Add missing </LI>s and </P>s.
This commit is contained in:
Jun Kuriyama
parent
dc65703a01
commit
524d9b90cd
Notes:
svn2git
2020-12-08 03:00:23 +00:00
svn path=/www/; revision=6974
3 changed files with 66 additions and 66 deletions
|
|
@ -1,10 +1,10 @@
|
||||||
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN" [
|
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN" [
|
||||||
<!ENTITY base CDATA "..">
|
<!ENTITY base CDATA "..">
|
||||||
<!ENTITY date "$FreeBSD: www/en/security/security.sgml,v 1.20 2000/01/02 19:23:21 hoek Exp $">
|
<!ENTITY date "$FreeBSD: www/en/security/security.sgml,v 1.21 2000/02/01 07:05:34 imp Exp $">
|
||||||
<!ENTITY title "FreeBSD Security Information">
|
<!ENTITY title "FreeBSD Security Information">
|
||||||
<!ENTITY % includes SYSTEM "../includes.sgml"> %includes;
|
<!ENTITY % includes SYSTEM "../includes.sgml"> %includes;
|
||||||
]>
|
]>
|
||||||
<!-- $FreeBSD: www/en/security/security.sgml,v 1.20 2000/01/02 19:23:21 hoek Exp $ -->
|
<!-- $FreeBSD: www/en/security/security.sgml,v 1.21 2000/02/01 07:05:34 imp Exp $ -->
|
||||||
|
|
||||||
<html>
|
<html>
|
||||||
&header;
|
&header;
|
||||||
|
|
@ -66,19 +66,19 @@ HREF="ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/public_key.asc">PGP key
|
||||||
following releases of FreeBSD:</P>
|
following releases of FreeBSD:</P>
|
||||||
|
|
||||||
<UL>
|
<UL>
|
||||||
<LI> The most recent official release of FreeBSD.
|
<LI> The most recent official release of FreeBSD.</LI>
|
||||||
<LI> FreeBSD-current.
|
<LI> FreeBSD-current.</LI>
|
||||||
<LI> FreeBSD-stable, when at least 2 releases are based on it.
|
<LI> FreeBSD-stable, when at least 2 releases are based on it.</LI>
|
||||||
<LI> The previous FreeBSD-stable when a "new stable" does not yet
|
<LI> The previous FreeBSD-stable when a "new stable" does not yet
|
||||||
have 2 releases based on it.
|
have 2 releases based on it.</LI>
|
||||||
</UL>
|
</UL>
|
||||||
|
|
||||||
At this time, security advisories are available for:
|
At this time, security advisories are available for:
|
||||||
<UL>
|
<UL>
|
||||||
<LI> FreeBSD 3.3
|
<LI> FreeBSD 3.3</LI>
|
||||||
<LI> FreeBSD 3.4
|
<LI> FreeBSD 3.4</LI>
|
||||||
<LI> FreeBSD-current
|
<LI> FreeBSD-current</LI>
|
||||||
<LI> FreeBSD-stable
|
<LI> FreeBSD-stable</LI>
|
||||||
</UL>
|
</UL>
|
||||||
|
|
||||||
<P>Older releases are not maintained and users are strongly encouraged
|
<P>Older releases are not maintained and users are strongly encouraged
|
||||||
|
|
@ -90,11 +90,11 @@ After a couple of days and some testing, the fix is retrofitted into
|
||||||
the supported FreeBSD-stable branch(es) and an advisory then sent
|
the supported FreeBSD-stable branch(es) and an advisory then sent
|
||||||
out.</P>
|
out.</P>
|
||||||
|
|
||||||
<P>Advisories are sent to the following FreeBSD mailing lists:
|
<P>Advisories are sent to the following FreeBSD mailing lists:</P>
|
||||||
<UL>
|
<UL>
|
||||||
<LI>FreeBSD-security-notifications@FreeBSD.org
|
<LI>FreeBSD-security-notifications@FreeBSD.org</LI>
|
||||||
<LI>FreeBSD-security@FreeBSD.org
|
<LI>FreeBSD-security@FreeBSD.org</LI>
|
||||||
<LI>FreeBSD-announce@FreeBSD.org
|
<LI>FreeBSD-announce@FreeBSD.org</LI>
|
||||||
</UL>
|
</UL>
|
||||||
|
|
||||||
|
|
||||||
|
|
@ -175,7 +175,7 @@ and if you would like to unsubscribe from a mailing list:
|
||||||
|
|
||||||
<A NAME=spg></A>
|
<A NAME=spg></A>
|
||||||
<H2>Secure Programing Guidelines</H2>
|
<H2>Secure Programing Guidelines</H2>
|
||||||
<P><P><UL>
|
<P></P><UL>
|
||||||
<LI>Never trust any source of input, i.e. command line arguments,
|
<LI>Never trust any source of input, i.e. command line arguments,
|
||||||
environment variables, configuration files, incoming TCP/UDP/ICMP packets,
|
environment variables, configuration files, incoming TCP/UDP/ICMP packets,
|
||||||
hostname lookups, function arguments, etc. If the length of or contents of
|
hostname lookups, function arguments, etc. If the length of or contents of
|
||||||
|
|
@ -341,13 +341,13 @@ walk on the stack.
