............................................................................................................................................................................. 8 1. ............................................................................................................................................................. 9 2. ........................................................................................................................................................... 9 3. ............................................................................... 9 4. ........................................................................................................................... 9 ...................................................................................................................................................................... 9 ..................................................................................................................................................................... 9 ................................................................................................................................................................................. 11 ..................................................................................................................................................... 12 ............................................................................................................................................... 12 .................................................................................................................................. 13 I ....................................................................................................................................................................... 15 , ................................................................................................................................. 16 ....................................................................................................................................... 16 ......................................................................................... 17 /etc/passwd................................................................................................................................................................. 18 /etc/passwd ................................................................................................................................................ 18 /etc/shadow ............................................................................................................................................................ 20 /etc/shadow................................................................................................................................................ 21 ..................................................................................................................................................... 22 /etc/groups ................................................................................................................................................................. 22 /etc/group................................................................................................................................................... 23 /etc/gshadow .............................................................................................................................................................. 23 /etc/login.defs ............................................................................................................................................................ 24 ............................................................................................................ 24 .............................................................................................................................................. 25 ........................................................................................................................................................... 27 .......................................................................................................................................................... 28 ...................................................................................................................................................................... 28 ........................................................................................................................................................ 29 .......................................................................................................................................................... 32 ...................................................................................................................................... 33 ......................................................................................................................................................................... 34 ............................................................................................................. 35 ....................................................................................................................................................... 35 ........................................................................................................................................ 36 / ..................................................................................................................................... 37 X .................................................................................................................................................................... 38 ................................................................................................................................................... 38 ............................................................................................................................................ 40 ...................................................................................................................................................... 41 .................................................................................................................................................................... 45 ......................................................................................................................................................................... 46 ......................................................................................................................................................... 47 Linux: ................................................................................................................................................... 47 ...................................................................................................................................................................... 47 .......................................................................................................................... 50 .......................................................................................................................................... 53 ..................................................................................................................... 53 ......................................................................................................................................................................... 54 SUID/SGID .................................................................................................................. 55 SUID/SGID ....................................................................................................................................................... 55 SUID/SGID............................................................................................................... 56 SUID/SGID ................................................................................................................................. 57 ......................................................................................................................................................... 58 ext2 ................................................................................................................................... 59 chattr ......................................................................................................................................... 60 Isattr .......................................................................................................................................... 60 ......................................................................................................................................................................... 61 ............................................................................................................................................... 62 ......................................................................................................................................................... 62 ........................................................................................... 65 Amiga affs ....................................................................................................................................................................... 66 Linux ext2........................................................................................................................................................................ 66

FAT, MSDOS, UMSDOS, VFAT ................................................................................................................................... 67 OS/2 HPFS ...................................................................................................................................................................... 67 CD-ROM ISO9660.......................................................................................................................................................... 68 PROC............................................................................................................................................................................... 68 ......................................................................................................................................................................... 68 /proc ......................................................................................................................................................... 69 /..................................................................................................................................................... 69 /proc/sys ................................................................................................................................................................ 73 /dev/pts................................................................................................................................................. 74 / .............................................................................................................................. 74 ......................................................................................................................................................................... 75 ................................................................................................................................................................... 76 ............................................................................................................................................................... 76 init , ............................................................................................. 77 inittab ................................................................................................................................................................ 79 inittab ............................................................................................................................................... 80 r, ................................................................................................................................................. 81 r, ................................................................................................................................................. 83 ......................................................................................................................................................................... 88 ................................................................................................................... 90 ................................................................................................................................................................ 90 LILO .................................................................................................................................................................................... 91 ...................................................................................................... 92 root.............................................................................................................................................. 94 ..................................................................................................................................................... 94 Linux.............................................................................................................................................................. 95 ......................................................................................................................................................................... 96 II .................................................................................................................................................................... 97 .................................................................................................................................................... 98 ............................................................................................................................................. 99 IP ................................................................................................................................................... 100 IP ..................................................................................................................................................... 101 IP........................................................................................................................................................... 102 ICMP ............................................................................................................................................................. 103 ............................................................................................................................... 104 CIDR ................................................................................................................................................................ 105 ................................................................................................................................................................ 105 IP.......................................................................................................................... 106 CIDR VLSM .................................................................................................................. 107 ipconfig ................................................................................................................................................... 109 route ........................................................................................................................................................ 111 ....................................................................................................................................................................... 112 ........................................................................................................................................................... 113 ............................................................................................................................................................ 113 netstat ................................................................................................................................................................. 118 ........................................................................................................................................ 118 ....................................................................................................................................................................... 121 inetd, inetd.conf ......................................................................................................................................... 123 inetd ................................................................................................................................................................................... 123 inetd.conf........................................................................................................................................................ 125 ................................................................................................................................................... 128 ?............................................................................................................................................. 130 ....................................................................................................................................................................... 131 ......................................................................................................................................... 132 FTP, 21 20........................................................................................................................................................... 132 telnet, 23 ................................................................................................................................................................... 136 smtp, 25..................................................................................................................................................................... 136 domain 53 ................................................................................................................................................................. 139 tftp, 69....................................................................................................................................................................... 140 finger, 79................................................................................................................................................................... 140 www, 80.................................................................................................................................................................... 140 2, 109 , 110...................................................................................................................................... 140 sunrpc, 11.................................................................................................................................................................. 141 auth, 113 ................................................................................................................................................................... 142 netbios, 137-139 ..................................................................................................................................................... 142 imap2, 143 imap3, 220.................................................................................................................................. 142

