Linux Server Security (Paperback)

by Michael D. Bauer (Author)
Key Phrases: hardening principles, web applications, configuring sendmail, Red Hat, Denial of Service, Securing Domain Name Services (more...)

Editorial Reviews

Product Description
Linux consistently appears high up in the list of popular Internet servers, whether it's for the Web, anonymous FTP, or general services such as DNS and delivering mail. But security is the foremost concern of anyone providing such a service. Any server experiences casual probe attempts dozens of time a day, and serious break-in attempts with some frequency as well.

This highly regarded book, originally titled "Building Secure Servers with Linux," combines practical advice with a firm knowledge of the technical tools needed to ensure security. The book focuses on the most common use of Linux--as a hub offering services to an organization or the Internet--and shows readers how to harden their hosts against attacks. An all-inclusive resource for Linux users who wish to harden their systems, "Linux Server Security" covers general security such as intrusion detection and firewalling a hub, as well as key services such as DNS, the Apache Web server, mail, and secure shell.

Author Michael D. Bauer, a security consultant, network architect, and lead author of the popular Paranoid Penguin column in the "Linux Journal," carefully outlines the security risks, defines precautions that can minimize those risks, and offers recipes for robust security. He is joined on several chapters by administrator and developer Bill Lubanovic.

A number of new security topics have been added for this edition, including:

Database security, with a focus on MySQL

Using OpenLDAP for authentication

An introduction to email encryption

The Cyrus IMAP service, a popular mail delivery agent

The vsftpd FTP server

Geared toward Linux users with little security expertise, the author explainssecurity concepts and techniques in clear language, beginning with the fundamentals. "Linux Server Security" with Linux provides a unique balance of "big picture" principles that transcend specific software packages and version numbers, and very clear procedures on securing some of those software packages on several popular distributions. With this book in hand, you'll have both the expertise and the tools to comprehensively secure your Linux system.

About the Author
Michael D. (Mick) Bauer, CISSP, is Network Security Architect for a large financial services provider. He is also Security Editor for Linux Journal Magazine, and author of its monthly "Paranoid Penguin" security column. Mick's areas of expertise include Linux security and general Unix security, network (TCP/IP) security, security assessment, and the development of security policies and awareness programs.

Product Details

• Paperback: 542 pages
• Publisher: O'Reilly Media, Inc.; 2 edition (January 18, 2005)
• Language: English
• ISBN-10: 0596006705
• ISBN-13: 978-0596006709
• Product Dimensions: 9 x 7.1 x 1.1 inches
• Shipping Weight: 1.6 pounds (View shipping rates and policies)
• Average Customer Review: 4.0 out of 5 stars See all reviews (8 customer reviews)
• Amazon.com Sales Rank: #644,817 in Books (See Bestsellers in Books)

  Popular in these categories: (What's this?)

  #6 in	Books > Computers & Internet > Business & Culture > File Sharing
  #23 in	Books > Computers & Internet > Web Development > Web Servers > Apache
  #24 in	Books > Computers & Internet > Operating Systems > Unix > Administration

Customer Reviews

Most Helpful Customer Reviews

12 of 14 people found the following review helpful:

4.0 out of 5 stars Solid, but perhaps too broad, January 26, 2005

By	Jack D. Herrington "engineer and author" (Silicon Valley, CA) - See all my reviews (TOP 500 REVIEWER)    (REAL NAME)

This is a somewhat high level walkthrough of all Linux related security issues, from basic networking and operating system issues, to web server configuration and scripting language security. At about 500 pages that's a tight squeeze, even for O'Reilly. Some of the coverage suffers, specifically I found the security information on PHP to be very scanty given the popularity of the language and how often web applications that use it are fraught with SQL injection vulnerabilities.

That being said, the writing is excellent, and the coverage that is there, which is at a reasonable level of depth, is solid. In addition, security is something you have to work at, so having an introduction to get you down the road is probably a good idea anyway. I'd like to see the next version have deeper information on web server security, but in the meantime this is a solid walkthrough of Linux security.