|
||||||
<LI>Always close file descriptors as soon as you can - this makes it more
|
<LI>Always close file descriptors as soon as you can - this makes it more
|
||||||
likely that the stdio buffer contents will be discarded. In library
|
likely that the stdio buffer contents will be discarded. In library
|
||||||
routines, always set any file descriptors that you open to close-on-exec.
|
routines, always set any file descriptors that you open to close-on-exec.
|
||||||
<P><P></LI>
|
<P></P></LI>
|
||||||
</UL>
|
</UL>
|
||||||
|
|
||||||
<A NAME=tat></A>
|
<A NAME=tat></A>
|
||||||
<H2>FreeBSD Security Tips and Tricks</H2>
|
<H2>FreeBSD Security Tips and Tricks</H2>
|
||||||
<P>There are several steps one must take to secure a FreeBSD system, or
|
<P>There are several steps one must take to secure a FreeBSD system, or
|
||||||
in fact any Unix system:
|
in fact any Unix system:</P>
|
||||||
<UL>
|
<UL>
|
||||||
|
|
||||||
<LI>Disabling potentially dangerous software<BR><P></P>
|
<LI>Disabling potentially dangerous software<BR><P></P>
|
||||||
|
|
@ -369,31 +369,31 @@ the time.<BR><P></P>
|
||||||
Not only remove programs that you don't use, also remove services you
|
Not only remove programs that you don't use, also remove services you
|
||||||
don't want or need to provide. This can be done by editing the
|
don't want or need to provide. This can be done by editing the
|
||||||
<TT>/etc/inetd.conf</TT> and <TT>/etc/rc.conf</TT> files and turning
|
<TT>/etc/inetd.conf</TT> and <TT>/etc/rc.conf</TT> files and turning
|
||||||
off all services you don't use.<P></P>
|
off all services you don't use.<P></P></LI>
|
||||||
|
|
||||||
<LI>Fixing software which has security bugs (or how to stay one step ahead
|
<LI>Fixing software which has security bugs (or how to stay one step ahead
|
||||||
of crackers)<BR><P></P>
|
of crackers)<BR><P></P>
|
||||||
Make sure you are subscribed to various <A HREF="#ml">FreeBSD Security
|
Make sure you are subscribed to various <A HREF="#ml">FreeBSD Security
|
||||||
mailing lists</A> so you get updates on security bugs and
|
mailing lists</A> so you get updates on security bugs and
|
||||||
fixes. Apply the fixes immediately.<P></P>
|
fixes. Apply the fixes immediately.<P></P></LI>
|
||||||
|
|
||||||
<LI>Backups - repair your system if a security breach does occur<BR><P></P>
|
<LI>Backups - repair your system if a security breach does occur<BR><P></P>
|
||||||
Always have backups and a clean version of the operating system (e.g. on
|
Always have backups and a clean version of the operating system (e.g. on
|
||||||
CD-Rom).
|
CD-Rom).
