
    510510        </listitem>
    511511        <listitem>
    512           <para>If your firewall is a DHCP client, you need to allow 
     512          <para>If your firewall is a DHCP client, you need to allow
    513513          those packets:</para>
    514514
    … …  
    518518        </listitem>
    519519        <listitem>
    520           <para>To simplify debugging and be fair to anyone who'd like 
    521           to access a service you have disabled, purposely or by mistake, 
     520          <para>To simplify debugging and be fair to anyone who'd like
     521          to access a service you have disabled, purposely or by mistake,
    522522          you could REJECT those packets that are dropped.</para>
    523523
    … …  
    530530      </itemizedlist>
    531531
    532       <para>These are only examples to show you some of the capabilities 
     532      <para>These are only examples to show you some of the capabilities
    533533      of the firewall code in Linux. Have a look at the man page of iptables.
    534       There you will find much more information. The port numbers needed for 
    535       this can be found in <filename>/etc/services</filename>, in case you 
     534      There you will find much more information. The port numbers needed for
     535      this can be found in <filename>/etc/services</filename>, in case you
    536536      didn't find them by trial and error in your log file.</para>
    537537
    … …  
    544544
    545545    <para>Finally, there is one fact you must not forget: The effort spent
    546     attacking a system corresponds to the value the cracker expects to gain 
    547     from it. If you are responsible for valuable information, you need to 
     546    attacking a system corresponds to the value the cracker expects to gain
     547    from it. If you are responsible for valuable information, you need to
    548548    spend the time to protect it properly.</para>
    549549

  • postlfs/security/gnupg.xml

    r99b1c520 r0afcfa88  
    3030    <title>Introduction to GnuPG</title>
    3131
    32     <para>The <application>GnuPG</application> package contains a 
    33     public/private key encryptor. This is becoming useful for signing 
    34     files or emails as proof of identity and preventing tampering with 
     32    <para>The <application>GnuPG</application> package contains a
     33    public/private key encryptor. This is becoming useful for signing
     34    files or emails as proof of identity and preventing tampering with
    3535    contents of the file or email.</para>
    3636
    … …  
    6161    <itemizedlist spacing='compact'>
    6262      <listitem>
    63         <para>Required Patch: <ulink 
     63        <para>Required Patch: <ulink
    6464        url="&patch-root;/gnupg-&gnupg-version;-po_install_fix-1.patch"/>
    6565      </para>
    … …  
    7171
    7272    <bridgehead renderas="sect4">Optional</bridgehead>
    73     <para><xref linkend="openldap"/>, 
    74     <xref linkend="libusb"/>, 
    75     <xref linkend="curl"/>, 
    76     <ulink url="../server/mail.html">MTA</ulink>, 
    77     <xref linkend="docbook-utils"/> and <ulink 
     73    <para><xref linkend="openldap"/>,
     74    <xref linkend="libusb"/>,
     75    <xref linkend="curl"/>,
     76    <ulink url="../server/mail.html">MTA</ulink>,
     77    <xref linkend="docbook-utils"/> and <ulink
    7878    url="http://www.oasis-open.org/docbook/tools/dtm/">docbook-to-man</ulink></para>
    7979
    … …  
    8383    <title>Installation of GnuPG</title>
    8484
    85     <para>Install <application>GnuPG</application> by running the following 
     85    <para>Install <application>GnuPG</application> by running the following
    8686    commands:</para>
    8787
    … …  
    104104    <filename class="directory">/usr/libexec</filename>.</para>
    105105
    106     <para><command>chmod -v 4755 /usr/bin/gpg</command>: 
    107     <command>gpg</command> is installed setuid root to avoid swapping 
     106    <para><command>chmod -v 4755 /usr/bin/gpg</command>:
     107    <command>gpg</command> is installed setuid root to avoid swapping
    108108    out sensitive data.</para>
    109109
Note: See TracChangeset for help on using the changeset viewer.