Advisories - Advisories (Linux) - Books - Cryptography - Electronic Commerce - FAQ'S - Hackers Pages - HOWTO's (linux) - Information Sources (General) - Information Sources (UNIX) - Information Sources (Linux) - NewsGroups - Papers & Publications - Papers & Publications (linux) - Protocols & Standards - Software




• Advisories
  
  
  AUSCERT - Australian Computer Emergency Response Team
  • AUSCERT Advisories & Bulletins.

  
  CERT - Computer Emergency Response Team

  • CERT Advisories, address Internet security problems. hey offer an explanation of the problem, information that helps you determine if your site has the problem, fixes or workarounds, and vendor information.
  • CERT Summaries, contain information on the types of attacks currently being reported to the CERT/CC and identify vulnerabilities that are being exploited. Also included are pointers to more information.
  • CERT Vendor-Initiated Bulletins.

  
  CIAC - Computer Incident Advisory Capability

  • CIAC Advisories, notices serve to alert sites to severe, time-critical vulnerabilities and solutions to be applied as soon as is possible.
  • CIAC Bulletins, are distributed to the Department of Energy community to notify sites of computer security vulnerabilities and recommended actions.
  • CIAC C-Notes, Notes are collections of computer security articles and information that are of a less time critical nature than the information contained in CIAC's Bulletins and Advisories.

  
  Defense Information Systems Agency Center for Automated System Security Incident Support Team [ASSIST (Automated Systems Security Incident Support Team), for DoD sites].

  • ASSIST

  
  FedCIRC - Federal Computer Incident Response Capability

  • FedCIRC

  
  FIRST - Forum of Incident Response and Security Teams

  • FIRST

  
  DFN-CERT - The German Research Network Computer Emergency Response Team

  • DFN-CERT

  
  NASIRC - NASA Automated Systems Incident Response Capability

  • NASIRC

  
  DISN - Defense Information System Network Security Bulletins

  • DISN Security Bulletins

  
  

  
  
• Advisories - Linux
  
  

  Caldera Open Linux

  • Caldera Security Advisories

  
  Debian GNU/Linux

  • Debian Security Information.
  • Debian mailing list archives - debian-security-announce: Security announcements.

  
  RedHat

  • Red Hat Security Pages - Includes Linux Security FAQ Section and Linux Security Alerts.
    
  • RedHat Mailing List Information and Archives - linux-security, from 1995 until today.
  • RedHat Linux Errata.

  
  SuSE

  • SuSE Linux Mailing lists index, suse-security, suse-security-announce.

  
  Pacific HiTech TurboLinux

  • Pacific HiTech TurboLinux Errata Guide
  
  

  
  

• Books
  
  

  
  

• Cryptography
  
  
  • Ron Rivest's large compilation of links.
  • Cryptography Hotlinks by Bruce Schneier.
  • Encryption and Security - related Resources. Includes: Crypto Link Farms, Crypto FTP Archives, Crypto Social Issues, Crypto Software, Miscellaneous Security Items: Random Numbers, Public Key Infrastructure, Security Agencies and Organizations, Security Books, Journals, and Bibliographies, and miscellaneous short publications, Security People, Security Problems. Security Products: Access Control, Data Encryption, Interception and Monitoring, Investigative Tools. Online Commerce and Banking, Smart Cards, Snake Oil. Security Standards, Laws, and Guidelines.
    

  
  

• Electronic Commerce
  
  
  • The Secure Electronic Transactions (SET) protocol.
  • The CyberCash system.
  • The DigiCash system.
  • The Millicent system.
  • WC3 Electronic Commerce Interest Group.