xdmcp, 177 (UDP) .................................................................................................................................................... 143 printer, 515................................................................................................................................................................ 143 r (rsh, rexec, rlogin), 512, 513, 514 ................................................................................................... 144 ................................................................................................................................................................. 145 ....................................................................................................................................................................... 146 DoS ........................................................................................................................................... 147 ping flooding .................................................................................................................................................... 147 SYN DoS ......................................................................................................... 149 .......................................................................................................................................................... 150 DoS .................................................................................................................................. 151 ....................................................................................................................................................................... 152 ................................................................................................................................................. 153 ............................................................................................................................................. 154 ..................................................................................................................................................................... 158 ........................................................................................................................................... 158 ............................................................................................................................................. 161 ....................................................................................................................................................................... 162 TCP (TCP Wrappers) ................................................................................................................. 163 TCP Wrappers ............................................................................................................................................... 165 ....................................................................................................... 166 , ................................................................................................................................... 167 ......................................................................................................................................................... 167 ............................................................................................................................................................................. 167 ................................................................................................................................................ 169 ........................................................................................................................................... 170 tcpdchk............................................................................................................................................................................... 170 tcpdmatch........................................................................................................................................................................... 171 ....................................................................................................................................................................... 172 III ...................................................................................... 173 , .......................................................................................................... 174 .......................................................................................................................... 174 ....................................................................................................................................................... 174 ? ............................................................................................................................................ 175 ............................................................................................................................................. 176 , ................................................................................................ 176 ............................................................................................................................... 177 ...................................................................................................................................................... 178 ........................................................................................................................... 183 ........................................................................................................................................................ 183 .................................................................................................................... 183 ............................................................................................................................................................... 184 ipchains........................................................................................................................................ 184 ipchains...................................................................................................................................................... 185 .................................................................................................................................................... 187 , .................................................................................................................... 188 ipchains....................................................................................................................................................... 188 ..................................................................................................................................... 189 ................................................................................................................................................. 189 ............................................................................................................................... 189 .......................................................................................................................................................... 190 ..................................................................................................................................................... 191 ...................................................................................................................................................................... 191 ................................................................................................................................................. 192 Linux 2.4.x netfilter............................................................................................................................. 192 2.2.x ................................................................................. 192 netfilter................................................................................................................................................. 193 netfilter.......................................................................................................................... 194 ....................................................................................................................................................................... 196 proxy Squid ............................................................................................. 197 ......................................................................................................................................... 198 NETWORK OPTIONS.................................................................................................................................................. 201 ............................................................................................................................................. 202 .................................................................................................................................................................. 202 LOGFILE PATHNAMES AND CACHE DIRECTORIES........................................................................................... 203 EXTERNAL SUPPORT PROGRAMS......................................................................................................................... 203 TUNING THE CACHE................................................................................................................................................. 203

TIMEOUTS ................................................................................................................................................................... 203 ACCESS CONTROLS .................................................................................................................................................. 204 ADMINISTRATIVE PARAMETERS .......................................................................................................................... 205 CACHE REGISTRATION SERVICE .......................................................................................................................... 206 HTTPD-ACCELERATOR OPTIONS .......................................................................................................................... 206 MISCELLANEOUS ...................................................................................................................................................... 206 DELAY POOL PARAMETERS ................................................................................................................................... 206 ................................................................................................................................. 206 squid ............................................................................................................................................ 207 squid .............................................................................................................................. 207 ............................................................................................................................................................................. 208 .......................................................................................................................................................... 208 squid............................................................................................................................................................. 208 ....................................................................................................................................................................... 209 IP ........................................................................................................................ 210 ........................................................................................................................................................ 214 IP .................................................................................................................................................................. 217 ................................................................................................................................................. 218 Linux 2.4.x ............................................................................................................................................................... 220 ....................................................................................................................................................................... 221 Samba............................................................................................................................................................. 223 Samba ................................................................................................................................................................................ 223 SWAT Samba ............................................................................................................ 224 SWAT ...................................................................................................................................... 224 SWAT inetd ....................................................................................................................... 224 SWAT Apache ................................................................................................................... 226 SWAT ..................................................................................................................................................... 226 Microsoft .................................................................................................................................... 228 NT D ................................................................................................................ 228 NT ............................................................................................................................................... 229 D, .................................................................................. 229 Samba Microsoft (NT / Windows 9x) .................................................................... 230 Linux D .............................................................................................................. 230 ............................................................................................................................................. 231 Base options................................................................................................................................................................... 231 Security options ............................................................................................................................................................. 232 Logging options ............................................................................................................................................................. 232 Tuning options ............................................................................................................................................................... 232 Filename handling ......................................................................................................................................................... 232 Browse options .............................................................................................................................................................. 232 Locking options ............................................................................................................................................................. 233 Miscellaneous options.................................................................................................................................................... 233 Homes..................................................................................................................................................... 234 .................................................................................................................................... 234 , Samba ............................................................................................................................. 235 Global .............................................................................................................................. 236 Samba .................................................................................................... 239 Samba ................................................................................. 240 ....................................................................................................................................................................... 240 web- Apache ........................................................................................................................... 241 Apache.................................................................................................................................................................. 241 .............................................................................................................................. 242 ...................................................................................................................................... 242 .................................................................................................................................................... 243 Apache ............................................................................................................................................. 246 SSL ....................................................................................................................................................................... 251 Apache ........................................................................................................................... 252 .htaccess..................................................................................................................................... 253 , ........................................................................................... 253 , suEXEC .................................................................................................................................... 254 Linux 2.4.x khttpd................................................................................................................................................. 255 ....................................................................................................................................................................... 256 Secure Shell VPN ......................................................................................................... 258 Secure Shell ....................................................................................................................................................................... 259 SSH..................................................................................................................................... 259 SSH ..................................................................................................................................................... 261

