SCO UNIX System administrators must look at the system security issues

This paper discusses the security problem of Unix from the point of view of system administrator, and ensures the daily work of the system's development and operation.

1. Security Management

Security management is divided into four main areas:

(1) Preventing unauthorized access: this is the most important problem with computer security: People who are not using the system enter the system. User awareness, good password management (coordinated by both the system administrator and the user), log in activity records and reports, and periodic checks of user and network activity are key to preventing unauthorized access.

(2) Preventing leaks: This is also an important issue in computer security. Prevents authorized or unauthorized users from accessing each other's important information. File system audit, SU Login and report, user awareness, encryption is the key to prevent leaks.

(3) Prevent users from rejecting system management: this aspect of security should be done by the operating system. A system should not be compromised by a user who intentionally attempts to use too many resources. Unfortunately, Unix does not really limit the user's use of resources, one user can use the entire disk space of the file system, and Unix basically does not prevent users from doing this. The system administrator should use the PS command, the accounting program df and the Du cycle to check the system. Detect excessive consumption of the cup and disk-intensive files.

(4) To prevent loss of the integrity of the system: This security aspect is related to the actual work of a good system administrator (for example: Running the fsck check after a periodic backup of the filesystem system crash, fixing the file system, detecting whether the user might crash the system when there is a new user) and maintaining a reliable operating system ( That is, users cannot crash the system on a regular basis. The remainder of this article mainly covers the first two issues, and the third is discussed in the "Security check" section.

2. Super User

Some system management commands can be run only by Superuser. Superuser has privileges not available to other users, and Superuser can read, write, and run any program regardless of file access License. System administrators typically use the command:/BIN/SU or root into the system to become superuser. In the following article, the # indicates that a command that must be run by a superuser should be typed, with $ indicating that a command run by all other users should be typed.

3. File system security

(1) UNIX File System Overview

The Unix file system is the heart part of the UNIX system, provides a hierarchy of directories and files. The file system divides disk space into a group of 1024 bytes, called blocks (also useful for 512 bytes, such as SCO Xenix). The maximum number of blocks numbered from 0 to the entire disk. All blocks can be divided into four parts, block 0 is called the boot block, the file system does not use the block; Block 1 is called a private block, which contains a lot of interest, which has a disk size and the size of the other two parts of all blocks. Starting with Block 2 is the I node table, the I node table contains the I node, and the number of blocks in the table is variable, which is discussed later.

The I node table is followed by an idle storage block (data storage block) that can be used to store the contents of the file. The logical structure and physical structure of the file are very different, the logical structure is the file that users see after typing the cat command, and the user can get a stream of characters representing the contents of the file. The physical structure is the storage format in which the file is actually stored on disk. The user thinks his file is a stream In reality, however, files may not be stored on disk as a frontier, and longer than a single file will normally be distributed on a disk. However, when the user accesses the file, the Unix file system takes the blocks in the correct order, giving the user the logical structure of the file.

Of course, there must be a table somewhere in the UNIX system, tells the file system how to convert the physical structure to a logical structure. This involves the I node. The I node is a 64-byte long table containing information about a file, including file size, file owner, file access License, and file as a normal file , catalog files or special files. One of the most important items in the I node is the disk Address table. There are 13 block numbers in the table. The first 10 block numbers are the address of the first 10 blocks of the file. This 10 block number gives you a logical structure of up to 10 long files, The file will take the block number in the order in which it appears in the Disk Address table.

What happens when a file is longer than 10 blocks? The 11th item in the Disk Address table gives a block number, which indicates that the block contains 256 block number, this method satisfies a file of up to 266 blocks (272,384 bytes). If the file is larger than 266 blocks, the 12th item in the Disk Address table gives a block number ,

This block number indicates that the block contains 256 block numbers, each block number of these 256 blocks is also indicated by a block with 256 block numbers, which are used to fetch the contents of the file. The disk address and the 13th index are addressed in the same way as item 12th, just a multiple-level indirect index. In this way, the maximum length of a file in a Unix system is 16,842,762, or 17,246,988,288 bytes, and it is fortunate that the UNIX system adds a more practical limit to the maximum length of the file (typically 1 to 2M bytes). Allows users to not inadvertently build a file that uses up all of the entire disk-scenting block.

The way the file system converts file names to I nodes is actually fairly straightforward. A directory is actually a file containing a table of contents: For each file in the directory, there is an entry in the table of contents that contains the file name and the I node number corresponding to the file. When the user typing cat xxx, the file system In the current directory table look for the entry named XXX, get the corresponding I node number of the file xxx, and then start to take a block containing the contents of the file XXX.

(2) Equipment files

Communication between UNIX systems and the various devices on the system side through special files to achieve, in terms of procedures, the disk is a file, modem is a file, and even memory is a file. All devices connected to the system have a file in the/dev directory that corresponds to it. When I/O operations are performed on these files, the An action that converts an I/O operation into a physical device by a UNIX system. For example, the file/dev/mem is the memory of the system, if the cat this file is actually in the terminal to display the system's memory. For security purposes, this file is unreadable to ordinary users. Because at any given time, The memory area may contain a user login password or a password to run the program, a portion of the file's edit buffer, and the buffer may contain text that is decrypted with the Ed-x command, and information that the user is unwilling to allow others to access. Files in/dev are often referred to as device files, with LS/ The dev command can look at some of the devices in the system:

Acuo Call Auto Dialer

Console System Console

DSKNN block mode to manipulate disk partitions

Kmem Core Memory

MEM Memory

LP Printer

MTO block mode to manipulate tapes

RDSKNN the disk partition of the flow mode operation

Rmto flow mode of tape operation

Swap Swap Area

Syscon System Terminal

Ttynn Terminal port

X25 Network Port

Wait a minute

(3)/etc/mknod command

Used to build device files. Only root can use this command to build device files. The parameter is the filename, and the letter C or B represents the character special file or block special file, the main device number, the secondary device number. Block special files are devices such as tapes, disks, and so on, that have access to data in blocks. Character special file. Is like a terminal , printer, MODEM, or any other communication with the system, one character at a time

devices, including disk drives that mimic character access to the disk. The master number specifies a system subroutine (device driver) that will be invoked by the system when I/O is executed on the device. When a device driver is invoked, the secondary device number is passed to the driver (the secondary device specifies a specific disk drive, With drive, signal line number, or disk partition. Each type of device typically has its own device driver.

The file system holds the main device number and the secondary device number in the disk Address table in the I node, therefore, there is no disk space allocated to the device file (except for the disk area occupied by the I node itself). When the program tries to perform I/O operations on the device file, the system recognizes that the file is a special file. and invokes the device driver specified by the main device number as the parameter that invokes the device driver.