|
||||||
Make sure your backups do not contain corrupted data or
|
Make sure your backups do not contain corrupted data or
|
||||||
data modified by attackers.<P></P>
|
data modified by attackers.<P></P></LI>
|
||||||
|
|
||||||
<LI>Install software to watch the state of the system<BR><P></P>
|
<LI>Install software to watch the state of the system<BR><P></P>
|
||||||
Programs like the tcp wrappers and tripwire (both in packages/ports) can
|
Programs like the tcp wrappers and tripwire (both in packages/ports) can
|
||||||
help you to monitor activity on your system. This makes it easier
|
help you to monitor activity on your system. This makes it easier
|
||||||
to detect break-ins. Also read outputs of the /etc/security scripts
|
to detect break-ins. Also read outputs of the /etc/security scripts
|
||||||
which are run daily and mailed to the root account.<P></P>
|
which are run daily and mailed to the root account.<P></P></LI>
|
||||||
|
|
||||||
<LI>Educating the people who work on the system<BR><P></P>
|
<LI>Educating the people who work on the system<BR><P></P>
|
||||||
Users should know what they are doing. They should be told to never give
|
Users should know what they are doing. They should be told to never give
|
||||||
out their password to anyone and to also use hard-to-guess passwords.
|
out their password to anyone and to also use hard-to-guess passwords.
|
||||||
Let them understand that the security of the system/network is partly
|
Let them understand that the security of the system/network is partly
|
||||||
in their hands.<P></P>
|
in their hands.<P></P></LI>
|
||||||
</UL>
|
</UL>
|
||||||
|
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -1,10 +1,10 @@
|
||||||
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN" [
|
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN" [
|
||||||
<!ENTITY base CDATA "..">
|
<!ENTITY base CDATA "..">
|
||||||
<!ENTITY date "$FreeBSD: www/en/security/security.sgml,v 1.20 2000/01/02 19:23:21 hoek Exp $">
|
<!ENTITY date "$FreeBSD: www/en/security/security.sgml,v 1.21 2000/02/01 07:05:34 imp Exp $">
|
||||||
<!ENTITY title "FreeBSD Security Information">
|
<!ENTITY title "FreeBSD Security Information">
|
||||||
<!ENTITY % includes SYSTEM "../includes.sgml"> %includes;
|
<!ENTITY % includes SYSTEM "../includes.sgml"> %includes;
|
||||||
]>
|
]>
|
||||||
<!-- $FreeBSD: www/en/security/security.sgml,v 1.20 2000/01/02 19:23:21 hoek Exp $ -->
|
<!-- $FreeBSD: www/en/security/security.sgml,v 1.21 2000/02/01 07:05:34 imp Exp $ -->
|
||||||
|
|
||||||
<html>
|
<html>
|
||||||
&header;
|
&header;
|
||||||
|
|
@ -66,19 +66,19 @@ HREF="ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/public_key.asc">PGP key
|
||||||
following releases of FreeBSD:</P>
|
following releases of FreeBSD:</P>
|
||||||
|
|
||||||
<UL>
|
<UL>
|
||||||
<LI> The most recent official release of FreeBSD.
|
<LI> The most recent official release of FreeBSD.</LI>
|
||||||
<LI> FreeBSD-current.
|
<LI> FreeBSD-current.</LI>
|
||||||
<LI> FreeBSD-stable, when at least 2 releases are based on it.
|
<LI> FreeBSD-stable, when at least 2 releases are based on it.</LI>
|
||||||
<LI> The previous FreeBSD-stable when a "new stable" does not yet
|
<LI> The previous FreeBSD-stable when a "new stable" does not yet
|
||||||
have 2 releases based on it.
