Submission Summary: 0 pending, 2 declined, 5 accepted (7 total, 71.43% accepted)

Submission + - Beginning SuSE Linux

Submitted by

Ravi

on Sunday December 31, 2006 @11:29AM

Ravi writes: "SuSE Linux, one of the oldest Linux distribution was originally developed by a German company. Not many people will know that SuSE is an acronym in the German language for "Software und System-Entwicklung" which translates as software and system development. Over time, SuSE has gained a reputation as a robust, secure and easy to use Linux distribution both on the server and desktop front.

The book "Beginning SuSE Linux" is authored by Kier Thomas and published by APress. As the name of the book indicates, it is geared towards beginners in GNU/Linux who have set their eyes on trying out the SuSE Linux distribution. The book is divided into 7 different parts with the first part of the book discussing the pros and cons of using Linux as a part of ones daily routine. In this part, the author gives a well balanced view of what Linux is all about and the history behind its formation.

The second part of this book contain chapters which hand hold a person in installing SuSE Linux on ones machine. The author starts by explaining the concept of partitions, backing up your data and the benefits of dual booting between diverse OSes. The 5th chapter titled "Installing SUSE Linux" gives a thorough introduction to installing this Linux distribution on ones machine. And the steps are accompanied by screen-shots which makes it rather intuitive to follow. SuSE provides a number of installation modes and one gets to know the best way of installing it. One thing worth noting is that SuSE allows the user to shrink his Windows partition from within its Installer and this book explains it in a clear way in the section on partitioning the disk. In fact the manner in which the author has explained the steps leaves no room for doubts while installing SuSE. The succeeding chapter lists the possible problems one might face and the solutions for these problems. Most Linux users would be aware of one or more of these problems but to a new Linux user, these could be a real time saver and will save their sanity when they face these problems.

Part 3 of this book is titled "The No-Nonsense getting started guide" and has a collection of 6 chapters. These chapters give a good introduction to the SuSE Desktop — more specifically to the Gnome desktop which is the default one in SuSE. In the 8th chapter titled "Getting everything up and running", the author explains how to setup and configure the diverse hardware which form a part and parcel of a computer. For instance, this chapter deals with configuring the sound card, setting up and managing the printer including a printer on the network which is connected to a Windows machine, importing photos from a digital camera and more. But what is worth noting is that SuSE has its own unique methods and GUI tools to accomplish these tasks and the author explains these via the SuSE specific tools where ever applicable.

There is a separate chapter on securing the machine running SuSE Linux where the author impresses upon the readers the necessity of securing ones machine. He further goes on to explain the different ways of securing SuSE which includes steps to update the software. This chapter also dwells deeply on using Aparmor — SUSE's industrial grade security system.

It is really thoughtful of the author to include a chapter detailing the various commonly used Windows software and their possible Free replacements.

The 4th part of the book titled "Shell and beyond" comprises of 5 chapters deals with educating the new Linux user on the usage of command line to accomplish ones tasks. The author starts by providing a gentle introduction to the shell, the different terminals available in Linux and then gradually moves on to explain the usage of different commands which provide the true power to Linux. In the chapter titled "Understanding Linux files and users", he gives a detailed explanation of the concept of files, their permissions and how they relate in the Linux as well as explain the concept of mounting. Even though I was conversant with most of what the author was explaining, reading the book, I couldn't help feel that this book is an excellent resource for a Linux neophyte who is looking forward to taking his first baby steps in learning to be productive in Linux, more specifically SuSE Linux.

The next three chapters deal with getting SuSE Linux to play all the proprietary music and video file formats. One of the inherent disadvantages of Linux owed mostly due to the ideological stance of GPL is that it cannot play music and video encoded in a proprietary file format out of the box. But with a little effort, it is possible to provide support for these proprietary file formats in Linux. In these chapters, the author gives a good run down on the various music and video codecs and ways of getting support for them in SuSE Linux. He introduces different software which allow one to not only just play music but also to categorize, burn music onto removable media and even rip music from audio CDs and save them on to ones hard disk. Surprisingly, I found this book much more than a mere how-to-do-it sort of book as the author provides details of related facts from a lay man's perspective where ever applicable. For instance, in the chapter titled "Movies and Multimedia", while explaining how to enable media players to play the files encoded in these formats, he impresses upon the readers the ethical issues surrounding the DRM and patents.

