guardian digital lockbox u manualredes-linux.com/manuales_english/seguridad/engarde-1.0.1.pdf ·...

GUARDI AN DI GI TAL

L I NUX L OCK BOX

USER M ANUAL

Linux Lockbox1.0.1

COPYRI GHT AND PATENT I NFORM ATI ON

Copyright c�

2000- 2001GuardianDigital, Inc. All rightsreserved. This materialmaybedistributed

only subjectto the termsandconditionssetforth in theOpenPublicationLicense,V1.0 or later (the

latestversionis presentlyavailableat http://www.opencontent.org/open pub / )

Distribution of substantively modified versionsof this documentis prohibitedwithout the explicitpermissionof thecopyright holder.

Distribution of thework or derivative of thework in any standard(paper)bookform for commercialpurposesis prohibitedunlessprior permissionis obtainedfrom thecopyright holder.

Information in this manualis subjectto changewithout notice. Companies,names,anddatausedin exampleshereinarefictitious unlessotherwisenoted.

Linux Lockbox, EnGardeandGD WebTool aretrademarksof GuardianDigital, Inc. in the UnitedStatesandothercountries.This productis coveredby oneor morependingpatentapplications.

Microsoft, InternetExplorer, Windows 95, Windows 98, Windows Millennium, Windows NT andWindows 2000areeitherregisteredtrademarksor trademarksof Microsoft Corporationin theUnitedStatesandothercountries.

MindTermis a trademarkof MindBright Technologyin theUnitedStatesand/orothercountries.

NetscapeandNetscapeNavigatorareregisteredtrademarksof NetscapeCommunicationsCorporationin theUnitedStatesandothercountries.

RSAPublicKey CryptosystemandMD5 areregisteredtrademarksof RSADataSecurity, Inc.

All othertrademarksandtradenamesarethepropertyof their respective owners.

Printedin theUnitedStatesof America.

Writtenby NicholasDeClarioEditedby DaveWreski

With contributionsfrom RyanMapleandPeteO’Hara

WrittenusingLATEX

Linux LockboxUserManual

Copyright c�

2001GuardianDigital, Inc.

January2001

Contents

1 I NTRODUCTI ON 1

1.1 Features. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2

1.2 HardwareSummary . . . . . . . . . . . . . . . . . . . . . . . . 5

1.2.1 RearView of Connectorsof aSingleProcessorMachine . 7

1.2.2 RearView of Connectorsof aDualProcessorMachine . . 8

1.3 RAID Support . . . . . . . . . . . . . . . . . . . . . . . . . . . 9

1.4 List of ChaptersandAppendices. . . . . . . . . . . . . . . . . . 11

1.5 ImportantSafeGuards . . . . . . . . . . . . . . . . . . . . . . . 13

1.6 Registration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15

1.7 ObtainingTechnicalSupport . . . . . . . . . . . . . . . . . . . . 16

1.8 Warranty . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18

2 GENERAL SECURI TY 19

2.1 Why Do We NeedSecurity? . . . . . . . . . . . . . . . . . . . . 20

2.2 How Secureis Secure? . . . . . . . . . . . . . . . . . . . . . . . 20

2.3 SecurityPlanningandPolicy . . . . . . . . . . . . . . . . . . . . 20

3 I NSTAL L I NG YOUR L OCK BOX 22

3.1 ConfiguringtheClientMachine . . . . . . . . . . . . . . . . . . 23

3.2 Connectingto YourLockbox . . . . . . . . . . . . . . . . . . . . 24

3.3 ConfiguringtheLockbox . . . . . . . . . . . . . . . . . . . . . . 26

3.3.1 ChangetheRootPassword . . . . . . . . . . . . . . . . 26

3.3.2 ChangetheGD WebTool Password . . . . . . . . . . . . 27

3.3.3 Createa New User . . . . . . . . . . . . . . . . . . . . . 28

3.3.4 SetuptheNetwork Configuration . . . . . . . . . . . . . 29

3.3.5 DefineTrustedHosts . . . . . . . . . . . . . . . . . . . . 30

3.3.6 DefineYourTimeZone. . . . . . . . . . . . . . . . . . . 31

3.3.7 SetupServicesthatareActive atBoot . . . . . . . . . . . 32

3.3.8 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . 32

3.3.9 Reboot . . . . . . . . . . . . . . . . . . . . . . . . . . . 32

4 THE GD WEBTOOL 34

4.1 ConnectingandLogginginto theGD WebTool . . . . . . . . . . 35

4.1.1 Loggingin . . . . . . . . . . . . . . . . . . . . . . . . . 35

4.2 TheMain GD WebTool MenuScreen . . . . . . . . . . . . . . . 37

4.3 Virtual HostManagement . . . . . . . . . . . . . . . . . . . . . 39

4.3.1 Creatinga Virtual Host . . . . . . . . . . . . . . . . . . 40

4.3.2 Creatinga SecureVirtual Host . . . . . . . . . . . . . . 41

4.3.3 EditingaVirtual Host . . . . . . . . . . . . . . . . . . . 42

4.3.4 DirectoryStructure. . . . . . . . . . . . . . . . . . . . . 53

4.3.5 SetupNameVirtual Hosts . . . . . . . . . . . . . . . . . 55

4.3.6 ConfigureWebSiteLog Analysis . . . . . . . . . . . . . 55

4.3.7 CreatinganOn-lineStore . . . . . . . . . . . . . . . . . 56

4.3.8 EditingandDeletingaStore . . . . . . . . . . . . . . . . 64

4.3.9 ConfigureaStore . . . . . . . . . . . . . . . . . . . . . 69

ii

4.4 SystemManagement . . . . . . . . . . . . . . . . . . . . . . . . 70

4.4.1 UserAccountAdministration . . . . . . . . . . . . . . . 70

4.4.2 Network Configuration . . . . . . . . . . . . . . . . . . 73

4.4.3 ChangeSystemTime . . . . . . . . . . . . . . . . . . . . 78

4.4.4 SecureShellManagement . . . . . . . . . . . . . . . . . 79

4.4.5 Mail ServerManagement. . . . . . . . . . . . . . . . . . 82

4.4.6 DNSManagement . . . . . . . . . . . . . . . . . . . . . 85

4.5 SystemStatusMonitor . . . . . . . . . . . . . . . . . . . . . . . 100

4.5.1 Logfile Management. . . . . . . . . . . . . . . . . . . . 100

4.5.2 ProcessManagement. . . . . . . . . . . . . . . . . . . . 100

4.6 Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105

4.6.1 ChangeWebTool Password . . . . . . . . . . . . . . . . . 105

4.6.2 ChangeAdministratorE-Mail Address . . . . . . . . . . 106

4.6.3 WebTool AccessControl . . . . . . . . . . . . . . . . . 108

4.6.4 SystemAccessControl . . . . . . . . . . . . . . . . . . 109

4.6.5 Edit Login Banner . . . . . . . . . . . . . . . . . . . . . 110

4.7 SystemBackup . . . . . . . . . . . . . . . . . . . . . . . . . . . 111

4.7.1 BackupMaintenance. . . . . . . . . . . . . . . . . . . . 111

4.7.2 Schedulea NamedBackup . . . . . . . . . . . . . . . . . 113

4.8 Changinga User’sPassword . . . . . . . . . . . . . . . . . . . . 116

5 GD UPDATE 118

5.1 RunningtheGD Update . . . . . . . . . . . . . . . . . . . . . . 118

6 L OCK BOX CONNECTI VI TY 120

6.1 Connectingfrom Windows9x/ME/NT/2000 . . . . . . . . . . . 121

6.1.1 InstallingMindTerm . . . . . . . . . . . . . . . . . . . . 121

6.1.2 RunningMindTerm. . . . . . . . . . . . . . . . . . . . . 122

iii

6.1.3 SecureCopy (SCP) . . . . . . . . . . . . . . . . . . . . 128

6.1.4 MENUS . . . . . . . . . . . . . . . . . . . . . . . . . . . 131

6.2 Connectingfrom Unix . . . . . . . . . . . . . . . . . . . . . . . 137

6.2.1 UsingOpenSSH . . . . . . . . . . . . . . . . . . . . . . 137

7 SECURE E-M AI L 139

7.1 ConfiguringNetscapeMail for SecureIMAP . . . . . . . . . . . 140

7.2 ConfiguringOutlookfor SecureIMAP andPOP3 . . . . . . . . . 147

8 AL L COM M ERCE 159

8.1 Introductionto AllCommerce . . . . . . . . . . . . . . . . . . . 160

8.1.1 Overview . . . . . . . . . . . . . . . . . . . . . . . . . . 160

8.2 Tutorial for CreatingaNew Store . . . . . . . . . . . . . . . . . 161

8.2.1 Part I - StoreCreation . . . . . . . . . . . . . . . . . . . 161

8.2.2 Part II - NameVirtual Hosts . . . . . . . . . . . . . . . . 177

8.2.3 Part III - DNSConfiguration . . . . . . . . . . . . . . . . 178

8.2.4 Part IV - Firewall / ProxyConfiguration. . . . . . . . . . 178

8.2.5 PartV - StoreContentConfiguration. . . . . . . . . . . . 179

8.3 UsingCyberCashCashRegisterwith YourStore . . . . . . . . . . 180

8.3.1 SettingupaMerchantCreditCardAccount . . . . . . . . 180

8.3.2 AboutMerchantAccounts . . . . . . . . . . . . . . . . . 180

8.3.3 FeesandRates . . . . . . . . . . . . . . . . . . . . . . . 181

8.3.4 UnderstandingCreditCardProcessingModels . . . . . . 182

8.3.5 BeforeGettingStarted . . . . . . . . . . . . . . . . . . . 182

8.3.6 SettingUp aMerchantAccount . . . . . . . . . . . . . . 182

8.3.7 Settingup the MerchantAccountto AcceptOnline Pay-ments . . . . . . . . . . . . . . . . . . . . . . . . . . . . 183

8.3.8 After theMerchantAccountis Approved . . . . . . . . . 183

8.3.9 Editing theCashRegistertemplates . . . . . . . . . . . . 184

iv

9 The Linux Intrusion DetectionSystem(LIDS) 186

9.1 Introductionto LIDS . . . . . . . . . . . . . . . . . . . . . . . . 186

9.2 UsingLIDS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 189

9.2.1 UsingthelidsadmUtility . . . . . . . . . . . . . . . . . 190

9.2.2 AddinganEntry . . . . . . . . . . . . . . . . . . . . . . 191

9.2.3 DeletinganEntry . . . . . . . . . . . . . . . . . . . . . 192

9.2.4 DeletingandUpdatingAll Entries . . . . . . . . . . . . . 192

9.2.5 PasswordCreation . . . . . . . . . . . . . . . . . . . . . 193

9.2.6 Viewing LIDS Status . . . . . . . . . . . . . . . . . . . 193

9.2.7 Viewing theCurrentLIDS Configuration . . . . . . . . . 193

9.3 ProtectingYourFiles . . . . . . . . . . . . . . . . . . . . . . . . 194

9.3.1 An Example:Protectinga FreshlyInstalledPackage . . . 194

9.4 KernelCapabilities . . . . . . . . . . . . . . . . . . . . . . . . . 198

9.4.1 CapabilityNamesandDescriptions . . . . . . . . . . . . 198

A QUI CK START GUI DE 204

A.1 Network Interfaces . . . . . . . . . . . . . . . . . . . . . . . . . 205

A.2 DNSServer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 206

A.3 Mail Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 208

A.4 WebServer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 209

B I SO CODES 212

B.1 Currency Codes(ISO 4217)Neededfor AllCommerce. . . . . . . . 212

B.2 LanguageCodes(ISO639-2)Neededfor AllCommerce . . . . . . . 219

C GENERAL L I NUX 220

C.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 220

C.1.1 RootAccessonYourLockbox . . . . . . . . . . . . . . 220

C.2 BasicBashCommands. . . . . . . . . . . . . . . . . . . . . . . 221

v

C.2.1 Moving AroundtheSystem . . . . . . . . . . . . . . . . 221

C.2.2 File Manipulation. . . . . . . . . . . . . . . . . . . . . . 222

C.2.3 EditingaFile . . . . . . . . . . . . . . . . . . . . . . . . 223

C.3 File SystemStructure . . . . . . . . . . . . . . . . . . . . . . . . 224

C.4 ServicesandDaemons . . . . . . . . . . . . . . . . . . . . . . . 225

C.5 GroupsandUsers . . . . . . . . . . . . . . . . . . . . . . . . . . 226

D FI REWAL L S AND PROXY SERVERS 228

D.1 Configuringa Firewall or ProxyServer . . . . . . . . . . . . . . . 228

D.2 DisablingProxySettingsin YourBrowser . . . . . . . . . . . . . 230

D.2.1 NetscapeNavigator . . . . . . . . . . . . . . . . . . . . . 230

D.2.2 InternetExplorer . . . . . . . . . . . . . . . . . . . . . . 231

E CERTI FI CATES 234

E.1 GeneralCertificateInformation . . . . . . . . . . . . . . . . . . . 234

E.1.1 GettingaCertificateSigned . . . . . . . . . . . . . . . . 234

E.1.2 Certificates,IP andVirtual HostIssues. . . . . . . . . . . 235

E.2 AcceptinganUnsignedCertificate . . . . . . . . . . . . . . . . . 235

F L I CENSES 240

F.1 GNU PublicLicense(GPL) . . . . . . . . . . . . . . . . . . . . . 240

F.2 BSD License . . . . . . . . . . . . . . . . . . . . . . . . . . . . 247

F.3 ApacheLicense . . . . . . . . . . . . . . . . . . . . . . . . . . . 248

F.4 OpenSSLLicense . . . . . . . . . . . . . . . . . . . . . . . . . 250

G GL OSSARY 252

H REFERENCES 258

vi

1 I N�

TRODUCTI ON

WEL COM E TO THE

GUARDI AN DI GI TAL L I NUX L OCK BOX

The GuardianDigital Linux Lockbox providesall the tools necessaryto createa highly reliableandsecuree-businessstorefrontor Web site. The Linux Lock-box leveragesthe ZelerateAllCommercee-businesssoftwarewith the power ofEnGarde,an OpenSourceLinux distribution engineeredby GuardianDigital toachieve thelevel of securityrequiredto conducte-business.

The Linux Lockbox improves securityof existing versionsof Linux in severalimportantways:

� Advancedformsof dataintegrity managementandassurance

� Intrusionalertcapabilities

� Reductionof any threat that occursshouldan administrative accountbecompromised

� Improvedauthenticationandaccesscontrolutilizing strongcryptography

� Real-timearound-the-clockremotenotificationvia e-mailor pagerwith in-formationof animmediatethreatto yourorganization

TheLinux LockboxGD WebTool offerseasy-to-usesecuregraphicalreportandadministrationcapabilities,providing the completeability to createhundredsofstorefrontsor virtual Websitesquickly andeasily. Its real-timenetwork andse-curity monitoringfeaturesprovidea level of assurancethattheserver is operatingefficiently andsecurely, andcanalert an administratorto any issuesthat requireimmediateattention.

Linux administratorsrevel at their ability to continueperformingadministrativetasksas they normally do, while non-technicalpeoplecan usethe Web-basedgraphicalfront endto performsimilar tasks,all without sacrificingthepowerandflexibility of theLinux operatingsystem.

