Red Hat ENTERPRISE LINUX 4 - DEVELOPER TOOLS GUIDE User manual

Red Hat Enterprise Linux 4
Security Guide
For Red Hat Enterprise Linux 4

Security Guide
Red Hat Enterprise Linux 4 Security Guide
For Red Hat Enterprise Linux 4
Edition 2
Copyright © 2008 Red Hat, Inc
Copyright © 2008 Red Hat, Inc.
The text of and illustrations in this document are licensed by Red Hat under a Creative Commons
Attribution–Share Alike 3.0 Unported license ("CC-BY-SA"). An explanation of CC-BY-SA is available
at http://creativecommons.org/licenses/by-sa/3.0/. In accordance with CC-BY-SA, if you distribute this
document or an adaptation of it, you must provide the URL for the original version.
Red Hat, as the licensor of this document, waives the right to enforce, and agrees not to assert,
Section 4d of CC-BY-SA to the fullest extent permitted by applicable law.
Red Hat, Red Hat Enterprise Linux, the Shadowman logo, JBoss, MetaMatrix, Fedora, the Infinity
Logo, and RHCE are trademarks of Red Hat, Inc., registered in the United States and other countries.
Linux® is the registered trademark of Linus Torvalds in the United States and other countries.
All other trademarks are the property of their respective owners.
1801 Varsity Drive
Raleigh, NC 27606-2072 USA
Phone: [phone]
Phone: [phone]
Fax: [phone]
PO Box 13588 Research Triangle Park, NC 27709 USA

iii
Introduction vii
1. Document Conventions ................................................................................................. viii
1.1. Typographic Conventions ................................................................................... viii
1.2. Pull-quote Conventions ........................................................................................ ix
1.3. Notes and Warnings ............................................................................................. x
2. More to Come ................................................................................................................ x
2.1. Send in Your Feedback ....................................................................................... xi
I. A General Introduction to Security 1
1. Security Overview 3
1.1. What is Computer Security? ................................................................................. 3
1.1.1. How did Computer Security Come about? ................................................... 3
1.1.2. Computer Security Timeline ....................................................................... 4
1.1.3. Security Today .......................................................................................... 6
1.1.4. Standardizing Security ............................................................................... 7
1.2. Security Controls .................................................................................................. 7
1.2.1. Physical Controls ....................................................................................... 7
1.2.2. Technical Controls ..................................................................................... 8
1.2.3. Administrative Controls .............................................................................. 8
1.3. Conclusion ........................................................................................................... 8
2. Attackers and Vulnerabilities 9
2.1. A Quick History of Hackers ................................................................................... 9
2.1.1. Shades of Grey ......................................................................................... 9
2.2. Threats to Network Security ................................................................................ 10
2.2.1. Insecure Architectures .............................................................................. 10
2.3. Threats to Server Security .................................................................................. 10
2.3.1. Unused Services and Open Ports ............................................................. 10
2.3.2. Unpatched Services ................................................................................. 11
2.3.3. Inattentive Administration ......................................................................... 11
2.3.4. Inherently Insecure Services ..................................................................... 11
2.4. Threats to Workstation and Home PC Security ..................................................... 12
2.4.1. Bad Passwords ....................................................................................... 12
2.4.2. Vulnerable Client Applications .................................................................. 12
II. Configuring Red Hat Enterprise Linux for Security 13
3. Security Updates 15
3.1. Updating Packages ............................................................................................ 15
3.1.1. Using Red Hat Network ........................................................................... 15
3.1.2. Using the Red Hat Errata Website ............................................................ 16
3.1.3. Verifying Signed Packages ....................................................................... 16
3.1.4. Installing Signed Packages ....................................................................... 17
3.1.5. Applying the Changes .............................................................................. 18
4. Workstation Security 21
4.1. Evaluating Workstation Security .......................................................................... 21
4.2. BIOS and Boot Loader Security .......................................................................... 21
4.2.1. BIOS Passwords ..................................................................................... 21
4.2.2. Boot Loader Passwords ........................................................................... 22
4.3. Password Security .............................................................................................. 23
4.3.1. Creating Strong Passwords ...................................................................... 24