|
have 2 releases based on it.</LI>
|
||||||
</UL>
|
</UL>
|
||||||
|
|
||||||
At this time, security advisories are available for:
|
At this time, security advisories are available for:
|
||||||
<UL>
|
<UL>
|
||||||
<LI> FreeBSD 3.3
|
<LI> FreeBSD 3.3</LI>
|
||||||
<LI> FreeBSD 3.4
|
<LI> FreeBSD 3.4</LI>
|
||||||
<LI> FreeBSD-current
|
<LI> FreeBSD-current</LI>
|
||||||
<LI> FreeBSD-stable
|
<LI> FreeBSD-stable</LI>
|
||||||
</UL>
|
</UL>
|
||||||
|
|
||||||
<P>Older releases are not maintained and users are strongly encouraged
|
<P>Older releases are not maintained and users are strongly encouraged
|
||||||
|
|
@ -90,11 +90,11 @@ After a couple of days and some testing, the fix is retrofitted into
|
||||||
the supported FreeBSD-stable branch(es) and an advisory then sent
|
the supported FreeBSD-stable branch(es) and an advisory then sent
|
||||||
out.</P>
|
out.</P>
|
||||||
|
|
||||||
<P>Advisories are sent to the following FreeBSD mailing lists:
|
<P>Advisories are sent to the following FreeBSD mailing lists:</P>
|
||||||
<UL>
|
<UL>
|
||||||
<LI>FreeBSD-security-notifications@FreeBSD.org
|
<LI>FreeBSD-security-notifications@FreeBSD.org</LI>
|
||||||
<LI>FreeBSD-security@FreeBSD.org
|
<LI>FreeBSD-security@FreeBSD.org</LI>
|
||||||
<LI>FreeBSD-announce@FreeBSD.org
|
<LI>FreeBSD-announce@FreeBSD.org</LI>
|
||||||
</UL>
|
</UL>
|
||||||
|
|
||||||
|
|
||||||
|
|
@ -175,7 +175,7 @@ and if you would like to unsubscribe from a mailing list:
|
||||||
|
|
||||||
<A NAME=spg></A>
|
<A NAME=spg></A>
|
||||||
<H2>Secure Programing Guidelines</H2>
|
<H2>Secure Programing Guidelines</H2>
|
||||||
<P><P><UL>
|
<P></P><UL>
|
||||||
<LI>Never trust any source of input, i.e. command line arguments,
|
<LI>Never trust any source of input, i.e. command line arguments,
|
||||||
environment variables, configuration files, incoming TCP/UDP/ICMP packets,
|
environment variables, configuration files, incoming TCP/UDP/ICMP packets,
|
||||||
hostname lookups, function arguments, etc. If the length of or contents of
|
hostname lookups, function arguments, etc. If the length of or contents of
|
||||||
|
|
@ -341,13 +341,13 @@ walk on the stack.
|
||||||
<LI>Always close file descriptors as soon as you can - this makes it more
|
<LI>Always close file descriptors as soon as you can - this makes it more
|
||||||
likely that the stdio buffer contents will be discarded. In library
|
likely that the stdio buffer contents will be discarded. In library
|
||||||
routines, always set any file descriptors that you open to close-on-exec.
|
routines, always set any file descriptors that you open to close-on-exec.
|
||||||
<P><P></LI>
|
<P></P></LI>
|
||||||
</UL>
|
</UL>
|
||||||
|
|
||||||
<A NAME=tat></A>
|
<A NAME=tat></A>
|
||||||
<H2>FreeBSD Security Tips and Tricks</H2>
|
<H2>FreeBSD Security Tips and Tricks</H2>
|
||||||
<P>There are several steps one must take to secure a FreeBSD system, or
|
<P>There are several steps one must take to secure a FreeBSD system, or
|
||||||
in fact any Unix system:
|
in fact any Unix system:</P>
|
||||||
<UL>
|
<UL>
|
||||||
|
|
||||||
<LI>Disabling potentially dangerous software<BR><P></P>
|
<LI>Disabling potentially dangerous software<BR><P></P>
|
||||||
|
|
@ -369,31 +369,31 @@ the time.<BR><P></P>
|
||||||
Not only remove programs that you don't use, also remove services you
|
Not only remove programs that you don't use, also remove services you
|
||||||
don't want or need to provide. This can be done by editing the
|
don't want or need to provide. This can be done by editing the
|
||||||
<TT>/etc/inetd.conf</TT> and <TT>/etc/rc.conf</TT> files and turning
|
<TT>/etc/inetd.conf</TT> and <TT>/etc/rc.conf</TT> files and turning
|
||||||
off all services you don't use.<P></P>
|
off all services you don't use.<P></P></LI>
|
||||||
|
|
||||||
<LI>Fixing software which has security bugs (or how to stay one step ahead
|
<LI>Fixing software which has security bugs (or how to stay one step ahead
|
||||||
of crackers)<BR><P></P>
|
of crackers)<BR><P></P>
|
||||||
Make sure you are subscribed to various <A HREF="#ml">FreeBSD Security
|
Make sure you are subscribed to various <A HREF="#ml">FreeBSD Security
|
||||||
mailing lists</A> so you get updates on security bugs and
|
mailing lists</A> so you get updates on security bugs and
|
||||||
fixes. Apply the fixes immediately.<P></P>
|
fixes. Apply the fixes immediately.<P></P></LI>
|
||||||
|
|
||||||
<LI>Backups - repair your system if a security breach does occur<BR><P></P>
|
<LI>Backups - repair your system if a security breach does occur<BR><P></P>
|
||||||
Always have backups and a clean version of the operating system (e.g. on
|
Always have backups and a clean version of the operating system (e.g. on
|
||||||
CD-Rom).