  
  

• FAQ'S
  
  
  • Firewall FAQ
  • Internet Firewalls Frequently Asked Questions
  • Computer security Faq's (Anon FTP, Compromise, Evaluation, Win NT, Mailing Lists, Patches, Sniffers, SSH, SSL, Vendor Contacts)
  • Kerberos FAQ
  • PGP faqs
  • The World Wide Web Security FAQ (W3C)
  • Cryptography FAQs
  • RSA Cryptography FAQ, download - Acrobat PDF (1.22mb) Acrobat PDF (.zip - 900k) PostScript (5.64mb) PostScript (.zip - 1.78mb).
  • ISS FAQ's
  
  
  
• Hackers Pages
  
  
  • Active Matrix Hidwaway
  • Illuminati
  • Phrack Magazine

  
  

• HOWTO's (linux)
  
  
  • IPChains HOWTO
    
  • Firewall HOWTO
    
  • NET-3 HOWTO
    
  • Security HOWTO
    
  • Shadow Password HOWTO
    

  
  

• Information Sources (General)
  
  
  • Netscape Security Resources.
  • WC3 Security Resources
  • Yahoo security links.

  
  

• Information Sources (UNIX)
  
  
  • BUGNET - BugNet gives you fixes for hundreds of bugs in popular off-the-shelf software -- plus news, analysis, and our exclusive statistical slice-and-dice of the industry's bug/fix performance.
  • BugTrack, This list is for *detailed* discussion of UNIX security holes: what they are, how to exploit, and what to do to fix them.
  • CIAC - is the U.S. Department of Energy's Computer Incident Advisory Capability. Established in 1989, CIAC provides computer security services free of charge to employees and contractors of the Department of Energy, including: Incident Handling, Computer Security Information, On-Site Workshops and Computer Security Consulting.
  • Computer and Network Security Reference Index, at Telstra ISP Australia.
  • Computer Institute Security
  • COAST Computer Operations, Audit, and Security Tools -- is a multiple project, multiple investigator effort in computer security research. It is intended to function with close ties to researchers and engineers in major companies and government agencies so as to help focus our research on real needs and limitations. Our goal is to develop strategic associations leading to mutual benefit over several years rather than cultivate "throw it over the wall" sponsors.
    • COAST Hotlist

  • Network/Computer Security Technology - list of many security related web pages.
    
  • FIRST - This coalition, the Forum of Incident Response and Security Teams (FIRST), brings together a variety of computer security incident response teams from government, commercial, and academic organizations. FIRST aims to foster cooperation and coordination in incident prevention, to prompt rapid reaction to incidents, and to promote information sharing among members and the community at large. Currently FIRST has nearly 70 members.
  • FreeFire, - Open Source security tools .
  • Gateway to information security - The Gateway to Information Security web site contains thousands of links to Books, Publications, Conferences, Training Seminars, Consulting Services, Discussion Groups, Companies, Products and Miscellaneous Topics associated with Information Security.
  • Matt's Unix Security Page - This site provide extensive security information including published papers, software & hyperlinks.

  • Netsurfer Focus on omputer and network security. You can browse update information here.
  • NIST, National Institute of Standards and Technology.
    • CSRC - NIST Computer Security Resource Cleainghouse
    • NIST Federal Information Processing Standards on Computer Security. Includes DSS (Digital Signature Standard), DES, DSA

  • L0pht Heavy Industries
  • Merit Authentication, Authorization and Accounting Server. Formerly known as the Merit RADIUS Server.
  • PGP home
  • Replay Associates - Your Data Security and Network Security Partner.
  • rootshell
    
  • SANS - SANS is the place to fine tune your skills and find the answers to practical problems faced by System and Network Administrators, Security Professionals and Webmasters.
  • SOCKS Proxy Protocol web site
  • Infilsec Vulnerability Engine - Infilsec has released a new vulnerability database called the Vulnerability Engine.

  • SSL
    • The SSL 2.0 Specifications
    • The SSL 3.0 Specifications

  • Security Portal- is a web site developed and funded by AIS, dedicated to providing corporate security professionals with the information and resources needed to protect their networks.
  • UNIX Computer Security Checklist and the Intruder Detection Checklist compiled by the Australian CERT.
  • Wietse's tools and papers - Wietse Venema's tools include: TCP Wrapper, SATAN, Portmap, Chrootuid and more. Well known person in the Unix security world.