Security Guide
iv
4.3.2. Creating User Passwords Within an Organization ...................................... 26
4.4. Administrative Controls ....................................................................................... 28
4.4.1. Allowing Root Access .............................................................................. 29
4.4.2. Disallowing Root Access .......................................................................... 29
4.4.3. Limiting Root Access ............................................................................... 32
4.5. Available Network Services ................................................................................. 33
4.5.1. Risks To Services .................................................................................... 34
4.5.2. Identifying and Configuring Services ......................................................... 34
4.5.3. Insecure Services .................................................................................... 35
4.6. Personal Firewalls .............................................................................................. 36
4.7. Security Enhanced Communication Tools ............................................................ 37
5. Server Security 39
5.1. Securing Services With TCP Wrappers and xinetd ............................................ 39
5.1.1. Enhancing Security With TCP Wrappers ................................................... 39
5.1.2. Enhancing Security With xinetd ............................................................. 41
5.2. Securing Portmap ............................................................................................... 42
5.2.1. Protect portmap With TCP Wrappers ...................................................... 42
5.2.2. Protect portmap With IPTables ............................................................... 42
5.3. Securing NIS ...................................................................................................... 43
5.3.1. Carefully Plan the Network ....................................................................... 43
5.3.2. Use a Password-like NIS Domain Name and Hostname ............................. 43
5.3.3. Edit the /var/yp/securenets File ........................................................ 44
5.3.4. Assign Static Ports and Use IPTables Rules .............................................. 44
5.3.5. Use Kerberos Authentication .................................................................... 45
5.4. Securing NFS .................................................................................................... 45
5.4.1. Carefully Plan the Network ....................................................................... 45
5.4.2. Beware of Syntax Errors .......................................................................... 45
5.4.3. Do Not Use the no_root_squash Option ................................................ 46
5.5. Securing the Apache HTTP Server ...................................................................... 46
5.5.1. FollowSymLinks ................................................................................... 46
5.5.2. The Indexes Directive ............................................................................ 46
5.5.3. The UserDir Directive ............................................................................ 46
5.5.4. Do Not Remove the IncludesNoExec Directive ....................................... 47
5.5.5. Restrict Permissions for Executable Directories ......................................... 47
5.6. Securing FTP ..................................................................................................... 47
5.6.1. FTP Greeting Banner ............................................................................... 47
5.6.2. Anonymous Access ................................................................................. 48
5.6.3. User Accounts ......................................................................................... 49
5.6.4. Use TCP Wrappers To Control Access ..................................................... 49
5.7. Securing Sendmail ............................................................................................. 49
5.7.1. Limiting a Denial of Service Attack ............................................................ 50
5.7.2. NFS and Sendmail .................................................................................. 50
5.7.3. Mail-only Users ........................................................................................ 50
5.8. Verifying Which Ports Are Listening ..................................................................... 50
6. Virtual Private Networks 53
6.1. VPNs and Red Hat Enterprise Linux .................................................................... 53
6.2. IPsec ................................................................................................................. 53
6.3. IPsec Installation ................................................................................................ 54
6.4. IPsec Host-to-Host Configuration ......................................................................... 54
6.5. IPsec Network-to-Network configuration ............................................................... 58

