| Introduction |
|
xi | |
|
SECTION 1 General Considerations and Definition of Terms |
|
|
1 | (20) |
|
Objective 1---Create a Security Concept |
|
|
2 | (9) |
|
Understand the Basics of a Security Concept |
|
|
2 | (2) |
|
Perform a Communication Analysis |
|
|
4 | (2) |
|
Analyze the Protection Requirements |
|
|
6 | (1) |
|
Analyze the Current Situation and Necessary Enhancements |
|
|
7 | (4) |
|
Objective 2---Understand Frequently Used Terms |
|
|
11 | (4) |
|
|
|
11 | (1) |
|
|
|
12 | (1) |
|
|
|
12 | (1) |
|
|
|
12 | (1) |
|
|
|
12 | (1) |
|
Application-Level Gateway |
|
|
12 | (3) |
|
|
|
15 | (1) |
|
Remote Access Service (RAS) |
|
|
15 | (1) |
|
|
|
15 | (1) |
|
|
|
16 | (1) |
|
|
|
17 | (2) |
|
|
|
19 | (2) |
|
|
|
21 | (32) |
|
Objective 1---Limit Physical Access to Server Systems |
|
|
22 | (1) |
|
Place the Server in a Separate, Locked Room |
|
|
22 | (1) |
|
Secure the BIOS with a Password |
|
|
22 | (1) |
|
Secure the GRUB Boot Loader with a Password |
|
|
22 | (1) |
|
Objective 2---Partitioning and File System Security |
|
|
23 | (4) |
|
|
|
24 | (1) |
|
The Basic Rule for User Write Access |
|
|
25 | (1) |
|
The Basic Rule for User Read Access |
|
|
25 | (1) |
|
How Special File Permissions Affect System Security |
|
|
26 | (1) |
|
Objective 3---Limit the Installed Software Packages |
|
|
27 | (1) |
|
Objective 4---Configure Security Settings with YaST |
|
|
27 | (1) |
|
Objective 5---Stay Informed about Security Issues |
|
|
28 | (1) |
|
Objective 6---Apply Security Updates |
|
|
29 | (4) |
|
Configure the Novell Customer Center |
|
|
30 | (1) |
|
Use the YaST Online Update |
|
|
31 | (2) |
|
Objective 7---Test and Document the Configuration |
|
|
33 | (9) |
|
|
|
33 | (1) |
|
|
|
34 | (3) |
|
|
|
37 | (2) |
|
|
|
39 | (1) |
|
|
|
40 | (2) |
|
Objective 8---Use Logging and Accounting |
|
|
42 | (3) |
|
|
|
42 | (1) |
|
|
|
42 | (2) |
|
|
|
44 | (1) |
|
Tools to Automate Checking of Log Files and Other Information |
|
|
44 | (1) |
|
|
|
45 | (1) |
|
|
|
46 | (2) |
|
|
|
48 | (2) |
|
|
|
50 | (3) |
|
|
|
53 | (28) |
|
Objective 1---Improve Application Security with AppArmor |
|
|
54 | (1) |
|
Objective 2---Create and Manage AppArmor Profiles |
|
|
55 | (13) |
|
Understand Profiles and Rules |
|
|
55 | (2) |
|
Administer AppArmor Profiles with YaST |
|
|
57 | (7) |
|
Administer AppArmor Profiles with Command Line Tools |
|
|
64 | (4) |
|
Objective 3---Control AppArmor |
|
|
68 | (3) |
|
|
|
68 | (1) |
|
|
|
69 | (1) |
|
|
|
70 | (1) |
|
Objective 4---Monitor AppArmor |
|
|
71 | (4) |
|
|
|
71 | (3) |
|
Security Event Notification |
|
|
74 | (1) |
|
|
|
75 | (1) |
|
|
|
76 | (2) |
|
|
|
78 | (2) |
|
|
|
80 | (1) |
|
SECTION 4 Cryptography: Basics and Practical Application |
|
|
81 | (38) |
|
Objective 1---Cryptography Basics |
|
|
82 | (5) |
|
Encryption and Decryption |
|
|
82 | (3) |
|
Cryptographic Hash Algorithms and Digital Signatures |