SSH SSHD........................................................................................................................................ 262 FreeS/WAN ....................................................................................................................................................................... 263 FreeS/WAN ........................................................................................................................ 264 FreeS/WAN ................................................................................................................................. 265 .......................................................................................................................................................... 265 ........................................................................................................................... 266 OpenSSH ........................................................................................................................................................................... 267 ....................................................................................................................................................................... 267 IV ................................................................................................................................. 268 syslog ................................................................................................................................................... 269 syslog.......................................................................................................................................... 270 syslogd............................................................................................................................................................... 274 ? ..................................................................................................................................... 276 ....................................................................................................................................................................... 277 syslog .................................................................................................................................. 278 , /var/log ................................................................................................................... 278 ...................................................................................................................... 280 ................................................................................................................................................ 281 utmp, wtmp last log............................................................................................................................................ 282 ....................................................................................................................................................................... 285 ...................................................................................................... 286 ................................................................................................................................................ 286 ...................................................................................................................................................... 287 ipchains...................................................................................................................................... 288 // ................................................... 288 ............................................................................................................................................ 293 ....................................................................................................................................................................... 294 .......................................................................................................................................... 295 courtney ......................................................................................................................................................... 295 nmap .............................................................................................................................................................. 298 nmap.................................................................................................................................. 300 nmap .............................................................................................................................................. 301 nmap .............................................................................................................................................. 303 nmap netstat................................................................................................................................................. 304 ....................................................................................................................................................................... 305 ................................................................................................................................... 306 ?................................................................................................................................................ 306 ............................................................................................................................................................. 307 Web-, ............................................................................................... 307 ............................................................................................................................. 312 ....................................................................................................................................................... 313 ....................................................................................................................................................................... 313 ....................................................................................... 314 ........................................................................................................................................................ 319

,

, , , 24 . , Road Runner, adsl/ xdsl, . , Web , web- , . , , . Linux , . . , . , , NASA , , , , , , ; , . , , , , . -, NASA . , , , , , . -, . , , . , , . . . , . , , , . , , , . , Caldera OpenLinux , Caldera OpenLinux, Linux. , , Linux , 1988 , : MS-DOS DR-DOS. . Linux, , Linux. telnet Linux, . Linux , . Linux , , , , Linux . , Linux, , , , ,

. , , .

.

1. . , , , . , , , , .

2. , , , . , , , . , .

3. , .

4. , . , , , , , . , . , , . , , .

. , , ( -). , -.

, : - , , (+), , Ctrl+P; - , , ; - , , , , . . : , , .

, .

, .

, , .

Linux. , . . , , . , . : ( Denial of Service ) . , , Linux , . , , , . , , ? , , , , , . , , , . , . . , . , , : , , . , , . . , - , - . , , , . 1999 Microsoft IIS . . PowerPC Linux. : web- Apache. . , , . , , , . , , . , . , . . , , . . , . . , ( Amazon.com). , . , , , .

Caldera OpenLinux ( -), Linux. Caldera Linux, .

, . , . , -. , , , . -, . , , . . . : , . . , ? , ? , : , , .

, , . , . . , : , . : , . . , , . , , . . , , . , - . , . , . (EEPROM) . Linux , IH (), Windows , , root, , . , . , Ethernet . , . , ( , , ), - . , , , . , . FTP Web - , - . , . . , . , ,

. , , , . . . , , . , . . . , , , . . , , , . , , . , . , , . , . , . , , , , .

, , . , . , : , , , . , . , , : . . , , , , , . , , . , , . , , , . . . , , , . Linux . , . , . , . , , , , . , , , . , . , , . . , . .

? ? , , . , ? ? , ? ? ? . , ? , ? , , ( . .), ( ?). , , , , , , , . RFC-2196 RFC-2504.

I

1. 2. 3. 4. 5. 6. 7. 8.

, SUID/SGID /

1-

,

: - ; ; ; /etc/passwd; /etc/shadow; /etc/gshadow; /etc/login.defs; ; .

Linux - , , , . - , . , . , . Linux . , , , .

Linux . , , . , , telnet, ftp, http . . . . , , , , . ( ). , . . , , , , . , . (user ID, UID). , UID , , UID .

. . . , , . . , , .

, (user ID, UID). Caldera OpenLinux 500 , 65 534. 500 . Linux : , 1000, 500. , , Linux. , 500, . 1 65 534 - . , 500 , . . . . , . 0 65 535. UID 0 UID. . . . , root ( , UID 0), , , . UID, , . , , . root, . . UID, 65 535. . UID nobody (). , . ( ), OpenLinux UID nobody 65 534. 65 535 UID, . , useradd: useradd -m -u 65535 noone . : , ( useradd, , ), a root? su -noone, , , . 65 535, nobody 65 534, 65 535 . ( : userdel ; rm -Rf /home/noone.) - 65 536, . , UID , , 0, 1. , . UID , , UID nobody, 65535 16 , 1111111111111111. 65 536 16 17 . (1), (0). 17 10000000000000000? , : 16 , 17 , . , , , , , , . , Linux , UID 65 536. . ? , , UID, , . , , .

, 65 536, , /bin/login .

. , . , , , , , , , . , , , . web- , . , . ? , , , ? , .

/etc/passwd , , /etc/passwd. , , ( , ). , , , , . , . , , passwd. /etc . , , . - , . 1.1. passwd . . 1.1. /etc/passwd

root::1i DYwrOmhmEBU: 0:0: root:: /root: /bin/bash bin:*:1:1:bin:/bin: daemon:*:2:2:daemon:/sbin:

adm:*:3:4:adm:/var/adm: lp:*:4:7:lp:/var/spool/lpd: sync:*:5:0:sync:/sbin:/bin/sync shutdown:*:6:11:shutdown:/sbin:/sbin/shutdown halt:*:7:0:halt:/sbin:/sbin/halt mail:*:8:12:mail:/var/spool/mail: news:*:9:13:news:/var/spool/news: uucp:*:10:14:uucp:/var/spool/uucp: operator:*:11:0:operator:/root: games:*:12:100:games:/usr/games: gopher:*:13:30:gopher:/usr/1ib/gopher-data:ftp:*:14:50:FTP User:/home/ftp:

man:*:15:15:Manuals Owner:/:majordom:*:16:16:Majordomo:/:/bin/false postgres:*:17:17:Postgres User:/home/postgres:/bin/bash mysql:*:18:18:MySQL User:/usr/local/var:/bin/false silvia:1iDYwrOmhmEBU:501:501:Silvia Bandel:/home/silvia:/bin/bash nobody:*:65534:65534:Nobody:/:/bi n/false david:1iDYwrOmhmEBU:500:500:David A. Bandel :/home/david:/bin/bash

. , . . . passwd, Unix, , . : , , , , GECOS ( ), .

