Building Internet Firewalls Second Edition

By Elizabeth D. Zwicky, Simon Cooper and D. Brent Chapman

This book is divided into five parts.

Part I, "Network Security", explores the problem of Internet security and focuses on firewalls as part of an effective strategy to address that problem.

• Chapter 1, "Why Internet Firewalls?", introduces the major risks associated with using the Internet today; discusses what to protect, and what to protect against; discusses various security models; and introduces firewalls in the context of what they can and can't do for your site's security.
• Chapter 2, "Internet Services", outlines the services users want and need from the Internet, and summarizes the security problems posed by those services.
• Chapter 3, "Security Strategies", outlines the basic security principles an organization needs to understand before it adopts a security policy and invests in specific security mechanisms.

Part II, "Building Firewalls", describes how to build firewalls.

• Chapter 4, "Packets and Protocols ", describes the basic network concepts firewalls work with.
• Chapter 5, "Firewall Technologies", explains the terms and technologies used in building firewalls.
• Chapter 6, "Firewall Architectures", describes the major architectures used in constructing firewalls, and the situations they are best suited to.
• Chapter 7, "Firewall Design", presents the process of designing a firewall.
• Chapter 8, "Packet Filtering" describes how packet filtering systems work, and discusses what you can and can't accomplish with them in building a firewall.
• Chapter 9, "Proxy Systems", describes how proxy clients and servers work, and how to use these systems in building a firewall.
• Chapter 10, "Bastion Hosts", presents a general overview of the process of designing and building the bastion hosts used in many firewall configurations.
• Chapter 11, "Unix and Linux Bastion Hosts", presents the details of designing and building a Unix or Linux bastion host.
• Chapter 12, "Windows NT and Windows 2000 Bastion Hosts ", presents the details of designing and building a Windows NT bastion host.

Part III, "Internet Services", describes how to configure services in the firewall environment.

• Chapter 13, "Internet Services and Firewalls", describes the general issues involved in selecting and configuring services in the firewall environment.
• Chapter 14, "Intermediary Protocols", discusses basic protocols that are used by multiple services.
• Chapter 15, "The World Wide Web", discusses the Web and related services.
• Chapter 16, "Electronic Mail and News", discusses services used for transferring electronic mail and Usenet news.
• Chapter 17, "File Transfer, File Sharing, and Printing", discusses the services used for moving files from one place to another.
• Chapter 18, "Remote Access to Hosts", discusses services that allow you to use one computer from another computer.
• Chapter 19, "Real-Time Conferencing Services", discusses services that allow people to interact with each other online.
• Chapter 20, "Naming and Directory Services", discusses the services used to distribute information about hosts and users.
• Chapter 21, "Authentication and Auditing Services", discusses services used to identify users before they get access to resources, to keep track of what sort of access they should have, and to keep records of who accessed what and when.
• Chapter 22, "Administrative Services", discusses other services used to administer machines and networks.
• Chapter 23, "Databases and Games", discusses the remaining two major classes of popular Internet services, databases and games.
• Chapter 24, "Two Sample Firewalls", presents two sample configurations for basic firewalls.

Part IV, "Keeping Your Site Secure", describes how to establish a security policy for your site, maintain your firewall, and handle the security problems that may occur with even the most effective firewalls.

• Chapter 25, "Security Policies", discusses the importance of having a clear and well-understood security policy for your site, and what that policy should and should not contain. It also discusses ways of getting management and users to accept the policy.
• Chapter 26, "Maintaining Firewalls", describes how to maintain security at your firewall over time and how to keep yourself aware of new Internet security threats and technologies.
• Chapter 27, "Responding to Security Incidents", describes what to do when a break-in occurs, or when you suspect that your security is being breached.

Part V, "Appendixes", consists of the following summary appendixes:

• Appendix A, "Resources", contains a list of places you can go for further information and help with Internet security: World Wide Web pages, FTP sites, mailing lists, newsgroups, response teams, books, papers, and conferences.
• Appendix B, "Tools", summarizes the best freely available firewall tools and how to get them.
• Appendix C, "Cryptography", contains background information on cryptography that is useful to anyone trying to decrypt the marketing materials for security products.

Click to Read More

DNS and BIND Fourth Edition

By Paul Albitz and Cricket Liu

The Domain Name System is a distributed database. This allows local control of the segments of the overall database, yet the data in each segment is available across the entire network through a client-server scheme. Robustness and adequate performance are achieved through replication and caching.

Programs called name servers constitute the server half of DNS's client-server mechanism. Name servers contain information about some segments of the database and make it available to clients, called resolvers. Resolvers are often just library routines that create queries and send them across a network to a name server.

The structure of the DNS database is very similar to the structure of the Unix filesystem, as shown in Figure 1-1. The whole database (or filesystem) is pictured as an inverted tree, with the root node at the top. Each node in the tree has a text label, which identifies the node relative to its parent. This is roughly analogous to a "relative pathname" in a filesystem, like bin. One label -- the null label, or "" -- is reserved for the root node. In text, the root node is written as a single dot ( .). In the Unix filesystem, the root is written as a slash ( / ).