|
|
85 | (2) |
|
Objective 2---Create a Certification Authority (CA) and Issue Certificates with CLI Tools |
|
|
87 | (9) |
|
|
|
88 | (2) |
|
Create a Certificate Signed by the Root CA |
|
|
90 | (2) |
|
Create a Certificate Revocation List (CRL) |
|
|
92 | (4) |
|
Objective 3---Create a Certification Authority (CA) and Issue Certificates with YaST |
|
|
96 | (8) |
|
Create a Root CA with YaST |
|
|
96 | (4) |
|
Create a Certificate Signed by the CA with YaST |
|
|
100 | (3) |
|
|
|
103 | (1) |
|
Objective 4---GNU Privacy Guard (GPG) |
|
|
104 | (8) |
|
|
|
105 | (1) |
|
Export and Import Public Keys |
|
|
106 | (1) |
|
Encrypt and Decrypt Files |
|
|
107 | (2) |
|
|
|
109 | (3) |
|
|
|
112 | (1) |
|
|
|
113 | (2) |
|
|
|
115 | (2) |
|
|
|
117 | (2) |
|
SECTION 5 Network Security |
|
|
119 | (32) |
|
Objective 1---Understand Services and Protocols |
|
|
120 | (9) |
|
|
|
120 | (3) |
|
|
|
123 | (1) |
|
|
|
124 | (1) |
|
|
|
125 | (2) |
|
|
|
127 | (1) |
|
|
|
128 | (1) |
|
|
|
129 | (1) |
|
Objective 2---Secure Access with TCP Wrapper |
|
|
129 | (8) |
|
The Role of the TCP Daemon |
|
|
130 | (1) |
|
Configure Access Controls |
|
|
131 | (3) |
|
|
|
134 | (1) |
|
|
|
134 | (3) |
|
Objective 3---Use SSL to Secure a Service |
|
|
137 | (5) |
|
Objective 4---Secure Clients |
|
|
142 | (1) |
|
|
|
143 | (1) |
|
|
|
144 | (3) |
|
|
|
147 | (2) |
|
|
|
149 | (2) |
|
SECTION 6 General Firewall Design |
|
|
151 | (12) |
|
Objective 1---Understand Firewall Concepts and Purpose |
|
|
152 | (1) |
|
Objective 2---Describe Components of Firewalls |
|
|
152 | (6) |
|
|
|
152 | (2) |
|
Application-Level Gateway (ALG) |
|
|
154 | (1) |
|
|
|
155 | (3) |
|
Objective 3---Understand Advantages and Disadvantages of Different Setups |
|
|
158 | (1) |
|
|
|
158 | (1) |
|
Application-Level Gateways |
|
|
158 | (1) |
|
|
|
158 | (1) |
|
|
|
159 | (1) |
|
|
|
159 | (1) |
|
|
|
160 | (2) |
|
|
|
162 | (1) |
|
|
|
163 | (34) |
|
Objective 1---Understand Packet Filters |
|
|
164 | (3) |
|
|
|
164 | (1) |
|
|
|
165 | (1) |
|
|
|
165 | (1) |
|
Dynamic (Stateful) Packet Filters |
|
|
166 | (1) |
|
Objective 2---Understand iptables Basics |
|
|
167 | (14) |
|
|
|
167 | (1) |
|
|
|
168 | (1) |
|
|
|
168 | (13) |
|
Objective 3---Understand iptables Advanced Features |
|
|
181 | (8) |
|
|
|
181 | (3) |
|
|
|
184 | (5) |
|
Objective 4---Understand Network Address Translation |
|
|
189 | (1) |
|
Prerouting and Postrouting Chains |
|
|
189 | (1) |
|
|
|
189 | (1) |
|
|
|
190 | (1) |
|
|
|
191 | (1) |
|
|
|
192 | (2) |
|
|
|
194 | (3) |
|
SECTION 8 Application-Level Gateways |
|
|
197 | (62) |
|
Objective 1---Application-Level Gateway Basics |
|
|
198 | (1) |
|
The Purpose of Application-Level Gateways |
|
|
198 | (1) |
|
How Application-Level Gateways Work |
|
|
198 | (1) |
|
Objective 2---Configure and Use Squid |
|
|
199 | (36) |
|
