Full Table of Contents

Contents

IRIX Admin Manual Set

About This Guide

What This Guide Contains

Part I

Part II

Part III

Conventions Used in This Guide

How to Use This Guide

Additional Resources

Books

Internet Resources

World Wide Web Resources for System Security

USENET News Groups

Commercial and Free Products

Connecting to the Internet

I - Backup

1. - Planning a Backup Strategy

Types of Backup Media

Choosing a Backup Tool

Backup Strategies

When to Back Up Data and What to Back Up

Root Filesystems

User Filesystems

Incremental Backups

Backing Up Files Across a Network

Automatic Backups

Storing Backups

How Long to Keep Backups

Reusing Tapes

2. - Backup and Recovery Procedures

General Backup Procedure

System Backups

Recovery After System Corruption

Changing the Default Backup Device

bru

Saving Data With bru

Estimating Space Required for Backup

Backing Up a Filesystem With bru

Backing Up Files With bru

Saving Files by Modification Date

Saving Files Using Data Compression

Incremental Backups With bru

Examining bru Archives

Comparing Archived Files

Inspecting an Archive for Consistency

Restoring bru Archives

Restoring a Filesystem With bru

Restoring Individual Files With bru

Backup and Restore

Estimating Space Required for Backup

Saving Data with Backup

Restoring Backup Archives With Restore

Restoring a Filesystem With Restore

dump and restore

Saving Data With dump

Saving a Filesystem With dump

Incremental Backups With dump

Restoring dump Archives With restore

Restoring a Filesystem With restore

Restoring Individual Files With restore

xfsdump and xfsrestore

Features of xfsdump and xfsrestore

Media Layout

Terminology

Possible Dump Layouts

Saving Data With xfsdump

Specifying Local Media

Specifying a Remote Tape Drive

Backing Up to a File

Reusing Tapes

Erasing Used Tapes

Incremental and Resumed Dumps

Examining xfsdump Archives

Restoring xfsdump Archives With xfsrestore

Simple Restores With xfsrestore

Restoring Individual Files with xfsrestore

Network Restores with xfsrestore

Interactive Restores With xfsrestore

Cumulative Restores With xfsrestore

Interrupting xfsrestore

housekeeping and orphanage Directories

Using xfsdump and xfsrestore to Copy Filesystems

tar

Saving Data With tar

Backing Up Files With tar

Saving Files by Modification Date

Incremental Backups With tar

Examining tar Archives

Restoring tar Archives

cpio

Saving Data With cpio

Backing Up Files With cpio

Saving Files by Modification Date

Incremental Backups With cpio

Examining cpio Archives

Restoring cpio Archives

dd

3. - Troubleshooting Backup and Recovery

Unreadable Backups

Reading Media From Other Systems

Errors Creating the Backup

Restoring the Wrong Backup

Testing for Bad Media

Backup and Recovery Error Messages

II - Security

4. - System Security

Standard Security Features

Security Guidelines

Password Administration

Choosing Passwords

PROM Passwords

Clearing the PROM Password Using nvram

Setting the PROM Password From the Command Monitor

Second (Dialup) Passwords

Creating a Shadow Password File

Password Aging

Password Aging With the passwd Command

Using Password Aging Manually

Using pwck to Check the Password File

Login and Account Administration

Special Accounts

Locking Unused Logins

System Login Options

Restricting root Logins

Maximum Login Attempts (MAXTRYS)

Length of Time to Disable a Line (DISABLETIME)

Recording Login Attempts

Forcing a Password

Displaying the Last Login Time

Set-UID and Set-GID Permissions

Checking for Set-UID Files Owned by root

Checking for Set-UIDs in the root Filesystem

Checking Set-UIDs in Filesystems Other Than root

General File and Directory Permissions

Accounts Shipped Without Passwords

Security File and Command Reference

5. - Network Security

Local Area Network Access

Controlling Network Access

Limiting X11 Access

xhost Command

X*.xhost File

Local inetd Services

Network Security and Firewalls

What is the Internet?

Network Security Issues

What Is a Firewall?

Firewall Design Philosophy

World Wide Web Issues

Hardware Configuration

Routers and Firewalls

Configuring SGI Hardware for Use as a Firewall

Dual-Homed Host Firewall

Screened Host Gateway

IRIX Configuration

Network Software Setup on a Dual-Homed Host

Tightening Security in IRIX

Disable Forwarding of IP Packets

Limiting inetd Services

Password Protection

Limiting rpc Services Access

Disabling NIS (YP)

Limiting NFS Access

Setting Up a Proper Log File

Checking Software Integrity

Educating Users

Internal Network Configuration

Domain Name System (DNS)

Mail Configuration

Sendmail Configuration and Mail Aliases

Spool Isolation

Using Proxy Servers

III - Accounting

6. - Administering the System Audit Trail

Enabling Auditing

Default Auditing

Customizing Auditing

What Should I Audit?

Auditable Events

Using satconfig

Using sat_select

Saving and Retrieving Your Auditing Environment

Placing the Audit Files

How to Audit a Specific User

How to Audit a File

How to Audit a Label Under Trusted IRIX/B

Understanding the Audit Data

Potential Security Violations

Use and Abuse by Outsiders

Attempts at Unauthorized Entry

System Usage at Unusual Hours or From Unusual Locations

Connections with Machines Outside the Local Network

Use and Abuse by Insiders

File Permission Violations

Unexpected Use of Root Privilege

Activity by Particularly Interesting Users

Access to Particularly Interesting Files or Resources

Proper and Improper Management

Modifications of System Data Files

Modifications of Attributes of System Programs

Manipulation of the Audit Trail

Archiving Audit Data

Removing Audit Data

Recovering From Audit File Overflow

7. - System Accounting

Process (System) Accounting

Parts of the Process Accounting System

Turning on Process Accounting

Turning Off Process Accounting

Controlling Accounting File Size

Accounting Files and Directories

Daily Operation

Setting Up the Accounting System

runacct

Recovering from a Failure

Restarting runacct

Fixing Corrupted Files

Fixing wtmp Errors

Fixing tacct Errors

Updating Holidays

Daily Reports

Daily Usage Report

Daily Command and Monthly Total Command Summaries

Files in the /var/adm Directory

Files in the /var/adm/acct/nite Directory

Files in the /var/adm/acct/sum Directory

Files in the /var/adm/acct/fiscal Directory

Additional Resources

Index