具体描述
Because the UNIX system was originally designed by programmers for use by other programmers, it was used in an environment of open cooperation where security was of minimal concern. Now that its use has spread to universities, businesses, and government, the confidential and sensitive nature of the data stored on UNIX systems has made the security of these systems of paramount importance.
Despite all the technical papers and workshops on UNIX security, this book is unique. "UNIX System Security" is the first up-to-date source to provide the UNIX system user or administrator with the information needed to protect the data and system from unauthorized use. By following the procedures described in this book and making use of the C programs and shell scripts provided as examples, you can protect your UNIX system from most attackers.
The author begins by examining four high-profile breaches of UNIX security as illustrations of how a UNIX system can be attacked. He then provides the information necessary to protect against these forms of attack, and offers the tools that can be used to do so. Focusing on the most recent release of Berkeley and System V UNIX, and such vendor derivatives as SunOS and ULTRIX, the book gives information that can be applied to any version of UNIX since Seventh Edition.
Issues discussed include account and password security, securing the file system, encryption and authentication systems, TCP/IP network security, the Network Information Service (NIS), NFS, RFS, workstation security, terminals and modems, and UUCP. Other chapters describe how to respond if your system is attacked and how to develop a comprehensive security policy for your organization. The book also gives comprehensive lists of freely available security software, and publications and mailing lists dealing with UNIX security.
作者简介
David A. Curry is a technically sophisticated, business-savvy information security professional with over 25 years of cross-industry experience in diverse security, privacy, and systems roles including security and privacy governance, risk management and analysis, legal and regulatory compliance, security incident response, professional services, software design, systems programming, and systems administration. He has held multiple senior-level positions with responsibility for envisioning, implementing, and maintaining the major components of information security programs, including policies and standards, risk management methodologies, training and awareness programs, legal and regulatory compliance, third party vendor security management, and security incident management.
Prior to his specialization in information security governance, David spent over ten years as a UNIX and TCP/IP systems programmer and systems administrator in the university/research sector. Some of the software he developed during that time is still in use today. He also spent five years in the professional security services field, where he worked with many cutting-edge security technologies and applications that are taken for granted today. He was a founding member of the world’s first commercial computer security incident response service, and the principal designer of the world’s first commercial real-time intrusion detection monitoring service. He is also the author of three successful technical books: two on the topic of UNIX systems programming, and one on UNIX system security.