v
7. Firewalls 63
7.1. Netfilter and iptables ...................................................................................... 64
7.1.1. iptables Overview ................................................................................ 64
7.2. Using iptables ................................................................................................ 64
7.2.1. Basic Firewall Policies ............................................................................. 65
7.2.2. Saving and Restoring iptables Rules .................................................... 66
7.3. Common iptables Filtering .............................................................................. 66
7.4. FORWARD and NAT Rules ................................................................................... 67
7.4.1. DMZs and iptables .............................................................................. 69
7.5. Viruses and Spoofed IP Addresses ..................................................................... 69
7.6. iptables and Connection Tracking ................................................................... 70
7.7. ip6tables ........................................................................................................ 70
7.8. Additional Resources .......................................................................................... 71
7.8.1. Installed Documentation ........................................................................... 71
7.8.2. Useful Websites ...................................................................................... 71
7.8.3. Related Documentation ............................................................................ 71
III. Assessing Your Security 73
8. Vulnerability Assessment 75
8.1. Thinking Like the Enemy .................................................................................... 75
8.2. Defining Assessment and Testing ....................................................................... 76
8.2.1. Establishing a Methodology ...................................................................... 77
8.3. Evaluating the Tools ........................................................................................... 77
8.3.1. Scanning Hosts with Nmap ...................................................................... 77
8.3.2. Nessus .................................................................................................... 78
8.3.3. Nikto ....................................................................................................... 79
8.3.4. VLAD the Scanner ................................................................................... 79
8.3.5. Anticipating Your Future Needs ................................................................ 79
IV. Intrusions and Incident Response 81
9. Intrusion Detection 83
9.1. Defining Intrusion Detection Systems ................................................................... 83
9.1.1. IDS Types ............................................................................................... 83
9.2. Host-based IDS .................................................................................................. 84
9.2.1. Tripwire ................................................................................................... 84
9.2.2. RPM as an IDS ....................................................................................... 84
9.2.3. Other Host-based IDSes .......................................................................... 86
9.3. Network-based IDS ............................................................................................ 86
9.3.1. Snort ....................................................................................................... 88
10. Incident Response 89
10.1. Defining Incident Response ............................................................................... 89
10.2. Creating an Incident Response Plan .................................................................. 89
10.2.1. The Computer Emergency Response Team (CERT) ................................ 90
10.2.2. Legal Considerations .............................................................................. 90
10.3. Implementing the Incident Response Plan .......................................................... 91
10.4. Investigating the Incident .................................................................................. 91
10.4.1. Collecting an Evidential Image ................................................................ 92
10.4.2. Gathering Post-Breach Information ......................................................... 92
10.5. Restoring and Recovering Resources ................................................................ 94

Security Guide
vi
10.5.1. Reinstalling the System .......................................................................... 94
10.5.2. Patching the System .............................................................................. 94
10.6. Reporting the Incident ....................................................................................... 94
V. Appendixes 95
A. Hardware and Network Protection 97
A.1. Secure Network Topologies ................................................................................ 97
A.1.1. Physical Topologies ................................................................................. 97
A.1.2. Transmission Considerations .................................................................... 98
A.1.3. Wireless Networks ................................................................................... 98
A.1.4. Network Segmentation and DMZs .......................................................... 100
A.2. Hardware Security ............................................................................................ 100
B. Common Exploits and Attacks 103
C. Common Ports 107
D. Revision History 117
Index 119

vii
Introduction
Welcome to the Security Guide!
The Security Guide is designed to assist users of Red Hat Enterprise Linux in learning the processes
and practices of securing workstations and servers against local and remote intrusion, exploitation,
and malicious activity. The Security Guide details the planning and the tools involved in creating a
secured computing environment for the data center, workplace, and home. With proper administrative
knowledge, vigilance, and tools, systems running Red Hat Enterprise Linux can be both fully functional
and secured from most common intrusion and exploit methods.
This guide discusses several security-related topics in great detail, including:
• Firewalls
• Encryption
• Securing Critical Services
• Virtual Private Networks
• Intrusion Detection
The manual is divided into the following parts:
• General Introduction to Security
• Configuring Red Hat Enterprise Linux for Security
• Assessing Your Security
• Intrusions and Incident Response
• Appendix
We would like to thank Thomas Rude for his generous contributions to this manual. He wrote the
Vulnerability Assessments and Incident Response chapters. Thanks, Thomas!
This manual assumes that you have an advanced knowledge of Red Hat Enterprise Linux. If you are
a new user or only have basic to intermediate knowledge of Red Hat Enterprise Linux and need more
information on using the system, refer to the following guides which discuss the fundamental aspects
of Red Hat Enterprise Linux in greater detail than the Security Guide:
• The Installation Guide provides information regarding installation.
• The Red Hat Enterprise Linux Introduction to System Adminitration contains introductory information
for new Red Hat Enterprise Linux system administrators.
• The System Administrators Guide offers detailed information about configuring Red Hat Enterprise
Linux to suit your particular needs as a user. This guide includes some services that are discussed
(from a security standpoint) in the Security Guide.
•Reference Guide provides detailed information suited for more experienced users to refer to when
needed, as opposed to step-by-step instructions.