There is a whole chapter dedicated to image manipulation where many features of the GIMP software has been explained. The author has done a splendid job of explaining this image manipulation editor within the constrains of this chapter.

The next 8 chapters deal with using SuSE in an office setup. SuSE Linux comes bundled with a plethora of applications which form a part and parcel of any office setup. This includes word processors, spreadsheets, a database, presentation software and email client just to name a few of them. This book has dedicated a chapter each in explaining how to put these software to productive use in an office setup. Catering to those die hard MS Word enthusiasts, there is also a chapter on making MS Office to work natively in SuSE Linux if at all you have a licensed copy of it lying around.

The seventh and final part of the book titled "Keeping your System Running" provides details on the vagaries of system administration such as installing, removing and updating software binaries, compiling software from source and installing it, managing users and groups optimizing your system, backing up data and scheduling tasks.

The final chapter which is the 34th chapter of this book deals with explaining various ways of connecting to the SuSE Linux machine remotely where the author explains about SSH and related tools.

This book contain three appendices with a glossary of Linux terms being one of them where the newbies among us gets to understand the meaning of Linux related geek terms. There is also an appendix containing a Bash command index which — embracing authors own words — provides a whistle stop tour of commands that can be used at the Bash Shell.

I have always maintained that writing a good book is an art. It is not just enough if the person is well versed in his area of expertise. Rather, he should also be a good communicator and should be able to sustain the reader's interest in the subject through out the book. Kier Thomas shines through in his narration of the concepts quite well. He explains in simple, lucid and entertaining manner the different ways of configuring all aspects of SuSE Linux from a users perspective. This is definitely a good book for those of us who look forward to installing and becoming productive in using SuSE Linux.

Ravi Kumar is a GNU/Linux enthusiast who likes to share his thoughts on GNU/Linux and Free Software through his blog on Linux."

Submission + - SELinux by Example

Submitted by

Ravi

on Wednesday December 20, 2006 @09:20AM

Ravi writes: "SELinux is a project started and actively maintained by the U.S Department of Defense to provide a Mandatory Access Controls mechanism in Linux. It had been a long standing grouse of Linux power users and system administrators over its lack of fine grained access control over various running processes as well as files in Linux. While Solaris touts its famous RBAC and Microsoft Windows has its own way of providing finer rights to its resources, Linux had to put up with the simple but crude user rights known in tech speak as discretionary access control to control user access of files. But with SELinux project making great strides and now being bundled with many major Linux distributions, it is possible to effectively lock down a Linux system through judicious use of SELinux policies. SELinux implements a more flexible form of MAC called type enforcement and an optional form of multilevel security.

The book "SELinux by Example" is authored by three people — Frank Mayer, Karl Macmillan and David Caplan and is published by Prentice Hall. The target audience for this book is SELinux policy writers and system administrators with more content dedicated to be put to use by policy writers. There are a total of 14 chapters and 4 appendices spread just over 400 pages. The 14 chapters are in turn broadly divided into three parts with the first part containing chapters which provide an overview of SELinux, its background and the concepts behind it. The second part contain 7 chapters which are most useful for SELinux policy writers and contain detailed explanation of the syntax used in writing the policy files. It is the third part namely "Creating and Writing SELinux Security Policies" which could be most put to use by system administrators where the authors provide enough details of working with SELinux.

In the second chapter, the authors introduce the concept of type enforcement access control, understanding of which is imperative to ones knowledge of SELinux. They further talk on the concept of roles and multi level security. And true to the title of the book, all these concepts are explained by analyzing the security controls of the ubiquitous passwd program.

In the succeeding chapter the authors explain the underlying architecture of SELinux. More specifically, how SELinux integrates with the Linux kernel via the Linux security module (LSM), the organization of the policy source file and how to build and install policies.

