Next | Prev | Top | Contents | Index

Chapter 4: System Security

This chapter deals with maintaining the security of your local computer system. Once you have initially established the security of a system, you can expand your secure area to include the network. But until you have local security, there is no point in trying to establish security over a larger area.

In addition, security is never established finally. That is, security is a dynamic process, requiring that you understand the issues, keep up to date on them, and continually monitor your system with the many tools available. It is the intention of this chapter and the next to give you the information you need to establish a security policy and begin its implementation.

Chapter 5 discusses network security issues, and is intended for use after the issues discussed in this chapter have been addressed to your satisfaction. If you are not connecting to the Internet or any large network scheme but only establishing or connecting to a small, local area network, you should still read the first part of Chapter 5, "Local Area Network Access".

This chapter includes the following sections:

"Standard Security Features", which is an overview of the standard security features incorporated in IRIX design.
"Security Guidelines" is a list of areas to check for common security holes.
"Password Administration" details proper setup and control of system software and user accounts to increase security.
"Login and Account Administration" covers proper maintenance of special accounts as well as user logins.
"Set-UID and Set-GID Permissions" describes the nature and control of the file permissions that enable user and group IDs to be set on execution.
"General File and Directory Permissions" discusses permission settings and lists the IRIX files and directories that are universally available for read and write access.
"Accounts Shipped Without Passwords" lists the user accounts in /etc/passwd that do not contain passwords on the software as shipped.

A great strength of the IRIX system is the ease with which users can share files and data. However, some of the security guidelines presented in this chapter are at odds with easy system access. It is up to you as the system administrator to balance the needs and concerns of the user community.

It is one thing to secure an isolated IRIX system, another to secure a local area network, and still another to secure a site that is connected to external networks such as the Internet. This chapter deals primarily with taking steps to secure an isolated system, but many of these same steps must also be taken before undertaking the more ambitious job of securing a network. For information regarding network security issues, refer to Chapter 5.

Standard Security Features
Security Guidelines
Password Administration
Login and Account Administration
Set-UID and Set-GID Permissions
General File and Directory Permissions
Accounts Shipped Without Passwords
Security File and Command Reference

Next | Prev | Top | Contents | Index