Several factors go into the
selection of a particular Unix operating system or application and
the choice of which version of the software to run, but we
won't try to get into those issues here.[6] Once you've settled on which version of
which software you're going to install, however, it
is imperative that you ensure that patches are available for all
known security problems in the software, that you find those patches,
and that you apply them. Similarly, once the system is up and
running, you must be vigilant in learning about newly discovered
security problems in your operating system and applications so
you'll be able to apply patches for them as they
become available.
[6] Except to urge you to consider the security features of the
software as part of your decision-making process, of course.
Sidebar 3. Installing a New Unix System
Because
of the speed with which attackers discover new systems on the
Internet, and the easy availability of attack scripts that can
determine the operating system version of a remote Unix host and
tailor its attacks against known bugs in that version, you must not
put an unpatched Unix host onto the Internet in a way that makes it
accessible to outsiders. Some commercial Unix vendors provide patch
CD-ROMs quarterly on a subscription basis, but the very latest
patches can usually be obtained only from the
vendor's web site.
The most secure way to patch a new installation is to download the
patches to another computer that's already connected
to the Internet and updated with the latest security patches (perhaps
a Mac or PC client that runs no server services). Once downloaded,
they can be burned onto a CD-ROM or transferred to the new system
using a local network connection, and then applied.
If no other Internet-connected host is available or suitable, the new
host may have to be connected before the patches are applied. In this
case, disable all network servers on the machine, and make the
connection as brief as possible—only long enough to download
the required patches—and then physically remove the machine
from the network while the patches are applied. This process can be
made even more secure if the machine's connection
can be protected by a stateful firewall or a router that implements
network address translation, so that the only packets that can reach
the new host are those associated with a connection initiated by the
new host.
You are currently reading a PREVIEW of this book.
Get instant access to over
$1 million worth of books and videos.