David’s varied background gives him a unique ability to examine problems from both the “business” and “technical” perspectives and devise an appropriate solution that meets the requirements of all stakeholders—business and information technology. He believes that one of the most important characteristics of any information security program is that it must support the business goals of the company and enable work to get done in a time- and cost-effective manner. David’s background has also allowed him to develop oral and written presentation skills suitable for any audience—technical, non-technical, or executive—an ability which is demonstrated by his selection as one of the top-five presenters at the Information Security Forum’s worldwide conference four years in a row.
David holds a Bachelor’s degree in Computer Science from Purdue University and is a Certified Information Systems Security Professional (CISSP).
目录信息
读后感
用户评价
这部关于系统安全的著作，尽管厚重，却像一幅精细的工业蓝图，引领我深入理解了操作系统的核心防御机制。书中对权限管理和用户身份验证的剖析，简直是教科书级别的深度。我尤其欣赏作者没有停留在理论层面，而是大量穿插了实际案例和配置文件的片段，这让抽象的安全概念变得触手可及。比如，关于PAM（Pluggable Authentication Modules）的章节，我花了整整一个下午才完全吃透不同模块间的调用逻辑和配置优先级，那种豁然开朗的感觉，远非阅读一般的安全指南所能比拟。它没有给我现成的“灵丹妙药”，而是提供了一整套思维工具箱，教我如何像系统内核一样去思考潜在的攻击面和加固点。阅读过程中，我频繁地对照着自己工作环境中的配置进行思考和验证，发现了不少过去忽略的、看似微不足道的配置漏洞。这种实践导向的深度讲解，使得这本书成为了我案头必备的“工具书”，而非一次性的阅读材料。它要求读者具备一定的技术功底，但对于那些渴望从“用户”层面跃升到“架构师”层面的安全从业者来说，这是无可替代的财富。这本书真正教会我的是，安全不是添加软件，而是系统性地移除弱点。
这本书的阅读体验更像是在进行一次漫长而艰苦的野外考察，而不是在图书馆里轻松翻阅。它的排版和内容组织方式，透露出一种对效率的极致追求——一切为信息传递服务，没有多余的营销辞藻。我特别欣赏作者在处理网络服务安全配置时的那种近乎偏执的细致。例如，在阐述SSH安全强化时，它不仅覆盖了密钥管理和协议版本选择，甚至深入探讨了`UseDNS`指令对登录延迟和潜在信息泄露的影响，以及如何通过限制特定用户环境（如限制`tty`访问）来构建纵深防御。这些是你在标准运维手册中很难找到的深层优化点。对我而言，最大的挑战在于，它要求读者必须主动地去“发现”安全问题，而不是被动地等待信息灌输。每一次合上书本，我都感觉自己的操作系统的“体感温度”提高了好几度，因为我开始能够预见到那些隐藏在配置文件深处的恶意意图。这本书不适合只想快速配置防火墙的人，它面向的是那些愿意为了一份坚实的安全感而投入时间进行深度钻研的硬核工程师。
坦白说，初次接触这本书时，我被其庞大的技术词汇量和复杂的数据流图吓了一跳，感觉像在阅读一份加密的军事技术手册。但坚持下来后，我体会到了一种奇特的满足感，那是源于征服了知识高地的成就。其中关于磁盘加密和存储层安全的章节，简直是技术深度的一个里程碑。它详细阐述了内核层如何与硬件层的安全模块（如TPM）进行交互，以及在不同RAID级别下面对物理入侵时的风险敞口分析。作者的文笔虽然不走抒情路线，但逻辑的严谨性本身就构成了一种强烈的说服力。每一次阅读新的安全控制措施，我都会联想到过去那些因为信息不对称而导致的系统失陷案例，从而更加深刻地理解了未雨绸缪的价值。这本书不是用来快速解决某个紧急问题的，它是用来重塑你的安全心智模型的。读完它，你不会觉得自己掌握了所有答案，但你会确信，无论面对何种新型攻击，你都拥有了一套清晰、系统化的分析和应对框架。
我发现，这本书的魅力在于其对历史脉络的尊重和对未来趋势的洞察力之间的完美平衡。它没有沉溺于对过时漏洞的描述，而是将现代安全威胁置于UNIX哲学的基础之上进行审视。比如，书中对文件系统完整性校验（FSCK）和日志审计（Auditd）的整合分析，展示了如何利用系统自带的工具链构建一个自我监控和修复的环境，而不是依赖昂贵的第三方监控软件。作者对审计日志的解析尤为精妙，他教你如何区分“噪音”和“信号”，如何通过定制审计规则来捕获那些试图绕过标准权限检查的微妙操作。这种自内而外的防御思路，与当前流行的“零信任”模型有着异曲同工之妙，但却是用更原始、更可靠的方式实现的。阅读过程中，我不断地在思考如何将这种基于核心原则的防御策略应用到我所负责的、远超传统UNIX范畴的分布式环境中。它提供的是一种“元知识”——关于如何构建安全系统的底层逻辑，而非针对特定软件版本的补丁指南。
我对市面上那些泛泛而谈的“安全速成”书籍早已感到厌倦，而这本则完全是另一番气象，它散发着一种老派、严谨的学术气息，却又充满了实战的锐气。作者的叙事节奏极慢，但每一步都踏实有力，仿佛在雕刻一件复杂的机械装置。我记得有一部分详细讲解了内核级别的安全增强模块（如SELinux/AppArmor）的策略语言，那段文字的密度极高，我不得不借助外部文档辅助理解其上下文无关语法（Context-Aware Grammar）的精妙之处。它没有用花哨的图表来掩饰内容的单薄，而是用严密的逻辑链条和恰到好处的命令序列，构建起一个坚不可摧的论证体系。我感觉自己仿佛置身于一个高级安全研讨会上，听一位经验丰富的老专家讲解如何从最底层代码逻辑的角度去抵御零日漏洞。这本书的价值在于，它不只是告诉你“什么应该做”，更重要的是解释了“为什么必须这样做”，以及在不同系统版本和架构下，这些原则如何微妙地发生变化。读完后，我再看任何关于系统基线强化的文档，都会不自觉地带着这本书所建立起来的、更高维度的批判性视角。
