Download Securing Debian Manual

Chapter 8. Security tools in Debian
100
• certificate-aware applications that can use certificates issued by a CA to enroll in encrypted communication and check
given certificates against CRL (for authentication and full Single Sign On solutions).
• a Time stamping authority to digitally sign documents.
• a management console from which all of this can be properly used (certificate generation, revocation list control,
etc. . . ).
Debian GNU/Linux has software packages to help you with some of these PKI issues. They include OpenSSL (for certificate generation), OpenLDAP (as a directory to hold the certificates), gnupg and openswan (with X.509 standard support).
However, as of the Woody release (Debian 3.0), Debian does not have any of the freely available Certificate Authorities such
as pyCA, OpenCA (http://www.openca.org) or the CA samples from OpenSSL. For more information read the Open
PKI book (http://ospkibook.sourceforge.net/).
8.7
SSL Infrastructure
Debian does provide some SSL certificates with the distribution so that they can be installed locally. They are found in
the ca-certificates package. This package provides a central repository of certificates that have been submitted to
Debian and approved (that is, verified) by the package maintainer, useful for any OpenSSL applications which verify SSL
connections.
FIXME: read debian-devel to see if there was something added to this.
8.8
Antivirus tools
There are not many anti-virus tools included with Debian GNU/Linux, probably because GNU/Linux users are not plagued
by viruses. The Unix security model makes a distinction between privileged (root) processes and user-owned processes,
therefore a “hostile” executable that a non-root user receives or creates and then executes cannot “infect” or otherwise
manipulate the whole system. However, GNU/Linux worms and viruses do exist, although there has not (yet, hopefully)
been any that has spread in the wild over any Debian distribution. In any case, administrators might want to build up
anti-virus gateways that protect against viruses arising on other, more vulnerable systems in their network.
Debian GNU/Linux currently provides the following tools for building antivirus environments:
• Clam Antivirus (http://www.clamav.net), provided since Debian sarge (3.1 release). Packages are provided both
for the virus scanner (clamav) for the scanner daemon (clamav-daemon) and for the data files needed for the scanner. Since keeping an antivirus up-to-date is critical for it to work properly there are two different ways to get this data:
clamav-freshclam provides a way to update the database through the Internet automatically and clamav-data
which provides the data files directly. 2
• mailscanner an e-mail gateway virus scanner and spam detector. Using sendmail or exim as its basis, it can use
more than 17 different virus scanning engines (including clamav).
• libfile-scan-perl which provides File::Scan, a Perl extension for scanning files for viruses. This modules can be
used to make platform independent virus scanners.
• Amavis Next Generation (http://www.sourceforge.net/projects/amavis), provided in the package
amavis-ng and available in sarge, which is a mail virus scanner which integrates with different MTA (Exim, Sendmail, Postfix, or Qmail) and supports over 15 virus scanning engines (including clamav, File::Scan and openantivirus).
• sanitizer (http://packages.debian.org/sanitizer), a tool that uses the procmail package, which can scan
email attachments for viruses, block attachments based on their filenames, and more.
• amavis-postfix (http://packages.debian.org/amavis-postfix), a script that provides an interface from a
mail transport agent to one or more commercial virus scanners (this package is built with support for the postfix
MTA only).
• exiscan, an e-mail virus scanner written in Perl that works with Exim.
2 If you use this last package and are running an official Debian, the database will not be updated with security updates. You should either use
clamav-freshclam, clamav-getfiles to generate new clamav-data packages or update from the maintainers location:
deb http://people.debian.org/~zugschlus/clamav-data/ / deb-src http://people.debian.org/~zugschlus/clamav-data/ /