Introduction
viii
1. Document Conventions
This manual uses several conventions to highlight certain words and phrases and draw attention to
specific pieces of information.
In PDF and paper editions, this manual uses typefaces drawn from the Liberation Fonts1 set. The
Liberation Fonts set is also used in HTML editions if the set is installed on your system. If not,
alternative but equivalent typefaces are displayed. Note: Red Hat Enterprise Linux 5 and later includes
the Liberation Fonts set by default.
1.1. Typographic Conventions
Four typographic conventions are used to call attention to specific words and phrases. These
conventions, and the circumstances they apply to, are as follows.
Mono-spaced Bold
Used to highlight system input, including shell commands, file names and paths. Also used to highlight
keycaps and key combinations. For example:
To see the contents of the file my_next_bestselling_novel in your current
working directory, enter the cat my_next_bestselling_novel command at the
shell prompt and press Enter to execute the command.
The above includes a file name, a shell command and a keycap, all presented in mono-spaced bold
and all distinguishable thanks to context.
Key combinations can be distinguished from keycaps by the hyphen connecting each part of a key
combination. For example:
Press Enter to execute the command.
Press Ctrl+Alt+F1 to switch to the first virtual terminal. Press Ctrl+Alt+F7 to
return to your X-Windows session.
The first paragraph highlights the particular keycap to press. The second highlights two key
combinations (each a set of three keycaps with each set pressed simultaneously).
If source code is discussed, class names, methods, functions, variable names and returned values
mentioned within a paragraph will be presented as above, in mono-spaced bold. For example:
File-related classes include filesystem for file systems, file for files, and dir for
directories. Each class has its own associated set of permissions.
Proportional Bold
This denotes words or phrases encountered on a system, including application names; dialog box text;
labeled buttons; check-box and radio button labels; menu titles and sub-menu titles. For example:
Choose System > Preferences > Mouse from the main menu bar to launch Mouse
Preferences. In the Buttons tab, click the Left-handed mouse check box and click
Close to switch the primary mouse button from the left to the right (making the mouse
suitable for use in the left hand).
1 https://fedorahosted.org/liberation-fonts/

Pull-quote Conventions
ix
To insert a special character into a gedit file, choose Applications > Accessories
> Character Map from the main menu bar. Next, choose Search > Find… from the
Character Map menu bar, type the name of the character in the Search field and
click Next. The character you sought will be highlighted in the Character Table.
Double-click this highlighted character to place it in the Text to copy field and then
click the Copy button. Now switch back to your document and choose Edit > Paste
from the gedit menu bar.
The above text includes application names; system-wide menu names and items; application-specific
menu names; and buttons and text found within a GUI interface, all presented in proportional bold and
all distinguishable by context.
Note the > shorthand used to indicate traversal through a menu and its sub-menus. This avoids
difficult-to-follow phrasing such as 'Select Mouse from the Preferences sub-menu in the System
menu of the main menu bar'.
Mono-spaced Bold Italic or Proportional Bold Italic
Whether mono-spaced bold or proportional bold, the addition of italics indicates replaceable or
variable text. Italics denotes text you do not input literally or displayed text that changes depending on
circumstance. For example:
To connect to a remote machine using ssh, type ssh [e-mail] at
a shell prompt. If the remote machine is example.com and your username on that
machine is john, type ssh [email protected].
The mount -o remount file-system command remounts the named file
system. For example, to remount the /home file system, the command is mount -o
remount /home.
To see the version of a currently installed package, use the rpm -q package
command. It will return a result as follows: package-version-release.
Note the words in bold italics above — username, domain.name, file-system, package, version and
release. Each word is a placeholder, either for text you enter when issuing a command or for text
displayed by the system.
Aside from standard usage for presenting the title of a work, italics denotes the first use of a new and
important term. For example:
When the Apache HTTP Server accepts requests, it dispatches child processes
or threads to handle them. This group of child processes or threads is known as
a server-pool. Under Apache HTTP Server 2.0, the responsibility for creating and
maintaining these server-pools has been abstracted to a group of modules called
Multi-Processing Modules (MPMs). Unlike other modules, only one module from the
MPM group can be loaded by the Apache HTTP Server.
1.2. Pull-quote Conventions
Terminal output and source code listings are set off visually from the surrounding text.
Output sent to a terminal is set in mono-spaced roman and presented thus:
books Desktop documentation drafts mss photos stuff svn
books_tests Desktop1 downloads images notes scripts svgs

