Forfatterarkiv: mike

Enforce user and groups resource limits

Udgivet den juli 9, 2004 af mike

Make sure resource-hungry users don’t bring down your entire system. Whether it’s through malicious intent or an unintentional slip, having a user bring your system down to a slow crawl by using too much memory or CPU time is no … Læs resten →

Udgivet i Knowledge Base, Linux, Old Base | Skriv en kommentar

Restricted Shell Environments

Udgivet den juli 9, 2004 af mike

Keep your users from shooting themselves (and you) in the foot. Sometimes a sandboxed environment [Hack #10] is overkill for your needs. If you want to set up a restricted environment for a group of users that only allows them … Læs resten →

Udgivet i Knowledge Base, Linux, Old Base | Skriv en kommentar

Control login access with pam

Udgivet den juli 9, 2004 af mike

Seize fine-grained control of when and where your users can access your system. In traditional Unix authentication there is not much granularity available in limiting a user’s ability to log in. For example, how would you limit the hosts that … Læs resten →

Udgivet i Knowledge Base, Linux, Old Base | Skriv en kommentar

Automated systrace policy creation

Udgivet den juli 9, 2004 af mike

Let Systrace’s automated mode do your work for you. In a true paranoid’s ideal world, system administrators would read the source code for every application on their system and be able to build system-call access policies by hand, relying only … Læs resten →

Udgivet i Knowledge Base, Old Base | Skriv en kommentar

Restricting system calls with systrace (BSD)

Udgivet den juli 9, 2004 af mike

Keep your programs from performing tasks they weren’t meant to do. One of the more exciting new features in NetBSD and OpenBSD is systrace, a system call access manager. With systrace, a system administrator can specify which programs can make … Læs resten →

Udgivet i FreeBSD, Knowledge Base, Old Base | Skriv en kommentar

Restrict apps with grsecurity

Udgivet den juli 9, 2004 af mike

To restrict specific applications, you will need to make use of the gradm utility, which can be downloaded from the main grsecurity site (http://www.grsecurity.net). You can compile and install it in the usual way: unpack the source distribution, change into … Læs resten →

Udgivet i Knowledge Base, Linux, Old Base | Skriv en kommentar

Lock down your kernel with grsecurity

Udgivet den juli 9, 2004 af mike

Harden your system against attacks with the grsecurity kernel patch. Hardening a Unix system can be a difficult process. It typically involves setting up all the services that the system will run in the most secure fashion possible, as well … Læs resten →

Udgivet i Knowledge Base, Linux, Old Base | Skriv en kommentar

Make compilers estinguis buffer overflows (eller noget)

Udgivet den juli 9, 2004 af mike

In C and C++, memory for local variables is allocated in a chunk of memory called the stack. Information pertaining to the control flow of a program is also maintained on the stack. If an array is allocated on the … Læs resten →

Udgivet i Knowledge Base, Old Base | Skriv en kommentar

Mysql authentication for proftpd

Udgivet den juli 9, 2004 af mike

Make sure that your database system’s OS is running as efficiently as possible with these tweaks. proftpd is a powerful FTP daemon with a configuration syntax much like Apache. It has a whole slew of options not available in most … Læs resten →

Udgivet i Knowledge Base, Old Base | Skriv en kommentar

automatic siganutre verification

Udgivet den juli 9, 2004 af mike

Use scripting and key servers to automate the chore of checking software authenticity. One of the most important things you can do for the security of your system is to be familiar with the software you are installing. You probably … Læs resten →

Udgivet i Knowledge Base, Old Base | Skriv en kommentar