INTRODUCTION Chapter1

1.1 F�

eatures

TheGuardianDigital Lockboxis thefirst OpenSourcenetwork server appliancedesignedto serve as a completee-businesssolution. Powering the Lockbox isEnGarde,GuardianDigital’s Linux, engineeredto achieve the level of securityrequiredto conducte-business.Its secureWeb-managementsoftwareprovidesaneasy-to-usestorefrontconfigurationandsystemadministrationtool, makingtheLockboxtheright choicefor any e-businessdeployment.

GuardianDigital’sproductsareoptimizedto work with Linux to achievethehigh-estlevel of performanceandcompatibility. Multiple rackmountconfigurationsareavailableto addressspacesaving considerationsatco-locationfacilitiesandASPs.TheGuardianDigital Lockboxfeatures:

� Browser-BasedAdministration - Browser-basedsecureremoteadminis-tration can be performedusing the GuardianDigital WebTool. The GDWebTool providessecuritythrougha 1024-bitSSLconnectionandallowsan administratorto perform 100% of the functionsthat could previouslyonly beperformedfrom thecommandline.

� GD Secure Update - The GD UpdateTool will automaticallyalert youto new securityupdatesandpackagesandprovide you with the ability toproactively updateyoursystem.

� Built-in E-Commerce- SecureE-CommercesitescanbepainlesslycreatedusingtheGD WebTool andintegratedSSLsupport.Creationof SSLcertifi-catesandmaintenancecanbeautomaticallymanagedthroughtheWebTool.

� WebServices- All WebfunctionsarecontrollablethroughtheGDWebTool.Thecreationof thousandsof virtual Web sitescanbeeasilymanagedandmaintained.

� Intrusion Detectionand Prevention - Theintrusiondetectionfeatureswilldetectandnotify youof possiblethreatsandsecurityrelatedevents.

� SystemLogging and Auditing - Extensive loggingis performedto insurethatyou have thelatestsysteminformation.

� Host Security - Securityof thehostitself hasbeensignificantlyincreased.Enforcementof longeruserpasswords,controlof expirationdates,anduti-lizationof thelatestin advancedformsof passwordencryptioncloseoneofthemostcommonandeasilyexploitablemeansof intrusion.

2 UserGuide

Section1.1 Features

� Electr� onic Mail Server - The includede-mail server hasbeenengineeredto provide securityandstability andcancontrole-mail for hundredsof do-mainswith the click of a mouse. Mail can thenbe retrieved in a secureformatusingconventionalmail clients. Additional securityimprovementshave beenmadeincluding protectionfrom commonthreatsaswell asre-strictingunsolicitede-mail.

� PHP Embedded Scripting - The PHP HTML embeddedscripting lan-guagemakes it easyfor developersto createdynamically-generatedWebpages. PHP also offers built-in databaseintegration for databaseman-agementsystems,providing theability theproducedatabase-enabledWebpageswith ashortlearningcurve.

� DatabaseSupport - The includeddatabaseserver providesa true multi-user, multi-threadedSQL(StructuredQueryLanguage)databaseserver, en-ablingLockboxusersandapplicationsto createrobustinteractiveWebsitesandpowerful E-Commercesites.

� Secured IMAP and POP3 - SSLSecuredIMAP andPOP3arefully sup-portedto helpincreasethesecurityof personale-mail.

� Domain NameServices- TheGuardianDigital Linux Lockboxcanman-ageDNSfor thousandsof domainsfor externaluserstrying to accessvirtualWebsitesontheLockbox,aswell asDNSfor internalusers.This is all con-figurableusingtheWebTool.

� Common GatewayInterface (CGI) Support - Theadministratorhastheability to enableCGI-baseddynamicWebcontenton an individual virtualserver basis.

� Server SideIncludes - TheLockboxhasthefull ability to correctlydisplayserver-parsedWebpages(.shtmlfiles).

� SecureShellAccounts-TheSecureShellprovidesasecureencryptedcom-municationslink with theGuardianDigital Linux Lockbox from a remotelocation,eliminatingtherisk previously foundin otherremoteaccessmeth-ods.

� Web Server Aliasing - TheLockboxhastheability to createthousandsofvirtual Websitesfrom thesameIP address.

� E-Mail Server Aliasing - TheLockboxgivestheadministratortheabilityto adde-mail server aliases,allowing the creationof thousandsof virtuale-maildomains.

TheGuardianDigital Linux Lockbox 3


� Hard�

wareand SoftwareRAID - LockboxconfigurationsareavailablethatincludehardwareandsoftwareRAID options,offering maximumperfor-manceandredundancy of data.

4 UserGuide

Section1.2 HardwareSummary

1.2 Hard� wareSummary

GuardianDigital hasanumberof differenthardwaresolutionsavailableto fit mostevery server requirement.Fromthesmallworkgroupserver to thefull enterprisesolution,GuardianDigital productsareoptimizedfor scalability, reliability andefficiency.

Guardian Digital Lockbox Commerce1000Series

� 1U Low Profile19" Rack-mountChassis

� SingleIntel PentiumIII Processorfrom 667Mhz to 933Mhz

� 128Mb to 512Mb PC133SDRAM

� One20Gb,40Gb,60Gbor 80GbEIDE 7,200RPM HardDisk

� 40xEIDE CDROM Drive

� 1.44MbFloppy Drive

� IntegratedIntel Fast-EthernetLAN Controller



� SingleIntel PentiumIII processorfrom 667Mhz to 933Mhz

� 128Mb to 512Mb PC133SDRAM

� Oneor two 10,000RPM 9Gbto 36GbUltra160SCSIHardDisks

� Two Hot PluggableSCSIDrivebackplane




� Softwareor HardwareRAID mirroringsupport



Guardian� Digital Lockbox Commerce2000Series


� SingleIntel PentiumIII processorfrom 667Mhz to 933Mhz

� 128Mb to 512GbPC133SDRAM

� Up to four 10,000RPM9Gbto 36GbUltra160SCSIHardDisks

� FourHot PluggableSCSIDrivebackplane







� Singleor Dual Intel PentiumIII processorfrom 667Mhz to 933Mhz

� 128Mb to 2GbPC133SDRAM

� Up to four 10,000RPM9Gbto 36GbUltra160SCSIHardDisks

� FourHot PluggableSCSIDrivebackplane





� ExternalSCSISupportfor Disk StorageArrays

6 UserGuide

Section1.2 HardwareSummary

1.2.1 Rear

View of Connectorsof a SingleProcessorMachine

Item Description

A MouseconnectorB KeyboardconnectorC Network connectorD USB port0 connectorE USB port1 connectorF VideoconnectorG Parallelport connectorH SerialportA connectorI Midi/GameportJ Audio line outK Audio line inL Microphonein



1.2.2 Rear

View of Connectorsof a Dual ProcessorMachine

Item Description

A USB connectorsB Serialport 2 connectorC Serialport 1 connectorD NMI switchE Parallelport connectorF KeyboardconnectorG MouseconnectorH VideoconnectorI Network connector

8 UserGuide

Section1.3 RAID Support

1.3 RAID Support

Several versionsof the GuardianDigital Linux Lockbox provide RAID supportin RAID-1 or RAID-5 configurations. RAID is an array of independentdiskswhichyeildsperformancegreaterthanthatof a singledisk. This arrayappearsasasinglelogicalstorageunit or drive to thecomputer. It canbemadefault-tolerantby redundantlystoringinformationin variousways. The redundantinformationenablesrecovery of thedataif oneof thedisksshouldfail.

The Lockbox 1400seriesimplementsRAID Level 1 (RAID-1), alsoknown asdisk mirroring, which consistsof two disks that contain identical information.Shouldoneof thedisksfail, theothercancontinueto operateuntil thefaileddiskis replaced.

TheLockbox2200seriesimplementsRAID-1 orRAID-5, dependingontheinitialconfigurationat time of purchase.RAID Level 5 (RAID-5) writes dataacrossmultiple disksratherthanonto onedisk. Additionally, redundancy is addedbywriting critical informationto a ’parity’ disk which containsall the informationnecessaryto reconstructa faileddisk.

You do not needto enableRAID on your Lockbox. It is enabledby default whenthesystemis shippedto you. Youcannotdisableor modify this configuration.

In caseof a failedharddisk,yoursystemwill alertyouto thefaileddriveatwhichpoint it mustbereplaced.ContactGuardianDigital RMA departmentfor expedi-ent disk replacement.The systemadministratorwill receive an email informingof the impendingdisk failure. Additionally, theSystemStatusMonitor menuoftheGD WebTool will containinformationonwhichdrivehasfailed.

Oncetheharddisk hasbeenreplacedandtheLockboxrebooted,thesystemwillautomaticallydetectthenew harddiskandintegrateinto theRAID array.

RAID Dri veLayout in a 1400SeriesCase



RAID Dri veLayout in a 2000& 2200SeriesCase

Whensettingup anexternalnon-RAIDSCSIdevicebesureto usetheSCSIcon-nectorin the rearandnot the externalRAID connector, aslabeledin the imagebelow:

The1400SeriesLockboxesonly haveanexternalRAID connectorandshouldnotbeusedfor normalSCSIdevices.

10 UserGuide

Section1.4 List of ChaptersandAppendices

1.4 List�

of Chaptersand Appendices

Chapter 1 IntroductioncoversbasicinformationaboutyourLockbox.

Chapter 2 General Securitygivesyouanunderstandingof basicsecurity.

Chapter 3 InstallingYour Lockboxis anguidefor installingandinitially config-uring yourLockbox.

Chapter 4 TheGD WebTool coversall thefunctionsof theGD WebTool config-urationutility.

Chapter 5 GDUpdateshowsyouhow to takeadvantageof theautomatedupdatesystem.

Chapter 6 LockboxConnectivityhasinformationof the differentwaysof con-nectingto your Lockbox from a remotelocationwithout using theGD WebTool.

Chapter 7 SecureE-Mail showsyouhow to configuredifferente-mailclientstowork with securee-mailservices.

Chapter 8 AllCommercehasthemanualfor administeringandrunninga Zeler-ateAllCommercestore.

Chapter 9 TheLinux Intrusion DetectionSystem(LIDS) is coveredin the GDWebTool but delvesinto amuchmoretechnicalaspectof this feature.

Appendix A QuickStartGuidecontainsastep-by-stepguideonsettingupall themajorcomponentsof yourLockbox.

Appendix B ISO Codescontainscountryandcurrency codesusedby AllCom-merce.

Appendix C General LinuxhassomebasicBASH commandsfor gettingaroundthesystemfrom theconsole.

Appendix D Firewalls andProxyServers covershow to allow your Lockbox toget througha firewall or proxy server andhow to geta client systemto theLockboxfrom behindafirewall or proxyserver.

Appendix E Certificateshasbasicinformationon what certificatesare,how tomanagethemandgettingacertificatesigned.

Appendix F Licensescoversall themajor licensesattachedto thedifferentsoft-wareprogramsincludedin theLockbox.



Appendix� G Glossarycoverscommonjargonandtermsusedin this manual.

Appendix H Referenceshasa list of referencesusedto aid in thecreationof thismanual.

12 UserGuide

Section1.5 ImportantSafeGuards

1.5 Important SafeGuards

For your protection,pleasereadthe following safetyprecautionsregardingyourLockbox.

1. Readinstructions

Readandunderstandall precautions,safetyguidelinesandproperopera-tion proceduresof the Lockbox beforeoperating. The manualwill guideyouthroughall thestepsnecessaryto fully utilize all featuresof yourLock-box.

2. Ventilation

The ventsand fan openingson the Lockbox are locatedon the front andrearandareprovidedfor ventilationandreliableoperationof theLockboxand to protectif from overheating. Theseopeningsmustnot be blockedor covered. This productshouldnot be placedin an enclosedareaunlessproperventilationis provided.

3. Lithium Battery

The lithium batteryon the systemboardprovidespower for the real-timeclock andCMOSRAM. Thebatteryhasanestimatedlife expectancy of 5to 10years.If yoursystemno longerkeepsaccuratetimeanddatesettings,it maybetime to changethebattery. ContactGuardianDigital for serviceinformation.Therearenooperatorserviceablepartsinside.

WARNI NG: Thereis a dangerof explosionif thebatteryis incorrectlyinstalled,or replacedwith thewrong typeof battery. Replaceonly with thesameor equiva-lent type recommendedby theequipmentmanufacturer. Disposeof usedbatteriesaccordingto manufacturer’s instructions.

4. Electrical Shock

To reducetherisk of electricalshock,donotdisassemblethisproduct.Takeit to a qualified servicepersonwhen serviceor repair work is required.Openingor removing coversmayexposeyou to dangerousvoltageor otherrisks andmay void the warranty. Incorrectreassemblycancauseelectricshockwhenthis productis usedin a mannernot in accordancewith manu-facturerspecifications.



5. Operating the Unit in an Equipment Rack

If you plan to install the Lockbox in an equipmentrack, take the follow-ing precautions:

(a) Ensurethe ambienttemperaturearoundthe Lockbox, which may behigherthantheroomtemperature,stayswithin 50to80degreesFahren-heit for properoperation.

(b) Ensurethereis sufficientair flow aroundtheunit.

(c) Ensureelectricalcircuits arenot overloaded;considerthe nameplateratingsof all theconnectedequipmentandensureyou have overcur-rentprotection.

(d) Ensurethe equipmentis properly grounded,particularlyany equip-mentconnectedto apowerstrip.

(e) Do notplaceobjectson topof theLockbox.

14 UserGuide

Section1.6 Registration

1.6 RegistrationRegisteringyourGuardianDigital Linux Lockboxgivesyoutheability to join ourmailing list, priority accessto thelatestsystemandsecurityupdatesandGuardianDigital technicalsupportasdescribedin thenext section.

RegisterOnline

GuardianDigital offerstheability to registeryourLinux Lockboxfrom your localdesktop.Simply connectto:

http://www.guardiandigital.com/register

Youcanfill outall thenecessaryinformationhereandsubmitit directlytoGuardianDigital. You will have immediateaccessto thelatestupdatesuponregistration.

Registerby Mail

To registerby mail simplyfill out theregistrationcardthatwasincludedwith yourLinux Lockboxandmail it to:

Lockbox RegistrationGuardian Digital, Inc.3 Industrial AvenueUpper Saddle River, NJ 07458

A GuardianDigital representative will notify you by phoneor e-mailwhenyouraccountis ready. Pleaseallow sometime for mail delivery andprocessing.



1.7 Obtaining� TechnicalSupport

BeforecontactingGuardianDigital’s technicalsupport,pleasemake aneffort toresolve theproblemonyourown by doublecheckingthesecommonproblems:

� Make sureall connectionsto yourLockboxarecorrect

� Checkto make surethenetwork connectionis connectedto thehub.

� Is theport theethernetcablepluggedinto lit?

� Canyouping thebox?

� If the statusor link light on the network equipmentis not lit but a cableis connectedto both the network equipmentand the Lockbox, checktheintegrity of thecable.

� Canyouconnectto it from anotherPC?

If noneof theabove solutionshelpedthenpleasevisit ourWebsiteor contactus.

Thefollowing informationcanhelpspeedupyoursupportcall:

� a hardcopy and/ore-mailof any errormessagesyou have receivedandthetime whenthey occured

� theprocessyouwererunningor whatchangesyouhadmadewhentheerroroccurred

� thestepstakenthusfar to resolve theproblem

� peripherals,if any, connectedto yoursystem

� any additionalsoftwareinstalled

GuardianDigital providesthirty (30)daysof freee-mailsupportstartingwhenthefirst e-mail is sent. Five (5) incidentsof phonesupportto our call centerwithinthefirst ninety(90) daysareprovided. Additional supportis availablefrom yourGuardianDigital salesrepresentative. Hardware is guaranteedundera one (1)yearwarranty.

