Welcome to Unix and Linux, security for these operating systems is a complete paradigm shift from Windows. Unix has been around a lot longer. The source code for Linux is freely available, so would be attackers are free to examine it and test it for holes such as buffer overflows and deadlock conditions. | Securing and Auditing Unix Examples tested on a Red Hat Linux Hedwig build Secure System Administration - SANS GIAC 2000 2001 1 Welcome to Unix and Linux security for these operating systems is a complete paradigm shift from Windows. Unix has been around a lot longer. The source code for Linux is freely available so would be attackers are free to examine it and test it for holes such as buffer overflows and deadlock conditions. Linux is different than Unix. Has the source code been available for Unix Certainly you used to be able to license source for both the ATT and BSD versions of Unix. It is rumored the Sun source code was stolen once via a workstation with a modem connection. This means that we are dealing with a lot more knowns than with Windows. Well at least that was true until October 2000 and critical Microsoft source code was stolen. From now on the rules of the game are who knows the most wins . Let s start our discussion with the notion of a firm foundation. Nothing is certain but if we can start with a clean build we have a better chance of ending up with a secure system. 1 A Clean Build is a Happy Build Load from CD Load from Net Load from another system Load from tape Secure System Administration - SANS GIAC 2000 2001 2 Windows loads from CDs. They are licensed and controlled. Though it is possible there could be a compromised version it is unlikely. The initial load of Unix can be a whole new ballgame. Many Unix systems make it easy to clone a system from an existing system. You plug in your Ethernet cable power on the system and the new computer looks for a system to boot from. This is great. unless the system you boot from is already compromised. The same thing goes for backup tapes. This is a big problem in incident handling. How do you know you are loading from a clean operating system For Linux it is possible to load from an Internet site but in general it is best to load from the CDROM. If you start out compromised you may never get .