5 of 5 people found the following review helpful:

4.0 out of 5 stars For sys admins, June 2, 2005

By	Lloyd R. "slackwolf" (P'cola | FL | USA) - See all my reviews

Linux Server Security, Second Edition
By Michael D. Bauer
Second Edition January 2005
ISBN: 0-596-00670-5
544 pages, $44.95 US
(...)
This book goes along with the moving trend of the normal computer user, securing your data. Servers generally are targeted more often than the average home PC because most are made to be accessible from the outside world. This is where securing that server comes into play. This book covers the tools and techniques to securing your Bastion host.

First I'd like to start out and explain what Bastion host means as according this book so you can understand what this book covers more specifically. Bastion Host is defined as "A system that runs publicly accessible services but is usually not itself a firewall. Bastion hosts are what we put on DMZ (although they can be put anywhere). The term implies that a certain amount of system hardening has been done, but sadly, this is not always the case."

After you understand what a Bastion host is defined as, you should understand that this book mainly covers these server daemons and the systems that run them. But some of the information applies to a Linux desktop system such as a per host iptables firewall, using secure shell, keeping up with your logs, and intrusion detection. Most of these things the average user doesn't care much about but sometimes being paranoid comes in handy.

Someone who would most likely use this book more than the average desktop user would probaly be a system administrator. Securing web, database, ftp, dns, and email servers is what majority of this book contains. Along with covering these server systems, there are guides to securing the Linux system that runs these daemons along with designing the networks around these types of hosts.

One of the sections I'm most fond of is Chapter 2: Designing Perimeter Networks. With this section you can really take a look at the design and layout of the different types of networks and figure out the portions that suit your needs for your own network. The diagrams shown in this chapter help explain what is going on with the traffic and allows you to see exactly what is going on and at what points the systems are protected.

At the end of the book there are 2 well commented iptables firewall scripted that allow you to get a feel for the netfilter iptables system if you're not familiar with it already. With some modification of these scripts you can easily bring them into a working environment depending on your situation, which sometimes these helps with some of the frustration with the iptables syntax. I personally prefer the PF system within OpenBSD for it's clean syntax and have grown away from iptables, but both are powerful firewall systems and should fit the needs of your network.

I'd definitely recommend this book to system admins or anyone who is paranoid about their security. Security is always something that people should be educated about.

Lloyd Randall
Pensacola Linux User's Group

4 of 4 people found the following review helpful:

5.0 out of 5 stars Great Reference for New Server Admins, March 21, 2005

By	J. Huckaby (rackAID www.rackaid.com) - See all my reviews (REAL NAME)

I highly recommend this book to anyone who is involved with securing Internet servers. The book strikes a nice balance between theoretical background and implementation examples.

Though certainly not all encompassing, the book touches on several key elements of server security, including DNS, Email, File Servers, Web Services, IDS methods and more. People new or just curious about Linux server security will gain the most. More experienced system administrators will find a few implementation tips and useful background information for presentation or training purposes.

Unlike many server security books, this one includes some notes on alternatives to the most popular software packages. For example, the chapter on securing Internet email includes excellent tips on securing both Sendmail and Postfix while the IDS chapter covers the popular Tripwire package and some lesser-known integrity checkers. References and the end of each chapter are provided to point you to even more solutions.

This book certainly will not replace a dedicated reference volume, but I find it to be a good summary of major security practices for bastion hosts. Note that the book focuses primarily on host hardening. Though there are some sections on network security, most of the chapters focus on locking down your server. So if you are mainly interested in network clusters, network surveillance, or honeypots, you will probably want to find another reference. Also, if you have several years of experience, you may not find too much new information, but the book is a handy reference volume that can point you in the right direction. If, however, you are new to Linux server security or just simply want a concise summary of common security practices, then this will be a welcomed addition to your technical library.