Introduction
x
Source-code listings are also set in mono-spaced roman but add syntax highlighting as follows:
package org.jboss.book.jca.ex1;
import javax.naming.InitialContext;
public class ExClient
{
public static void main(String args[])
throws Exception
{
InitialContext iniCtx = new InitialContext();
Object ref = iniCtx.lookup("EchoBean");
EchoHome home = (EchoHome) ref;
Echo echo = home.create();
System.out.println("Created Echo");
System.out.println("Echo.echo('Hello') = " + echo.echo("Hello"));
}
}
1.3. Notes and Warnings
Finally, we use three visual styles to draw attention to information that might otherwise be overlooked.
Note
Notes are tips, shortcuts or alternative approaches to the task at hand. Ignoring a note
should have no negative consequences, but you might miss out on a trick that makes your
life easier.
Important
Important boxes detail things that are easily missed: configuration changes that only
apply to the current session, or services that need restarting before an update will apply.
Ignoring a box labeled 'Important' won't cause data loss but may cause irritation and
frustration.
Warning
Warnings should not be ignored. Ignoring warnings will most likely cause data loss.
2. More to Come
The Security Guide is part of Red Hat's growing commitment to provide useful and timely support and
information to Red Hat Enterprise Linux users. As new tools and security methodologies are released,
this guide will be expanded to include them.

Send in Your Feedback
xi
2.1. Send in Your Feedback
If you spot a typo in the Security Guide, or if you have thought of a way to make this manual better,
we would love to hear from you! Submit a report in Bugzilla (http://bugzilla.redhat.com/
bugzilla/) against the component rhel-sg.
Be sure to mention the manual's identifier:
rhel-sg
By mentioning the identifier, we know exactly which version of the guide you have.
If you have a suggestion for improving the documentation, try to be as specific as possible. If you have
found an error, include the section number and some of the surrounding text so we can find it easily.

xii

Part I. A General
Introduction to Security
This part defines information security, its history, and the industry that has developed to address it. It
also discusses some of the risks that computer users or administrators face.

Chapter 1.
3
Security Overview
Because of the increased reliance on powerful, networked computers to help run businesses and keep
track of our personal information, industries have been formed around the practice of network and
computer security. Enterprises have solicited the knowledge and skills of security experts to properly
audit systems and tailor solutions to fit the operating requirements of the organization. Because
most organizations are dynamic in nature, with workers accessing company IT resources locally and
remotely, the need for secure computing environments has become more pronounced.
Unfortunately, most organizations (as well as individual users) regard security as an afterthought,
a process that is overlooked in favor of increased power, productivity, and budgetary concerns.
Proper security implementation is often enacted postmortem — after an unauthorized intrusion has
already occurred. Security experts agree that the right measures taken prior to connecting a site to an
untrusted network, such as the Internet, is an effective means of thwarting most attempts at intrusion.
1.1. What is Computer Security?
Computer security is a general term that covers a wide area of computing and information processing.
Industries that depend on computer systems and networks to conduct daily business transactions
and access crucial information regard their data as an important part of their overall assets. Several
terms and metrics have entered our daily business vocabulary, such as total cost of ownership (TCO)
and quality of service (QoS). In these metrics, industries calculate aspects such as data integrity and
high-availability as part of their planning and process management costs. In some industries, such
as electronic commerce, the availability and trustworthiness of data can be the difference between
success and failure.
1.1.1. How did Computer Security Come about?
Many readers may recall the movie "Wargames," starring Matthew Broderick in his portrayal of a high
school student who breaks into the United States Department of Defense (DoD) supercomputer and
inadvertently causes a nuclear war threat. In this movie, Broderick uses his modem to dial into the
DoD computer (called WOPR) and plays games with the artificially intelligent software controlling
all of the nuclear missile silos. The movie was released during the "cold war" between the former
Soviet Union and the United States and was considered a success in its theatrical release in 1983.
The popularity of the movie inspired many individuals and groups to begin implementing some of the
methods that the young protagonist used to crack restricted systems, including what is known as war
dialing — a method of searching phone numbers for analog modem connections in a defined area
code and phone prefix combination.
More than 10 years later, after a four-year, multi-jurisdictional pursuit involving the Federal Bureau
of Investigation (FBI) and the aid of computer professionals across the country, infamous computer
cracker Kevin Mitnick was arrested and charged with 25 counts of computer and access device fraud
that resulted in an estimated US$80 Million in losses of intellectual property and source code from
Nokia, NEC, Sun Microsystems, Novell, Fujitsu, and Motorola. At the time, the FBI considered it to
be the largest computer-related criminal offense in U.S. history. He was convicted and sentenced to
a combined 68 months in prison for his crimes, of which he served 60 months before his parole on
January 21, 2000. Mitnick was further barred from using computers or doing any computer-related
consulting until 2003. Investigators say that Mitnick was an expert in social engineering — using
human beings to gain access to passwords and systems using falsified credentials.
Information security has evolved over the years due to the increasing reliance on public networks
to disclose personal, financial, and other restricted information. There are numerous instances such

