Security takes many forms in a computing environment. This chapter gives examples of three different types of security: access, prevention and detection.
Access for users is usually handled by login or an application designed to handle the login function. In this chapter, we show how to enhance login by setting policies with PAM modules. Access via networks can also be secured by policies set by iptables, commonly referred to as a firewall. For applications that don't offer the best security, you can use the Stunnel package to wrap an application daemon inside an SSL tunnel.
Prevention of breaches, like a trojan, are assisted by applications like GnuPG, specifically the ability to confirm signed packages, which recognizes modifications of the TAR ball after the packager creates it.
Finally, we touch on detection with a package that stores "signatures" of critical files (defined by the administrator) and then regenerates those "signatures" and compares for files that have been changed.
The OpenSSL package contains management tools and libraries relating to cryptography. These are useful for providing cryptography functions to other packages, notably OpenSSH, email applications and web browsers (for accessing HTTPS sites).
Download (HTTP): http://www.openssl.org/source/openssl-0.9.7e.tar.gz
Download (FTP): ftp://ftp.openssl.org/source/openssl-0.9.7e.tar.gz
Download MD5 sum: a8777164bca38d84e5eb2b1535223474
Download size: 3.0 MB
Estimated disk space required: 35 MB
Estimated build time: 1.16 SBU
bc-1.06 (recommended if you run the test suite during the build)
Install OpenSSL by running the following commands:
sed 's/^passwd/openssl-passwd/' doc/apps/passwd.pod \
> doc/apps/openssl-passwd.pod &&
rm doc/apps/passwd.pod &&
mv doc/crypto/{,openssl_}threads.pod &&
./config --openssldir=/etc/ssl --prefix=/usr shared &&
sed -i 's%SHLIBDIRS= fips crypto ssl%SHLIBDIRS= crypto ssl%g' Makefile &&
make MANDIR=/usr/share/man
Now, as the root user:
make MANDIR=/usr/share/man install &&
cp -r certs /etc/ssl
no-rc5 no-idea: When added to the ./config command, this will eliminate the building of those encryption methods. Patent licenses may be needed for you to utilize either of those methods in your projects.
rm doc/apps/passwd.pod: This command prevents OpenSSL from installing its passwd man page over an existing man page with the same name.
mv doc/crypto/{,openssl_}threads.pod: This commands prevents OpenSSL from overwriting an existing man page from Perl.
sed -i 's%SHLIBDIRS= fips crypto ssl%SHLIBDIRS= crypto ssl%g' Makefile: This command prevents installation of the non-existent libfips library.
make MANDIR=/usr/share/man; make MANDIR=/usr/share/man install: These commands install OpenSSL with the man pages in /usr/share/man instead of /etc/ssl/man.
cp -r certs /etc/ssl: The certificates must be copied manually since the install script skips this step.
Most people who just want to use OpenSSL for providing functions to other programs such as OpenSSH and web browsers won't need to worry about configuring OpenSSL. Configuring OpenSSL is an advanced topic and so those who do would normally be expected to either know how to do it or to be able to find out how to do it.
is a Perl script that scans all files in a directory and adds symbolic links to their hash values.
is a command-line tool for using the various cryptography functions of OpenSSL's crypto library from the shell. It can be used for various functions which are documented in man 1 openssl.
implements a wide range of cryptographic algorithms used in various Internet standards. The services provided by this library are used by the OpenSSL implementations of SSL, TLS and S/MIME, and they have also been used to implement OpenSSH, OpenPGP, and other cryptographic standards.
implements the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) protocols. It provides a rich API, documentation on which can be found by running man 3 ssl.