Translation status
| 452 | Strings | 77% | Translate |
|---|---|---|---|
| 15,122 | Words | 65% |
Other components
Translation Information
| Project website | https://debian-handbook.info/ | |
|---|---|---|
| Mailing list for translators | debian-handbook-translators@lists.alioth.debian.org | |
| Instructions for translators | ||
| Translation process |
|
|
| Translation license | GNU General Public License v2.0 or later | |
| Repository |
https://salsa.debian.org/hertzog/debian-handbook.git
|
|
| Repository branch | buster/master | |
| Last remote commit |
Drop draft status
bd654cd4
Raphaël Hertzog authored 8 days ago |
|
| Repository containing Weblate translations |
https://hosted.weblate.org/git/debian-handbook/12_advanced-administration/
|
|
| Filemask | */14_security.po |
|
| Translation file |
ja-JP/14_security.po
|
|
None
Some of these operations can be made easier with specialized software. In particular, the <emphasis role="pkg">sleuthkit</emphasis> package provides many tools to analyze a filesystem. Their use is made easier by the <emphasis>Autopsy Forensic Browser</emphasis> graphical interface (in the <emphasis role="pkg">autopsy</emphasis> package). Some Linux distributions have a "live install" image and contain many programs for forensic analysis, such as Kali Linux (see <xref linkend="sect.kali" />), with its <emphasis>forensic mode</emphasis>, BlackArchLinux<footnote><para> <ulink url="https://blackarch.org" /></para></footnote> and the commercial Grml-Forensic, based on Grml (see <xref linkend="sect.grml" />).
While it may seem tempting to analyze the system as it runs, especially when the server is not physically reachable, this is best avoided: quite simply you can't trust the programs currently installed on the compromised system. It' is quite possible for a subverted <command>ps</command> command to hide some processes, or for a subverted <command>ls</command> to hide files; sometimes even the kernel is compromised!
This may only be possible if the server is physically accessible. When the server is hosted in a hosting provider's data center halfway across the country, or if the server is not accessible for any other reason, it' is usually a good idea to start by gathering some important information (see <xref linkend="sect.keeping-everything-that-could-be-used-as-evidence" />, <xref linkend="sect.forensic-analysis" /> and <xref linkend="sect.reconstituting-the-attack-scenario" />), then isolating that server as much as possible by shutting down as many services as possible (usually, everything but <command>sshd</command>). This case is still awkward, since one can't rule out the possibility of the attacker having SSH access like the administrator has; this makes it harder to “clean” the machines.
Cracking acts are often not detected until they have direct consequences on the legitimate services hosted on the machine, such as connections slowing down, some users being unable to connect, or any other kind of malfunction. Faced with these problems, the administrator needs to have a good look at the machine and carefully scrutinize what misbehaves. This is usually the time when they discover an unusual process, for instance, one named <literal>apache</literal> instead of the standard <literal>/usr/sbin/apache2</literal>. If we follow that example, the thing to do is to note its process identifier, and check <filename>/proc/<replaceable>pid</replaceable>/exe</filename> to see what program this process is currently running:
An attacker taking control of your machine then using it as a forward base (known as a “relay system”) from which to perform other nefarious activities could cause legal trouble for you, since the attacked party would initially see the attack coming from your system, and therefore consider you as the attacker (or as an accomplice). In many cases, the attacker will use your server as a relay to send spam, which shouldn't have much impact (except potentially registration on black lists that could restrict your ability to send legitimate emails), but won't be pleasant, nevertheless. In other cases, more important trouble can be caused from your machine, for instance, denial of service attacks. This will sometimes induce loss of revenue, since the legitimate services will be unavailable and data can be destroyed; sometimes this will also imply a real cost, because the attacked party can start legal proceedings against you. Rights-holders can sue you if an unauthorized copy of a work protected by copyright law is shared from your server, as well as other companies compelled by service level agreements if they are bound to pay penalties following the attack from your machine.
In the Ffree Ssoftware world, there is generally ample room for choice, and choosing one piece of software over another should be a decision based on the criteria that apply locally. More features imply an increased risk of a vulnerability hiding in the code; picking the most advanced program for a task may actually be counter-productive, and a better approach is usually to pick the simplest program that meets the requirements.
Apache 2 includes modules allowing filtering incoming HTTP queries. This allows blocking some attack vectors. For instance, limiting the length of parameters can prevent buffer overflows. More generally, one can validate parameters before they are even passed to the web application and restrict access along many criteria. This can even be combined with dynamic firewall updates, so that a client infringing one of the rules is banned from accessing the web server for a given period of time.
Statistics
| Percent | Strings | Words | Chars | ||
|---|---|---|---|---|---|
| Total | 452 | 15,122 | 116,566 | ||
| Translated | 77% | 351 | 9,834 | 74,412 | |
| Needs editing | 11% | 52 | 3,290 | 26,560 | |
| Failing check | 29% | 133 | 4,584 | 40,415 |
Last activity
| Last change | Dec. 9, 2017, 3:26 p.m. | |||
|---|---|---|---|---|
| Last author | Galina Anikina | |||