YoucancontactGuardianDigital via phoneat:

16 UserGuide

Section1.7 ObtainingTechnicalSupport

Phone: 1-866-GDLINUX

201-934-9230

E-Mail: [email protected]

Youmusthave previously registeredonoursite:

http://www.guardiandigital.com/register

beforeany technicalsupportcanbe given. This is necessaryso we have up-to-dateinformationon your runningsystemto aid usin solvingyour problemmoreefficiently.



1.8 W�

arranty

PORTIONS OF THIS PRODUCT ARE COVERED UNDER THE GNU GEN-ERAL PUBLIC LICENSE

THIS PRODUCT MAY NOT BE EXPORTED TO, OR SOLD TO A NATIONOF, ANY COUNTRY OTHERTHAN THE UNITED STATESAND CANADA.

THIS SOFTWARE IS PROVIDED BY GUARDIAN DIGITAL, INC. “AS IS” AND ANYEXPRESSOF IMPLIED WARRANTIES, INCLUDING BUT NOT LIMITED TO, THEIMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESSFORA PARTIC-ULAR PURPOSEARE DISCLAIMED. IN NO EVENT SHALL GUARDIAN DIGI-TAL, INC. OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, IN-CIDENTAL, SPECIAL,EXEMPLARY, ORCONSEQUENTIAL DAMAGES(INCLUD-ING, BUT NOT LIMITED TO, PROCUREMENTOF SUBSTITUTEGOODSOR SER-VICES;LOSSOFUSE,DATA, ORPROFITS;ORBUSINESSINTERRUPTION)HOW-EVERCAUSEDAND ON ANY THEORY OFLIABILITY , WHETHERIN CONTRACT,STRICTLIABILITY , ORTORT (INCLUDING NEGLIGENCEOROTHERWISE)ARIS-ING IN ANY WAY OUT OF THE USEOF THIS SOFTWARE, EVEN IF ADVISED OFTHE POSSIBILITYOFSUCHDAMAGE.

This publicationandtheinformationhereinis furnishedAS IS, subjectto changewithout notice,andshouldnot be construedasa commitmentby GuardianDigital, Inc. Furthermore,GuardianDigital,Inc., assumesno responsibilityor liability for any errorsor inaccuracies,makesno warrantyof anykind (express,implied or statutory)with respectto this publication,andexpresslydisclaimsany andall warrantiesof merchantability, fitnessfor particularpurposesandnon infringementof third partyrights.

18 UserGuide

2 G�

ENERAL SECURI TY

BeforeyoustartusingyourGuardianDigital Linux Lockboxwerecommendyoureadthis sectioncoveringgeneralsecurityknowledge.This sectionwill helpyouunderstandthegoalsof yourLockboxandin turnwill helpyouconfigureit betterfor your needswith security in mind and increasethe overall securityof yournetwork.

GENERAL SECURITY Chapter2

2.1 Wh�

y Do WeNeedSecurity?

In the ever changingworld of global datacommunications,inexpensive Internetconnections,andfast-pacedsoftwaredevelopment,securityis becomingmoreandmoreof anissue.Securityis now a basicrequirementbecauseglobalcomputingis inherentlyinsecure.As your datagoesfrom point A to point B on theInternet,for example,it maypassthroughseveralotherpointsalongtheway, giving otheruserstheopportunityto intercept,andevenalterit. It doesnothingto protectyourdatacenter, otherserversin yournetwork,or amalicioususerwith physicalaccessto yourLockbox.

2.2 How Secure is Secure?

Securityis aboutdefensein depth.Providing physicalsecurityaswell asa well-designednetwork, control over the usersand processeson the host itself, andregularmaintenancecangoa long way towardsproviding goodsecurity.

In themostbasicsense,asystemis secureif it doeswhatit’ssupposedto do,evenif its usersattemptto do somethingthey’re not supposedto do. It protectstheinformationstoredin it from beingmodifiedeithermaliciouslyor accidentallyorreador modifiedby unauthorizedusers.

Considerthesecurityof your household.Perhapsyou have analarmsystem,butdoesit work if the intrudercutsthe systempower? Securityinvolvestradeoffs.How muchis yourdataworth?Doesit makesenseto protectyoursystemwith thelevel of securityyoumightfind protectingFort Knox,or wouldthatcostmorethanthe dataitself? GuardianDigital providesan extremely functionale-commerceserver, while still retainingall the reliability, configurability, andscalabilityyouhave cometo expectwith theLinux operatingsystem.

2.3 Security Planning and Policy

Assessingrisk andmakingprudentdecisionsbeforethesystemis installedis thebestapproach.You cango a long way towardsproviding goodsecurityby es-tablishinga securitypolicy. A securitypolicy is a written documentthatoutlineswhat is permittedbehavior on the system.Oncewritten, it is reviewed periodi-cally anddistributedto all usersof thesystem.No systemcanbefully secure,butwith duediligenceandattentionto detail,many securitythreatscanbemitigated.

20 UserGuide

Section2.3 SecurityPlanningandPolicy

Linux is not susceptibleto virusesin the strictestsenseof the word (no pun in-tended),but permittingcontentto enterthe systemthat hasnot explicitly beenauthorizedwill surelyleadto problems.

The GuardianDigital Linux Lockbox hasbeenengineeredwith the greatestde-greeof securityavailableon any Linux OpenSourcee-businessserver to date.No longeris it thecasethata company canpurchaseor contractane-commercesolutionwithout greatconcernfor theassuranceandintegrity for thedataandin-formationcontainedwithin it. GuardianDigital solutionshave beenengineeredwith securityasa primary concern,providing that high degreeof assurancere-quiredto conductbusinesson theWebtoday.

This high level of securityintegratedin to the GuardianDigital Linux Lockboxrequiresyou follow theguidelinesin this manualwhenconfiguringandadminis-teringtheLockbox.By following theseguidelinesyoucanbeassuredthehighestlevel of systemsecurityatall times.


3 I N�

STAL L I NG YOUR L OCK BOX

TheGuardianDigital Linux Lockboxprovidesaneasyto useinterfacefor theini-tial configuration.This interfacerequiresyou to configureit from anotherPC,viatheincludedcross-overcableto theLockbox.TheclientPCcanbeany operatingsystemandonly requiresa browserthatsupportsSSL.Netscape4+ andInternetExplorer5+ will befine for doingthis.

The interfaceyou will be usingwill guideyou step-by-stepthroughthe setupprocess.Wewill alsooutlinethestepsin moredetailin thismanual.TheGuardianDigital WebTool will provide thecompleteability to configureyourLockbox.

Section3.1 ConfiguringtheClientMachine

3.1 Configuring� the Client Machine

A client machineis requiredto configuretheLockbox. Includedwith your Lock-box is a cross-over cablefor connectingyour client PC to the Lockbox. This isdonesothedefault settingson your Lockboxdon’t interferewith othermachineslocatedonyournetwork, while alsomaintainingasecureconnection.

You mustfirst startby disconnectingyour client PCfrom your network. You cansimply do this by unpluggingits network connection. Then changeyour PC’snetwork settings.Don’t forget to write down your old settingsto changebacktowhenyouarefinishedsettingup theLockbox.

ChangeyourclientPC’snetwork settingsto thefollowing:

IP Address: 192.168.10.110Subnet: 255.255.255.0Broadcast: 192.168.10.255Network: 192.168.10.0

Onceyouhavechangedyoursettingsandthechangeshavetakeneffect,youmustmake sureall your proxy settingsaredisabled.To disableyour proxy settingsinbothNetscapeNavigatorandInternetExplorerpleasereadAppendixD FirewallsandProxy Servers on page228. Onceall changeshave beenmadeto the proxysettingsyouwill bereadyto connectto theLockbox.

If you have difficulty connectingaftermakingthechangesabove on a Windowsclient,you mayhave to disabletheLogonto WindowsNT Domainoptionin yournetwork configuration.Youcando thisby selectingNetworkingfrom theControlPanel, thenselectingpropertiesfor Client for MicrosoftNetworkanduncheckingtheLogonto WindowsNT Domaincheck-box.You cannow hit theOK buttontofinish. You maybeaskedto rebootyourWindows system.


INSTALLING YOUR LOCKBOX Chapter3

3.2 Connecting� to Your Lockbox

At thispointyouhaveyourclientPC’snetwork configurationsetup to work withyour Lockbox,andyou have it physically connectedto your PCvia the includedcross-overcable.Youarenow readyto connectto yourLockbox.

Startby poweringup yourLockbox.Thereis a rocker switchlocatedon thefrontpanel.Hold thebuttondown until themachinestartsto poweron.

Now load up the browseron your PC. Either InternetExplorer4+ or NetscapeNavigator4+ is required.Firstyoumustmakecertainthatyouhaveproxyserversdisabled.You will not beableto successfullyconnectto theLockboxwith proxyserversenabled.Typein thefollowing address:

https://192.168.10.100:1023

It will take a few momentsto connect.Oncetheconnectionis madeyou will beinformedof a new certificate. GuardianDigital distributesthe Lockbox with acertificategeneratedby our securityteam. Sincethe certificateis not issuedbya certificateauthorityyou will bepromptedto acceptthecertificate.Instructionson how to do this andmoreinformationconcerningcertificatescanbe found inAppendixE Certificateonpage234if necessary.

After acceptingthe certificateyou will be promptedfor a login nameandpass-word. This informationis pre-setto:

Login: adminPassword: lock&%box

24 UserGuide

Section3.2 Connectingto YourLockbox

The login� andpassword arecasesensitive. During step2 of the initial config-urationyou will be promptedto changethe password. You MUST changethispassword. Otherwiseit will remainlock&%box.



3.3 Configuring� the Lockbox

Onceyou enterthelogin nameandpassword you arein theLockboxInitial Con-figuration.

Now we arereadyto starttheinitial configurationof your Lockbox. Click on theBegin Configurationbuttonto starttheinitial configurationprocess.

At themainscreenyouwill seeabrief outlineof thedifferentstepsyouareaboutto begoingthrough,eachwith a brief description.

Fromhereyoucanstarttheinitial systemconfiguration.It will guideyouthroughstep-by-step.Youcannotskipstepshere.Thenext sectioncoverseachstepof theconfigurationprocess.

3.3.1 Changethe Root Password

This first stepin theconfigurationis to settheroot password. Theroot passwordwill only be usedto login to the systemfrom the console.Enter in a password

26 UserGuide

Section3.3 ConfiguringtheLockbox

that is at� leastsix characters.Mixing numbers,lettersandavoiding wholewordsis recommended.A few exampleswouldbeto takeaword like lockboxandbreakit upwith somelettersandnumbers.Youcanusethefollowing charactersaswell:

! @ # $ % ^ & * ( )

Soyoucanendupwith somethingalongthelinesof:

lock%$box

Whichwill bealmostimpossibleto guessevenmoredifficult to crack.

Youhave to enterthepasswordasecondtime to verify they match.

3.3.2 Changethe GD WebTool Password

TheGD WebTool passwordwill beusedeverytimeyoulogin to theWebTool. Wesuggestmakingthispassworddifferentfrom therootpasswordbut still follow thesuggestionsweofferedabove.



3.3.3 Createa NewUser

You will now needto createa new user. When you accessyour systemvia aSecureShell (SSH)or from the consoleyou will want to useyour regular useraccountasoftenaspossible.This is recommendedfor securityreasonsandalsofor accidentsthatcanhappenwhenalwaysaccessingthesystemastherootuser.

You canselectEnableremotelogin so theuserhasthecapabilityto connectviaanSSHsecureconnectionto theLockbox.BeforeausercanSSHin though,theirkey will have to be transferred.Informationon doing this via the GD WebToolwill becoveredin Section4.4.4Secure ShellManagementonpage79.

28 UserGuide


3.3.4 Setup�

the Network Configuration

Now we arereadyto configurethenetwork settingsfor your Lockbox. This sec-tion is prettystraightforward.

Hostname Thehostnameis anotherwayof labelingyourcomputer. Generallyre-memberingandtyping in anIP addressfor a machineis moredifficult thenrememberingadomainname.Forexample,rememberingwww.guardiandigital.com isnotnearlyasdifficult asremembering63.87.101.80 .You cansetthehostnameto any nameyou wish, aslong asit doesn’t con-flict with anotherhostnameon thenetwork.

Domain Name HerewesimplyneedtheFully-QualifiedDomainName(FQDN)without thehostname.For exampleguardiandigital.com would beenteredin for the host lockbox.guardiandigital.com . For moreinformationconcerningdomainnamespleaseseeFQDN in theglossary.

IP Addr ess An IP addressis a uniquenumberusedto identify a computerona network. Generallyyou can purchasea block of IP addressesyou are



allo� wed to useon the Internetor are assignedone or more IP addressesfrom your serviceprovider. Enterin the IP addressyou want to assigntheLockboxto here.

Netmask Thestandardstructureof anIP addresscanbelocally modifiedby usinghostaddressbitsasadditionalnetwork addressbits. Essentially, the“divid-ing line” betweennetwork addressbits andhostaddressbits is moved,cre-atingadditionalnetworks,but reducingthemaximumnumberof hoststhatcanbelongto eachnetwork. Thesenewly designatednetwork bits defineanetwork within thelargernetwork, calledasubnet.Thenetmaskdefinesthesubnetmask.Entertheappropriatesubnetmaskfor thenetwork, generally255.255.255.0 .

Gateway Computerscanonly talk to othercomputersthatareon thesamenet-work. To give a computerthe ability to talk to computerson anothernet-work they mustcommunicatethrougha gateway. You mustdefinethe IPaddressof thegateway machinehere.

Primary DNSAddr ess The primary DNS server, alsoreferredto asthe masterDNSserver,controlstheDNSqueriesfor yourzone.Enterin theIP addressof your primaryDNS server. More detailedinformationregardingprimaryDNS serversandDNS canbefoundin Section4.4.6DNSManagementonpage85. If this machineis to beconfiguredastheprimaryDNS for itself,enterit’sown IP address.

SecondaryDNS Addr ess ThesecondaryDNSserver, alsoreferredtoastheslaveDNS server, is a backupto the primary. If the primary server doesn’t re-spondor returnsno datathe secondaryDNS server will be queried. Thissectionis optionalif no secondaryDNS server existson yournetwork. En-ter theIP addressof thesecondaryDNS server if youwish to here.

Whenregisteringa domainnameon the Internet,throughNetwork Solu-tions,for example,a secondaryserver mustbeprovided. GuardianDigitalcanassistyouwith this. Contactusshouldyou requireassistance.

3.3.5 DefineTrusted Hosts

In this areayou will have to supplya list of hoststhat areallowed to accesstheGD WebTool. You canlist asmany hostsasyou want,but we recommendlistingonly thosethatarenecessaryfor administration.

Youcanlist themby IP address,anduseablankspaceasthedelimiterbetweenIPor hostname.Enteringthenetwork addresswill allow accessto theentirenetwork.

30 UserGuide


3.3.6 DefineYour Time Zone

This sectionallows you to setyour time zone. You have a selectionof the fourmajor time zonesin the continentalU.S. SelectSaveSettingsto finish the setupprocess.This will enabledefault network time serviceswhich canbeconfiguredlaterif necessary.



