UNIT FIVE

SECURITY

1
 What is LINUX
Linux is a free Unix-type operating system
originally created by Linus Torvalds with the
assistance of developers around the world.
It originated in 1991 as a personal project of
Linus Torvalds, a Finnish graduate student.
The Kernel version 1.0 was released in 1994
and today the most recent stable version is
2.6.9
Developed under the GNU General Public
License , the source code for Linux is freely
available to everyone.
2
 Why LINUX/UNIX?
 LINUX is free.
 · Can view and edit the source code of OS
 It is fully customizable.
 Most Important Feature is Stability
 · Important in shared environments and
critical applications
 LINUX has better security structure.
 High Portability
 · Easy to port new H/W Platform
 · Written in C which is highly portable

3
 Linux System Networking Concepts
 Linux itself is just a kernel.
 Linux can be configured as a networked workstation, a
DNS server, a DHCP server, a web server, a mail server, a
file and print server, database server, a firewall, a
gateway router and many more. Is Linux can be all that?
Yes it can.
 In this section, you will learn the true meaning of Linux,
which is a network operating system or server system,
to be all that mention above.
 The first thing you should learn about networking is ip
addresses.

4
 Cont’d…
 A server and a client computer must have an ip
address so that it can be reach in network
environment.
 Linux server can serves networking 365 days a
year without any problem.
 It's a proof that Linux is a very stable and secure
network operating system when properly
configured and maintained.
 All that starts with setting up a network card and
configure an ip address for the server.

5
 Cont’d…
 During this period of learning, understanding
of Linux command structure and syntax is
necessary.
 Setting up and configuring Linux network
requires testing and troubleshooting.
 You might encounter errors, which is most
likely, and try to troubleshoot by analyzing
error log files.

6
 Linux Service/Server Administration
 On a Linux system the system administrator is
frequently the owner and only user of the system.
 This person has many responsibilities.
 The first responsibility may be to set up the system
and install the software.
 Once the system is up and running, the system
administrator is responsible for downloading and
installing software(including upgrading the operating
system), backing up and restoring files, and managing
such system facilities as printers, terminals, servers, and
a local network.
7
 Cont’d…
 The system administrator is also responsible for
setting up accounts for new users on a multiuser
system, bringing the system up and down as needed,
and taking care of any problems that arise.

8
 GUIs: Graphical User Interfaces
 The X Window System (also called X or X11) was
developed in part by researchers at MIT (Massachusetts
Institute of Technology) and provides the foundation for
the GUIs available with Linux.
 Given a terminal or workstation screen that supports X, a
user can interact with the computer through multiple
windows on the screen, display Graphical information, or
use special-purpose applications to draw pictures,
monitor processes, or preview formatted output.
 X is an across-the network protocol that allows a user to
open a window on a workstation or computer system
that is remote from the CPU generating the window.
9
 (Inter)Networking Utilities
 Linux network support includes many utilities that enable
you to access remote systems over a variety of networks.
 In addition to sending email to users on other systems,
you can access files on disks mounted on other
computers as if they were located on the local system,
make your files available to other systems in a similar
manner, copy files back and forth,
 Also run programs on remote systems while displaying
the results on the local system, and perform many other
operations across local Area Networks(LANs) and Wide
Area Networks(WANs),including the Internet.

10
 Software Development
 One of Linux’s most impressive strengths is its
rich software development environment.
 You can find compilers and Interpreters for
many computer languages.
 Besides C and C++,languages available for
Linux include Ada, FORTRAN, Java, Lisp,
Pascal, Perl, and Python.