Understand the Basics of HTTP |
|
|
200 | (1) |
|
Understand How Squid Works |
|
|
200 | (1) |
|
Install Squid on SUSE Linux Enterprise Server 10 |
|
|
201 | (1) |
|
Understand the Squid Configuration File |
|
|
202 | (3) |
|
|
|
205 | (5) |
|
Configure Web Browsers to Use Squid |
|
|
210 | (6) |
|
Understand How Squid Handles SSL Connections |
|
|
216 | (4) |
|
Configure Proxy Authentication |
|
|
220 | (8) |
|
|
|
228 | (5) |
|
Configure an Intercepting Proxy Server |
|
|
233 | (1) |
|
|
|
234 | (1) |
|
Objective 3---Configure and Use Dante |
|
|
235 | (14) |
|
|
|
235 | (1) |
|
Install and Configure Dante |
|
|
236 | (5) |
|
Configure Clients to Use a SOCKS Server |
|
|
241 | (8) |
|
Objective 4---Configure and Use rinetd |
|
|
249 | (3) |
|
Configure Forwarding Rules |
|
|
250 | (1) |
|
Configure Allow and Deny Rules |
|
|
250 | (1) |
|
|
|
251 | (1) |
|
|
|
252 | (1) |
|
|
|
253 | (2) |
|
|
|
255 | (2) |
|
|
|
257 | (2) |
|
SECTION 9 Virtual Private Networks |
|
|
259 | (26) |
|
Objective 1---VPN and IPSec Basics |
|
|
260 | (1) |
|
Objective 2---Configure and Establish an IPSec Connection |
|
|
261 | (14) |
|
Connect Two Sites with IPSec (Site-to-Site) |
|
|
262 | (5) |
|
Connect a Single Computer with a Site (End-to-Site) |
|
|
267 | (2) |
|
Connect Two Single Computers (End-to-End) |
|
|
269 | (1) |
|
|
|
270 | (1) |
|
|
|
271 | (4) |
|
Objective 3---Understand Packet Filtering of VPN Traffic |
|
|
275 | (4) |
|
|
|
275 | (1) |
|
Connections Initiated from Road Warriors to Hosts Behind the Gateway |
|
|
276 | (1) |
|
Connections Initiated from Hosts Behind the Gateway to Road Warriors |
|
|
277 | (2) |
|
|
|
279 | (1) |
|
|
|
280 | (1) |
|
|
|
281 | (1) |
|
|
|
282 | (3) |
|
SECTION 10 Intrusion Detection and Incident Response |
|
|
285 | (24) |
|
Objective 1---Log Files and Their Evaluation |
|
|
286 | (7) |
|
|
|
286 | (2) |
|
Evaluate Log Files and Run Checks |
|
|
288 | (5) |
|
Objective 2---Host-Based Intrusion Detection |
|
|
293 | (3) |
|
|
|
294 | (2) |
|
|
|
296 | (1) |
|
Objective 3---Network-Based Intrusion Detection |
|
|
296 | (4) |
|
|
|
296 | (1) |
|
|
|
297 | (1) |
|
|
|
297 | (1) |
|
|
|
298 | (1) |
|
|
|
299 | (1) |
|
Objective 4---Incident Response |
|
|
300 | (3) |
|
|
|
300 | (1) |
|
|
|
301 | (1) |
|
Documentation and Investigation |
|
|
301 | (1) |
|
|
|
302 | (1) |
|
Re-Evaluate Your Security Policy |
|
|
302 | (1) |
|
|
|
303 | (1) |
|
|
|
303 | (2) |
|
|
|
305 | (2) |
|
|
|
307 | (2) |
|
SECTION 11 LiveFire Exercise |
|
|
309 | (6) |
|
|
|
310 | (1) |
|
Objective 1---Set Up the Application-Level Gateway |
|
|
311 | (1) |
|
Objective 2---Set Up the Screening Router |
|
|
312 | (1) |
|
Objective 3---Set Up a Web Server in the DMZ |
|
|
312 | (1) |
|
Objective 4---Set Up the Mail Server in the LAN |
|
|
312 | (1) |
|
Objective 5---Set Up the VPN Gateway |
|
|
313 | (2) |
| Glossary |
|
315 | (10) |
| Index |
|
325 | |