3.3.7 Set�

up Servicesthat are Activeat Boot

Hereyouhaveaselectionof differentservicesthatareavailableduringboottime.You can selectwhich onesyou wish to turn on and off by selectingthe checkboxes. It is recommendedyou only activateservicesyou will be usingon thisLockbox.

3.3.8 Summary

The information you enteredduring the Initial Configurationwill now be dis-playedbackto youfor confirmation,asshown in thenext screenshot.If everythingis correctclick theConfirmbuttonto completetheconfigurationprocess.

Click the Start Over button to restartthe configurationprocess.Referto Figure3.3.8.

3.3.9 Reboot

All theinformationfrom yourconfigurationis now savedonyourLockbox.SelecttheRebootbuttonandthesystemwill bereadyto go.

NOTE: Beforethemachinerebootsyou will bereturnedto thelogin screen.This isnecessaryfor a successfullsystemlogout.You donotneedto log backin.

Remove your crossover cableandplug your Lockbox into thenetwork. You arenow readyto startadministeringyourserver.

32 UserGuide


Figure1: 3.3.8- Initial ConfigurationSummary


4 TH�

E GD WEBTOOL

The GD WebTool is a secureon-line administrationutility accessedusingyourbrowser. You have the capability to control every aspectof the systemthroughtheGD WebTool utility. In this sectionwe will discusstheGD WebTool usage,interface,andhow to take full advantageof everythingit hasto offer. Thissectiondoesnot cover usingtheGD WebTool for the initial machineconfiguration.Youcanfind this informationin theprevioussection,InstallingyourLockbox.

NOTE: TheGD WebTool is a programthat is run on theLockbox. Whenyou makechangestheWebTool maytakeafew momentsto processthechanges.Whilethis is happeningyour browsermayreport“Hostcontacted.Waiting for re-ply...”. Do notpressback, stop, or reloadwhile this is happening.

Section4.1 ConnectingandLogginginto theGD WebTool

4.1 C� onnectingand Logging into the GD WebTool

The GD WebTool is always running throughit own personalmini Web server.This server is securingyour connectionwith SSL andcanbe accessedon port1023. To connectto theGD WebTool programfrom your browseryou will haveto typein thefollowing URL:

https://computername.domain.com:1023/

We usedhttps asopposedto http . This tells your browseryou will be us-ing an SSL securedconnectionto connectto the server. Wherecomputer-name.domain.com is you will replacewith theactualnameanddomain.Forexample,if thecomputeris namedlockbox andthedomainis guardiandig-ital.com youwouldbeconnectingtohttps://lockbox.guardiandigital.com:1023/ . Thelastpartof theURL is :1023/ , which specifiesanex-plicit port ratherthanthedefault port.

https://lockbox.guardiandigital.com:1023/

This tells the browserthat insteadof connectingto the default port, 80 for non-SSLand443for SSLconnections,to insteadconnectto thespecifiedport, 1023in this situation.

If you arehaving difficulty connectingat this point, checkthe DNS settingsonyour localPCor enterin theIP addressinsteadof thehostname.

Oncetheconnectionismadeyouwill bepresentedwith anew certificate.GuardianDigital issuesthecertificatefor the GD WebTool. Sincethecertificateis not is-suedby a certificateauthorityyou will bepromptedto acceptthecertificate.In-structionsonhow to do this,andmoreinformationconcerningcertificates,canbefoundin AppendixE Certificatesonpage234.

Onceyou entersecuremodein your browseryou will noticea lock thatwill turnyellow. In InternetExplorerandNetscapeNavigator you will seethis lock dis-playedalong the bottom of the browser window. Netscapewill also display aclosedlock at the top of the browser. This lock will also turn yellow when insecureSSLmode.If you click on thelock you will beprovidedwith moreinfor-mationaboutyourcurrentsecureconnection.

4.1.1 Logging in

Oncetheconnectionhasbeenestablished,theGD WebTool will promptyou for alogin nameandpassword.


THE GD WEBTOOL Chapter4

Usethelogin nameandpassword you specifiedduringtheinitial installationandconfigurationof the machine. If you enter in a wrong nameand/orpassword,returnto thepreviousscreenandyou canenterit in again.

36 UserGuide

Section4.2 TheMain GD WebTool MenuScreen

4.2 The� Main GD WebTool Menu Screen

After asuccessfullogin theGD WebTool will bringyou to themainscreen:

Thisscreencontainsthemaincategoriesof optionsfor administeringyoursystem.Thesecategoriesarelistedbelow with explanations:

ThissectioncontrolsWebservervirtual hostsandthecreationanddeletionof on-linestores.

SystemManagementhasall the basicLinux administrationfeaturesincluding usercontrol,network configuration,systemtime,portsandaddressessettings,interfacelanguagesandSSHmanage-ment.

Thesystemmonitorwill give you anoverview of thecurrentrunningstateof yoursystem.This includesviewing userprocesses,anumberof differentlogs,currentdrive space,kernelinformationandnetwork information.

This is quitea largesection.It containsall theconfiguration



for yourCertificates,SSLconnection,IP accesscontrolandtheloginbanner.

The GuardianDigital Updateallows you to safelyandse-curly updatethe packageson your Lockbox. The GD Updateutil-ity will scanyour system’s currentsoftwareandcompareit againstthelatestavailablepackages.Whennew packagesarefoundyou aregiventheability to upgradeyourold oneswith thesuppliednew ones.

This sectionwill allow you to createandview systemback-ups.

38 UserGuide

Section4.3 Virtual HostManagement

4.3 V�

irtual Host Management

TheVirtual HostManagerprovidescompletecontrolover all Webserver virtualhostconfigurations.Thissectionis alsowhereyoucancreateanddeleteanon-linestore.To entertheVirtual HostManagementsectionclick theVirtual HostMan-agementicon. The upperportion of this screendisplaysa list of virtual serversyou have on your system.It hastheport number, hostnameanddocumentrootofthatvirtual host.Below thatis thelist of Virtual Hostoptions.

If nostoresor virtual hostshave beensetupyet,yourVirtual Servers sectionwillbe empty. At this point you will want to eithercreatea virtual host for a Website or createan on-line store,which createstwo virtual hostsautomaticallyforthestore,a secureSSLvirtual hostfor purchasesanda standardvirtual hostusedduringstorebrowsing.First we will discusshow to createa virtual host.

NOTE: After makingany Web changesyou must restartthe Web server. You canrestartthe server by clicking the RestartWeb Serverbuttong on the main



Virtual Host Managementpageto shut it down. Click the button again tostartit.

4.3.1 Creating a Virtual Host

In this sectionyou will have theability to createa Virtual Host, alsoknown asaVirtual Server. This hasnothingto do with the storecreationprocess,which isdescribedlaterin thissection.CreatingaVirtual Hostthroughthismethodwill befor hostinga Websiteandwill not affect any othervirtual hostsor on-linestores.Youmustfill in all therequiredfields.A descriptionof eachfield is listedbelow.

Addr ess Hereyou canenterthe IP addressof your new virtual host. You areallowedto have multiple virtual hostson oneIP address.Themainreasonto do this is so you canhostmany siteswithout the needto registermoreIP addresses.The Web server will know how to differentiatebetweenthedifferentvirtual hostswhenthey arecalledon.

Administrator E-Mail This will be the default e-mail addressthat will be dis-playedto a userwho receives an error. Settingthis to the owner and/orsystemadministratorof thevirtual hostis recommended.

Server Name Thiswill bethenameof theserver. Enterin avalid FQDN.

40 UserGuide


Webmaster This is theuserwho will own all of thefiles for this Website. Youcanchooseauserby clicking on“...” or youcantypeanexistingusernamein thisbox.

Group This is thegroupthatwill have accessto all of thefiles for this Website.You canselectan existing groupby clicking on “...” or you cantype anexisting groupnamein this box.

If you wish to createa new group,click on the CreateGroup button andcreatea new group. You can thenselectthis new groupusing the groupchooserby clicking on “...”.

Createa databasefor this site If this box is checked,a databasewill becreatedfor usewith this site.You mustenterausernameandpassword for access-ing thedatabasebelow.

Username If youwish to createadatabasefor thissite,thiswill betheusernameassociatedwith accessingthedatabasewhich is created.

An exampleusernameis dbadmin .

Password If youchoseto createadatabasefor thissite,thiswill bethepasswordassociatedwith accessingthedatabasewhich is created.

An examplepassword is gu@rd1@n.

You cannow click theCreatebuttonto createthevirtual host.

After someprocessingyouwill bereturnedto theVirtual Serversmainmenu.Youwill seethenew virtual hostyou createdin theVirtual Servers list. If you createda new IP addressor a new domainnamefor this virtual hostyou will have to addit to yourDNSservers.Detailson this arelaterin this section.

After thehostis createdyou will now have theability to edit thathost.

4.3.2 Creating a Secure Virtual Host

In this sectionyou have the ability to createa virtual host securedwith SSL.Creatingthesecurehostis similar to creatinga non-securehost.



Eachfield is describedin theCreatinga Virtual Hostsectionabove.

Whenyou aredonemakingchangesclick theSavebutton. Don’t forgetto createor uploadyour certificatefor this virtual host. Instructionson doing so canbefound in Section4.3.3Editinga Virtual Host on thecurrentpagefoundafter thisone.

4.3.3 Editing a Virtual Host

You canedit any of your virtual hostsettingson anexisting hostby clicking onthe addressof the host listed underthe virtual servers. This alsoallows you toedit virtual hostsettingsfor your on-linestoresif you purchasedthee-commerceversionof theLockbox.

Onceyou arebroughtto the Virtual ServerOptionspageyou will be presentedwith quite a large numberof options. First, beforeyou start making changes,checkat thetopof thepage,below theGuardianDigital banner, youwill seea listof options.Refereto Figure 4.3.3.

Makesureyouareeditingtheintendedhost.In placeof lockbox.guardiandigital.com will bethenameof thesiteyou areediting.

The optionsin this sectionare for advanceduserswho have knowledgeof theApacheserver. Therearemany complex optionsto give you full andcompletecontrolover your virtual host. We recommendyou readthemainApachedocu-mentation,which canbefoundat http://www.apache.org/docs , beforemakingany changes.Therearealsonumerousbooksavailableon thissubject.

42 UserGuide


Figure2: 4.3.3- Edit Virtual Host

Networking and Addr esses

In this sectionyou will have the ability to definewhat interfacesandaddressesthis virtual hostshouldlistenon.

First youwill needto enterin theserveradministratorse-mailaddress.Followingthat is theAlternatevirtual servernamessection.You have theability to assignothernamesto yourhost.For example,sayyouhavewww.guardiandigital.com andyoualsowantwww.guardiandigital.net to goto www.guardiandigital.com . You would enterwww.guardiandigital.net intotheAlternatevirtual servernamesfield.



Click theSavebuttonto save yourchanges.

DocumentOptions

Hereyou have the option to configurespecificApachesettingsfor the specifiedhost.

Server-sideincludesand execsThis will give you the ability to turn on serverside includesandallow CGI scriptsto be executedwithin them. Server-sideincludesaremodulesor programsthatrun on theserver. CGI andPerlscriptsareboth server-sideincludesbecausethey run on the server, whileJava andJavaScriptareexecutedon theclient.

Server-sideincludes This worksthesameastheabove optionexceptit turnsofftheability to executeCGI scripts.

Generatedir ectory indexes With this option enabledApachewill createa fileindex whena directoryis specifiedfrom theWebbrowser. It will createacleanlist of files,with modificationdatesandfile types.

44 UserGuide


Err or Handling�

Errorhandlingis whattheWebserverdoesin theeventarequestis maderesultingin anerror. For example,if you try to go to a pagethatdoesn’t exist on a serveryou will seetheall too common“Error 404: File not found.”. In this menuyoucanlist theerrornumberandtell Apacheto loada specifiedWebpageor displaya specifiedmessageif this error is encountered.Below are a list of commonerrorcodesandtheir meanings.You canreferto theApachedocumentationfor acompletelist of errorcodes.

ErrorCode Meaning

301 PermamentRedirect302 TemporaryRedirect401 BadPassword403 Forbidden/ AccessDenied404 File Not Found405 MethodNot Allowed500 InternalServerError

Aliasesand Redirects

This sectionallows you to set up aliasesand redirects. A brief explanationofthe differencesbetweenredirectsandaliasesis a CSRis a requestfor a signedcertificateyoucangiveto aCertificateAuthority to sign.givento avoid confusion.

An Alias allows documentsto be storedin the local file systemother than thedefineddocumentdirectory. Whena useraccessesa documentthroughthis alias



it will appearin their browseras if it was in the aliaseddirectory, keepingtheactualdirectoryhiddenfrom theuser. This canbeusefulwhenyou don’t wantauserto know wherethey really areor to have links andURL referencesthathavea “clean” look. For exampleif youhave files storedin:

/home/httpd/html/updates/products/dece mber/2 000 /do cumentation

youcanaliastheaddressto:

/home/httpd/html/documentation

allowing you to keepeverythingorganizedneatlyon your server while keepingtheURL shortfor theuser.

For theexamplegivenabove youwouldneedto typein:

updates/products/december/2000/documen tat ion

in theFromfield andtypein

documentation

in theTo field.

NOTE: Whensettingupanaliasthepathis relativeto thedocumentpathsetupin theWebserver.

A Redirect mapsan old URL into a new one. The new URL is returnedto theclientwhichattemptsto fetchit againwith thenew address.Thebrowseris awareof thisnew addressandwill bevisibleto theuserin theURL locationfield in theirbrowser. This couldbeusefulif you wish to point theuserto anotherserver. Anexampleof this couldbeif youaremoving apage:

http://www.guardiandigital.com/documen tat ion /oc tob er

46 UserGuide


to another� directoryon your web site. In this examplewe areredirectingdocu-mentsdatedfrom Octoberto thearchivessectionof thewebsite,

http://www.guardiandigital.com/doc/arc hiv es

Usingtheexamplegivenabove youwouldneedto typein:

documentation/october

in theFromfield and

doc/archives

in theTo field.

NOTE: As with aliasesabove, theredirectpathsarerelative to theURL.

Hopefullyyouhaveaclearerunderstandingbetweenthedifferencesof aliasesandredirects.In this sectionyou will seetwo fields,DocumentdirectoryaliasesandURLredirects.

Documentdir ectory aliases This will allow you to aliasa new documentroot.Enterthedirectoryyou want theuserto seein theFromfield andwhereitwill actuallybepointingto in theTo field.

URL redirects This will allow you to maponeURL on to another. Simply enterin theoriginalURL andwhereyouwould like it to point to. Thesourceanddestinationmustbothpoint to valid URLs.



Dir ectory Indexing

This sectiondefinestheinitial pagewhentheWebbrowserclient requestsa URLwithoutspecifyinganexplicit filename.Forexample,if youtypein www.guardiandigital.com , it is really loadingwww.guardiandigital.com/index.html . If the Web server doesn’t find an index file it will returna directorylisting. Generallyindex.html or index.htm is used.You canspecifymorethanone.

Certificate Management

Therearetwo typesof certificates:"self-signed"certificatesand"signed"certifi-cates. A "signed" certificateis issuedby a CertificateAuthority (CA) suchasVerisignor Thawte. A "self-signed"certificateis simply a certificatethathasnotbeenissuedby aCA. Thisprovidestheauthenticationpartof theprocess,becausethecertificatehasbeensignedby anexternalauthority.