Chapter 1. Security Overview
4
as the Mitnick and the Vladimir Levin cases (refer to Section 1.1.2, “Computer Security Timeline” for
more information) that prompted organizations across all industries to rethink the way they handle
information transmission and disclosure. The popularity of the Internet was one of the most important
developments that prompted an intensified effort in data security.
An ever-growing number of people are using their personal computers to gain access to the resources
that the Internet has to offer. From research and information retrieval to electronic mail and commerce
transaction, the Internet has been regarded as one of the most important developments of the 20th
century.
The Internet and its earlier protocols, however, were developed as a trust-based system. That
is, the Internet Protocol was not designed to be secure in itself. There are no approved security
standards built into the TCP/IP communications stack, leaving it open to potentially malicious users
and processes across the network. Modern developments have made Internet communication more
secure, but there are still several incidents that gain national attention and alert us to the fact that
nothing is completely safe.
1.1.2. Computer Security Timeline
Several key events contributed to the birth and rise of computer security. The following timeline lists
some of the more important events that brought attention to computer and information security and its
importance today.
1.1.2.1. The 1960s
• Students at the Massachusetts Institute of Technology (MIT) form the Tech Model Railroad Club
(TMRC) begin exploring and programming the school's PDP-1 mainframe computer system. The
group eventually coined the term "hacker" in the context it is known today.
• The DoD creates the Advanced Research Projects Agency Network (ARPANet), which gains
popularity in research and academic circles as a conduit for the electronic exchange of data and
information. This paves the way for the creation of the carrier network known today as the Internet.
• Ken Thompson develops the UNIX operating system, widely hailed as the most "hacker-friendly" OS
because of its accessible developer tools and compilers, and its supportive user community. Around
the same time, Dennis Ritchie develops the C programming language, arguably the most popular
hacking language in computer history.
1.1.2.2. The 1970s
• Bolt, Beranek, and Newman, a computing research and development contractor for government and
industry, develops the Telnet protocol, a public extension of the ARPANet. This opens doors for the
public use of data networks which were once restricted to government contractors and academic
researchers. Telnet, though, is also arguably the most insecure protocol for public networks,
according to several security researchers.
• Steve Jobs and Steve Wozniak found Apple Computer and begin marketing the Personal Computer
(PC). The PC is the springboard for several malicious users to learn the craft of cracking systems
remotely using common PC communication hardware such as analog modems and war dialers.
• Jim Ellis and Tom Truscott create USENET, a bulletin-board-style system for electronic
communication between disparate users. USENET quickly becomes one of the most popular forums
for the exchange of ideas in computing, networking, and, of course, cracking.