11
 Open Source Licenses
 Open Source licenses ensure basic freedoms,
including:
 The freedom to use the software for any
purpose
 The freedom to distribute the software to
others
 The freedom to modify the software
 The freedom to distribute the modified
software to others (under the same licensing
conditions)
12
 GPL, MPL and BSD licenses are some
examples
 LINUX Distributions
 Mandrake: [Link]
 RedHat: [Link]
 Fedora: [Link]
 SuSE/Novell: [Link]
 Debian: [Link]
 Ubuntu: [Link]

13
 Supporting a Windows Network - through SAMB
 Integrating Linux and Window
 What is Samba?
 Free suite of programs that enables flavors of
UNIX to work with other operating systems such
as OS/2 and Windows, as both a server and a
client
 As a server, Samba shares Linux files and
printers with Windows systems.
 As a client, Samba gives Linux users access to
files on Windows systems

14
 Shares
 Under Samba, an exported directory hierarchy is
called a share.
 Samba derived from SMB – protocol for file and
printer sharing in Windows
Samba Users, User Maps, and Passwords
 For a Windows user to gain access to Samba
services on a Linux system, the user must provide a
Windows username and a Samba password.
 It is also possible to authenticate using other
methods such as LDAP or PAM
15
 Usernames
 The supplied username must be the same as a
Linux username or must map to a Linux username.
 Samba keeps the username maps in/etc/samba/
smbusers.
 Users with the same username on Windows and
Samba do not need to appear in this file, but still
need a Samba password
 When you install Samba, /etc/samba/smbusers has
2 entries:
root = administrator admin
Nobody = guest pcguest smbguest
16
 Passwords
 Samba uses Samba passwords, not Linux passwords
to authenticate users.
 When you attempt to connect from Windows to a
Samba server, Windows presents your Windows
username and password to Samba.
 If your windows username is the same as or maps to
your Linux username,
 Also if your Windows and Samba passwords are the
same, you do not have to enter a username and
password to connect to the Samba server.
 Samba keeps passwords in /etc/samba/smbpasswd

17
 To add Samba access for the Win user
sam
 vi smbusers
sls = sam
 # smbpasswd –a sls
New SMB password:
Retype new SMB password:
Added user sls
 Now when sam uses the username sam to log in to
the Samba server, Samba maps sam to sls and
looks up sls in smbpasswd.
 Sam logs on as sls.

18
 Configuring a Samba Server
 system-config-samba – can set up only basic
features of a Samba server.
 Performs 3 functions:
Configuration of server
Configuration of users
Setting up shares that are exported to
Windows machines
 Overwrites /etc/samba/[Link]. Make
backup copy before running system-config-
samba
19
 Configuring samba using system-config-samba
 System-config-samba
Set workgroup to workgroup in use on
Windows machines.
Make sure authentication is set to user
Set encrypted passwords to Yes
Add Samba users
Add shares

20
 Swat: Configures a Samba
server
 Samba Web Administration Tool – is a
browser-based GUI for the [Link] file.
 Swat is run from /etc/xinetd.d/swat
 Turn on by changing disable = yes to
disable=no.
 Add any remote names or Ips of other
systems that will access swat
 Chkconfig swat on
 Service xinetd restart
 To access, enter [Link] or http://
21 localhost:901
 Manually configuring a Samba server
 Edit the /etc/samba/[Link]
 Can set up:
Global parameters
Security parameters
Logging parameters
Browser parameters
Communication parameters
Share parameters

22
 Sharing user’s home directories
 Often, users like to share their home directories
with a Windows machine.
 To make this easier, Samba provides the [homes]
share.
 When you define this share, each user’s home
directory is shared with the specified parameters.
 For example:
[homes]
comment = Home Directories
browseable = no
writable = yes
 This prevents users other than the owners from
23 browsing home directories while allowing logged-
in owners full access.
 Accessing Windows Shares from
Linux
 As a client, samba enables you to view and
work with files on a Windows system from a
Linux system.
 smbtree – displays windows shares in a
hierarchical tree.
 When prompted for a password, hit enter to
view shares available to guest.
 Enter password to view restricted shares.

24
 Smbclient: Connects to Windows Shares
 Smbclient functions similarly to ftp and
connects to a windows share.
 $ smbclient //PB/mark connects to a windows
share
Mounting Windows Shares
 On the Linux computer, you can mount a
Windows share so that you can write files to it.
 Mount –t cifs //host/sharedir /share –o
username=mark, password=pizza
 Ls /
25
 Troubleshooting
 Samba provides 3 utilities to troubleshoot a
connection:
Smbstatus – displays a report on open
Samba connections
Testparm – checks the syntax of /etc/
samba/[Link] and displays its contents
Testprns – checks the validity name of a
printer