|
CD-Rom).
|
||||||
Make sure your backups do not contain corrupted data or
|
Make sure your backups do not contain corrupted data or
|
||||||
data modified by attackers.<P></P>
|
data modified by attackers.<P></P></LI>
|
||||||
|
|
||||||
<LI>Install software to watch the state of the system<BR><P></P>
|
<LI>Install software to watch the state of the system<BR><P></P>
|
||||||
Programs like the tcp wrappers and tripwire (both in packages/ports) can
|
Programs like the tcp wrappers and tripwire (both in packages/ports) can
|
||||||
help you to monitor activity on your system. This makes it easier
|
help you to monitor activity on your system. This makes it easier
|
||||||
to detect break-ins. Also read outputs of the /etc/security scripts
|
to detect break-ins. Also read outputs of the /etc/security scripts
|
||||||
which are run daily and mailed to the root account.<P></P>
|
which are run daily and mailed to the root account.<P></P></LI>
|
||||||
|
|
||||||
<LI>Educating the people who work on the system<BR><P></P>
|
<LI>Educating the people who work on the system<BR><P></P>
|
||||||
Users should know what they are doing. They should be told to never give
|
Users should know what they are doing. They should be told to never give
|
||||||
out their password to anyone and to also use hard-to-guess passwords.
|
out their password to anyone and to also use hard-to-guess passwords.
|
||||||
Let them understand that the security of the system/network is partly
|
Let them understand that the security of the system/network is partly
|
||||||
in their hands.<P></P>
|
in their hands.<P></P></LI>
|
||||||
</UL>
|
</UL>
|
||||||
|
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -1,10 +1,10 @@
|
||||||
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN" [
|
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN" [
|
||||||
<!ENTITY base CDATA "..">
|
<!ENTITY base CDATA "..">
|
||||||
<!ENTITY date "$FreeBSD: www/en/security/security.sgml,v 1.20 2000/01/02 19:23:21 hoek Exp $">
|
<!ENTITY date "$FreeBSD: www/en/security/security.sgml,v 1.21 2000/02/01 07:05:34 imp Exp $">
|
||||||
<!ENTITY title "FreeBSD Security Information">
|
<!ENTITY title "FreeBSD Security Information">
|
||||||
<!ENTITY % includes SYSTEM "../includes.sgml"> %includes;
|
<!ENTITY % includes SYSTEM "../includes.sgml"> %includes;
|
||||||
]>
|
]>
|
||||||
<!-- $FreeBSD: www/en/security/security.sgml,v 1.20 2000/01/02 19:23:21 hoek Exp $ -->
|
<!-- $FreeBSD: www/en/security/security.sgml,v 1.21 2000/02/01 07:05:34 imp Exp $ -->
|
||||||
|
|
||||||
<html>
|
<html>
|
||||||
&header;
|
&header;
|
||||||
|
|
@ -66,19 +66,19 @@ HREF="ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/public_key.asc">PGP key
|
||||||
following releases of FreeBSD:</P>
|
following releases of FreeBSD:</P>
|
||||||
|
|
||||||
<UL>
|
<UL>
|
||||||
<LI> The most recent official release of FreeBSD.