All of thecertificatemanagementcanbedonein theWebTool. Youshouldnotdoany of this by handunlessyou have a very goodideaof whatyou’re doing,sinceif it is doneincorrectlyit will causetheWebserver to fail. As wassaidabove, thecertificateandkey area pair. If for somereasonthecertificateandkey thatareinplacedo not "match"eachotherthentheWebserver will fail to start. If theWebserver fails to startthenall of theothersiteson themachineareinaccessible.

48 UserGuide


TheCertificateManagementsectionwill allow you to configureyourSSLcertifi-cate.This optionwill only beavailableif thevirtual hostyou areeditinghasSSLenabled.Onceat this menuyou will be presentedwith threeoptionswhich areeachdiscussedbelow.

GenerateCertificate and Key

Hereyou will seea screensimilar to thecertificategenerationscreenwhencreat-ing a virtual host. All thefieldsarerequired.Uponcompletionof this form youa self-signedcertificateandkey pair will becreatedfor thesite. A descriptionofeachfield is givenbelow:

Authority Name The authoritynameis the namethe server the certificatewillbe usedon. For examplewww.guardiandigital.com or as in the



exampleabove, lockbox.guardiandigital.com .

E-Mail Addr ess Thee-mail addressfor the contactin control of this certificateshouldbeenteredhere.An [email protected] or asin theexampleabove,[email protected] .

Department Hereyou canenterin the nameof the departmentthis certificatewill beusedin. An examplewouldbeE-Commerce.

Organization This is thenameof theorganizationwho owns thecertificate.Intheexampleabove Guardian Digital, Inc. is used.

City This field requiresyou enterthenameof thecity in which theorganizationresides.You mustenterin the full nameof thecity. In theexampleaboveUpperSaddleRiverused.

Stateor Providence Hereyou will needto enterin the statein which your or-gianizationresides.Youmustenterthefull nameof thestate,not anabbre-viation. In theexampleabove New Jersey used.

Country Enterin thecountryin which theorganizationresidesin thisfield. Thisrequiresan abbreviatednamefor the country, not the full nameas in theprevioustwo fields. In theexampleabove USwasused.

When all the fields are completedclick the Generate Key button to createthecertificateandkey. You mustnow go backto the previous screenandclick theRestartWebServerbuttonfor thechangesto beactivated.

GenerateCertificate Signing Request

A CertificateSigning Request(CSR) is what is sentto a CertificateAuthority(CA), suchasVerisignor Thawte to requestasignedcertificatefor yoursite.Thissectionwill allow youto createoneto besubmitted.Theform lookssimilar to theGenerate Certificateand Key form above. You canrefer to the previous sectionabove,GenerateCertificateandKey for a descriptionof eachof thefields.

Thereis however, onenew field, CreateNew Certificate/Key Pair. If thisoptionisselectedit will createa new certificateandkey with theinformationyou filled in.It will thenallow youto downloadthecertificateto besigned.If youwishrequesta new certificatebecauseyour old onehasexpired thend not selectthe CreateNew Certificate/Key Pair.

NOTE: Thisnew certificatewill notbeusedonthesiteuntil youuploadit. It is meantto besignedby a CertificateAuthority.

50 UserGuide


Onceyouhaveall thefieldsfilled in youcanclick theGenerateCertificatebuttonandyouwill bepresentedwith yourcertificate.



Enter Certificate�

and Key

If you alreadyhave a certificateanda key or have senta CSRto a CA andhavereceived thesignedcertificateback,thenyou would want to uploadit herefromyour local machine.This sectionwill presentyou with your currentSSLCertifi-cateandgive you theability to uploadanew certificateandkey.

If youhave acertificateandkey in placethenit showsyou four things:

Fingerprint: This is theuniqueID of thecertificate

Valid: This is thedatarangefor which thecertificateis valid.

Subject: This is who thecertificateis fore

Issuer: This is whohassignedthecertificate.

Clicking theBrowse... buttonwill allow you to browsethroughthefiles on yourlocalmachineandselectthecertificateandkey. Youcanthenclick theSavebuttonto save thecertificateandkey to theserver.

52 UserGuide


Server Configuration�

Hereyou canalter thebasicvirtual hostsettings.You have theability to changetheIP addressof yourvirtual hostandtheservernameof thevirtual host.Youcanalsodeletethevirtual hostandchangethedatabasepassword from here.

4.3.4 Dir ectory Structur e

Whena Web site is created,the following directorystructurewill be createdontheLockbox:

/home/httpd/<sitename>-<port>

Insideof this directory, thefollowing sub-directorieswill exist:

cgi-bin This is thedirectorywhere/cgi-bin/ is aliasedto.

html This is thedocumentroot.

logs This is wheretheaccess,error, andssllogsarekept.

If a securesitewascreated,thefollowing will alsobecreated:

ssl This is wheretheSSLcertificateandkey arekept.



cgi-bin�TheCGI files for you Websiteshouldbelocatedhere.For example,if regis-ter.cgi wasplaced,thenyouwouldaccessit by usingthefollowing URL:

http://www.linuxlockbox.com/cgi-bin/re gis ter .cg i

Usingthelockbox.guardiandigital.comexamplebeingusedin this sectionthedi-rectoryURLs would look asfollows:

For a standard,non-secureWebserver:

� /home/httpd/lockbox.guardiandigital.co m-80/c gi- bin

� /home/httpd/lockbox.guardiandigital.co m-80/h tml

� /home/httpd/lockbox.guardiandigital.co m-80/l ogs

� /home/httpd/lockbox.guardiandigital.co m-80/s sl

For a SecureSocketLayer(SSL)Webserver:

� /home/httpd/lockbox.guardiandigital.co m-443/ cgi -bi n

� /home/httpd/lockbox.guardiandigital.co m-443/ htm l

� /home/httpd/lockbox.guardiandigital.co m-443/ log s

� /home/httpd/lockbox.guardiandigital.co m-443/ ssl

In anHTML form, youwouldusesomethingof thesort:

<FORMACTION=”/cgi-bin/register.cgi” METHOD=”GET”>

html

This is wheretheHTML files arekept.

logs Thisis thedirectorywherethelogsarekept.Youcansetuphow oftenthelogsareanalyzedin theConfigureWebsiteLog Analysissectionof theWebTool.

54 UserGuide


ssl

If this is a securesite, then this is wherethe certificateandkey arekept. Youshouldneveredit anything in this directoryby hand.

4.3.5 SetupNameVirtual Hosts

A Virtual Host hasto be boundto an IP address. This is requiredfor properoperationof yourvirtual host.

Hereis whereyou canenterin theIP addressandport of your new NameVirtualHosts.

To adda new hostselectthe port from the pull-down menuandenterin the IPaddressyouwant.Theportpull-down menugivesyou two selections.Port80 fornormalconnectionsand443for secureconnections.Chooseaccourdingly. ClicktheAddNew IP buttonaftereachIP addressyouryournew hostwill beadded.

To deletea namedvirtual hostsimplyclick on theIP addressof it.

4.3.6 ConfigureWeb SiteLog Analysis

Eachvirtual host runningon your systemhasit’s own statuslogs. In hereyouhave theoptionsto configuretheselogs. You will first bepresentedwith a list oftheexisting nonsslvirtual hosts.Selectwhetheryou would like to have theWebstatisticsgenerateddaily or weekly.



In this menuyou will have thefollowing options:

SiteName Hereyou canenterin the nameyou wish to associatewith this site.Leaving it asthenameof thevirtual hostis agoodidea.

Frequency TheWebstatisticssoftwarecanberundaily or weekly. It’sup to youhow oftenyouwantnew statisticsgenerated.

Click theSaveSettingsbuttonwhenyou’vefinishedyourselection.

Going to the site namefollowed by WEBSTATSwill display the logs for yourvirtual host.Usingtheexampleabove,youwould typein:

http://lockbox.guardiandigital.com/WEBSTATS

UserAccessControl

CurrentlyyourWebstatisticsareprotectedsonoonecanview themwithoutausernameandpassword. Since,mostlikely, yourWebstatisticsareprivateinformationyou will want to protectthe Web statisticsfrom unauthorizedvisitors. Herewewill assignuseraccesscontrol.

Hereyou have two fields,UsernameandPassword. This allows you to assignausernameandpassword to yourstatisticsdirectory. Whena persontriesto accessthem,ausername/passwordwindow will appear. Thisallowsyouto definewho isauthorizedto accessyour log statistics.

NOTE: By default nousershave access.

4.3.7 Creating an On-line Store

Creatingan on-line storecanbe donein a few minutesusingthe GD WebTool.Thecreationprocessis brokendown into a seriesof steps.We will outlineeachstephere.

56 UserGuide


Step1

In Step1 we will start by defining somebasicinformation for the store. FirstyouneedtheFully-QualifiedDomainName(FQDN), followedby thestoreiden-tifier andfinally theadministrator’se-mailaddress.Descriptionsof eacharelistedbelow.

Fully-Qualified Domain Name Hereyouwill needto enterin thefull hostname.For more informationconcerninghostnamesand the Fully-QualifiedDo-mainName(FQDN) pleasereferto theglossary.

StorenameIdentifier The StorenameIdentifier is a singlestring which will beusedto identify thestore.This identifier is alsousedto namethedatabasefor thestoreandthenameof thedatabaseuser.

Administrator E-Mail Theaddressyouenterherewill bedisplayedany timeanerror occurson the site. For example,when Apachesendsa 404 er-ror you will have a messagealong the lines of “Error 404 - File notfound. [email protected] this error”. For our examplewewill usethe usernameadmin . So our e-mail addressherewill be [email protected] . E-mailsto this addressareintendedforthesystemadministratorand/orstoreowner.

StoreUserName Hereyouhaveapull-down menuof all availablesystemusers.Selecta usernameandthis userwill own the imagesandtemplatefiles inthe currentstore. You would most likely want this userto be the storesowner. If the owner is not listed in the pull-down menuyou may have tocreatea new userfor thatperson.You cancreatea new in the4.4.1sectiononpage70.



StoreGr�

oup Name This assignsa group to the currentstore. The group willhave accessto edit templatesand imagesandalsohave the ability to runbasicmaintenancescripts.Youcansetthegroupto bethesameasthestoreusernameabove. This is mosthelpfull if the storeowner hasadditionalpeoplewhowill beeditingandmaintainingthestore.

Step2

In Step2 we will besettingup detailedstoreinformation.Therearequitea num-berof categories,andeveryfieldneedstobeentered.Below isalist of all thefieldsandtheir descriptions.We suggestreadingSection8 AllCommerce on page159for a clearerunderstandingof this section.

SiteName This definesthe full nameof the site. Dependingon how you de-sign your storestemplates,the site visitor may seethis on every screen.

58 UserGuide


The� default templatesdonotdisplaythis,but weHIGHLY recommendcus-tomizingyour templates.Youcanfind outhow to customizeyour templatesin Section8 AllCommerce on page159 . For this entry we will put in thefull storename,Guardian Digital On-Line Store .

Administrator Password Enter in the password you would like to usefor ad-ministeringyour store. Informationaboutstoreadministrationandhow toaccesstheadministrationof astorecanbefoundin Section8 AllCommerceonpage159.

CustomerService,Order, and WebmasterE-Mail For all three of theseyouwill just needto enterin theassociatede-mailaddresses.Theseaddresseswill bedisplayedat theappropriatetimesin thesite. For this examplewewill use:[email protected], [email protected] , [email protected] .

Pay ProcessHereyou have a pull down menufor your selection.If you will beusingCyberCashCashRegisterto handleyourpaymentsselectthecyber-cash option,otherwiseselectnone . DirectionsonsettingupaCybercashaccountcanbe found in Section8.3 Using CyberCashCashRegister withYour Store on page 180. ConfiguringCyberCashvia theGD WebTool andtheconsolewill beexplainedlater.

StoreState This is thetwo letterabbreviationof thestatethestorewill bein. Wewill beusingNew Jersey for ourexample,soenterNJ.

Tax Rate This is thesalestax rateyour statechargeson itemsdeliver within thestate. The statetax herein New Jersey is 6%. You needto enterthe taxratein decimalformat. So for this exampleour tax is 6%, so we enterin06.00 .

DatabasePassword This is the password for thedatabaseuserwe just created.A password is requiredfor thedatabaseto preventany userfrom beingableto accessthe informationheld in the database.We recommendat least8charactersandmixing numberswith letters.

DatabasePassword Verification Youwill needto enteryourpassword in hereasecondtime to doublecheckfor typing errors. An incorrectpassword canlock youout of yourown database.

NOTE: Thepassword is casesensitive.



Reply T�

o E-Mail Thiswill betheaddressto whichall e-mailreplieswill besent.Justenterin a standarde-mail address.We want admin to handleall oure-mailsin thisexample,sowewill beenteringin whatwehadearlierundertheAdministratingE-Mail section.For this examplewe [email protected] .

Step3

In Step3 youhave theability to addtheSecureSocketLayer(SSL)to yourstore.TheSecureSocket Layer(SSL)will encryptyour connectionto provide thestoreshopperswith thehighestlevel of securitywhile purchasingyourproducts.UsingSSLis optionalbut recommended.

For this sectiononly Mail Configurationneedsto befilled in. Dependingonyourselectionin SSLOptions,you may have to fill in more. Eachcategory will beexplainedin detail.

SSL Options

Successfullyconfiguringandsettingup SSL canbe a difficult task. Using theWebTool to guideyou throughtheprocesscanmake it easyandpainless.Hereisabrief overview of theprocess.

1. First you mustselectwhetheryou wantSSL,alreadyhave a certificateandkey, or needto generatea certificateandkey pair. This canbe donefromtheSSLOptionsmenubelow.

2. If you choseto createa new certificateyou will needto fill out the formfoundbelow underGeneratea New CertificateandKey.

60 UserGuide


If you alreadyhave a certificatethenyou canselectwhereto uploadyourcertificateandkey from usingthe Upload SSLCertificateand Key menu,alsofoundbelow. If thecertificateyou uploadedwasnot signedby a Cer-tificate Authority you may wish to get it signed. Skip to Part 4 below toreadhow to accomplishthis.

3. If youcreatedanew certificateyoursitewill automaticallyuseit. By defaultthis certificateis not signedby a CertificateAuthority. If you wish to get itsignedreadthenext part.

4. To getyour certificatesignedyou mustmake a requestto a CertificateAu-thority. A CertificateAuthority is a company who is approved for signingcertificates.Two suchcompaniesareThawte andVerisign.

To make a requestyou will needto fill out a CertificateSigningRequestform. Informationonfilling outa form andhandlingtheCSRcanbefoundSection4.3.8EditingandDeletinga Store onpage64.

5. Onceyou make your requestandreceive your signedcertificateyou mustuploadit backto theserver. Instructionson how to do this canbefoundinSection4.3.8EditingandDeletinga Store onpage64.

6. Onceeverythingis uploadedyourstoreis now properlysecured.

Do Not UseSSL Selectingthis will turn off all securetransactionson thevirtualserver youarecreating.This is mostdefinitelyNOT recommended.

Upload Certificate and Key If youhave alreadycreatedacertificateandkey, orhave an existing signedcertificateandkey, you canenterthe path to thefiles on your local computerto beuploadedto theLockbox. Theuploadofyour certificateandkey aresecuredwith 128 bit encryptionso they can’tbeinterceptedwhenyou uploadthem.You canenterthefile locationsintotheSSLCertificateandSSLKey fieldslocatedin theUploadSSLCertificateandKey sectionbelow this one.



