How to Find Out More

Useful general references on UNIX System security include

• Barrett, D.J., Silverman, R.E., and Curry, D.A. Linux Security Cookbook. Sebastapol, CA: O’Reilly & Associates, 2003.

• Curry, D.A. UNIX System Security, A Guide for Users and System Administrators. Reading, MA: Addison-Wesley, 1992.

• Garfinkel, S., G. Spafford, and A. Schwartz. Practical UNIX and Internet Security. 3rd ed. Sebastopol, CA: O’Reilly & Associates, 2003.

• Loza, B. UNIX, Solaris, and Linux: A Practical Security Cookbook. Bloomington, IN: Authorhouse, 2005.

• Reeds, J.A., and P.J. Weinberger. “The UNIX System: File Security and the UNIX System Crypt Command.” AT&T Bell Laboratories Technical Journal, vol. 53, no. 8 (October 1984): 1673–1683.

• Ross, Seth. Unix System Security Tools. New York: McGraw-Hill, 1999.

Useful information about security in HP-UX can be found in

• Shah, Jay. HP-UX System and Administration Guide. New York: McGraw-Hill, 1997.

There are several useful books about PGP, including

• Garfinkel, Simson. PGP; Pretty Good Privacy. Sebastopol, CA: O’Reilly & Associates, 1995.

• Stallings, William. Protect Your Privacy, the PGP User’s Guide. Englewood Cliffs, NJ: Prentice Hall, 1995.

• Zimmermann, Philip. The Official PGP User’s Guide. Cambridge, MA: MIT Press, 1995.

This is a useful article about writing setuid programs:

• Bishop, Matt. “How to Write a Setuid Program.” :login;, vol. 12, no. 1 (January/February 1987): 5–11.

You can find out about the Internet Worm, including details about how it worked, by consulting these references:

• Eichin, Mark W., and Jon A. Rochlis. “With Microscope and Tweezers: An Analysis of the Internet Virus of November, 1988.” 1989 IEEE Computer Society Symposium on Security and Privacy. Washington, DC: Computer Society Press, 1989, 326–343.

• Spafford, Eugene H. “The Internet Worm Program: An Analysis.” ACM SIGCOM, vol. 19 (January 1989).

There are a number of useful web sites related to UNIX security. For example, the site http://www.alw.nih.gov/Security/security.html provides many useful links to sites related to computer security, including UNIX security. The UNIX Computer Security site at http://www.unixtools.com/security.html provides many useful tips on different aspects of UNIX System security. Another useful site is the UNIX Security site at http://www.deter.com/unix/.

To ensure that your UNIX systems are configured to ensure high security, you can use benchmarks available from the Center for InternetSecurity (CIS). You can use CIS Scoring Tools to verify the security configuration of systems and monitor these systems for compliance with these configurations. The Scoring Tools generate reports that users and system administrators can use to security vulnerabilities. CIS Benchmarks and Scoring Tools are available for Mac OS X, Solaris, HP-UX, AIX, and FreeBSD, as well as for the Red Hat, SUSE, and Slackware Linux distributions. To find out more about the CIS Benchmarks and the Scoring Tools, go to http://www.cisecurity.org/.

You may also find the following USENET newsgroups helpful:

• att.security

• alt.secruity.gpg

• comp.security.unix

• comp.security.misc

• comp.security.pgp.announce

• comp.security.pgp.discuss

• comp.security.pgp.resources

• comp.security.pgp.tech