|
<LI> The most recent official release of FreeBSD.</LI>
|
||||||
<LI> FreeBSD-current.
|
<LI> FreeBSD-current.</LI>
|
||||||
<LI> FreeBSD-stable, when at least 2 releases are based on it.
|
<LI> FreeBSD-stable, when at least 2 releases are based on it.</LI>
|
||||||
<LI> The previous FreeBSD-stable when a "new stable" does not yet
|
<LI> The previous FreeBSD-stable when a "new stable" does not yet
|
||||||
have 2 releases based on it.
|
have 2 releases based on it.</LI>
|
||||||
</UL>
|
</UL>
|
||||||
|
|
||||||
At this time, security advisories are available for:
|
At this time, security advisories are available for:
|
||||||
<UL>
|
<UL>
|
||||||
<LI> FreeBSD 3.3
|
<LI> FreeBSD 3.3</LI>
|
||||||
<LI> FreeBSD 3.4
|
<LI> FreeBSD 3.4</LI>
|
||||||
<LI> FreeBSD-current
|
<LI> FreeBSD-current</LI>
|
||||||
<LI> FreeBSD-stable
|
<LI> FreeBSD-stable</LI>
|
||||||
</UL>
|
</UL>
|
||||||
|
|
||||||
<P>Older releases are not maintained and users are strongly encouraged
|
<P>Older releases are not maintained and users are strongly encouraged
|
||||||
|
|
@ -90,11 +90,11 @@ After a couple of days and some testing, the fix is retrofitted into
|
||||||
the supported FreeBSD-stable branch(es) and an advisory then sent
|
the supported FreeBSD-stable branch(es) and an advisory then sent
|
||||||
out.</P>
|
out.</P>
|
||||||
|
|
||||||
<P>Advisories are sent to the following FreeBSD mailing lists:
|
<P>Advisories are sent to the following FreeBSD mailing lists:</P>
|
||||||
<UL>
|
<UL>
|
||||||
<LI>FreeBSD-security-notifications@FreeBSD.org
|
<LI>FreeBSD-security-notifications@FreeBSD.org</LI>
|
||||||
<LI>FreeBSD-security@FreeBSD.org
|
<LI>FreeBSD-security@FreeBSD.org</LI>
|
||||||
<LI>FreeBSD-announce@FreeBSD.org
|
<LI>FreeBSD-announce@FreeBSD.org</LI>
|
||||||
</UL>
|
</UL>
|
||||||
|
|
||||||
|
|
||||||
|
|
@ -175,7 +175,7 @@ and if you would like to unsubscribe from a mailing list:
|
||||||
|
|
||||||
<A NAME=spg></A>
|
<A NAME=spg></A>
|
||||||
<H2>Secure Programing Guidelines</H2>
|
<H2>Secure Programing Guidelines</H2>
|
||||||
<P><P><UL>
|
<P></P><UL>
|
||||||
<LI>Never trust any source of input, i.e. command line arguments,
|
<LI>Never trust any source of input, i.e. command line arguments,
|
||||||
environment variables, configuration files, incoming TCP/UDP/ICMP packets,
|
environment variables, configuration files, incoming TCP/UDP/ICMP packets,
|
||||||
hostname lookups, function arguments, etc. If the length of or contents of
|
hostname lookups, function arguments, etc. If the length of or contents of
|
||||||
|
|
@ -341,13 +341,13 @@ walk on the stack.
|
||||||
<LI>Always close file descriptors as soon as you can - this makes it more
|
<LI>Always close file descriptors as soon as you can - this makes it more
|
||||||
likely that the stdio buffer contents will be discarded. In library
|
likely that the stdio buffer contents will be discarded. In library
|
||||||
routines, always set any file descriptors that you open to close-on-exec.
|
routines, always set any file descriptors that you open to close-on-exec.
