UNIX / Linux Intranet and Internet Security

Description

Unix and Linux are widely used as server operating systems. Protecting them from security threats is important. This course covers the tools and techniques to make your system secure. It starts with an overview of security and then describes particular issues of Unix / Linux security. It also includes background information on topics such as networks and encryption. The course features lectures, games, and hands-on exercises. (3 days)

Who Should Attend

Unix/Linux system administrators, security personal, security managers, network managers

Prerequisites

• Experience in using a Unix system
• Knowledge of basic system administrator tasks

Objectives

By the end of the course you will be able to:

• Understand the security aspects of a Unix system
• Appreciate the superuser's potential for security loopholes
• Explore the utilities to manage security
• Appreciate the threats to security

Outline

• Security Concerns
  • Authentication
  • Access control
  • Privacy / Confidentiality
  • Data integrity
  • Availability
  • Risk assessment
• Security Concepts
  • Separation of privilege
  • Accountability
  • Process isolation
• Authentication
  • Passwords
  • Kerberos
  • Digital certificates
  • PAP and CHAP
• Access control
  • Ownership and access
  • Role-based versus user-based
• Encryption
  • Message authenticity checks (MAC) (e.g. MD5)
  • Symmetric keys
  • Asymmetric keys
  • Public Key Infrastructure (PKI)
  • DES, RSA, PGP
• Network topologies
  • Firewalls
  • Proxies
  • Routers
• Network security
  • Trusted hosts
  • Configuring Internet services (e.g. FTP)
  • Accessing Internet services (e.g. TCP Wrappers)
  • Monitors and packet sniffers
  • Network layer - IPSec
  • Transport layer - SSL
• Audit and Accounting Trails
  • Setting up audit logs
  • What to audit
  • Log analysis
• System backup and disaster recovery
  • Data backup
  • Data recovery
• Security considerations and common problems
  • Configuration
  • Working as root
  • SUID, SGID programs
  • Virus checking
  • Secure shell (SSH)
• Security tools
  • Password cracking (e.g. Crack)
  • File system auditing (e.g. Tripwire)
  • Monitoring traffic (e.g. Tcpdump)
  • Network analysis (e.g. SATAN)
  • Security leaks (e.g. COPS)
• Intrusion detection & security incidents
  • Types of attacks
  • Threat Analysis
  • Countermeasures