/etc/passwd

. , . ( , useradd, coastool LISA ), , , . , , UID . , . , . . , . - . Linux DES (Data Encryption Standard). - 13 , , , (. /etc/shadow). , 13- , , : . , /etc/passwd :david::500:500:David A. Bandel:/home/david:/bin/bash

, , , . , , . , , . /etc/passwd . , , - , , , . , 14- . , . /etc/shadow ( ), . , , , ( , , - ), root, . , , , toor tuber. . , . (salt). ( , . .) , , -, . , . , , , . - - . (dictionary attack) . , . , , , ( 0-9) . .

1.1 , root, silvia david - . , . : silvia. ( silvia) . 3 , , , .

06 2.

. , . , . , root, , . , , , ( toor, tuber, ) . . , : root . root, . , , , . , , . , UID , , . root. root . , , . , NFS, . (Group ID, GID). , , (primary group). , . . , GECOS, GE Consolidated Operating System. finger . . . . , , , , . , . , ftp , ftp, . . . . OpenLinux /etc/shells (. ). , , /etc/passwd, . , , passwd, , , , . . . .

/etc/shadow /etc/shadow root . - passwd shadow, passwd . passwd , , . , , /etc/shadow. . pwck. passwd , - . pwck, pwconv /etc/shadow. /etc/passwd. pwuncov. . ,

. , , , . 1.2. /etc/shadow. 1.2. /etc/shadow root:1iDYwrOmhmEBU:10792:0:: 7:7:: bin:*:10547:0::7:7:: daemon:*:10547:0::7:7:: adm:*:10547:0::7:7:: lp:*:10547:0::7:7:: sync:*:10547:0::7:7::

shutdown:U:10811:0:-1:7:7:-1:134531940 halt:*:10547:0::7:7:: mail:*:10547:0::7:7:: news:*:10547:0::7:7:: uucp:*:10547:0::7:7:: operator:*:10547:0::7:7::

games:*: 10547:0: :7:7::gopher:*:10547:0::7:7:: ftp:*:10547:0::7:7:: man:*:10547:0::7:7::

majordom:*:10547:0::7:7::postgres:*:10547:0::7:7::

mysql:*:10547:0::7:7:: si1via:1iDYwrOmhmEBU:10792:0:30:7:-l:: nobody:*:10547:0::7:7:: david:1iDYwrOmhmEBU:10792:0::7:7::

/etc/shadow shadow , passwd. . OpenLinux 13 24 , crypt 13-- . , , , 52 ( ), 0-9, (/). 64 , - . , , , , , 4096 (64x64). DES 56 , 256 , 72 057 590 000 000 000 72 . , . , , 56- . ( , , , , .) , , , c, , ( ), . , , , . (. ). , 1 1970 . . 1.1. , 2000-2005 . 1.1. , shadow,

/ (31) (28/29) (31) (30) (31) (30) (31) (31)

200010957 10988 11017 11048 11078 11109 11139 11170

200111323 11354 11382 11413 11443 11474 11504 11535

200211688 11719 11747 11778 11808 11839 11869 11900

200312053 12084 12112 12143 12173 12204 12234 12265

200412418 12449 12478 12509 12539 12570 12600 12631

200512784 12815 12843 12874 12904 12935 12965 12996

(30) (31) (30)

11201 11231 11262

11566 11596 11627

11931 11961 11992

12296 12326 12357

12622 12692 12723

13027 13057 13088

(31)

11292

11657

12022

12387

12753

13118

, , . , , . , , . , password , . , . , , . , , . , , , , . . .

, . passwd shadow , :+::0:0:::

+:*:0:0::-1:-1::

, . NIS (Network Information Services, Yellow Pages, - British Telecom), . , NIS, , NIS . NIS+ , NIS+ Linux () . NIS , . NIS, .

/etc/groups . , . 1.3. 1.3. /etc/group root::0: wheel::10: bin::1:bin,daemon daemon::2:bin,daemon sys::3:bin,adm adm::4:adm,daemon tty::5: disk::6: lp::7:daemon,lp mem::8: kmem::9: operator::11: mail::12:mail news:: 13: news uucp::14:uucp man::15: majordom::16: database::17:

mysql::18: games::20: gopher::30: dip::40: utmp::45: ftp::50: silvia::501:silvia nobody::65534: users::100:david,silvia david::500:david

/etc/group /etc/group , . . , ( ). , , , . newgrp , . , : , . root , , , . ? . , , (. ). (Group ID, GID). , . , , . , ( , ). . , . ( ) passwd . , passwd, .

/etc/gshadow OpenLinux . , . : . , , . , . , , . , , . , . gshadow. ( gshadow) ( gshadow) , passwd. grpck, /etc/group , . grpconv. /etc/group , /etc/gshadow. gshadow , . , ( ). . . shadow, grpuncov.