26
 Troubleshooting
1. Restart the smbd and nmbd daemons
 Service smb restart
2. Run testparm to check that the [Link] is
syntactically correct
3. Ping from both sides of the connection to
make sure that the network is up.
4. From Windows, net view \\servername to
display a list of shares available from the
server.
5. Try to map the drive with a net use x:
\\pb\tmp
27
6. Sbclient –L pb List all available shares
 File Security
File Permissions in Linux
 There are three Classes – Owner, Group, Others.
 The Owner is the usually the creator of the files/
folders.
 In Linux, files or folders that you created in your
Home directory are usually owned by you, unless
you specifically change the ownership.
 The Group contains a group of users who share
the same permissions and user privilege.
 Others means the general public.
 As for permissions, there are 3 type of actions
that you can perform on a file/folder. You can
28
either read, write or execute.
 Cont’d…
 Read – You can only view the file, but cannot
modify the content of the file.
 When applied on Folder, you can only view the
files in the folder, but you can’t delete from or
add files into the folder.
 Write – You can edit and modify the file. For
Folders, you can delete and add files into the
folder.
 Execute – Execute is mainly used when you
need to run the file (commonly used when you
need to run a script).
29
 Cont’d…
What’s about the number?
With the basic understanding of the Classes and
Permissions, let’s delve into it further and see how the
“777” or “775” come about.
Every file and folder contain a 8-bit data that
control the permissions.
 At its basic binary form, it will be “000”, which
means no permissions of any form is granted.
When you set a “Read” permission, it will add 4-bit
to the data, making it “100” (in binary format) or a “4”
in the usual decimal format.

30
 Cont’d…
 Setting a “Write” permission will add 2-bit to
the data, making it “010” and “2” in decimal
form.
 Lastly, setting an “Execute” permission adds
1-bit to the data, which will result in “001”, or
“1” in decimal form. In short:
 Read is equivalent to ‘4’.
 Write is equivalent to ‘2’.
 Execute is equivalent to ‘1’

31
 Cont’d…
 When we want to set permissions, we just add up
the number.
 For example, to set the permissions to read and
write, we will use ‘6’ (4 + 2) for the permission.
 For read, write and execute, we will use ‘7’ (4 + 2 +
1) for the permission.
 0 – no permission
1 – execute
2 – write
3 – write and execute
4 – read
5 – read and execute
6 – read and write
32 7 – read, write, and execute
 Cont’d…
 What about the 3 digits ‘777’?
 Well, the first digit is assigned to the Owner, the second
digit is assigned to the Group and the third digit is
assigned to the Others.
 So for a file with ‘777’ permission, everyone can read,
write and execute the file.
Here are some of the commonly used permissions:
 755 – This set of permission is commonly used in web
server.
 The owner has all the permissions to read, write and
execute.
33  Everyone else can only read and execute, but cannot
make changes to the file.
 Cont’d…
 777 – Everyone can read write and execute.
 In a web server, it is not advisable to set ‘777’ permission
for your files and folders as it allows anyone to add
malicious code to your server.
 However, in some cases, you will need to set the 777
permissions before you can upload any file to the server
(For example, uploading images in WordPress)
 644 – Only the owner can read and write. Everyone else
can only read. No one can execute the file.
 655 – Only the owner can read and write, but not execute
the file.
 Everyone else can read and execute, but cannot modify
the file.
34
 Package Management
Apt-Get
The apt-get command is a powerful command
line tool.
Which is used to work with Ubuntu's Advanced
Packaging Tool (APT) performing such functions
as installation of new software packages,
 Upgrade of existing software packages,
updating of the package list index, and even
upgrading the entire Ubuntu system.

35
 Cont’d…
 apt-get update – refresh available updates
 apt-get upgrade – upgrade all packages
 apt-get dist-upgrade – upgrade with package
replacements; upgrade Ubuntu version
 Apt-cache policy pkg-check weather the pkg
installed or not
 Apt-cache search pkg-check the avialability of the
pkg
 apt-get install pkg – install pkg
 apt-get purge pkg – uninstall pkg
 apt-get autoremove – remove obsolete packages
 apt-get -f install – try to fix broken packages
36  dpkg --configure -a – try to fix broken packages