SELinux policies to a large extent are based on object classes. For example, you can create an object class and associate a set of permissions to that class. And all objects associated with that class will share the same set of permissions. In the fourth chapter, one get to know about different types of object classes and the permissions that can be assigned to these classes. A total of 40 classes and 48 permissions are discussed in this chapter.

The next chapter titled "Types Enforcement" goes into a detailed analysis of all the types and attributes as well as the rules that could be used. The majority of SELinux policy is a set of statements and rules that collectively define the type enforcement policy. Going through the chapter, I was able to get a fair idea of the syntax used in writing TE policies.

Keeping in mind the complexity of the subject, it helps a great deal that at the end of each chapter, there is a summary section where the authors have listed the important points covered in the chapter. More over, one gets to answer a couple of questions and check one's knowledge about the topic being discussed.

In the 6th chapter, the authors explain in detail the concept of roles and their relationship in SELinux. In fact, what I really like about this book is the fact that each concept of SELinux has been dedicated a chapter of its own. For instance, constraints, multilevel security, type enforcement, conditional policies,... all are explained in chapters of their own.

One thing worth noting is that Fedora Core 4 and RHEL 4 and above ship with the targeted policy by default. Where as to completely lock down a Linux machine, you need to embrace the strict SELinux policy. But this has the side effect of causing breakages with some of the existing Linux applications which expect looser security controls. In targeted policy, the more confining rules are focused on a subset of likely to be attacked network applications. So in most cases, one can manage by using targeted policy. This book mostly deals with the strict policy of SELinux and in chapter 11, the authors dissect the strict example policy maintained and updated via the NSA and Fedora Core mailing lists.

But there is another policy called the Reference Policy which is an attempt to water down the strict policy maintained by NSA and in the process make it easier to use, understand, maintain, also to make it more modular and this is covered in the succeeding chapter titled "Reference Policy".

The next chapter titled "Managing an SELinux system" is one which the system administrators will relate to, where the authors throw light on the hierarchy of SELinux configuration files. The purpose of each file is explained in simple terms. And considering that SELinux comes bundled with a rich set of tools meant to be used by system administrators, one gets to know the usage of some of them and also learn about the common problems that are faced by administrators while administering an SELinux system.

And in the last chapter of the book which is the 14th chapter, one is introduced to the task of writing policy modules. Here the authors hand hold in the creation of a policy module for the IRC daemon for Fedora Core 4 from start to finish which involves right from the planning stage to writing and applying the policy module, to the final testing of the module.

This book also includes 4 appendices which contain a wealth of knowledge on SELinux. I especially liked appendix C which lists all the object classes and permissions as well as appendix D which has a list of SELinux system tools and third party utilities with explanations.

It could be just me but I found that I was better able to assimilate what the authors explained when I read the 13th chapter of this book first and then went back to read the 4rd chapter onwards. Having said that, I find this book to be an excellent resource for people interested in developing SELinux policies and to a slightly lesser extent a resource for system administrators. At the very least, this book imparts a deep understanding of the features, structure, syntax and working of SELinux.

Ravi Kumar maintains a blog at linuxhelp.blogspot.com where he shares his thoughts and experiences on all things related to Linux."

Submission + - Configuring IPCOP Firewalls

Submitted by

Ravi

on Tuesday November 21, 2006 @03:36AM

Ravi writes: "IPCop is a GPLed firewall solution targeted at Small Office/Home Office network. It is favored by many for its ease of configuration and setup and its support for a variety of features that you would expect to have in a modern firewall. IPCop is famed for letting users setup a sophisticated firewall for ones network without ever having to write an iptables rule themselves.