|
||||||
<P><P></LI>
|
<P></P></LI>
|
||||||
</UL>
|
</UL>
|
||||||
|
|
||||||
<A NAME=tat></A>
|
<A NAME=tat></A>
|
||||||
<H2>FreeBSD Security Tips and Tricks</H2>
|
<H2>FreeBSD Security Tips and Tricks</H2>
|
||||||
<P>There are several steps one must take to secure a FreeBSD system, or
|
<P>There are several steps one must take to secure a FreeBSD system, or
|
||||||
in fact any Unix system:
|
in fact any Unix system:</P>
|
||||||
<UL>
|
<UL>
|
||||||
|
|
||||||
<LI>Disabling potentially dangerous software<BR><P></P>
|
<LI>Disabling potentially dangerous software<BR><P></P>
|
||||||
|
|
@ -369,31 +369,31 @@ the time.<BR><P></P>
|
||||||
Not only remove programs that you don't use, also remove services you
|
Not only remove programs that you don't use, also remove services you
|
||||||
don't want or need to provide. This can be done by editing the
|
don't want or need to provide. This can be done by editing the
|
||||||
<TT>/etc/inetd.conf</TT> and <TT>/etc/rc.conf</TT> files and turning
|
<TT>/etc/inetd.conf</TT> and <TT>/etc/rc.conf</TT> files and turning
|
||||||
off all services you don't use.<P></P>
|
off all services you don't use.<P></P></LI>
|
||||||
|
|
||||||
<LI>Fixing software which has security bugs (or how to stay one step ahead
|
<LI>Fixing software which has security bugs (or how to stay one step ahead
|
||||||
of crackers)<BR><P></P>
|
of crackers)<BR><P></P>
|
||||||
Make sure you are subscribed to various <A HREF="#ml">FreeBSD Security
|
Make sure you are subscribed to various <A HREF="#ml">FreeBSD Security
|
||||||
mailing lists</A> so you get updates on security bugs and
|
mailing lists</A> so you get updates on security bugs and
|
||||||
fixes. Apply the fixes immediately.<P></P>
|
fixes. Apply the fixes immediately.<P></P></LI>
|
||||||
|
|
||||||
<LI>Backups - repair your system if a security breach does occur<BR><P></P>
|
<LI>Backups - repair your system if a security breach does occur<BR><P></P>
|
||||||
Always have backups and a clean version of the operating system (e.g. on
|
Always have backups and a clean version of the operating system (e.g. on
|
||||||
CD-Rom).
|
CD-Rom).
|
||||||
Make sure your backups do not contain corrupted data or
|
Make sure your backups do not contain corrupted data or
|
||||||
data modified by attackers.<P></P>
|
data modified by attackers.<P></P></LI>
|
||||||
|
|
||||||
<LI>Install software to watch the state of the system<BR><P></P>
|
<LI>Install software to watch the state of the system<BR><P></P>
|
||||||
Programs like the tcp wrappers and tripwire (both in packages/ports) can
|
Programs like the tcp wrappers and tripwire (both in packages/ports) can
|
||||||
help you to monitor activity on your system. This makes it easier
|
help you to monitor activity on your system. This makes it easier
|
||||||
to detect break-ins. Also read outputs of the /etc/security scripts
|
to detect break-ins. Also read outputs of the /etc/security scripts
|
||||||
which are run daily and mailed to the root account.<P></P>
|
which are run daily and mailed to the root account.<P></P></LI>
|
||||||
|
|
||||||
<LI>Educating the people who work on the system<BR><P></P>
|
<LI>Educating the people who work on the system<BR><P></P>
|
||||||
Users should know what they are doing. They should be told to never give
|
Users should know what they are doing. They should be told to never give
|
||||||
out their password to anyone and to also use hard-to-guess passwords.
|
out their password to anyone and to also use hard-to-guess passwords.
|
||||||
Let them understand that the security of the system/network is partly
|
Let them understand that the security of the system/network is partly
|
||||||
in their hands.<P></P>
|
in their hands.<P></P></LI>
|
||||||
</UL>
|
</UL>
|
||||||
|
|
||||||
|
|
||||||
|
|
|
||||||
Loading…
Reference in a new issue