/etc/login.defs . Open-Linux : coastooL, LISA, useradd. . COAS , . useradd LISA passwd shadow /etc/login.defs. 1.4 ( ). 1.4. /etc/login.defs # , : # (-1 ) PASS_MAX_DAYS -1

: PASS_MIN_DAYS # : PASS_WARN_AGE 7 # # , : PASS_INACTIVE -1

# :# ( PASS_EXPIRE -1 ### 70/1/1, -1 = )

# useradd # : GROUP 100 # : %s = ) M /home/%s # : SHELL /bin/bash # , : SKEL /etc/skel # GID_MIN 100 GID_MAX 60000

gid

groupadd

passwd shadow. , . , , . , -1, . . ? . COAS Caldera ( , ). System Administration ( ) > Account Administration ( ) .

chage (change aging ). chage -l , . ( ) , . chage . 1.5. , . 1.5. david # chage -1 david Minimum: 2 Maximum: 90

Warning: 7 Inactive: 14 Last Change: Password Expires: Password Inactive: Account Expires:

Aug 11, 1999 Nov 09, 1999 Nov 23, 1999 Never

1.5 , david . , , 90. . 14- , , , ( ). , . -, 1 . , , . , ( ) . , , . 2.

COAS . . . expiry.

, , , () , . Sun , Solaris 2.3, Linux. (Pluggable Authentication Modules) . , , , , . . , , : (SUCCESS), (FAILURE) (IGNORE). , , (SUCCESS) (FAILURE) . , , , , , : . , . , , . , , : (SUCCESS), (IGNORE) (FAILURE) . , - . . . . , . : , , - . . . 1.6. OpenLinux 2.3 ( ) login. /etc/pam.d , su, passwd .

., , . (restricted service) . , other, other.d. ( , . , , .) 1.6. login auth required pam_securetty.so auth required pam_pwdb.so auth required pam_nologin.so #auth required pam_dialup.so auth optional pam_mail.so account required pam_pwdb.so session required pam_pwdb.so session optional pam_lastlog.so password required pam_pwdb.so

, . , . , . , (#), . , pam_dialup ( 1.6.) . , . 1.1. , pam_pwd.so, auth. (stacking) ( ), .

. : auth, account, session password. , . - auth (authentication ) , , . , , . , - - , . - account ( ) , , . . - password () . , /etc/shadow , passwd chauthok ( ) , , (SUCCESS).

- session () . , , , . .

, , , (SUCCESS), (IGNORE) (FAILURE). : requisite, required, sufficient optional. , . , , sufficient (), (SUCCESS), . (FAILURE) , requisite (), (FAILURE). . - requisite () . requisite, (FAILURE), (FAILURE). . , . , , , , required (). - required () . : (SUCCESS), (IGNORE) (FAILURE), . , , , , , , . . - sufficient () (SUCCESS) , (SUCCESS) required, (FAILURE). , sufficient . (IGNORE) (FAILURE), sufficient optional (. ). - optional () , , (SUCCESS). . , . , , requisite required, (FAILURE). , optional , , (SUCCESS).

, . , , , , . OpenLinux /lib/security. . , , . . 1.7 , OpenLinux. 1.7. , OpenLinux pam_access.so pam_cracklib.so pam_deny.so pam_dialup.so

pam_env.so pam_ftp.so pam_group.so pam_lastlog.so pam_limits.so pam_listfile.so pam_mail.so pam_nologin.so pam_permit.so pam_pwdb.so pam_radius.so pam_rhosts_auth.so pam_rootok.so pam_securetty.so pam_shells.so pam_stress.so pam_tally.so pam_time.so pam_unix_acct.so pam_unix_auth.so pam_unix_passwd.so pam_unix_session.so pam_warn.so pam_wheel.so

, (module stacking).

pam_access.so / /etc/security/access.conf. :: :

: - + (), - () - ALL, @, , . - ( /dev/), , ( ), IP ( , , 192.168.0. 192.168.0.), ALL LOCAL. OpenLinux , ( ) . . pam_cracklib.so . , , , , . : debug, type= retry=. debug . type, , New Unix password: Unix . retry , , ( ). 1.8. /etc/ pam.d/other. , , /etc/pam.d. , , . , , auth, account, password session, required pam_deny.so. , .

, - - , FTP, /etc/pam.d/ftp /etc/pam.d/ftp.orig . 1.8. /etc/pam.d/other auth required pam_deny.so auth required pam_warn.so account required pam_deny.so password required pam_deny.so password required pam_warn.so session required pam_deny.so

pam_dialup.so , , /etc/security/ ttys.dialup. , ttyS, tty-. , /etc/ security/passwd.dialup. passwd.dialup dpasswd ( ). pam_group.so /etc/security/group.conf. , . , , . , . , . OpenLinux /etc/security/ group.conf, . . pam_lastlog.so lastlog , . session optional. pam_limits.so , . root ( ). OpenLinux /etc/security/limits.conf. , . pam_lastfile.so (item), (SUCCESS) (FAILURE). :item=[ | _ | _ | | ]

- sense=[allow|deny] ( ; , , ) fil=////_ - onerr=[succeed|fail] ( ) - 1=[|@] ( , . item=[ | _ | ], item=[ | _ | ] ) pam_nologin.so auth required. , /etc/nologin, , (SUCCESS), (FAILURE). , , . pam_permit.so pam_deny.so. (SUCCESS). . pam_pwdb.so passwd shadow. :- debug ;

- audit , ; - use_first_pass , ; - try_first_pass , ; - use_authtok (FAILURE) , pam_authtok

, , ( password); - not_set_pass ; - shadow ; - unix /etc/passwd; - md5 md5; - bigcrypt DEC C2; - nodelay . OpenLinux md5 bygcrypt , . , , u nix. pam_rhosts_auth.so / .rhosts hosts.equiv. , / . : - no_hosts_equiv /etc/hosts.equiv; - no_rhosts /etc/rhosts ~/.rhosts; - debug ; - nowarn ; - suppress ; - promiscuous + ( ). pam_rootok.so (SUCCESS) . sufficient, . . sufficient auth login, , , , . : debug. pam_securetty.so . /etc/securetty, . telnet ( ttyp), ttyp0-255, pam_securetty.so login. , , . pam_shells.so (SUCCESS), , /etc/passwd, /etc/shells. /etc/passwd , /bin/sh. /etc/passwd , /etc/shells, (FAILURE). /etc/shells . pam_stress.so . , debug, : - rootok ; - expired , . , . . , , . OpenLinux pam_tally.so /etc/pam.d , - . . . , . /var/log/ faillog ( ). : - onerr=[succeed|fail] , , ; - fil=////_ , . auth: - no_magic_root (

