free barcode generator dll for vb.net s SECURING FILES AND FILE SYSTEMS in Font

Generator Data Matrix in Font s SECURING FILES AND FILE SYSTEMS

where the applications creating files are easily quantifiable. Like most permissions settings, this will require some testing with your applications, and you should note that some users (especially those that run processes to create files or objects) will require more lenient umask settings than other users.

s Note If you are using Red Hat, then the default umask for all users with a UID greater than 99 (in other words, nonsystem users) is 002 rather than 022. The default umask of 022 would normally prevent other users and members of the primary group to which a user belongs from modifying any files they create. But because most users on a Red Hat system are created together with a group of the same name that is their primary group (a convention generally called user private groups; see 1), they do not need this protection and a umask of 002 is adequate to protect their newly created files.

As I have mentioned, the last triplet of access permissions is the access granted to everyone, or world access. World access includes all users on your system. This means that if an attacker were to compromise an ordinary user account on your system, they would have whatever world access is granted to all your files and objects. This poses three significant risks. The first is what world-readable files and directories are on your system, and how could their content benefit an attacker The second is what world-executable files and directories exist on your system, and what could running them gain an attacker The last and arguably most significant risk is what world-writable files and directories exist on your system, and how could changing, editing, or deleting them benefit or assist an attacker in penetrating your system I recommend you carefully audit the files and objects on your system for those with world-readable, world-executable, and world-writable permissions. Find all those files and directories on your system, and determine whether they require the world permissions; if not, remove those permissions. Some files on your system will require world access permissions such as some devices in the /dev and /proc directories or some files required for particular applications. I recommend you carefully conduct tests before you make changes to your permissions in a production environment. In Listing 4-6, you can see a command to find all files and objects with world access on your system. Listing 4-6. Finding World Permissions puppy# find / -perm -o=w ! -type l -ls The find command is using the -perm option to search for files and objects with particular permissions set. The -o=w flag for the -perm option selects files with at least world-writable access (which includes lesser access such as readable and executable permissions). The ! -type l part

selects all file and object types except links, and the last option, -ls, outputs the list of files in the same format as used when you execute the ls command with the -dla options specified.

s The find command is a powerful tool for searching for particular files and objects on your system; Tip

Linux security permissions can be highly inflexible. If a user has the write permissions, or a group they belong to has write permissions to a directory, the user will be able to delete the files in that directory even if they do not own those files. This has some serious implications for directories to which more than one user or application share write permissions. In Listing 4-7 user bob belonging to the group sales can create a file in the directory /usr/sharedfiles. Listing 4-7. Sticky Bits puppy$ su bob puppy$ cd /usr/ puppy$ ls -l sharedfiles drwxrwxr-x 2 root sales puppy$ cd sharedfiles puppy$ vi bobsfile puppy$ ls -l bobsfile -rw-rw-r-1 bob bob