The book titled "Configuring IPCOP Firewalls" published by Packt Publishing is authored by two people Barrie Dempster and James Eaton-Lee and is divided into 11 chapters. The first chapter gives a brief introduction to firewalls and explains technical concepts such as OSI reference model, an introduction to TCP/IP and a brief outline of the parts that comprise a network. Even though I did not find anything new in this chapter, I realized that this is meant for people who are new to the world of computer networks and aims to bring them upto date with the various technologies associated with it. A network administrator intending to pick up skills in configuring and setting up IPCOP, can circumvent this chapter and directly go to the second chapter which gives an introduction to IPCOP — its different features, and in which all ways it can be effectively used. The authors have explained the concepts in an easily understood way with the aid of necessary screen-shots. One of the salient features of IPCOP is its web based interface which allows one to configure all aspects of it from a remote location. In fact, IPCOP is designed to be controlled from a remote location and serves all its configuration parameters via the Apache web server. In the second chapter, one gets to know all the features of IPCOP including the different services it offer. One thing that struck me while going through this book was that the authors are fully immersed in explaining the configuration aspects of IPCOP which is done entirely via the web interface. So much that other than the first chapter — "Introduction to firewalls", the third chapter titled "Deploying IPCop and Designing a network" and the 10th chapter titled "Testing, Auditing and Hardening IPCop" where the readers are made to digest some theory, the rest of the book is a how-to sort of book which I found to be ideally suited — especially for people who are the least bothered about theory and just want to set up IPCop and get on with what ever they were doing.

In the third chapter, we are introduced to the unique feature used by IPCop to segregate the network depending upon its vulnerability. And in the succeeding chapter, the authors walk one through installing IPCop on ones machine. Here each and every installation step is explained with the help of a screenshot which makes understanding the procedure much more intuitive.

The chapter titled "Basic IPCop Usage" gives a good introduction to the web interface provided by IPCop. Reading this chapter, I was able to get a good feel for the IPCop interface. More specifically, one gets to know how to configure IPCop to provide different services such as DHCP server, support for Dynamic DNS, editing the hosts file and so on. Mind you, the IPCop interface is quite rich in functionality even providing options to reboot or shutdown the machine remotely. In this chapter, apart from the introduction to the web interface, the authors have also provided a few tips related to logging in to the remote machine running IPCop using SSH.

Put in simple terms, IPCop is a specialized Linux distribution which contain a collection of tools which revolve around providing robust firewall capabilities. The tools bundled with IPCop range from the ubiquitous iptables, services such as DNS, DHCP to tools which specialize in intrusion detection such as snort. The sixth chapter titled "Intrusion Detection with IPCop" explains the concept of intrusion detection and how one can use snort IDS bundled with IPCop to effectively find out what is passing through our network and thus isolate any harmful packets.

From there, the book moves on to explain how to use IPCop to set up a virtual private network (VPN). By way of an example, the authors explain how to setup a VPN between two remote networks with each end having a IPCop firewall in place. This chapter covers different VPN scenarios such as host to net, net to net connections as well as configuring IPCop to detect the Certifying Authority certificates.

The 8th chapter is a rather short one which explains how to effectively use proxying and caching solutions available in IPCop to manage the bandwidth.

One of the biggest advantages of IPCop is that it is possible to extend it to provide additional features by way of addons. Addons are generally developed by third parties and are usually developed with an aim to provide a feature that the developers of IPCop have missed. There are a whole lot of addons available for IPCop. The 9th chapter introduces the most popular addons available for IPCop such as SquidGuard — a content filtering addon, LogSend — an addon which send the IPCop logs to remote email accounts, AntiSpam, integrating ClamAV anti virus solution and more. The authors have also explained how to install and enable these addons using the IPCop web interface.

As I said earlier, the tenth chapter titled "Testing, Auditing and Hardening IPCop" has more of a theoretical disposition where the authors list some of the common attributes towards security and patch management and also some of the security risks and a few common security and auditing tools and tests.

One thing I really like about this book is the practical approach taken by the authors in explaining how to accomplish a certain task. Each section is accompanied by the relevant screenshots of the web interface with a brief explanation of the options available. The book is well designed with a number of tips provided in each section highlighted in big square brackets which makes it quite eye catching. Even though I found the book a bit short on theory, it is an ideal resource which provides a hands on approach to people who are more interested in installing and setting up IPCop firewall solutions in ones network rather than pondering about the theoretical concepts of the same.

Ravi Kumar likes to share his thoughts on all things related to GNU/Linux, Open Source and Free Software through his blog on Linux."

« Newer Older »

Submission + - Beginning SuSE Linux

Submission + - SELinux by Example

Submission + - Configuring IPCOP Firewalls

Slashdot Top Deals

Slashdot