). , telnet. account: - deny=n . reset/no_reset (. ) no_reset reset. , root (UID 0), no_magic_root; - no_magic_root deny , root. deny= (. ) root reset, ; - even_deny_root_account no_magic_root. . no_magic_root , , , ; - reset ; - no_reset ; , deny=. pam_time.so . /etc/security/ time.conf. : . pam_unix Unix ( pam_pwdb.so). , : pam_unix_auth.so, pam_unix_session.so, pam_unix_acct.so pam_unix_passwd.so. account auth . passwd : strict=false. , , ( ) . session : debug trace. debug , syslog.conf, trace - authpriv. pam_warn.so syslog. . pam_wheel.so wheel. wheel , , , , . , wheel . , , telnet , , wheel. , . : - debug ; - use_uid , , ; - trust wheel (SUCCESS), (IGNORE); - group=xxx GID , GID wheel; - deny ( ). group= . , , , /etc/security /etc/pam.d, , /etc/pam.d.

, , 1.6. , auth, securetty required. , ,

/etc/securetty. . /etc/nologin. , (SUCCESS). , , , tty.dialup passwd.dialup /etc/security. auth optional, , - . account , . session . pwdb , . , lastlog, optional, , lastlog . , lastlog , (SUCCESS), (FAILURE) (IGNORE) - , . password required , . /etc/pam.d . chfn, , pam_pwdb.so, required auth, account passwd. chsh. imap pop : pwdb session, nologin auth. , , nullok . , - , , . -, ftp. listfile. , , /etc/ftpusers, , ftp ( , ftp, , ). , , . rlogin. , , ( , ). , /etc/securetty. /etc/hosts.equiv ~/rhosts . , . , , cracklib.so, , , , , . , , su. : auth sufficient pam_rootok.so su , , , , . , . - /etc/pam.d , , , , , . , , , . , , .

syslogd, /var/log/secure ( 1.9). 1.9. /var/log/secure Jan 11 16:45:14 chiriqui PAM_pwdb[30022]: (su) session opened for user root by david(uid=0) Jan 11 16:45:25 chiriqui PAM_pwdb[30022]: (su) session closed for user root Jan 11 17:18:06 chiriqui login[13217]: FAILED LOGIN 1 FROM (null) FOR david, Authentication failure

Jan 11 17:18:13 chiriqui login[13217]: FAILED LOGIN 2 FROM (null) FOR david. Authentication failure Jan 11 17:18:17 chiriqui PAM_pwdb[13217]: (login) session opened for user david by (uid=0) Jan 11 17:18:06 chiriqui login[13217]: FAILED LOGIN 1 FROM (null) FOR david. Authentication failure Jan 11 17:18:13 chiriqui login[13217]: FAILED LOGIN 2 FROM (null) FOR david, Authentication failure Jan 11 17:18:17 chiriqui PAM_pwdb[13217]: (login) session opened for user david by (uid=0) Jan 11 17:18:17 chiriqui -- david[13217]: LOGIN ON ttyl BY david Jan 11 17:18:20 chiriqui PAM_pwdb[13217]: (login) session closed for user david

, . , . , , . 1.9 su, login. session opened ( ), session closed ( ). , session opened, , , . , /var/log/secure , .

. , /etc/passwd, . /etc/shadow, /etc/passwd. , /etc/group. /etc/login.defs , useradd . . , , /etc/securetty, /etc/ shells, /etc/security/, . , , . , Linux , , .

2

: - ; - /; - / ; - ; - ; - ; - ; - .

: . . , ( ). : . , .

, Unix, , Unix ( Linux), , . , . , . . , , . , (, ), newgrp. ( , ). . . . , . OpenLinux, , ( ), . newgrp , (login group). , , newgrp. , ( ) , . 4,

. (

) . , , . , , . , , . : , , , . , , ( ). OpenLinux , gshadow /etc . , , 1. OpenLinux , . useradd LISA . COAS . , . , , , . , /etc/ login.defs, COAS. - , . , , , , . , . useradd, LISA COAS, .

, , . , . 3 4 .

, , - , , , , . , . , . OpenLinux users. , , .

, . , , , - . , david david, - . , : . OpenLinux,

. , . , , . , umask, , , - , , . umask 3.

, . , , , . , . , /etc/passwd, /etc/shadow, /etc/groups, /etc/gshadow .

/ , / , , , . . newgrp. , newgrp . , , . , . newgrp , . newgrp . : , . , - , , . 4 , - .

newgrp chown chgrp. , , newgrp, chown chgrp . , , silvia GIF. silvia, , gifs ( ). silvia newgrp, chown chgrp. . , (*.gif), GIF, silvia . , GIF, silvia sg. sg , newgrp. sg, , . substitute group ( ). , , . readers, users, readers. , xv, users, sg. , , xv, users,

:sg - users - xv

:sg - users - "xv my.gif"

, X Window xhost. newgrp X Window xterm, : , , , , . , , , .

X X Window . X, /etc/groups /etc/gshadow. , , . X , , , , , . :#!/bin/bash sg - gifs - /usr/X11R6/bin/xv &

xv, gifs. . , , . /etc/groups , . /etc/gshadow, , newgrp - sg. , X ( , X) . :#!/bin/bash xhosts +llhost sg - gifs -c /usr/X11R6/bin/xv &

(gifs). - , ( X xhost Linux). - ( xdm kdm) , , , .

