Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 


Forgot your password?
Close
typodupeerror
×
Security Books Media Operating Systems Software The Internet Unix Book Reviews

Practical Unix & Internet Security 123

Posted by timothy from the updated-classic dept.
Charles McColm writes "At just under 1,000 pages the 3rd edition of Practical Unix & Internet Security might look intimidating on the shelf, but a quick glance through the pages reveals that it is both practical and entertaining. With Slammer and Blaster making their way into the news it seemed like a good time to brush up on security. Already considered a classic reference, the 3rd edition of the book provides extensive updated information about topics like PAM (Pluggable Authentication Modules), LDAP, forensics, intrusion detection, wireless devices, and cryptography." Read on for the rest of McColm's impressions of the book.
Practical Unix & Internet Security
author Simson Garfinkel, Gene Spafford & Alan Schwartz
pages 954
publisher O'Reilly & Associates
rating 8/10
reviewer Charles McColm
ISBN 0596003234
summary The 3rd edition of Practical Unix & Internet Security adds much-needed updated information to an already classic security text. It's very comprehensive but a little dry in parts.

Practical Unix & Internet Security is divided up into six sections:

The first section covers the basics of computer security, tracing the history of Unix and security, as well as providing details of what should be in a good security policy.

The second section covers the building blocks of security, authentication, users and groups, filesystems, cryptography, physical security for servers, and personnel security.

Network and Internet security are focused on in the third section, with emphasis on modems and dialup security, TCP/IP networks, securing TCP and UDP services, Sun RPC, NIS, Kerberos, LDAP, NFS, and SAMBA, and finishing up with a chapter dedicated to secure programming techniques.

Day-to-day operations are the focus of the fourth section. Keeping up to date, making backups, defending accounts, using integrity checking tools, and auditing, logging, and forensics are all expanded upon in detail over five chapters.

The fifth section rounds off the main part of the book by describing how to handle security incidents. Special focus is given to discovering a break-in, protecting against programmed threats, Denial of Service Attacks (& DDoS), legal options, and a chapter on who you can trust.

The Appendixes make up the sixth and final section. Not a spot is wasted in the appendixes, which begin with a Unix security checklist, and then outline Unix processes, provide extensive links to both paper and electronic resources, and conclude with a sub-section on security organizations.

Among the topics I found most interesting were: Access Control Lists (ACL), Pluggable Authentication Modules (PAM), the section about 128-bit keys and dictionary-based passwords, connection laundering, honeypots, the false syslog example, and the example detailing a call to Microsoft's anti-piracy help line. The real-life examples scattered throughout Practical Unix & Internet Security keep the security sections from seeming overwhelming. This is one of the few books that I've found ever chapter of the appendix useful, so don't overlook them as simple reference pages.

Normally one-liners are reserved for movie discussions but for those who've already delved into Practical Unix & Internet Security here are a few of my favorite one-liners:

  • "...we do believe that making files readable and writable by everyone leads to many evil deeds." - talking about the octal mode 666.

  • "Humidity is your computer's friend." - just before static discharge kills your entire system.

  • "Beware of Key Employees." - warning against making one person so key that their departure could cause your company irreparable harm.

  • "You mean, you don't really have a copy? [of Windows 98]" - the last part of a conversation with Microsoft's Anti-Piracy line. The company which called Microsoft's was tracing some intruders who had uploaded a copy of Windows 98 to the company's web site and was using the site to peddle warez. Microsoft was just about to launch Windows 98. The example shows just how clueless some help desks can be.

There are a few spelling mistakes and grammatical flaws but not enough to take away from the bulk of the information and no glaring omissions. UUCP coverage was dumped because UUCP simply is not a practical anymore now that more advanced alternatives like sendmail exist. I started glazing over material by the middle of the NIS chapter, but it probably had more to do with the fact that I was thinking about the other 400 or so pages I had to read before I finished the main section of the book rather than the topic itself.

One of the great things about Practical Unix & Internet Security is that it is appropriate for a wide audience. There is relevant material for system administrators, security, company decision makers, even the guy sitting at the accounting terminal. Despite its massive size Practical Unix & Internet Security is entertaining enough to be read cover to cover. (It's good for the arm muscles too.) Though it is easy to read, beginners should probably reread their system manual before plunging headlong into this book. All in all Practical Unix & Internet Security continues to be one of those must-have books for any Linux user.

You can purchase Practical Unix & Internet Security from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.
This discussion has been archived. No new comments can be posted.

