Security and System
Administration Websites
Some Good Books on
System Security
Guidelines
Computer Emergency Response Team for Operating
CERT Essential System Administration
http://www.cert.org by Æleen Frisch Multi-User
Usenix
http://www.usenix.org/sage/sysadmins/
sysadmins.html
Practical Unix and Internet Security
by Garfinkel & Spafford
Systems on
http://www.usenix.org/sage/sysadmins/
sysadmin_resource.html
Computer Security Basics
NYU-NET
Take an online course in Unix system by Russell & Gangemi
administration
http://www.washington.edu/R870/ TCP/IP Network Administration
Tips and tricks for system administrators by Craig Hunt
are maintained on a rich website by the publisher
O’Reilly & Associates Web Security and Commerce
http://www.ora.com/ by Garfinkel & Spafford
OS-specific Security Websites
SGI Running Linux
http://www.sgi.com/support/security/index.html by Welsh, Dalheimer & Kaufman
Linux
http://www.redhat.com/apps/support/updates.html (all Web Security Sourcebook
updates, bug fixes and security alerts)
by Rubin, Geer & Ranum
Solaris
http://www.sun.com/security
Windows NT and Windows 2000
http://support.microsoft.com/directory/
Another Helpful Security Website:
http://www.cert.org/security-improvement/
index.html http://www.nyu.edu/its/security/
http://www.cerias.purdue.edu/hotlist/
http://www.securemac.com Created January 2001 by Jane DelFavero and Tim
O’Connor. © 2003 NYU - All Rights Reserved.
http://www.nipc.gov/ NEW YORK UNIVERSITY
http://www.tripwire.com (NT & Unix) ITS pub. # 2003-12. Comments or suggestions about this publication?
Information Technology Services
These Are Your Systems! What You Can Do As A Users and Passwords:
It is your responsibility to know about System Administrator Do’s and Don’ts
your systems and to be able to answer
the following questions: Keep informed! • Be sure that every person who uses your
There are many sources of computer-security infor- computer has his or her own account.
mation. To get started, visit the Computer Emergency
• What services are you offering? Response Team (CERT) site at www.cert.org. Other • Be sure that every account has a password.
good sources are www.nsa.gov and http://
• Who is using the system? csrc.nist.gov. There is a more-detailed list on the back • Make sure to change the password of every
panel of this pamphlet. Take some time to research “default” account that comes with your UNIX
• Who has superuser privileges? Why? security topics, and continue to keep up to date. system.
Subscribe to the NYU Security Alert list
• Will you be communicating only with comput- • After you change your password, test it with
ers on NYU-NET or do you need outside To subscribe, send e-mail to:
connectivity?
[email protected], the su command by trying to log in on another
or send your address to Jane DelFavero: terminal or by using the telnet localhost com-
[email protected]. mand.
• What tasks are performed by your system?
Subscribe to Other Mailing Lists
• Pick strong, non-obvious passwords.
• What tasks are never performed by your sys- Many mailing lists outside NYU provide free security
tem? information via e-mail. Subscribe to those that pertain
to your areas of interest. Below are a few examples • Ensure that all users know about good pass-
• What expectations do you have of your system? of the available options. word management practices.
• What expectations do your users have? For general computer security, join the • Never record passwords online or send them to
mailing list at [email protected] by another user via e-mail. Do not post them on or
• What do you do about backing up your system? sending an e-mail with “subscribe bugtraq” as the near the machine. Written passwords should be
message text. kept in a secure and locked location, preferably
away from the machine or application they secure.
• How do you back up or otherwise secure your SANS runs a good general mailing list that alerts
data?
system administrators to new vulnerabilities. Send e- • Think about how you can assign group IDs to
mail to [email protected] with a message that has promote appropriate sharing and protection
• Are your users expected to be responsible for “NewsBites subscription” as the subject.
their own data (including data collections and without sharing accounts.
email), or do you do that for them?
Linux: To join, send e-mail to linux-security-
[email protected] with “subscribe linux-security” • Avoid use of the root account for routine
• If you expect your users to protect their data, as the message text. activities that can be done under a plain
do you make this fact clear to them? user ID.
Windows NT: To join, send e-mail to
[email protected] with “subscribe • Scan the files /var/adm/messages, /var/adm/
ntbugtraq” as the message text. sulog, or other appropriate log files on a
regular basis for bad su attempts.
SGI: Send mail to [email protected] with a
message that says “subscribe yourname@ nyu.edu,”
or visit http://www.sgi.com/ support/security/
wiretap.html.