Generate Certificate and Key Youcanselectthisoptionto haveacertificateandkey generatedfor you. If you decideto generatea key you will have to fillout the form locatedunderGeneratea New SSLCertificateandKey. Thisform canbefoundat thebottomof themenu.

NOTE: A new generatedcertificatewill NOT besigned.PleasereadAppendixE onpage 234 for informationongettingyour certificatesigned.

Upload SSLCertificate and Key

SSL Certificate If you selectedto uploadyour certificateyou can type in thepathto thefile thatcontainsyour certificatehere.You alsohave theoptionto click theBrowse... buttonto bringupawindow to browseyour localharddrive for thefile. For moreinformationon uploadinga certificateyou canreadtheabove section.

SSL Key If youareuploadingyourcertificateandit requiresakey to decryptyoucanenterin thepathto thefile thatcontainsyour certificatekey here.Thecertificaterequiresakey asameansof authentication.Thekey will beusedwhenthe Web server is startedup. You alsohave the option to click theBrowse... button to bring up a window to browseyour local harddrive forthefile. For moreinformationon uploadinga certificatekey you canreadtheabove section.

62 UserGuide


Generate! NewSSLCertificate and Key

Authority Name This shouldmatchthe site name. If you enterthe site nameincorrectly it will warn the userthat the certificatemay be invalid sinceit doesnot belongto the domainit is on. An exampleof what would beenteredhereis www.guardiandigital.com .

Organization Thisshouldbethenameof yourcompany or organizationthatthestorewill beownedby. For exampleGuardian Digital, Inc ..

Department This is the only optionalfield, but if it appliesit is recommendedyou fill it in. This shouldcontainthedepartmentwithin thecompany thatownsthesite.For exampleE-Commerce or Sales .

E-Mail Addr ess This shouldcontainthe site owner’s or administrator’s e-mailaddress.Thecertificatewill beregisteredunderthis address.

City Enterthenameof thecity in which thesite resides.For exampleSaddleRiver .

Stateor Providence Enterthenameof thestateor providencein which thesiteresides.For exampleNew Jersey .

Country Enterthecountryin which thesiteis in. For exampleUS.



Onceyou submittheSSL informationyou will bebroughtto a summaryscreento confirm your changes.You canmake any last minutechangeshereandclickPreview Changesto updatethescreen.Whenyouaresatisfiedwith yourconfigu-rationclick theCreateStorebuttonto createthestore.Pleasetakenoteof theSSLstatus.This will saySSLWill beEnabledif everythingwassetcorrectly, unlessyou turnedSSLoff for this store.

It will takeafew momentsfor thestoreto becreated.TheWebTool is configuringthe Web server, settingup the database,creatingthe necessarySSL informationandsettingtheHTML andCGI scriptsproperly. While it is doingthisdonotpressany keys.

NOTE: If you areusinga namevirtual host to hostyour storeon you will needtocreateone.Youonly needanamevirtual hostif youwill behostingthestorefrom thesameIP address.If thestorehasa uniqueIP addressyou will notneedto do this. Informationon creatinga namevirtual hostcanbefoundinSection4.3.5SetupNameVirtual Hostsonpage55.

4.3.8 Editing and Deletinga Store

After creatinga new storeyou have the option to edit anddeletethe new store.Whenyouselecttheoptionfrom themainscreenyouwill seethefollowing menu.

To deletea storeselectthecheckbox of thestore(s)you wantto deletethenclicktheDeleteSelectedStoresbutton.

To edit thestoreyou have five options,AllCommerce, WebServer, SSL, GenerateCSRand,if configured,CashRegister. Eachitem is discussedbelow.

NOTE: TheCashRegisteroptionwill only appearif youselectedto useCashRegis-terwith thison-linestore.

64 UserGuide


Figure3: 4.3.8a- AllCommerceConfiguration

AllCommerce

By clicking on the AllCommercelink beneaththe selectedstore you will bebroughtto anothermenuwith somefamiliar categories.Referto Figure 4.3.8a.

Youcanupdateall yourAllCommerceinformationhere.Eachsectionis explainedin detail in theStoreCreationportionof this section.

WebServer

The Web server sectioncontainssimply the Web server FQDN andthe site ad-ministratorse-mail address. Detailed information on this can be found in theStore Creationportionof this section.Referto Figure 4.3.8b.



Figure4: 4.3.8b- WebServer Configuration

SSL

Herewe canuploador generatea new certificate.Thereareseveral reasonsyoumaywantto uploadanew certificate.Thetwo mostcommonwouldbeif youhadacertificatesignedor if yourold certificateexpiredafteroneyearandyouneedtoreplaceit with a new one.You canalsogeneratea new certificateif your old onehasexpired.All certificatesexpire365days,or 1 yearafterbeingissued.RefertoFigure 4.3.8c.

NOTE: If a certificatealreadyexists for the host it will be overwritten when youuploador createanew one.

This menuwill alsodisplayyour currentcertificate,if oneexists,andthecurrentstatusof SSLfor thestore.

GenerateCSR

A CSR,which is shortfor CertificateSigningRequest,is whatyou will sendto acertifiedCA to getyour certificatesignedandverified. VerisignandThawte aretwo companiesthatoffer suchservices.Earlier in this sectionyou hadtheabilityto createa CSRfor a virtual host,hereyou have theability to createonefor youron-linestore.

66 UserGuide


Figure5: 4.3.8c- SSLConfiguration



Hereyou mustenterin all the fields, with Departmentbeing the only optionalfield. Onceall thefieldsarefilled in you canclick theGenerateCSRbutton.

Oncethe screenrefreshesyou will be presentedwith your CertificateSigningRequest.Youcancopy andpastethisdirectly into ane-mailor afile onyour localmachine.

Onceyou have your certificatesignedyou cango to the above SSLsectionandusetheUploadCertificateandKey featureto addit to yourserver.

For moreinformationreadAppendixE Certificateson page234 containingcer-tificateinformation.

CashRegister

If you configuredyour storeto usethe CyberCashCashRegister softwareyoucanchangetheconfigurationsettingshere.You have threeoptionshere,AccountType, CyberCashUserID andMerchantKey. Eachitem is describedbelow.

68 UserGuide


Account Type Thisoptiongivesyoutwo choices,NormalandFulfillment. SelectFulfillment if you will be usingCashRegister for fulfillment only andnosales.

CyberCashUser ID This ID string will be assignedto whenyou sign-upwithCyberCash.

Merchant Key Whensigningupwith CyberCashyouwill beassignedapersonalMerchantKey.

Onceall the fields arecompletedclick the UpdateStore button andthe changeswill take effect.

4.3.9 Configurea Store

Theconfigureastoresectionprovidestheability to administerthecontentof yourstore.This differsgreatlyfrom theEdit/Deletea Store section.For example,youcanaddanddeleteorderanditemsfrom thestore.Whenyouclick on theConfig-urea Store link youwill bepresentedwith a list of storescurrentlyconfigured.

They will be listed in theorderthey werecreatedin. On the left sidewill be thestorenamefollowed by the URL for the administrationportion of the site. Tobegin administrationclick on theURL. You will bebroughtto thesite’s adminis-trationpage.

For informationon how to administerthesitepleasereadtheon-linedocumenta-tion foundat:

http://support.guardiandigital.com



4.4 System" Management

TheSystemManagementsectioncontainsall thesystemconfigurationoptionsforadministeringthesystem.On themainscreenyou arepresentedwith a list of alltheuseraccounts.

Following thissectionis themainSystemManagementsectionwith all of themainsystemoptions.

We will discusstheuseraccountsportionfirst..

4.4.1 UserAccount Administration

In this sectionwe will describehow to add users,deleteusers,edit users,andconfiguregroups. Thesearethe regular systemusers. Userswho wish to haveSSH accessto the machinewill needan accounthere. For more informationon usersandgroupsrefer to the Groupsand Users sectionin AppendixC.5 onpage226.Youshouldseeall userslistedin thetable,asfollows:

70 UserGuide

Section4.4 SystemManagement

Createa NewUser

To createanew systemuserstartby clicking ontheCreateNew Userbutton.Thiswill bringyou to this screen:

Hereyouwill enterall basicuserinformation.Below is abrief descriptionof eachoption:

Username Enterauniqueusernamein here.A usernamecannotcontainspacesor specialcharactersandcanbeno morethan16 charactersin length. Forexample:

Username Valid Reason

Nick DeClario No Containsspacesnick Yes <16charactersandnospaces

NicholasDeClario No >16charactersandspaces

Realname Theusersrealname.This will betherealnameof theuser. You canenterin their full name.Usingtheexampleabove,Nick DeClariowouldbevalid.

AccessEnablingthis will allow a userto only accesstheir e-mail via a secureIMAP or POP3client. This will prevent the userfrom physically logginginto themachine.

Password Enter in a password for the user. This password will be asked if theuserlogsinto theconsoleor needsto retrieve their e-mail.

Now we mustsetup theuserin a group. ReadtheGroupsandUsers sectioninAppendixC.5onpage226for moreinformationonusergroups.

Primary Group Youeithercancreateanew groupfor thisuseror useanexistinggroup.



Wearenow readyto createtheuser. PresstheCreatebutton.Youwill bebroughtbackto the main SystemManagementpageindicatingthe userhasbeencreatedsuccessfully.

Edit a User

To starteditinganexistinguser, click on theusernamefor themainSystemMan-ager menu. You will be broughtto the samescreenasfor creatinga new user,exceptit will containall the informationabouttheuseryou selected.Fromherejust changewhatyou wish to changeandselectSave. Theoptionswork exactlythesameascreatinganew userin theprevioussection.

ConfigureGroups

The last useroption in this sectionis the Configure Groupsoption. In hereyoucanchangethegroupID’s, passwordsandmembers.Click on Configure Groupsto edit thegroups.Thenselectthegroupyouwish to edit.

NOTE: Whencreatinga new userthatuseris automaticallygiven their own privategroup. For example,usernick will automaticallybegivengroupnick. Thisallows usernick to have privatefiles thatnootheruserbut root canaccess.

The reasonto changea usersgroup would be to changetheir privileges. Forexample,if youwantacertainuserto beableto administertheLockboxyoumayaddthatuserto theadmin group.Perhapsyouwantacertainuserto only beableto edit their own personalfiles andtheWebfiles, you mayaddthemto thewwwgroup.A brief explanationof thegroupsin theexampleaboveis explainedbelow:

72 UserGuide


admin Theadmingroupwill give a useraccessto someof thesystemsser-vices.This would begoodif you have othertrusteduserswhomyouwish to doadministrative taskssuchasmaintenance,file cleanupandotherneededtasks.

users This is thegroupgeneraluserswould beput in for e-mailaccessandbasicsystemaccess.

mysql The mysql group is primarily usedfor running the MySQL server.This is donefor the samereasonsasexplainedabove in the nameddescription.Theadministratorwill alsohave accessto MySQL andall its databases.

www The www groupis an examplegroupthat might be usedto controlweb files owned by the membersof the group. Additional groupscanbecreatedto containadditionalusersthatwill beseparatedfromusersin thewww group,restrictingtheirwrite accessto files in othergroups.

4.4.2 Network Configuration

SelectingtheNetworkConfigurationoptionfrom theSystemManagementsectionwill bringyou to theNetwork Configurationmainmenu.

Thefirst thingyouwill seeat thetopof thismenuis thelist of interfacescurrentlyinstalledin your system. You canedit active interfacesby clicking on the Editoption to the left of the interface. We will discussmore on editing the devicelater in this section.First we wantto createa device. If you click on theNetworkInterfacesbuttonyouwill bebroughtto a new screen:

You will now seea table labeledPersistentInterfaces. Click on an interfacetoedit or click theAdda New Interfacelink to adda new one.



Adding a PersistentInterface

If you installeda new ethernetinterfaceandyou would mostlikely wish to makeit availablefor usewith your systemby configuringit. You would do so in thissection.Persistentinterfaceswill besavedpermanentlysothey will beactive onfuturereboots.Usethatsectionif youwish to have thedevice startonboot-up.

All theabovefieldsmustbefilled in to successfullyaddyournew interface.Afterclicking Create, theinterfacewill bereadyto use.

Name This is thenameof thedevice suchaseth0 or eth2 . If it is thesecondnetwork card in your Lockbox it is eth1 , the first cardbeingeth0 , thethird cardbeingeth2 andsoforth.

IP Addr ess Enter the IP addressyou wish to assignto the device here. An IPaddressis auniquenumberusedto identify acomputeronanetwork. Gen-erally you canpurchasea block of IP addressesyou areallowed to useonthe Internetor are assignedone or more IP addressesfrom your serviceprovider. Enterin theIP addressyouwantto assigntheLockboxto here.

Netmask Entertheappropriatenetmaskthatmatchesyour subnetfor the IP ad-dress.This is usually255.255.255.0

Edit an existing interface

To edit a device click on theEdit link to theleft of theinterfaceyou wantto edit.After selectinganinterfaceto edityouwill bepresentedwith thecurrentinterfacesettings.

74 UserGuide


Hereyouwill seestandardinterfaceoptionsyousaw duringthesetupof theinter-face.If you needto changetheseor updatethem,make theappropriatechanges.However, thereis onenew field:

Virtual Interfaces This will display the total numberof virtual interfacesat-tachedto this device. If thedevicewasjust installedit will say0.

If you want to createa new virtual interfacefor this device click on theAdd Virtual Interfaceoption found to the right of the numberof virtualinterfaces.

Oncea new virtual interfaceis addedit will be listed on the main menuunderPersistentInterfaces. Click on the Virtual Interfacefrom this menuto edit it. In theexamplebelow theVirtual Interfacesarehighlighted.

Adding a Virtual Interface

A virtual interfaceactsasanotherethernetdevicebut is boundto a realdevice. Avirtual interfaceis referencedby the device it is boundto (eth ) andassignedareferencenumber, (i.e., eth0:1 ). Thevirtual interfacehasit’s own IP address,netmask,andbroadcast.This is especiallyusefulwhencreatingvirtual Webhosts.SeeSection4.3Virtual HostManagement on page39 for moreinformation.

NOTE: This assumesthat this virtual interfaceis on the samenetwork as the realdevice.



This sectionrequiresall theentryfieldsto befilled in. Onceyou have completedthis click theCreatebuttonto activatethis new virtual interface.After thedeviceis createdyou arereturnedto thepreviousscreen.You will noticethatthedeviceis now listedin theInterfacesActiveNowsectionandwill beindentedandlabeledwith Virtual. Youcanedit this device by clicking on thename.

Default Route

In this sectionyou canconfigurethe routing table. This is initially configuredwhenyou first setup your Lockbox but if you changethe network aroundandneedto changetheroutingtable,this is whereit getsdone.

A descriptionof eachentryfield is explainedbelow:

Default Router Youwill needto enterin theIP addressof thedefault routeryouwill beusing.

Routing Device This will bethedevice in your Lockboxthatwill beusedto ac-cesstherouter. Generallyeth0 is usedfor this. Only configuredinterfaceswill bedisplayed.

DNSClient

This is whereyou configureyour Lockboxto look for DNS servers.You canlistyour DNS serversby IP or hostnamein their searchorder. Fill this in with theappropriateinformation for your network. A descriptionof eachitem is givenbelow.

76 UserGuide


DNSServers Hereyou canlist all theDNS serversyou will beusing.You needat leastonelistedhereto beableto accessDNS. You have to list theDNSserver(s) by their IP addresses.If your Lockbox is performingthe DNSfunctionsfor you network thensetthis to the IP addresson your machinedesignatedfor DNS.