Practical Unix & Internet Security More

Practical Unix & Internet Security

Comments Filter:

  • Practical UNIX... (Score:5, Funny)

    by Anonymous Coward on Tuesday August 26, 2003 @01:19PM (#6795720)
    The companion book [cashncarrion.co.uk] seems, uh, interesting too. :)

  • the thing i always want to know (Score:5, Interesting)

    by Transient0 ( 175617 ) on Tuesday August 26, 2003 @01:19PM (#6795725) Homepage
    when talking about computer books is:

    What does this book offer that I can't easily find by asking google or google groups?

  • Get for just $27! (Score:5, Interesting)

    by Anonymous Coward on Tuesday August 26, 2003 @01:20PM (#6795732)
    Thanks to froogle price check [google.com]

  • viruses (Score:1, Insightful)

    by K_Bomb ( 250478 )
    one thing unix doesnt really have to worry about is viruses..

    except when the virus has a brain and the users choose weak passwords

    • Re:viruses (Score:4, Insightful)

      by Medievalist ( 16032 ) on Tuesday August 26, 2003 @01:32PM (#6795878)
      one thing unix doesnt really have to worry about is viruses..
      I'm not so sure.

      Since people frequently use tools like NIS, rdist, rsync/ssh, and LDAP to create single authentication domains that span multiple physical boxen, somebody could use one of the usual social engineering tricks to get root on a single box and then load a boot-sector infector into the .profile in root's home dir. Then, every time root logs in on any particular physical box, that box get the boot-sector virus loaded.

      Best that *nix sysadmins remain on guard, regardless.

      • Re:viruses (Score:5, Funny)

        by jdludlow ( 316515 ) on Tuesday August 26, 2003 @01:41PM (#6795982)
        boot-sector infector

        Sounds like a nerd garage band.

      • somebody could use one of the usual social engineering tricks to...

        Not with the facist-nazi SAs I have in my group. Root should really never be handed out. "sudo" may not be perfect, but it's a far better alternative. The only reason we give root out is for very specific servers and for limited amounts of time.

        The other thing is that your trusted server had better not be loading .profile from remote boxes anyway, certianly not for root. Even our everyday users have scripts they have to run to set u

        • > Remember "social engineering" only works on people with social
          > skills! We read BOFH articles in the same way as "HOW-TO" documents!

          User: I'm having a little trouble starting up Notepad...
          BOFH: That's because we're standardising everyone on two text
          editors, to maintain consistency across the network. We
          upgraded the Windows systems from Notepad to EDLIN last
          night during overnight processing.
          User: But I don't know how to use EDLIN!
          BOFH: Whose fault is that?
          User: You said
      • While I have thought of setting up such a configuration for regular user authentication, I had always just 'felt' that I shouldn't do that with the root accounts on the various machines under my control.

        I never have known why I felt that way, just that it is something that didn't seem right to me. So, when I do get that all slapped together on the network I am running, I will make certain to work it in such a way as to keep root out of the chain.

        I already use a different root password on every
  • I think a few new books on Windows security will be coming out soon to take advantage of the latest worms. But its the nature of the open-source community to continually test each other that ultimately leads to security excellence.

  • At least you have your health! (Score:3, Funny)

    by Anonymous Coward on Tuesday August 26, 2003 @01:21PM (#6795749)
    How does one glance quickly through a 1000-page book without straining something important? ;-D
  • But can we patch OpenServer(UnixWare) with it?

    Had to ask since SCO can not seem to patch OpenServer

  • UUCP (Score:5, Informative)

    by Medievalist ( 16032 ) on Tuesday August 26, 2003 @01:25PM (#6795790)
    UUCP coverage was dumped because UUCP simply is not a practical anymore now that more advanced alternatives like sendmail exist.
    Um, I think you meant "UUCP is not necessary anymore now that PPP, NNTP and SMTP are widely supported".

    Sendmail (a program) is not an alternative to UUCP (a protocol). Even if you are talking about the UUCP software and not the protocol, the alternative is pppd, not sendmail.

    Sendmail still supports UUCP, but most distros do not enable that support, and hardly anyone uses UUCP anymore.

    • HP-sUX still needs UUCP (Score:2, Interesting)

      by Anonymous Coward
      Because the uucp uid still owns all the serial port hardware. You need UUCP so that your modems will work, even though they are not running the UUCP protocol.

      One MORE reason why HP-UX is the most GODAWFUL WORST *NIX on the FUCKING PLANET!

      • Because the uucp uid still owns all the serial port hardware. You need UUCP so that your modems will work, even though they are not running the UUCP protocol.