  
  

• Information Sources (Linux)
  
  
  • Security Alerts
    • Linux-only Security News Alerts, from SecurityPortal.com.

  • The Linux Administrators Security Guide (LASG) from seifried.org.
  • Linux Network Address Translation.
  • LISC - Linux Security Support Cooperative
    
  • Linux Security HomePage
  • Pluggable Authentication Modules (PAM)
    
  • Replay Associates Red Hat Crypto
  • Security Bugware, LINUX system bugs - Linux Bug List Page.
    
  • Trinux - Linux Security Toolkit.
    
    
  • Shadow Password
    • Shadow Password HOWTO
      
    • Shadow Passwords with Linux

  • Linux Smartcard Security Project

  • VPN (..and PPTP & IPSEC)
    • IETF PPTP Internet Draft.
    • PoPToP, a PPTP server solution for Linux.
    • PPTP-Linux Client - A PPTP Linux client that allows a linux system to connect to a PPTP server. Developed by C. S. Ananian.
    • Understanding PPTP whitepaper - This Microsoft whitepaper Point-to-Point Tunneling Protocol (PPTP) usage scenarios, architecture, and security.
    • Counterpane Systems FAQ on Microsoft's PPTP Implementation - FAQ on the security flaws in Microsoft's PPTP Implementation.
    • The VPN FAQ.
    • The VPN HOWTO - How to set up a Virtual Protected Network in Linux.
    • The virtual private network daemon - VPND is a daemon which connects two networks on network level either via TCP/IP or a (virtual) leased line attached to a serial interface. All data transfered between the two networks are encrypted using the unpatented free Blowfish encryption algorithm
    • Worldvisions Tunnel Vision for Linux - Tunnel Vision creates an encrypted VPN between two Tunnel Vision-capable sites on the Internet
    • Linux VPN Masquerade Page
    • Freeswan IPSec - An IPSec project for Linux (known as Freeswan and KLIPS).
    • IPSec for Linux - A merged implementation of IPSec from Linux and OpenBSD, running on Linux.
    • Cerberus - An IPsec implementation for Linux that is available only to residents of the U.S. and Canada.
    • L2TP - Layer Two Tunneling Protocol.
    • L2TP Internet Drafts.
    • Crypto IP Encapsulation - CIPE is a simple encapsulation system that securely connects two subnets.
    • HOW TO: ssh and ppp - How to use ssh to setup a point-to-point private link between any two linux hosts on the internet
    • VTUN - Virtual TUNnels over TCP/IP networks.

  
  

• NewsGroups
  
  
  • alt.security
  • alt.security.index
  • comp.security.announce - Announcements from the CERT about security.
  • comp.security.misc - Security issues of computers and networks.
  • comp.security.unix - Discussion of Unix security.
  • misc.security - Miscellaneous Security.
  • comp.risks - Risks to the public from computers & users.
  • comp.virus -Computer viruses & security.
  • alt.security.pgp - Pretty Good Privacy.
  • alt.security.ripem - Privacy Enhanced Mail.
  • alt.hackers - Descriptions of projects currently under development. (Moderated).
  • alt.2600
  
  
  
• Papers & Publications
  
  
  • CERT
    • Unix Configuration Guidelines. [Local Copy].

    • AUSCERT Papers
      Improving Computer Security through Network Design
      Surfing Between The Flags: Security on the Web
      Enhancing Security of Unix Systems (PostScript)
      Forming an Incident Response Team (PostScript)
      Operational Security Occurrences and Defence (PostScript)
      Selected Aspects of Computer Security in Open Systems (PostScript)
      Site Security Policy Development (WordPerfect)
      Practical Exercise in Securing an OpenVMS System
      UNIX Security Checklist. [Local Copy].
      Secure Unix Programming Checklist. [Local Copy].