Host Addr esses

This containsa list of your statichostaddresses.Oneline for eachhostnameandIP addresswill appearhere,includingIP’sfor virtual interfaces.Therewill beoneentryfor eachhostnameconfiguredonyourLockbox.

Add a NewHost Addr ess

To addahostenterin theIP Addressfollowedby alist of all associatedhostnames.



Click theCreatebuttonto applythechanges.

Edit a Host Addr ess

To make changes,edit your changesdirectly in theappropriatefields. Whenyouaredoneeditingclick theSavebuttonto applythechanges.

To deletetheentryjust click theDeletebutton.

4.4.3 ChangeSystemTime

This sectionallows you to changethecurrentsystemtime,or synchronizeit withanInternetor designatedlocal timeserver.

Changingthetime is controlledby pull down menus.Selectthecurrenttime andhit SetSystemTime for thechangesto take effect. Normally, systemtime will beaccuratelycontrolledwith thenetwork timeservicesandmanuallysettingit is notnecessary.

It is alsopossibleto configuretheLocoboxto useInternettime serversto setitstime.

78 UserGuide


You have threefields to fill in thehostnamesof the time servers. Your Lockboxwill useall threeserversto synchronizeits time. Keepingaccuratesystemtime isextremelyimportant. You have to enterhostnamesin here. IP addressesarenotallowed.

4.4.4 Secure Shell Management

SecureShell (SSH)is a programfor logging into a remotemachineandfor ex-ecutingcommandson a remotemachine.It is intendedto replacerlogin andrsh , andprovidesecureencryptedcommunicationsbetweentwo untrustedhostsoveraninsecurenetwork.

Thissectionwill allow youto edit theSSHconfiguration,generateanew hostkeyandgenerateuserkeys.

Edit the SSHconfiguration

By clicking on theSSHConfigurationicon you arebroughtto theEdit SSHCon-figuration page. Hereyou have the ability to allow anddeny groupsandusers



SSHabilities.# Be carefulwhenediting theseoptionssinceyou maygrantaccessor deny accessto thewrongpeople,whichcouldcauseproblems.

In eachfield youcanenterin agroupnameor username,whichever is appropriatefor thefield, usinga blankspaceasa delimiter. Clicking on the“...” buttonwillbringupasmallwindow containinga list of usersor groupsyoumayselectfrom.

Therearea few rules to take noteof whenconfiguringaccesscontrol for SSL.Below is a shortlist of basicrules:

$ Onceyou adda useror groupto theAllow sections,all otherusersthatarenot listedwill bedenied.

$ If you adda userto theAllow Users sectionbut thegrouptheuserbelongsto is in theDenyGroupssection,theuserwill bedeniedaccess.

$ Thedeny rulestake precedenceover theallow rules.

$ You maydeny a userbut allow thegrouptheuserbelongsto.

Mostconfigurationswill besafeallowing theadmingroupaccess.Thiswill auto-maticallydeny everyoneelsewho is not partof theadmingroup.

After youhavefinishedmakingyourchangesclick theWriteConfigurationbuttonfor thechangesto besaved.

SSHKeyManagement

TheKey Managementsectionallows you to createnew SSHkeys for yourusers.

80 UserGuide


Generate a userkey

Generatinga userkey will allow yourusersto log in to theLockboxremotelyviaSSH.First click on theGenerateUserKey button. This will bring you to a newscreenwith a form to befilled out. It first requiresa username.You cantype inthenameor selectit from a list by clicking the“...” button.

An IP addressis not requiredbut recommendedfor increasedsecurity. The IPaddresswill tell theLockboxwherethisuseris authorizedto connectfrom. If youdonot enterin anIP addressit will let this userconnectfrom any IP address.

NOTE: If no IP addressis enteredyou will needto addtheusersIP addressthroughSection4.6.4 SystemAccessControl on page109 to give the useraccessto the system. Without this IP addressthe userwill be deniedaccess.Werecommendyouenterit in at this time.

Thedescriptionfield allows you to enterin a shortdescription.This descriptionwill bedisplayedbackto theuserevery time they attemptto connectto theLock-box usingan SSHclient suchasMindTerm. For more informationconcerningMindTermreadSection6 LockboxConnectivityonpage120.



Finally you needto entera password. Selectany password that is at least5 char-acters.Now click on theGeneratekey button.

Youwill now seeascreenwith theresultsof theSSHKey generation.

You now have theoptionto downloadyour key. You will needto have a copy ofyour key to load into your SSHprogramto soyou will beableto gain accesstothemachine.Save thefile in asecurelocation.

Thekey thatwasgeneratedanddownloadedis a public key. Beinga public keyyoucansendit to ausersafelythroughe-mail.

4.4.5 Mail Server Management

The Mail Server Managementsectionwill give you completecontrol over yourmail server, giving you theability to add/remove usersandaliasesandothermailoptions.

On the main menuyou will have four main options,Mail ServerConfiguration,DomainManagement, Mail RoutingandStopMail Server.

82 UserGuide


Mail Server Configuration

Hereyouhave theoptionto setupvarioussystem-wideoptions.

TheDeliver directlyoptionwill forwardany outgoingmail not destinedfor usersof yoursystemdirectly to thegivenhost.

If the mail server is behinda firewall or proxy server to the outsideworld, youwill needto tell themail serverwhereto forwardnon-localmail. Youcanenterinahostnameor IP addresshere.

Domain Management

The DomainManagementsectionallows you to createa new mail domain,ex-plainedbelow, andto edit analreadycreateddomain. Creatinga new domainisquitesimple.Below theDomainManagementmenuyou will seetheCreateNewDomainmenu.Hereyou have two options,DomainandPostmaster. Both fieldsarerequired.

Domain The domain is simply the nameof the domain you wish to receivemail for. For example, if you wish for the mail server to receive mailfor guardiandigital.com thenyou would enterguardiandigi-tal.com into this field.



Postmaster If a usersendsan e-mail to a non-existent accountit will be for-wardedto this user. It’s anadministrative addressthatreceivesall undeliv-erablemail.

Editing a Domain

Tomakechangestoadomainyouhavecreatedyoucansimplyclick onthedomainnamelistedundertheDomainManagementmenu.Thiswill presentyouwith thefollowing screen.

Therearequitea largenumberof optionshere.We will breakdown eachsectionbelow.

Mail Routing

Themail routingsectionallowsyoutoselectwhatdomainsyouwouldlikealiased.If youhaveauserat theguardiandigital.com domain,andwanteveryuserto beableto receivemail to linuxsecurity.com aswell, thismenuprovidesthatability. Referto Figure 4.4.5.

Enterin thedomainyouwantthemail aliasedas.Weusedlinuxsecurity.comto createanexistingmail routein theaboveimage.Wethenenterin theRelaymailto... field theactualdomainthemail shouldgo to, guardiandigital.com inthis example.

NOTE: Subdomainsareautomaticallyincludedin theroute.

84 UserGuide


Figure6: 4.4.5- Mail Routing

SelecttheAddNew buttonandthenew optionsyou enteredin will appearin theExistingMail Routes. Click theSaveoptionto save or theDeletebuttonto deleteamail route.

4.4.6 DNSManagement

TheDNSManagementsectionwill allow you to fully configureyour Lockbox’sDomainNameSystem(DNS) settings.You will beableto addanddeletemasterandslave zonesandhave theability to edit all globaloptions.

The Domain NameSystem(DNS) is the software that is responsiblefor con-verting hostnamesinto numbersthat computerscan understand.For example,the namewww.guardiandigital.com correspondsto the host IP address63.87.101.80 and vice versa. The DNS server, sometimescalled a nameserver, is theprocessthat runson the Lockboxawaiting incomingnameservicerequests.

For example,if the DNS server is given an IP addressof 63.87.101.80 , itwill look it up in a databaseof addressesand link it to it’s domainname. Inthisexample63.87.101.80 will resolveto www.guardiandigital.com .DNS will alsowork the otherway. Giving it www.guardiandigital.comwill resultin 63.87.101.80 .

Beforeyoucanconfigureyourown DNSserver, youmustfirst registeryourDNSserver anddomainnamewith Network Solutionsor anothernamingauthoritybycompletingtheir hostregistrationform. You will needto reserve oneIP address



for useby%

yournameserver. In orderto maximizeavailability, everydomainmusthave botha primaryandsecondaryDNS server, andbothmustberegisteredwitha namingauthoritysuchasNetwork Solutions. GuardianDigital canassistyouwith this processif youwish.

TheDNSManagementsectioncontainsthreeoptions,asshown below.

Thissectionprovidestheability to:

Global Option Forwardersandothervariousdefaults that will apply to all thezonesyou manage.

Createa NewMaster Zone Thiswill bringuptheconfigurationscreento createa new DNSmasterzone

Createa NewSlaveZone Thiswill bringup theconfigurationscreento createanew DNSslave zone

Createa NewMaster Zone

Thedomainnamespaceis divided into regionscalledzones.For thepurposesofthisdocument,it is sufficientto describeazoneasadomain,or sectionthereof,forwhich theserver will beresponsible.Thehostwww.guardiandigital.comisamemberof thedomainguardiandigital.com , asismail.guardiandigital.com anddns.guardiandigital.com .

For example,Figure 4.4.6ashows the guardiandigital.comzoneand two hostswithin thezone.

Whenyou selectthe option to createa new zoneyou will bepresentedwith thepagein Figure 4.4.6b.

86 UserGuide


Figure7: 4.4.6a- Exampleof theguardiandigital.comzone.

Figure8: 4.4.6b- New MasterZoneOptions



Theabove pagehasquitea few options.Herewewill discusseachonein detail.

Zone type Thezonetypewill allow you to choosebetweenforwardandreverselookup.

� Forward lookupallows theclient machineto supplya Fully-QualifiedDo-mainName(FQDN) andtheDNSwill returntheIP address.

� Reversedoesthe exact opposite. You supplyan IP addressandthe DNSwill returnanFQDN.

Domain name/ Network This containstheactualdomainname,or, in thecaseof reversezones,thenetwork addressblock, thatthis DNS zonewill residein. Forexample,if yourLockboxis likeabove,lockbox.guardiandigital.com , thenthedomainwouldbeguardiandigital.com .

Master Server This sectionwill contain the IP addressof your masterDNSserver. ThemasterDNSserver, alsoknown asaPrimaryDNSServer,main-tainsa list of domainnamesandtheir IP addresses.This list is madeavail-ableto otherDNSserversontheInternetsothatuserscanaccessthesesitesover the network. For example, if you own guardiandigital.comyour masterserver will controlguardiandigital.com . You canhaveotherDNSservers,known assecondaryDNSservers,or slaveDNSservers,that act as a backupto the primary DNS server for guardiandigi-tal.com . If your Lockbox is your masterDNS server thenenterin theaddressof yourLockbox.

Email Addr ess Thedefault e-mailaddressassociatedwith this zone.Generallythis is the e-mail addressof the systemadministratoror whomever is re-sponsiblefor DNSonyournetwork.

Allow TransfersFrom... DNSwill needto transferinformationif youhaveslaveDNS serverson your network. This shouldcontaina list of IP addressesand/ora block of IP addressesfor otherDNS servers that areallowed totransferDNSinformationbetweeneachother. Youcansetthedefault in theDefaultZoneSettingssectionfor thisspecificzone,which is describedlaterin thissection.

Allow QueriesFrom... Hereyou canlist theIP addressesand/orblock of IP ad-dressesfor machinesthatareallowedto queryyour DNS server. You maywant to limit this to the peopleinside your network if your Lockbox is

88 UserGuide


locatedonyour internalor privatenetwork. Werecommendleaving thede-fault set if you areuncertain.You cansetthe default in the Default ZoneSettingssection,which is describedlaterin this section.

Creatinga NewSlave Zone

A secondaryDNS server, alsosometimesreferredto asa slave server, for a zonegetsthe zonedatafrom anotherDNS server that is authoritative for the zone,calledits masterserver. Whena secondarynameserver startsup, it contactsitsmasterserverandrequestsacopy of thezonedatafor whichit is responsible.Thisis calledazonetransfer.

A slave server will backupyour masterserver. This is mostly for redundancy ifyourmasterserver is not runningor is unavailableto answeraquery. Thissectionhaseverythingnecessaryto createone.

NOTE: You mustconfigurethe masterserver to allow this new slave server to per-form zonetransfersfrom themasterserver. Thesechangesmustbemadeonthemasterserver. Informationpertainingto thiscanbefoundin Section4.4.6Edit MasterZoneon page93.

The optionson this screenarethe sameassettingup a masterserver. Find thedetailedinformationin theprevioussection.

However, thereis onenew category, MasterServers.



Master servers In the masterserverssectionyou canlist all the masterserversthat this slave server will obtain its DNS information from. At leastonemasterserver is requiredin this section.

NOTE: You arerequiredto list your slave server asa nameserver on your masterserver. Youcanfind informationondoingthis in theNameServerSectiononpage96.

To finishcreatinganew slavezoneyouwill needto defineamail routeto backup.Defininga mail routemustbedonefrom themasterserver. You will needeithertheFully-QualifiedDomainName(FQDN) or IP addressof theslave server thatwill be handlingthe mail route. Informationon configuringthis on your masterservercanbefoundonpage97.

A NewDNS ManagementScreen

Onceyou have completedthe zonecreationform, click the Createbutton. Youwill be returnedbackto themainscreen.Now you will have a list of optionsatthetop, followedby a list of yourDNSservers.

The first object in this menuis the Global ServerOptions. Hereyou have theability to createnew Masterand Slave zones,discussedabove, and to edit theGlobalOptions.

90 UserGuide


Global& Options

Global Forwarding and ZoneTransfer Options

Servers to Forward Queriesto... A forwarderis usedfor nameserversthatmaynot necessarilybe directly-connectedto the Internet. This may be duetobeingbehinda firewall, or insideof a corporatenetwork. Forwarderswillinsteadqueryaspecifiedadditionalnameserver for its DNSinformation.Ifyour DNS server will be respondingto a forwardingserver you will wantto specifytheserver(s)it is allowedto contact.Seeforwardersandforwardzonein theglossaryfor moreinformationconcerningforwardqueries.

NOTE: A forward server is still a primary or slave server; don’t get confusedhere.All outsidequerieswill begivento it first.

Default ZoneSettings

Allow transfers fr om... This setsthe servers that are allowed to perform zonetransfersfrom theDNSserver. Whena slave server requestsupdatedinfor-mationfrom themasterserver, themasterserver will transferit to theslaveserver if authorized.Thisprocedureis known asazonetransfer. No servers



areauthorizedby default. If youareuncertainof whatto enterin here,leavethedefault setandcontactyournetwork administrator.

Allow queriesfr om... This setsfrom which IPs your DNS server will acceptDNS queries. By default the DNS server will acceptqueriesfrom all IPaddresses.If you areuncertainaboutwhatshouldbeenteredin here,leavethedefault on.

Existing DNSZones

The other sectionon the main DNS pagebelow the Global ServerOptions isExisting DNS Zones. This will display the reverseand forward addressesof adomain. If you click on the addressyou will be broughtto the correspondingoptionspageto have the ability to make changes.The reverseaddresspageandtheforwardaddresspagebothhave differentoptions.We will discussbothpagesbelow.

Edit a SlaveServer

In this sectionyou have the ability to make changesand deletea slave server.Youshouldbefamiliarwith theseoptionssincethey wereusedto createtheslave

92 UserGuide


serverandin theGlobalOptionssection.Referto thosesectionsfor moredetailedinformation.