: . ? . , root, root . ,

. , . , , ( , ) . .

su. substitute user ( ), , , , super user (). - . su, , , ( , ) root. , /etc/pam.d/su. , root, root, . /etc/pam.d/su 1.

su root , - su, ( , , ). , . , , (-) su . , , , . su , . , PATH PATH , . , . su ( ) root.

su, , . , root ? . sudo. , , . sudo sg. sudo __, , , . , root, . ? , . , . , , , , , 15 . , , - ? , . /etc . sudo , . . 4.

- : . , , , . , , , . , . . . , , . , . , , , . , , , . ( ) , , . , , , , , . , , . , . , . , , . , root. , , . . , . . , . , - , , ( users ), . , , , . 0 , , , 4.

, OpenLinux. : , , . . OpenLinux , . Linux , , . , , /etc/skel. /etc/skel :/bin /src /docs /misc

() , , . . , ,

- . ~/bin , PATH . , Linux.

, , , , . , , , Linux- ( web-, telnet . .). , . , . , . . ( ) , . , , , . , , . , . , .

. , . , . , , . , . , , . , . , , . , , . , , , , , . , , , . - ( , , ). ( ). ? . , . , , , , , , , . : . PIN- , . , , , , , , , ( , ,

). - , , . , , (social engineering). , . , , . . . , , , , - ( Enter , , - ), , , . , -, . . , . , , , , , , . . , , , . , , , .

, . , , ( RFC 2196 , ). - ? , , , - ? - ? , , , , (, , ). - , ? - ( ) ? , ( Ethernet )? , , , , , , . , , ( ) , . ? , . , . , , . , . . 1. makepasswd ( tech.ilp.physik.uni-essen.de/www.debian.org/Packages/stable/admin/makepasswd.html). makepasswd -, .

http://

2. , . 3. . 4. . . . , . , makepasswd, , ? , . , : - (!@#$%^&*, ) ; - , ; - ; - , . , : - ( ): party, fiesta, party5, fi3sta . .; - - : , , . . - : 610930, 300961 . .; - : , . .; - . . ( , , , , ). , , , . , , - . , , . (rose, oak, ivy . .) - , , (red, blu, blk) , , , : blk*ros3 .. blu!ivyred#oak4

, , . . makepasswd. , , . , . , , , . . makepasswd Perl, , , . :# makepasswd --char 8 --count 8 --crypt ecuraCdK aFP4Fy.p/K9bY dLeiVWVd Flqcui.9L3xQI 7FSBJEFH MkHjkpOIdSmLc ORA2vLsv !QYuK3Fw5Ih8U DuSbFxDj bB.thDEpz7Zi. wCPOIX6v Xe3ntRWjABCnM SowKUgvg Z485y6UQyMEdE xPViT6AU X9gm2NtZc.hK6

makepasswd , . , , (, studentl student100), , ,

.

-, , , , , ( ) . : ( UID/GID), /etc/shadow.

, : root, UID . . , 1 . , , , , , . , . , cut. , , , . - , . . , , expect, expect--. , , expect , , (, ftp rogue). , , . : . . ( , , ).1 #!/bin/bash 2 # (D.Bandel) 3 99; GPL # 4 # /etc/shadow 5 6 prog=/usr/bin/makepasswd 7 names=/root/newusernames 8 1ogins=/root/newlogins 9 tmpshadow=/root/shadow.tmp 10 startid=1000 11 12 if [ $UID != 0 ] ; then echo " $0, root" 14 exit 1 15 fi 16 17 if [ ! - /etc/shadow ] ; then 18 echo " shadow" 19 exit 2 20 fi 21 if [ ! -x $prog ] ; then 22 23 echo " $prog" exit 3

24 fi 25 if [ 'grep ":${startid}:" /etc/passwd' ] ; then 26 echo ", " 27 exit 4 28 fi 29 echo : echo " ..."

startid

(

UID/GID)

, makepasswd 1.07, (1.10 ) --clear. . .

1

30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50

for i in 'cat $names' do j='$prog --char 8' echo "${i}:${j}" >>$logins ; echo " . " done k=$startid;cp /etc/shadow /etc/shadow.orig echo ; echo " ..." for i in 'cat $logins' do j='echo $i | cut -d : -f 1 -' l='echo $i | cut -d : -f 2 -' groupadd -g $k $j useradd -m -u $k -g $j $j k=$[$k+l] m='$prog --clear=$l --crypt | cut -b 12 --' sed "s|$j:\*not set\*|$j:$m|" /etc/shadow > $tmpshadow mv $tmpshadow /etc/shadow ; echo " . " done exit 0

. /etc/newusernames, , . . - 6-10 , , , . , , /root. , /root . , , , (UID/GUID). - 12-28 . , . - 30-34 , . - 38-48 , , /etc/shadow. . makepasswd .

, , , . , , , - , - , , ( , , - ). , , , , - . , , - (screen saver), , ? . .

, . , , , , .

, . : . , . , , . , , , . . , .

3

: - Linux; - ; - ; - ; - .

. , 1 2, .

Linux: Linux . , Linux- , , . ., . , , . , . , . , , (, , , . .), Linux . . - , , . (UID), , (GID), . , .

