Unix Audit & Security

Course objectives:
The course is intended for those who need to find out what UINX is and where the different components are located, with a specific security objective in mind. In conjunction with an explanation of the technology, the prime risks and defences will be pointed out. Delegates who will benefit most from this course are typically computer auditors, security specialists and security conscious managers. The course also serves as a useful general introduction to UNIX.

Having acquired a high level understanding of UNIX, you will learn how to assess security hands on. All aspects are covered, both business and technical. You will hear commentary on certain real disasters that have happened to high profile companies in the past.

Planning for audits and discussion of suitable tests forms a substantial part of the course. Delegates will get a chance to run audit and security related commands. See what the administrators do. Find out how you could script your own TRIPWIRE.

Though the course is designed specifically for a SUN Solaris installation, it will serve as a good general overview for any flavour of UNIX.

Course content:
Introduction

The popularity of UNIX, UNIX attributes, UNIX security, the structure of the UNIX system
Processes

The ps command, daemon processes, cron daemon, validating executables
Startup and Shutdown

Shutdown, booting UNIX, Init states, rc scripts, fsck
The UNIX Filesystem

File system structure (SVR4), File and directory permissions, locating a UNIX file - the find command, disk management information
Managing users

Logging in, the super user /etc/passwd and /etc/shadow, control files in /etc affecting users and user sessions, password quality controls, session records, groups, profiles, Managing application systems - users, groups and file accesses
Secure inter server working

Network services, the services file, inetd.conf, examples of insecure services
System compromise - detection and response

Programmed threats, determine if your system has been compromised

steps for recovering from a UNIX root compromise

software tools