  • Kerberos: An Authentication Service for Computer Networks
  • SunWorld Online articles on security
  • Unix Security: The Guide, by Rajib K. Mitra.

  • Wietse Venema papers:
    murphy.ps.gz (postscript), murphy.txt.gz (ascii) - "Murphy's law and computer security", a paper presented at the Sixth USENIX Security Symposium (San Jose, July 1996).
    admin-guide-to-cracking.101.Z (ascii) Slightly updated version of an article that was posted to Usenet on December 2, 1993, titled: "Improving the security of your site by breaking into it." by Dan Farmer and Wietse Venema. The paper explains to the administrator what crackers have known for a long time.
    tcp_wrapper.ps.Z (postscript), tcp_wrapper.txt.Z (ascii) Presented at the 3rd UNIX Security Symposium (Baltimore, September 1992). Describes the development of the TCP Wrapper tool (aka the log_tcp package) to trace a malicious Dutch computer cracker (see also: An evening with Berferd by Bill Cheswick).
    

  • An Architectural Overview of UNIX Network Security by Robert B. Reinhardt. [Local Copy].

  
  

  
  

• Papers & Publications (linux)
  
  
  • Adding Security to Common Linux Distributions LinuxFocus. [Local Copy].
  • Creating a Linux Firewall using the TIS Toolkit. Linux Journal issue 25, May 1996. [Local Copy].
  • Securing Your Linux Box by Peter Vertes. Linux Gazzete issue 34, November 1998. [Local Copy].
  • Through the Looking Glass: Finding Evidence of Your Cracker, by Chris Kuethe. Linux Gazzete issue 36, January 1999. [Local Copy].
  • Introduction to Linux Security. Linux Power.

  
  

• Protocols & Standards
  
  
  • The HTTP/1.0 Basic authentication scheme.
  • HTTP/1.1 Digest Authentication.
  • Secure Sockets Layer (SSL) pages.
    • The SSL 2.0 Specifications
    • The SSL 3.0 Specifications

  • TLS specification (IETF protocol based on SSL)
  • A Distributed Authorization Model for WWW by Jose Kahan (INET'95).
  • An introduction to Shen.
  • The Web Transaction Security Working Group's Requirementes for Web Transaction Security
  • Generic Security Service(GSS) API for WWW transactions
  • Microsoft's Private Communication Technology(PCT) protocol.

  
  

• Software
  
  
  • IP Filter, IP Filter is a TCP/IP packet filter, suitable for use in a firewall environment.
  • Linux IPFW Firewall Design Tool

  • SSH
    • SSH
    • Getting started with SSH
      

  • Wietse's tools and papers. Wietse Venema's is a well known person in the Unix security world. His tools include:

    SATAN - For more than one year, the most famous piece of Internet vaporware. SATAN closes much of the knowledge gap between intruders and system administrators, by proposing how to fix problems. CERT-UU wrote a nice overview of the program (also on the site release information), of vendor bulletins, and of alternative archive sites. Additional information can be found on this really slow site. This unusual program is the result of an even more unusual cooperation between unusual people: Wietse Venema and Dan Farmer. TCP Wrapper - Wietse Venema's network logger, also known as TCPD or LOG_TCP. These programs log the client host name of incoming telnet, ftp, rsh, rlogin, finger etc. requests. Security options are: access control per host, domain and/or service; detection of host name spoofing or host address spoofing; booby traps to implement an early-warning system. The current version supports the System V.4 TLI network programming interface (Solaris, DG/UX) in addition to the traditional BSD sockets. Also wrote: Postfix, Chrootuid, Portmap, Rpcbind, Logdaemon, Unproto, Yapasswd, Agetty.

  
  
  

Created By [MIA], September 15, 1998 ,Copyright © Ofir Arkin 1998-1999
Last Modified  December 15, 1999