The first implementation of the Domain Name System was called JEEVES, written by Paul Mockapetris himself. A later implementation was BIND, an acronym for Berkeley Internet Name Domain, which was written for Berkeley's 4.3 BSD Unix operating system by Kevin Dunlap. BIND is now maintained by the Internet Software Consortium.

BIND is the implementation we'll concentrate on in this book and is by far the most popular implementation of DNS today. It has been ported to most flavors of Unix and is shipped as a standard part of most vendors' Unix offerings. BIND has even been ported to Microsoft's Windows NT.

The fourth edition of this book deals with the new 9.1.0 and 8.2.3 versions of BIND as well as the older 4.9 versions. While 9.1.0 and 8.2.3 are the most recent versions as of this writing, they haven't made their way into many vendors' versions of Unix yet, partly because both versions have only recently been released and many vendors are wary of using such new software. We also occasionally mention other versions of BIND, especially 4.8.3, because many vendors continue to ship code based on this older software as part of their Unix products. Whenever a feature is available only in the 4.9, 8.2.3, or 9.1.0 version, or when there is a difference in the behavior of the versions, we try to point out which version does what.

We use nslookup, a name server utility program, very frequently in our examples. The version we use is the one shipped with the 8.2.3 BIND code. Older versions of nslookup provide much, but not quite all, of the functionality in the 8.2.3 nslookup. We've used commands common to most nslookup sin most of our examples; when this was not possible, we tried to note it.

Click to Read More

Network Troubleshooting Tools First Edition

by Joseph D. Sloan

This book is not a general introduction to network troubleshooting. Rather, it is about one aspect of troubleshooting -- information collection. This book is a tutorial introduction to tools and techniques for collecting information about computer networks. It should be particularly useful when dealing with network problems, but the tools and techniques it describes are not limited to troubleshooting. Many can and should be used on a regular basis regardless of whether you are having problems.

Some of the tools I have selected may be a bit surprising to many. I strongly believe that the best approach to troubleshooting is to be proactive, and the tools I discuss reflect this belief. Basically, if you don't understand how your network works before you have problems, you will find it very difficult to diagnose problems when they occur. Many of the tools described here should be used before you have problems. As such, these tools could just as easily be classified as network management or network performance analysis tools.

This book does not attempt to catalog every possible tool. There are simply too many tools already available, and the number is growing too rapidly. Rather, this book focuses on the tools that I believe are the most useful, a collection that should help in dealing with almost any problem you see. I have tried to include pointers to other relevant tools when there wasn't space to discuss them. In many cases, I have described more than one tool for a particular job. It is extremely rare for two tools to have exactly the same features. One tool may be more useful than another, depending on circumstances. And, because of the differences in operating systems, a specific tool may not be available on every system. It is worth knowing the alternatives.

The book is about freely available Unix tools. Many are open source tools covered by GNU- or BSD-style licenses. In selecting tools, my first concern has been availability. I have given the highest priority to the standard Unix utilities. Next in priority are tools available as packages or ports for FreeBSD or Linux. Tools requiring separate compilation or available only as binaries were given a lower priority since these may be available on fewer systems. In some cases, PC-only tools and commercial tools are noted but are not discussed in detail. The bulk of the book is specific to Ethernet and TCP/IP, but the general approach and many of the tools can be used with other technologies.

While this is a book about Unix tools, at the end of most of the chapters I have included a brief section for Microsoft Windows users. These sections are included since even small networks usually include a few computers running Windows. These sections are not, even in the wildest of fantasies, meant to be definitive. They are provided simply as starting points -- a quick overview of what is available.

Finally, this book describes a wide range of tools. Many of these tools are designed to do one thing and are often overlooked because of their simplicity. Others are extremely complex tools or sets of tools. I have not attempted to provide a comprehensive treatment for each tool discussed. Some of these tools can be extremely complex when used to their fullest. Some have manuals and other documentation that easily exceed the size of this book. Most have additional documentation that you will want to retrieve once you begin using them.

My goal is to make you aware of the tools and to provide you with enough information that you can decide which ones may be the most useful to you and in what context so that you can get started using the tools. Each chapter centers on a collection of related tasks or problems and tools useful for dealing with these tasks. The discussion is limited to features that are relevant to the problem being discussed. Consequently, the same tool may be discussed in several places throughout the book.

Please be warned: the suitability or behavior of these tools on your system cannot be guaranteed. While the material in this book is presented in good faith, neither the author nor O'Reilly & Associates makes any explicit or implied warranty as to the behavior or suitability of these tools. We strongly urge you to assess and evaluate these tool as appropriate for your circumstances.

Click to Read More/Download

Network Troubleshooting Tools (O'Reilly System Administration)