xvii
43.7.8. Starting and Stopping an IPsec Connection ........................................... 696
43.8. Firewalls ......................................................................................................... 697
43.8.1. Netfilter and IPTables ........................................................................... 698
43.8.2. Basic Firewall Configuration .................................................................. 698
43.8.3. Using IPTables .................................................................................... 702
43.8.4. Common IPTables Filtering ................................................................... 703
43.8.5. FORWARD and NAT Rules ..................................................................... 704
43.8.6. Malicious Software and Spoofed IP Addresses ....................................... 707
43.8.7. IPTables and Connection Tracking ........................................................ 708
43.8.8. IPv6 .................................................................................................... 708
43.8.9. Additional Resources ............................................................................ 709
43.9. IPTables ......................................................................................................... 709
43.9.1. Packet Filtering .................................................................................... 710
43.9.2. Differences Between IPTables and IPChains ......................................... 711
43.9.3. Command Options for IPTables ............................................................ 712
43.9.4. Saving IPTables Rules ......................................................................... 721
43.9.5. IPTables Control Scripts ....................................................................... 721
43.9.6. IPTables and IPv6 ............................................................................... 724
43.9.7. Additional Resources ............................................................................ 724
44. Security and SELinux 725
44.1. Access Control Mechanisms (ACMs) ............................................................... 725
44.1.1. Discretionary Access Control (DAC) ...................................................... 725
44.1.2. Access Control Lists (ACLs) ................................................................. 725
44.1.3. Mandatory Access Control (MAC) ......................................................... 725
44.1.4. Role-based Access Control (RBAC) ...................................................... 725
44.1.5. Multi-Level Security (MLS) .................................................................... 726
44.1.6. Multi-Category Security (MCS) .............................................................. 726
44.2. Introduction to SELinux ................................................................................... 726
44.2.1. SELinux Overview ................................................................................ 726
44.2.2. Files Related to SELinux ...................................................................... 727
44.2.3. Additional Resources ............................................................................ 731
44.3. Brief Background and History of SELinux ......................................................... 731
44.4. Multi-Category Security (MCS) ........................................................................ 732
44.4.1. Introduction .......................................................................................... 732
44.4.2. Applications for Multi-Category Security ................................................. 732
44.4.3. SELinux Security Contexts ................................................................... 732
44.5. Getting Started with Multi-Category Security (MCS) .......................................... 733
44.5.1. Introduction .......................................................................................... 733
44.5.2. Comparing SELinux and Standard Linux User Identities .......................... 734
44.5.3. Configuring Categories ......................................................................... 735
44.5.4. Assigning Categories to Users .............................................................. 736
44.5.5. Assigning Categories to Files ................................................................ 737
44.6. Multi-Level Security (MLS) .............................................................................. 738
44.6.1. Why Multi-Level? ................................................................................. 738
44.6.2. Security Levels, Objects and Subjects ................................................... 740
44.6.3. MLS Policy .......................................................................................... 741
44.6.4. LSPP Certification ................................................................................ 742
44.7. SELinux Policy Overview ................................................................................ 742
44.7.1. What is the SELinux Policy? ................................................................. 742
44.7.2. Where is the Policy? ............................................................................ 743
44.7.3. The Role of Policy in the Boot Process ................................................. 744