        This is irrational. Presumably you could create any user/group you wanted and give it access to this hardware, so long as the users that the programs that need access to this hardware run as are also part of that group/that user. BUt why mess with perfection? If it works, there is no reason to change it. There is nothing magic about the name uu

      • > One MORE reason why HP-UX is the most GODAWFUL WORST *NIX

        Are you certain you don't have it confused with XENIX?

  • Simson Garfinkel... (Score:5, Funny)

    by ravind ( 701403 ) on Tuesday August 26, 2003 @01:26PM (#6795807)
    ...I love their music :D

  • this vs. Robert Slade in comp.risks (Score:4, Interesting)

    by ansak ( 80421 ) on Tuesday August 26, 2003 @01:27PM (#6795828) Homepage Journal
    For more book reviews, especially on computer security, watch for Robert Slade's regular contributions to comp.risks [comp.risks]. It doesn't look as though Robert has reviewed this one yet so I'll look forward to reading and comparing. His praise for a former edition [victoria.tc.ca] seems uncharacteristically positive -- compare reviews of Secrets of a Super Hacker [victoria.tc.ca] or Computer Security Basics [victoria.tc.ca] -- so I'll be surprised if he doesn't praise this one, too...

    cheers...ank

  • is there a digital copy with the book? (Score:4, Interesting)

    by phaetonic ( 621542 ) on Tuesday August 26, 2003 @01:27PM (#6795829)
    my newest requirement is to have the book in PDF format so I can simply search for keywords, saving time, and hassle. having the PDF on a few different computers and storing the book away after skimming through it works better than having thousands and thousands of pages take up my precious 500 sq ft. apartment
    • Yes, ed2k link please!
    • Not PDF, but online in html [oreilly.com].

    • Re:is there a digital copy with the book? (Score:4, Informative)

      by LinuxHam ( 52232 ) on Tuesday August 26, 2003 @03:50PM (#6797645) Homepage Journal
      Being a good IBMer, here [ibm.com] are a couple. :) But seriously, many people tend to miss IBM's publishing arm, and never even realize that all of their books are published as freely downloadable PDF's. Granted, there's an IBM slant to most of it, but there are some really good, get-to-the-good-stuff, hands-on tasty morsels in there. In fact, this [ibm.com] book on AIX is currently $117 at Amazon. Take the PDF to OfficeMax and get a book bound with comb binding (so it opens flat) for 1/3rd the price, and you can put the CD you burned the PDF onto inside the back cover :)

      If you [have|want] to manage large quantities of Linux servers, pay closer attention to the Linux on zSeries materials since its customary to run hundreds of virtual Linux servers at a time, and they still need to be managed. Same goes for HPC clusters. Since these books are written by different people, its neat to hear the tack they've each taken to managing large-scale communities. One book even touches on configuring a Linux virtual server on a zbox with LEAF [sf.net] to serve as a software firewall for the remaining machines.

      You laugh!

  • and also importantly... (Score:4, Insightful)

    by spamchang ( 302052 ) on Tuesday August 26, 2003 @01:34PM (#6795900) Journal
    what about social engineering? or do they trust management and sysadmins to be socially mobile, compatible, and perceptive? i think humans are one of the weaker links in the security chain.

  • Hey... (Score:5, Funny)

    by blueforce ( 192332 ) <clannagael@@@gmail...com> on Tuesday August 26, 2003 @01:35PM (#6795915) Homepage Journal

    One of the great things about Practical Unix & Internet Security is that it is appropriate for a wide audience

    I resemble that remark.

    • you forgot something:
      I resemble that remark you insensitive clod!

    • I tried reading Oreilly's Unix Power tools, I then decided to read the man page for every command in /bin. I then wiped my Linux install with a badly formatted shred command. Now I am going to try LFS. Is it appropriate for me? Hmmmm.

  • This sounds like something I want on my shelf... (Score:3, Insightful)

    by John Seminal ( 698722 ) on Tuesday August 26, 2003 @01:37PM (#6795940) Journal
    I know that many computer users do not ever look at computer security, they just plug it in and go. At the best, some of my friends will block ports, but that is about it. They do not check logs, or anything. And how many people out there have a second PC attached by serial cable to log intrusion data? I think if more people secured their systems, then everyones security would increase because there would be less places to launch attacks from. What we need is someone at the major distros to write a program which, when executed, will secure a system. Something which is point and click "easy".