Linux . . . ls -la, , , . , :drwxr-xr-x24 root drwxr-xr-x20 root drwxr-xr-x3 root crw-rw-r--1 root brw-rw-rw-1 root -rw-r--r-- 1 root srwxrwxrwx1 root prw------- 1 root lrwxrwxrwx1 root root root root root root root root root root 2048 Sep 4 00:01 . 1024 Aug 26 19:09 .. 1024 Jul 22 22:17 .civctp 29, 0 Aug 5 09:12 fbO 2, 0 Jul 27 19:14 fdO 694 Sep 2 21:02 foo 0 Sep 3 19:18 mysql.sock 0 Sep 3 19:14 initctl 4 Aug 5 08:49 sh -> bash

. d, d, d, , b, -, s, p, l. (. . 3.1). d ( directory). ,

. , . .., . , . (/), .. , . .. Linux, cd ... . .. , , . , . cd .. , , , . , , debugfs. , .., , , . . , , . 3.1. _____________________________ ___________ ___________________ , , d __________________________/bin b _______________/dev/hda ( _________________________________ IDE-) ____________/dev/ttyS1 ( com2 DOS) s ___________________________/dev/log (named pipe) ____/dev/inictl ( _________________________________ |) I _____________/dev/modem -> /dev/ttyS1

. , (.). , (- dot files), ls . , ls -. , . , . , ( , bash), . , , , . , - . - , . ( b) . , . /dev. , , , , ( ). , , () , , . , , , , 8 , , . . , , , , . . . . . , root ( , ) mknod. , , ( ), . /home.

:find /home -type b -print find /home -type -print

5.

, , . , , . , -, . Linux. , ( ASCII, , . .). s, . mysql , netstat -, :unix [] STREAM LISTENING 12210 /tmp/mysql.sock

, , ( LISTENING). . netstat 10.

, (named pipe). . , : , , . (symbolic link). (soft link). , . , , (target file). , , . , . - , , . Macintosh (alias), Windows (shortcut). , inode (information node). , , . , , , , , , , (atime), (ctime), (mtime), , , . debugfs.

Linux , (hard link) (link). , , -i -I:20512 -rwxr-xr-x 3 root root 20512 -rwxr-xr-x 3 root root 20512 -rwxr-xr-x 3 root root 49280 Jul 27 19:37 gunzip 49280 Jul 27 19:37 gzip 49280 Jul 27 19:37 zcat

, ls , ,

, 20512. (inode) . , . , , ls, . , ( ). , . , , , 49 280 . , ls , . , (inode). , - , , . , . , . , root, , . , zcat, gunzip gzip , 3 2. . . . . , . , , , , . . , . .., . (inode), , , . , , , . , . , , , , . . , , , , , , , , . .

:-rwxr-xr-x -rwxr-xr-x -rwxr-xr-x rwxr-x---rwxr-xr-x Irwxrwxrwx Irwxrwxrwx -rwxr-xr-x -rwxr-xr-x -rwxr-xr-x -rwxr-xr-x -rwxr-xr-x -rwxr-xr-x -rwxr-xr-x -rwxr-xr-x Irwxrwxrwx -rwxr-xr-x I root 1 root 1 root 1 root 1 root 1 root 1 root 1 root 1 root 1 root 1 root 1 root 1 root 1 root 1 root 1 root 1 root root root root root root root root root root root root root root root root root root 3164 Jul 27 20:27 arch 317504 Jul 27 22:22 bash 464564 Jul 28 02:54 bash2 34236 Jul 28 09:37 box 11856 Jul 28 09:37 build_menu 5 Aug 5 08:50 bunzip2 -> bzip2 5 Aug 5 08:50 bzcat -> bzip2 57404 Jul 27 20:11 bzip2 7152 Jul 27 20:11 bzip2recover 9240 Jul 27 21:12 cat 11692 Jul 27 21:38 chgrp 11820 Jul 27 21:38 chmod 12164 Jul 27 21:38 chown 28204 Jul 27 21:38 cp 47448 Jul 27 19:32 cpio 4 Aug 5 09:02 csh -> tcsh 38132 Jul 27 22:59 ctags

, ( - l) . . . . Linux

(mode) . , , , . (Read), w (Write), x (eXecute). , : , (rwx), , , (r-), (-). (inode) . 0 7, , , 000 111. : rwx. ( ) , , . , , (1), , (2), (4). 0 7. , ( ) 000 777. , , . rwxr-xr-x 755. , . , chmod 755 _. . 3.2. 3.2. -------000 - -- - -w - -w - - w -wx-wx-wx r--r--r-r-xr-xr-x rw-rw-rwrwxrwxrwx 111 222 333 444 555 666 777 (4, 2 1), rwxr-x--x = 751

, ( , , ). , , UID , . UID ( ) , , . UID UID , GID , GID , . , , , . UID, GID , , , . , . . : , , ; , ; ( ). , 750. root, box UID (, root), , . UID , GID. GID , , . UID, GID , , . .

, . , UID UID 055, , , . 055 , , , (, ), . , , , , . , , , . . Delete file overriding mode 0055? (y/n), : 0055 (/). . . , , . , . , , - . , , , . , . , , :perl myperlsript.pl sh myshellscript.sh

.sh, Perl .pl. , , Perl.

, , , - , file. , , /usr/ share/misc/magic. /etc/magic. , . , . , , , . , , , / . , , , , . , , , . , , . , , - . , , . , . . cd. , , . , , . , , incoming ftp-. :drwx-wx-wx 2 root ftp 1024 Jul 8 12:47 incoming

ftp- , . . ftp-, ,

(, , , ). . , , , / , . , - .

, . . . , , . , , umask (user mask) . umask , 0777, 0666 ( ), , . , , : umask, , 0777, 0666, . . : file , , umask 0777, umask 0666. OpenLinux /etc/config.d/ shells ( bashrc), umask . 022, 002. , , , 755 (rwxr-x-r-x), 644 (rw-r--r--). , , 775 (rwxrwxr-x), 664 (rw-rw-r--). umask , umask . umask (, umask 222).

chown chmod. , . , . , . chown / , , . . , , foo silvia silvia. root gifs, :chown root.gifs foo

, root .gifs. chmod . , , . , . , umask 002, 664. permission denied ( ). , , , . 664 755 (rwxr-xr-x). , :

chmod 755 filename

, , . : chmode , . : , , , . u, g, , , , g , , . : +, = -. + , - , =