Linux System Administrator Security Guide

Article Title: Linux System Administrator security guide. Linux is a technology channel of the IT lab in China. Includes basic categories such as desktop applications, Linux system management, kernel research, embedded systems, and open source.

This article discusses security issues from the perspective of system administrators. The system administrator is the person who manages the system: starts the system, stops the system from running, installs new software, adds new users, deletes old users, and completes daily tasks to maintain the system development and operation.
　
1. Security Management
Security management is mainly divided into four aspects:
(1) prevent unauthorized access: This is the most important issue in computer security: People who are not using the system enter the system. User awareness, good password management (with the cooperation of both the system administrator and the user), logon activity records and reports, and periodic check of user and network activities are the key to preventing unauthorized access.
　
(2) prevent leaks: this is also an important issue of computer security. Prevent authorized or unauthorized users from accessing important information from each other. File system account checking, su logon and reporting, user awareness, and encryption are the key to preventing leaks.
　
(3) Prevent Users From rejecting System Management: the security of this aspect should be completed by the operating system. A system should not be compromised by a user who intentionally tries to use too many resources. Unfortunately, UNIX does not limit the use of resources. A user can use the entire disk space of the file system, and UNIX basically cannot prevent the user from doing so. It is recommended that the system administrator use the PS command to check the system periodically by the accounting program df and du. Find out the processes that occupy too much CPU and files that occupy a large number of disks.
　
(4) prevent loss of System Integrity: This security aspect is related to the actual work of a good system administrator (for example, backing up the file system periodically and running the fsck check after the system crashes, fix a file system. When a new user is present, the software that checks whether the user can cause the system to crash) is related to maintaining a reliable operating system (that is, the user cannot cause the system to crash on a regular basis ).
　
The rest of this article mainly involves the first two questions. The third question is discussed in the "security account check" section.
2. superuser
Some system management commands can only be run by Super Users. Super Users have the privileges that other users do not have. Super Users can read, write, and run any program regardless of the file access permission method.
　
The system administrator usually uses the command "/bin/su" or "root" to enter the system and become a Super User. In the following article, # indicates the commands that must be run by the super user, and $ indicates the commands that should be run by all other users.
3. File System Security
(1) UNIX File System Overview
UNIX file systems are at the heart of UNIX systems and provide hierarchical directories and files. The file system divides the disk space into a group of every 1024 bytes, which is called a block (also 512 bytes are used as a block, such as sco xenix ). The maximum number of blocks from 0 to the entire disk.
　
The entire block can be divided into four parts. Block 0 is called a boot block, and the file system does not need this block. Block 1 is called a dedicated block, which contains a lot of information, the disk size and the size of the other two parts of the whole block are displayed. From Block 2, it is an I-node table. The I-node table contains I-nodes, and the number of blocks in the table is variable. We will discuss it later.
　
An I-node table is followed by an idle storage block (Data Storage block), which can be used to store file content.
　
The logical structure of a file is very different from that of a physical structure. The logical structure is the file you see after you press the cat command. You can get the volume stream that represents the file content. The physical structure is the storage format of files stored on disks. Users think that their files are frontier streams, but in fact the files may not be stored on the disk in the form of frontier. Files larger than one block are usually stored on the disk in a scattered manner. However, when a user accesses a file, the UNIX file system extracts the blocks in the correct order to provide the user with the logical structure of the file.
　
Of course, there must be a table somewhere in the UNIX system, telling the file system how to convert the physical structure to the logical structure. This involves the I node. An I node is a 64-byte table that contains information about a file, including the file size, file owner, file access permission, and the file is a common file, directory files or special files. The most important one in I node is the disk address table.
　
This table has 13 block numbers. The first 10 block numbers are the storage addresses of the first 10 blocks. The 10 block numbers can provide a logical structure of up to 10 long files, and the files will take the corresponding block numbers in the order they appear in the disk address table.
　
What if there are more than 10 files? The first item in the disk Address Table provides a block number, which indicates that the block number contains 11th block numbers. At this point, this method supports up to 266 files (272,384 bytes ). If the number of files is larger than 266, a block number is provided for the first item in the disk address table. The block number indicated by this block number contains 12th block numbers, each block number of the 256 block numbers points out another block. The block contains 256 block numbers, which are used to obtain the content of the file. The addressing method for the disk address and the 13th index items is similar to that for the 12th items, but the multi-level indirect index is used.
　
In this way, in UNIX systems, the maximum length of a file is 16,842,762, that is, 17,246,988,288 bytes. Fortunately, it is the maximum length of a file in UNIX systems (generally 1 to 2 M bytes) with more practical restrictions, you will not accidentally create a file that uses all blocks of the entire disk quota.
　
The file system converts a file name to an I node. A directory is actually a file containing a directory table: for each file in the directory, there is an entry in the directory table, which contains the file name and the corresponding I-node number of the file. When you press cat xxx, the file system searches for the entry item named xxx in the current directory table to obtain the I-node number corresponding to file xxx, then, you can obtain the block containing the file xxx.
(2) Device Files
Communication between UNIX systems and devices with edges on the system is implemented through special files. For programs, disks are files, MODEM is files, and even memory is files. All devices connected to the system have a file in the/dev directory. When I/O operations are performed on these files, the UNIX system converts the I/O operation to the actual device action. For example, the file/dev/mem is the system memory. If the file cat is used, the system memory is actually displayed on the terminal. For the sake of security, this file is not readable to common users. Because at any given time, the memory zone may contain the user login password or the program running password, and the editing buffer of some files may contain the text decrypted by the ed-x command, and information that users do not want others to access.
　

[1] [2] [3] [4] [5] [6] [7] Next page