操作系统安全

NT的安全性UNIX的安全性1 23二、NT1、NT包括：文件（夹，打印机，I/OSIDRID。创建时根据计算机明、系统时间、进CPU的时间进行创建。S-1-5-<domain>-500S-1-5-<domain>-501S-1-5-32- S-1-5-32-

Auseraccountforthesystemadministrator.Thisaccountisthefirstaccountcreatedduringoperatingsysteminstallation.Theaccountcannotbedeletedorlockedout.ItisamemberoftheAdministratorsgroupandcannotberemovedfromthatgroup.Auseraccountforpeoplewhodonothaveindividualaccounts.Thisuseraccountdoesnotrequireapassword.Bydefault,theGuestaccountisdisabled.Abuilt-ingroup.Aftertheinitialinstallationoftheoperatingsystem,theonlymemberofthegroupistheAdministratoraccount.Whenacomputerjoinsadomain,theDomainAdminsgroupisaddedtotheAdministratorsgroup.Whenaserverbecomesadomaincontroller,theEnterpriseAdminsgroupalsoisaddedtotheAdministratorsgroup.TheAdministratorsgrouphasbuilt-incapabiltiesthatgiveitsmembersfullcontroloverthesystem.Thegroupisthedefaultownerofanyobjectthatiscreatedbyamemberofthegroup.Abuilt-ingroup.Aftertheinitialinstallationoftheoperatingsystem,theonlymemberistheAuthenticatedUsersgroup.Whenacomputerjoinsadomain,theDomainUsersgroupisaddedtotheUsersgroupontheUserscanperformtaskssuchasapplications,usinglocalandnetworkprinters,shuttingdownthecomputer,andlockingthecomputer.Userscaninstallapplicationsthatonlytheyareallowedtouseiftheinstallationprogramoftheapplicationsupportsper-userinstallation.访问控制列表：ACEACEFigure WindowsNTSecurity三、UNIX12crond,wu-ftp,3、/etc/passwd和/etc/shadow4、non-rootuseraccesstosensitivecommands:poweroff,reboot,Pluggableauthenticationmodules:PAMs,createadditionalauthenticationparameterswithoutaffectingexistingauthenticationsystemsPAMdirectory: determinewhatmustoccurbeforeausercanlogged setlimitsconcerningusersanddaemonsoncetheyhaveloggedontothesystem theactuallocationofthePAMmodulesPAMentryformat:Moduletype Moduletype:determineauthenticationtypeFlags:determinemoduletypePath:determinemodulelocationinthesystemArgs:optional,customizePAMbehavior/etc/securityaccess.conf:determineswhocanaccessthemachineandfromwheregroup.conf:determineswhichgroupcanlogintime.conf:setlogontimelimits.conf:setlimitsbaseduponpercentageofprocessorusageornumberofprocessesausercanrunsimultaneouslyNT账号的安全性UNIX账号的安全性12二、NT122000中账号策略必须在域的级别来进行设置Kerberos区别：2000127位密码，NT147位为单位，所7的整数倍NT缺省不禁用管理员账户，2000可以远程禁用34567SYSKEYSAM三、UNIX1/etc/passwd：everyonecanread,butonlyrootcanownitandchange/etc/shadow：onlyrootcanreadandwrite23Solaris: console=Linux:/etc/securitylistthedevicenamewhererootcanloginLog:/etc/default/sucanincludesulog=/var/adm/sulog4shell:rkshWindows2000:looksincurrentdirectoryforapplicationlooksatpathstatementUnix:onlylooksatpathDonotsetthecurrentdirectoryinthefirstplaceoftheDonotallowwritepermissionfornormalusersaboutdirectoryinPATHofroot7syslogd:使用/etc/syslog.confinetd:使用-t选项激活日志功能，可以记录相应服务的运行情况第三章文件系统安全性概述：windowsLinux一、windows1FAT16,FAT32,NTFS4.0,NTFS5.0,2、NTFS权限：权限的继承：ACL列表的拷贝erveryoneauthenticateduserseveryonefullread3、IPSecNTFS外,45Administrators、ServerOperators、PowerUsersgroup有权利设置共享新建共享后，EveryonegroupFC所能接受的最大用户数：Win2kProfessional Win2kServe DenyAllowsharesecurity取并集FAT、FAT32、NTFS上设置共享6NTFS安全性和共享安全性：NTFSattrib+HNTFS文件分流：不需要重新共建文件系统就能够给一个文件添加属性和信息的机制，Macintosh的文件兼容特性。