Download Users Manual - Physics, Computer Science and Engineering

Chapter 11. Security Under GNU/Linux
•
Socket Filtering (CONFIG_FILTER)
Using this option, user-space programs can attach a filter to any socket and thereby tell the kernel that it
should allow or disallow certain types of data to get through the socket. GNU/Linux socket filtering works on
all socket types except TCP for now. See the text file /usr/src/linux/Documentation/networking/filter.
txt for more information.
•
IP: Masquerading
The 2.2 kernel masquerading has been improved. It provides additional support for masquerading special
protocols, etc. Be sure to read the IP Chains HOWTO for more information.
11.7.2. Kernel Devices
There are a few block and character devices available on GNU/Linux that will also help you with security.
The two devices /dev/random and /dev/urandom are provided by the kernel to provide random data at any
time.
Both /dev/random and /dev/urandom should be secure enough to use in generating PGP keys, ssh challenges,
and other applications where secure random numbers are required. Attackers should be unable to predict the
next number given any initial sequence of numbers from these sources. There has been a lot of effort put in to
ensuring that the numbers you get from these sources are random in every sense of the word.
The only difference between the two devices, is that /dev/random runs out of random bytes and it makes you
wait for more to be accumulated. Note that on some systems, it can block for a long time waiting for new usergenerated entropy to be entered into the system. So you have to use care before using /dev/random. (Perhaps
the best thing to do is to use it when you’re generating sensitive keying information, and you tell the user to
pound on the keyboard repeatedly until you print out “OK, enough”.)
/dev/random is high quality entropy, generated from measuring the inter-interrupt times etc. It blocks until
enough bits of random data are available.
/dev/urandom is similar, but when the store of entropy is running low, it’ll return a cryptographically strong
hash of what there is. This isn’t as secure, but it’s enough for most applications.
You might read from the devices using something like:
root# head -c 6 /dev/urandom | mimencode
This will print six random characters on the console, suitable for password generation. You can find mimencode
in the metamail package.
See /usr/src/linux/drivers/char/random.c for a description of the algorithm.
11.8. Network Security
Network security is becoming more and more important as people spend more and more time connected.
Compromising network security is often much easier than compromising physical or local security, and is
much more common.
There are a number of good tools to assist with network security, and more and more of them are shipped with
your Mandrake Linux distribution, either in the main CD-ROM, contribs, or through the FTP crypto server
(see above).
157