Computer Security Timeline
5
1.1.2.3. The 1980s
• IBM develops and markets PCs based on the Intel 8086 microprocessor, a relatively inexpensive
architecture that brought computing from the office to the home. This serves to commodify the PC
as a common and accessible tool that was fairly powerful and easy to use, aiding in the proliferation
of such hardware in the homes and offices of malicious users.
• The Transmission Control Protocol, developed by Vint Cerf, is split into two separate parts. The
Internet Protocol is born from this split, and the combined TCP/IP protocol becomes the standard for
all Internet communication today.
• Based on developments in the area of phreaking, or exploring and hacking the telephone system,
the magazine 2600: The Hacker Quarterly is created and begins discussion on topics such as
cracking computers and computer networks to a broad audience.
• The 414 gang (named after the area code where they lived and hacked from) are raided by
authorities after a nine-day cracking spree where they break into systems from such top-secret
locations as the Los Alamos National Laboratory, a nuclear weapons research facility.
• The Legion of Doom and the Chaos Computer Club are two pioneering cracker groups that begin
exploiting vulnerabilities in computers and electronic data networks.
• The Computer Fraud and Abuse Act of 1986 is voted into law by congress based on the exploits of
Ian Murphy, also known as Captain Zap, who broke into military computers, stole information from
company merchandise order databases, and used restricted government telephone switchboards to
make phone calls.
• Based on the Computer Fraud and Abuse Act, the courts convict Robert Morris, a graduate student,
for unleashing the Morris Worm to over 6,000 vulnerable computers connected to the Internet. The
next most prominent case ruled under this act was Herbert Zinn, a high-school dropout who cracked
and misused systems belonging to AT&T and the DoD.
• Based on concerns that the Morris Worm ordeal could be replicated, the Computer Emergency
Response Team (CERT) is created to alert computer users of network security issues.
• Clifford Stoll writes The Cuckoo's Egg, Stoll's account of investigating crackers who exploit his
system.
1.1.2.4. The 1990s
• ARPANet is decommissioned. Traffic from that network is transferred to the Internet.
• Linus Torvalds develops the Linux kernel for use with the GNU operating system; the widespread
development and adoption of Linux is largely due to the collaboration of users and developers
communicating via the Internet. Because of its roots in UNIX, Linux is most popular among hackers
and administrators who found it quite useful for building secure alternatives to legacy servers
running proprietary (closed-source) operating systems.
• The graphical Web browser is created and sparks an exponentially higher demand for public
Internet access.
• Vladimir Levin and accomplices illegally transfer US$10 Million in funds to several accounts by
cracking into the CitiBank central database. Levin is arrested by Interpol and almost all of the money
is recovered.

Chapter 1. Security Overview
6
• Possibly the most heralded of all crackers is Kevin Mitnick, who hacked into several corporate
systems, stealing everything from personal information of celebrities to over 20,000 credit card
numbers and source code for proprietary software. He is arrested and convicted of wire fraud
charges and serves 5 years in prison.
• Kevin Poulsen and an unknown accomplice rig radio station phone systems to win cars and cash
prizes. He is convicted for computer and wire fraud and is sentenced to 5 years in prison.
• The stories of cracking and phreaking become legend, and several prospective crackers convene at
the annual DefCon convention to celebrate cracking and exchange ideas between peers.
• A 19-year-old Israeli student is arrested and convicted for coordinating numerous break-ins to US
government systems during the Persian-Gulf conflict. Military officials call it "the most organized and
systematic attack" on government systems in US history.
• US Attorney General Janet Reno, in response to escalated security breaches in government
systems, establishes the National Infrastructure Protection Center.
• British communications satellites are taken over and ransomed by unknown offenders. The British
government eventually seizes control of the satellites.
1.1.3. Security Today
In February of 2000, a Distributed Denial of Service (DDoS) attack was unleashed on several of the
most heavily-trafficked sites on the Internet. The attack rendered yahoo.com, cnn.com, amazon.com,
fbi.gov, and several other sites completely unreachable to normal users, as it tied up routers for
several hours with large-byte ICMP packet transfers, also called a ping flood. The attack was brought
on by unknown assailants using specially created, widely available programs that scanned vulnerable
network servers, installed client applications called trojans on the servers, and timed an attack with
every infected server flooding the victim sites and rendering them unavailable. Many blame the attack
on fundamental flaws in the way routers and the protocols used are structured to accept all incoming
data, no matter where or for what purpose the packets are sent.
This brings us to the new millennium, a time where an estimated 945 Million people use or have used
the Internet worldwide (Computer Industry Almanac, 2004). At the same time:
• On any given day, there are approximately 225 major incidences of security breach reported to the
CERT Coordination Center at Carnegie Mellon University.1
• In 2003, the number of CERT reported incidences jumped to 137,529 from 82,094 in 2002 and from
52,658 in 2001.2
• The worldwide economic impact of the three most dangerous Internet Viruses of the last three years
was estimated at US$13.2 Billion.3
Computer security has become a quantifiable and justifiable expense for all IT budgets. Organizations
that require data integrity and high availability elicit the skills of system administrators, developers,
and engineers to ensure 24x7 reliability of their systems, services, and information. Falling victim to
malicious users, processes, or coordinated attacks is a direct threat to the success of the organization.
Unfortunately, system and network security can be a difficult proposition, requiring an intricate
knowledge of how an organization regards, uses, manipulates, and transmits its information.
Understanding the way an organization (and the people that make up the organization) conducts
business is paramount to implementing a proper security plan.