  • This book is overkill for slammer/blaster (Score:3, Insightful)

    by SpaFF ( 18764 ) on Tuesday August 26, 2003 @01:38PM (#6795942) Homepage
    With Slammer and Blaster making their way into the news it seemed like a good time to brush up on security.

    You don't need a 1000 page book on security to patch your systems against worms; you need a 1 page book on common sense.

  • Sample Chapters (Score:5, Informative)

    by Anonymous Coward on Tuesday August 26, 2003 @01:51PM (#6796105)
    Sample chapters of the book can be found here [oreilly.com] and here. [onlamp.com] I read this first one (the one on TCP/IP) and found that it was an excellent introducation to it. The other is on "secure programming techniques." Gotta read that.
  • Using this [openbsd.org]during my install of an OpenBSD firewall taught me a quite a bit.
  • The sysadmins are known in our organization as the "illiterati". What we are not sure about is whether it's can't read or won't read, but we know for sure they don't read... <SIGH>

    I thought about audio books, but the sysadmins don't listen, either. <SIGH^2>

    To the topic: All the manuals in the world, no matter how thorough & thoughtfully written, are of no use if the people who need to read them are busier worrying about their golf game. And the doubly sad thing, is that these guys "know

  • Sounds practical, alright.

    Now if I could only find a good off-shore haven... [vacationbookreview.com]
  • Why can't book publishers provide these tomes in multiple volumes so you don't have to break your wrists trying to read through the book?

    My RSI is bad enough as it is.

    A book like this borders on being unreadable because of its size. And its especially irritating to have to man-handle the book if you just want to look at the material in a single section or chapter.

  • After reading the sample chapter @ oreilly, it seems like a good book fo beginners. I if you have involved in sysadmin/sys security, this book might be too basic for you. Just my thoughts.
    www.xml-dev.com [xml-dev.com]

    • Re:good book for beginners (Score:4, Interesting)

      by LinuxHam ( 52232 ) on Tuesday August 26, 2003 @03:22PM (#6797283) Homepage Journal
      Yes, an older edition of this book did help me back when I was a beginner. But, its also one of the books that taught me that by the time something is in print, it's already out of date.

      I learned all the great stuff about TCP Wrappers and how it was revolutionizing inetd. When I went to my Slackware box to try to implement, it was already done! Same for shadow passwords. Its funny in that, even being a 7 year user and an RHCE, it still seems like commercial UNIX was in the dark ages until the early 90's just based on those two features alone. Not to say MS was any better (my god no), but to require applications to have root privs to bind to a low port and have world-readable password hashes just seems like something from a million years ago. Different times, those were.

      I *still* have to instruct local UNIX pros on the virtues of ssh over telnet. If the X forwarding over ssh doesn't sell them on it, password collectors like ettercap will, every time ;)
    • Well thank you for judging the depth of the book based on one sample chapter.

      Seriously, the chapter given (11), was more of a prelude and background to chapter 12, which is securing TCP and UDP services. Don't be too misled.
  • FYI, Fyodor [insecure.org] of nmap [insecure.org] fame endorsed this book in his earlier (and quite thorough) slashdot interview [slashdot.org].

    If it's good enough for him, it's good enough for me. That spurred me to read it, and I've found it to be quite an interesting read. It also has a good history section, detailing the "family-tree" of all the unices.
  • I have this book. It's very good. What I would be interested in are any comments from any old hands at UNIX security who also have it and noticed anything wrong with or ommited from it. For myself, a UNIX developer with average network experience, I'd like to learn what flaws there are that I can't see.
    • I'm a co-author of this book, and I can tell you two things that were omitted. We don't spend a lot of time on web application security, because the other ORA book, Web Security, Privacy, and Commerce focuses exclusively on that. And we don't do much about 802.11 wireless security beyond noting that WEP isn't enough, because again, there's a whole book on this and the field is changing very quickly.

      Of course, I still think it's a great book, but that's to be expected. :)
  • I almost considered buying this book, but then I remembered that season 3 of The Simpsons just came out today. Guess I won't be reading for a while... :) And the DVD set comes with a bottle opener. Guess I'm going to be drinking tonight... :)
  • Price at BN: $43.96, price at http://www.bookpool.com : $33.50 and possible free shipping if you order more than $40.

    Disclaimer: I'm not affiliated with Bookpool and receive no kickbacks. I've been a happy customer with BP and just don't like to pay too much for books.

    regards,

    Heiko

Slashdot Top Deals

He has not acquired a fortune; the fortune has acquired him. -- Bion

Close