NTRKPOSIXcpcpnc.exeoso001.009:nc.execposo001.009:nc.exeoso001.009大小没有变化，但修改日期可能会有变化分流后不能直接执行：startoso001.009:nc.exeFATNTFS分区ISSStreamfinder.二、linuxfilesystemsecurity:ls–loutput:drwxrwxrwx5james james120Mar2117:22accountd:directory-:normalfile5:link120:fileordirectoryfileeachfilehasitseveryfilebelongstoonegroup,primaryonlyonepermissionissuitableforyouifyouhavethreekindsofpermissionsownermayhavenoanypermissiontothefilethatheownsdirectoryumaskfiledefault:rw-rw-rw-directorydefault:rwxrwxrwx w-rwxchangeumask:umaskchangepermissions:chmodabsolutemode:chmod666filenamesymbolicmode:chmodogw+/-/=rwxsetbits:changeshellduringexecutethecommandsticky:usercancontrolandmanagementthewholedirectoryifuserhaswritepermissionaboutthedirectory,itmeanstheusercandeleteotherusers’files.Youmaysetstickysothatyouassignwritepermissionbutnoadministrativepermissiontothedirectory.Chmodu=rwx,og=wxtdirectory查看危险的setuid和setgid许可权限： /-perm-4000–print>diff.oldChangefileowner:chownnewownerfilenameChangefilegroup:chgrpnewgroupfilename第四章评估风险12二、windows123HKLM\System\CCS\services\lanmanagerserver\parameters\autoshareserver(autosharewks)=04三、UNIX1R*Rps-、采用/etc/hosts.equiv和用户主目录下的.rhosts600644的权限ip、伪造DNSmountdNFS服务器相关的缓冲区溢出条件已被发现RPC服务，可以轻易的安装远程系统上的文件NFS和相关服务实现客户机和用户的访问控制，/etc/exports和/etc/dfs/dfstab能够控制进行访在允许安装某个文件系统的客户机列表中决不要加上相应服务器的本地iplocalhost.portmapper会打开代理中转，会代理供给者中转连接请Windows1servicespackhotfixes，如果系统没有相关服务，不2win.ini5个配置单元（hivekey）4个存放于winnt\system32\config目录下：SAM,SYSTEM,SECURITY,SOFTWARE4system账号访问。HARDWARE进行硬件检测，HKEY_LOCAL_MACHINE(HKLM的配置单元。实际上，HKLM保存着注册表中的大部分信息，因为另外四个配置单元都是HKEY_CURRENT_USER(HKCU配置单元包含着当前登录到由这个注网络连接、打印机和应用程序首选项(环境变量在s2000中被用来允许脚本、注册表条目，以及其它应用程序使用通配符来代替可能会发生改变的重要的系统信息)，存储于用户配置文件的ntuser.dat中。优先于HKL中相同关键字。这些信息是SS配置单元当前登录用户的SecurityD(SID)子项的映射。HKEY_USERSHKU置文件。其中一个子项总是映射为HKEY_CURRENT_USER通过用户的SID值)。另一个子项HKEY_USERS\DEFAULT包含用户登录前使用的信息。HKEY_CLASSES_ROOT(HKCR)配置单元包含的子项列出了当前已在计算机上注册的所有COM服务器和与应用程序相关联的所有文件扩展名。这些信息是HKEY_LOCAL_MACHINE\SOFTWARE\Classes子项的映射。HKEY_CURRENT_CONFIG(HKCC)配置单元包含的子项列出了计算机器某个指定的会话中支持哪些设备驱动程序。这些信息是HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet子项的映射。HKEY_LOCAL_MACHINE(HKLMWindowsNT：使用C2Config和C2regacl.infWindows2000：使用组策略在web服务器上禁止serverSMBconnectionEstablishaTCPconnectionnegotiatedialectsetupSMBsessionaccessPcnetworkprogram1.0MicrosoftnetworksLanman1.0LMLanMan2.1WindowsNTLM禁止匿名连接：HKLM\服务器控制验证方法：lmcompatibilitylevel0激活SMBHKLM