Standardizing Security
7
1.1.4. Standardizing Security
Enterprises in every industry rely on regulations and rules that are set by standards making bodies
such as the American Medical Association (AMA) or the Institute of Electrical and Electronics
Engineers (IEEE). The same ideals hold true for information security. Many security consultants and
vendors agree upon the standard security model known as CIA, or Confidentiality, Integrity, and
Availability. This three-tiered model is a generally accepted component to assessing risks of sensitive
information and establishing security policy. The following describes the CIA model in further detail:
• Confidentiality — Sensitive information must be available only to a set of pre-defined individuals.
Unauthorized transmission and usage of information should be restricted. For example,
confidentiality of information ensures that a customer's personal or financial information is not
obtained by an unauthorized individual for malicious purposes such as identity theft or credit fraud.
• Integrity — Information should not be altered in ways that render it incomplete or incorrect.
Unauthorized users should be restricted from the ability to modify or destroy sensitive information.
• Availability — Information should be accessible to authorized users any time that it is needed.
Availability is a warranty that information can be obtained with an agreed-upon frequency and
timeliness. This is often measured in terms of percentages and agreed to formally in Service Level
Agreements (SLAs) used by network service providers and their enterprise clients.
1.2. Security Controls
Computer security is often divided into three distinct master categories, commonly referred to as
controls:
• Physical
• Technical
• Administrative
These three broad categories define the main objectives of proper security implementation. Within
these controls are sub-categories that further detail the controls and how to implement them.
1.2.1. Physical Controls
Physical control is the implementation of security measures in a defined structure used to deter or
prevent unauthorized access to sensitive material. Examples of physical controls are:
• Closed-circuit surveillance cameras
• Motion or thermal alarm systems
• Security guards
• Picture IDs
• Locked and dead-bolted steel doors
• Biometrics (includes fingerprint, voice, face, iris, handwriting, and other automated methods used to
recognize individuals)

Chapter 1. Security Overview
8
1.2.2. Technical Controls
Technical controls use technology as a basis for controlling the access and usage of sensitive data
throughout a physical structure and over a network. Technical controls are far-reaching in scope and
encompass such technologies as:
• Encryption
• Smart cards
• Network authentication
• Access control lists (ACLs)
• File integrity auditing software
1.2.3. Administrative Controls
Administrative controls define the human factors of security. It involves all levels of personnel within
an organization and determines which users have access to what resources and information by such
means as:
• Training and awareness
• Disaster preparedness and recovery plans
• Personnel recruitment and separation strategies
• Personnel registration and accounting
1.3. Conclusion
Now that you have learned about the origins, reasons, and aspects of security, you can determine
the appropriate course of action with regard to Red Hat Enterprise Linux. It is important to know what
factors and conditions make up security in order to plan and implement a proper strategy. With this
information in mind, the process can be formalized and the path becomes clearer as you delve deeper
into the specifics of the security process.