Edit a Master Zone

Add Addr essRecord

TheAddresssectionwill allow youto defineaddressrecords.In thegivenaddress(i.e., smtp.guardiandigital.com ) you can definespecificservers. Themenuis broken down into two sections,Add AddressRecord anda tableof thecurrentrecordslisted by IP addressfollowed by the hostname.Take note thattheserecordsareonly valid for thedefinedzone.



To create' a new Forward AddressRecordyou simply needto fill in the two re-quiredfieldsdescribedbelow.

Hostname The hostnameis the Fully-QualifiedDomainName(FQDN) for thespecifiedmachine.

Addr ess In theaddressentryfield you will needto enterin theIP addressof themachinefor this record.

Onceyou have filled in all thefieldsyou canclick on theCreatebuttonto createthe new forward address.Oncethe pagerefreshesyou will seeit listed at thebottomof thepage.

Edit/Deletea Record

Oncearecordhasbeencreatedandyouseeit listedbelow theAddAddressRecordmenu,you will have the ability to edit the recordby clicking on the nameof it.This will bring you to a new screenthat is similar to the Add AddressRecordscreen.

To edit the nameserver simply make your changesdirectly in the NameServerfield andclick the Savebutton to make the changes.If you wish to deletethisnameserver recordclick on theDeletebutton.

94 UserGuide


NameAlias(

TheNameAlias sectiongivesyou theoptionto configureanaliasfor this record.

On this menuyouhave two options,Alias andRealName.

Alias Thealiasneedsto beaFully-QualifiedDomainName(FQDN).In thiscasethe aliasis whereyou want the userto be redirectedto. For example,theusertypesin www.guardiandigital.com while really they arebeingsentto lockbox.guardiandigital.com .

RealName The real nameof the server alsoneedsto be a Fully-QualifiedDo-mainName.Thisis thenamethattheAlias will reallybegoingto. In theex-ampleabove youwouldenterin lockbox.guardiandigital.com .

Edit/Deletean Alias

Onceyoucreateanew aliasit will appearat thebottomof thepage.

Similar to theothersections,you canclick on thenameto edit therecord.Afterclicking on thenameyouwill bebroughtto theEdit NameAlias Record page.



You canmake your changesby editingtheappropriatefield. Whenyou aredonewith your changesyou canclick theSavebuttonto setthechanges.To deletetherecordsimplyclick theDeletebuttonandthealiaswill bedeleted.

NameServer

The Domain NameSystem(DNS) is the software that is responsiblefor con-verting hostnamesinto numbersthat computerscan understand.For example,the namewww.guardiandigital.com correspondsto the host IP address63.87.101.80 and vice versa. The DNS server, sometimescalled a nameserver, is theprocessthat runson the Lockboxawaiting incomingnameservicerequests.

Thenameserversectionallowsyou to specifythenameserver thatwill behostedhere.A nameserver is requiredfor thedomainto functionproperly.

96 UserGuide


To addthe' nameserver simply typeit into theNameServerfield andclick on theCreatebuttonto submitthechanges.

Edit/Deletea NameServer

Onceyoucreateanew nameserver youwill seeit listedbelow.

Youcanclick on thenameto edit therecord.

To make changesto therecordsimply edit thefield andclick theSavebutton. Todeletetherecordclick theDeletebutton.

Mail Server

Hereyou have theability to setup a mail server for thedomain.You cansetupmorethanoneserver andsetthepriority level of theserver. More detailon doingthis will beprovidedbelow.



Youcandefineyourmail server(s)in theMail Serverfield. Only oneservercanbedefinedat a time. However, you canhave morethanonemail server perdomainwith differentlevelsof priority. This providesfailover. If a particularmail serveris unavailable,DNSwill automaticallyinstructit to usea differentmail server.

Theorderin which thenext server is chosenis known asthepriority. The lowernumberthe priority, the higher the precedence.In other words, a mail serverconfiguredwith apriority of 10will receive mail beforeonewith apriority of 20.

You mustcompletetheMail ServerandPriority fields. Onceyou aredone,clicktheCreatebuttonandtheserveryoujustenteredin will bedisplayedatthebottom.

Edit/Deletea Mail Server

Onceyouhave createdamail server it will belistedasshown below.

Youcanclick on thenameof theserver to bringup theedit screen.

To edit theserver simply make necessarychangesandclick Save. Your changeswill immediatelytake effect. To deletetheserveryoucanclick theDeletebutton.

Edit ZoneParameters

The zoneparametersaregeneralsettingsneededby the zone. You will be pre-sentedwith amenuof theoptionswith thedefaultsbeingdisplayed.A descriptionof eachitem is listedbelow.

98 UserGuide


Master Server TheMasterServerfield containstheaddressof yourmasterDNSserver, alsoknown asaprimaryDNSserver. ThemasterservercontrolstheDNSfor yourzone.

For example,if you own guardiandigital.com your masterserverwill beresponsiblefor thehostnamesandIPaddressesfor guardiandig-ital.com .

E-mail Addr ess Theadministrativee-mailaddressresponsiblefor thiszone.Gen-erally this is thee-mailaddressof thesystemadministratoror whomever isresponsiblefor DNSfor thiszone.

Wheneditingis finished,click theSavebuttonto applythechanges.

Edit ZoneOptions

The zoneoptionsarepresetto the settingsyou specifiedglobally in the GlobalOptionssection4.4.6on page91. If you wish to overrideany globalsettingsyoucandosohere.



4.5 System" StatusMonitor

4.5.1 Logfile Management

Logfile Managementprovides the ability to view the systemlogs. By clickingon the log you want to view, a new browser window will appearwith the loginformation.

NOTE: Logsarerotatedon a regularbasis.No maintenanceis required.

Oncea new browserwindow is open,andthe log informationis displayed,youwill bepresentedwith a coupleof options. At thebottomof the list of logsyouwill seeLast20 linesandRefresh. ChangetheLastLinesoptionto view moreorlessof thatparticularlog andhit Refresh. You canalsoclick Refreshat any timeto view themostrecentlog entries.

4.5.2 ProcessManagement

TheProcessManagementsectionallowsyouto view alist of all runningprocessesandallowsyou to alterthem.Youcanview yourprocessesin thefollowing ways:

$ Ownership

$ ProcessID (PID)

$ CPUUsage

100 UserGuide

Section4.5 SystemStatusMonitor

In this sectionyou alsohave anoptionto view currentsystemstatistics.

Viewing processes

To view a list of the currently runningprocessesfirst choosehow you want tohave themsorted.After makingyour selectionyou will bepresentedwith a newpagecontainingall the processesorganizedaccordingto how you specified.Atthetopof thepageyouhave theoptionto changeviews. By clicking onaprocessID numberyou can view more information aboutthe process. In the examplebelow SortbyUserwasselected.Youwill first seetheDisplaysectionwith otherviews you mayhave selected,followedby theuserID with theusersfull nameinparenthesis.A tableof all of theselecteduser’s processesarelistedbelow. Theimagebelow is showing asmallportionof theprocessesonly.

Whenviewing moreinformationabouta PID a new browserwindow will open.Thisnew window will displaythefollowing information:

) thecommandthatstartedtheprocess

) theprocessID (PID)

) theprocessesowner



� amountof RAM in Kb theprocessis using

� theprocessesparentprocess

� CPUusage

� run time

It will show you thecommandthatstartedtheprocess,thePID, theownerof theprocess,theamountof RAM, in Kb thatit is using,it’sparentprocess,CPUusage,run time, amonga few other options. Refer to the General Linux Informationsectionfound in AppendixC on page220 for moreinformationaboutprocessesandsignals.

SystemStatistics

TheSystemStatisticssectioncontainsthreesmallersections,SystemInformation,Disk Usage, andActiveNetworkConnections.

SystemInf ormation TheSystemInformationsectiondisplaystheresultsof run-ning uname -a and uptime . The following information will be pre-sentedto you:

� operatingsystemname

� nameof themachine

� kernelversion

� date

� processorarchitecture

� processortype

� currenttime (12hourformat)

� systemup-time

� numberof currentusersor thesystem

� currentloadaverage

102 UserGuide

Section4.5 SystemStatusMonitor

� loadaverageover thelastfiveminutes

� loadaverageover thelast15minutes

Disk Usage TheDisk Usagesectiondisplays:

� device name

� total size

� amountused

� amountavailable

� percentageused

� wherethedrive is currentlymounted

ActiveNetwork Connection The Active NetworkConnectionsectionwill dis-play a list of currentconnections.It shows the connectiontype, the localIP address(your Lockbox),theforeigncomputer’s addressandthecurrentstateof theconnection.This is really for informationalpurposesonly.



ServicesMonitor

TheServicesMonitor givesyoua list of yourcurrentrunningservicesandallowsyou to startandstopthemandcontrolstartingthematboottime.

To startor stopa serviceclick on theStateassociatedwith theservice.Onceyouclick on theStatethescreenwill refresh,reflectingthenew statusof theservice.To changethe boot time activation statussimply click on the Active at Boot?option.

TheRebootSystemandShutdownSystemoptionswill bothdisplayconfirmationscreenbeforethecommandis carriedout.

NOTE: If you chooseShutdownSystemit will power down the entiresystem.Youwill have to physically turn thepowerbackon to thesystem.

104 UserGuide

Section4.6 Security

4.6 Security"

Your Lockbox includesall necessarysecuritysettingspre-configured.They areoptimally setfor thehighestlevel of securitywithout hinderingtheusageof theLockbox. This sectionwill let you configuresomeof thesesecuritysettingstoadaptto possiblesystemchangesyou maymake over time. Fromhereyou havethe ability to managecertificates,configureSSL encryption,IP accesscontrol,customizeyourconsolelogin banner, andconfigurethehostintrusiondetection.

4.6.1 ChangeWebTool Password

You canchangeyour administrative WebTool password here. You needto enterit in twice to avoid typing errors.We recommenda password no shorterthansixcharacters.Mixing lettersandnumbersis a goodideaandavoid full words. SeeLinuxSecurity.com for tipson choosingasecurepassword.



4.6.2 ChangeAdministrator E-Mail Addr ess

The administratorsaddresscan be enteredhereto receive a daily summaryofimportantlog informationandsecurityalerts.

The Daily Summary

The daily summaryis e-mailedout every night at ten minutespasttwelve. Thecontentswill look somethinglike this sampledaily summarye-mail:

Log Summary for 10/3/2000

*** Log summary for system logins ***Total number of:

- root logins via su - 0- SSH sessions opened - 5

106 UserGuide

Section4.6 Security

- console logins - 0

*** Log summary for GD WebTool logins ***Total number of:

- successful administrator logins - 16

- failed logins - 4

This has been e-mailed to : [email protected]

End of summary for 10/3/2000

Dependingonyoursystemconfigurationandinstalledpackages,youmayreceivemoreor lessinformationin this summary.

Security Alerts

For serversthathavetheLIDS hostintrusiondetectionserviceenabled,andsome-onetriesto disableit, but givesanincorrectpasswordthreetimesin arow in undera oneminuteinterval, an e-mail will be sentto the administratorwhoseaddresswasspecifiedin theChangeAdministrator E-Mail Addresssection.

NOTE: Chancesareyou cansafelyignorethis section.If you areuncertainof whatto do shouldthis eventarise,contactGuardianDigital for furtherassistanceandwewill begladto help.

The e-mail will containinstructionson how to handlethe situation. It will looksimiliar to theexamplebelow:

A password to disable the host intrusion monitor was en-

tered three (3) times incorrectly. This could be an er-

ror of the system administrator or it could be some-

one attempting to gain unauthorized access.

We suggest checking in to this matter as soon as possi-

ble. To check if the host intrusion monitor is prop-

erly running login to your Lockbox as the root user. In-

structions on this can be found in Section 6 of the docu-

mentation, and type:



lidsadm -r

This will return the current running status of the intru-

sion monitor. If the monitor is not run-

ning you should turn it back on. Do this by typing:

lidsadm -S -- +LIDS_GLOBAL

It will prompt you for your host intrusion monitor pass-word. Once the password is correctly entered the intru-sion monitor will be en-abled. You can scan the logs through the GD WebTool for more de-tailed information. You can also read more on the intru-sion monitor in Section 9 of your of your manual.

Thiserrorwill only occurunderthefollowing conditions:

* A wrongpassword is enteredin threetimesin a row to disableLIDS

* A wrongpassword is enteredin threetimesin a row to enableLIDS

* A wrong password is enteredin threetimes in a row to reloadthe LIDSconfiguration

What this meansis that eithera userwith root accessaccidentlyenteredin thepassword wrong threetimes in a row or an unauthorizeduserhasattemptedtogainaccess.

If you only usethe GD WebTool to administeryour Lockbox you shouldrarelyseethis message.

In theeventof thise-mail,youarewelcometo contactGuardianDigital for furtherassistance.ReadSection1.7onpage16on how to contactGuardianDigital.

4.6.3 WebTool AccessControl

This sectionallows you to control what IP addresseshave accessto the GDWebTool. You shouldallow asminimum aspossible.You canenterthe IP ad-dressesin a list, enteringa new line aftereachentry.

108 UserGuide

Section4.6 Security

ChoosingtheAllow fromall addressesoptioncanplaceyoursystematthegreatestsecurityrisk.

4.6.4 SystemAccessControl

Thisworkssimilar to theWebTool AccessControl sectionexcepttheserulesapplysystem-wide.

EnteringanIP addressin thegiven IP Addressfield will give thatIP Addresstheability to makeanSSHconnectionto theLockbox.Examplesaregivenabove theIP Addressfield. Onceyou have thattypedin click theAddHostbuttonandyournew settingswill appearbelow oncethescreenrefreshes.



4.6.5 Edit Login Banner

This allows you to alter the login bannertheuserseeswhenthey connectto thesystemor login from the console. Justtype in plaintext andhit savewhenfin-ished. We recommendputting in a warning/disclaimeraboutillegally accessingthesystem.It maybenecessaryto consultyoursecurityor legal department.

110 UserGuide

Section4.7 SystemBackup

4.7 System+ Backup

Backingupyoursystemis oneof themostcrucialrolesof systemadministration.The systembackupsectionallows you to completelybackupall characteristicsof your system. You can backupconfigurationfiles, usershomedirectoriesorthe whole systemfrom here. You canrestorebackups,checkfor changedfiles,scheduleregularbackuptimes,view backupsandcreatenew backups.

NOTE: All backupsarewritten to thelocalharddrive. Youhave theoptionto down-loadanarchive to your localmachine.

4.7.1 Backup Maintenance

TheBackupMaintenancesectioncontainsall your optionsfor maintainingyourbackups.

Themaininterfacefor BackupMaintenanceis thepull down menu.Youcanselectyouroptionhere.Whenyoumakeyourselectionclick on the“Execute” buttontocontinue.Theoptionsin thepull down menuareexplainedbelow:

Createa NewBackup This option allows you to backupyour systemwith theconfigurationlisted in the pull-down menu. Eachconfigurationis a setofrulesto tell the Lockboxwhat exactly you want to backup.You won’t becreatinga new backuprule here,but insteadactually runningthe backupprocess.More informationon creatingnew backuprulesis in the sectionSchedulea NamedBackup. Selecta namedbackupfrom the pull-downmenuandhit Execute. Do NOT hit stop, back, or reload in your browserwhile this is running. Your systemis backingup andwhen it is finishedyour screenwill automaticallyrefreshinforming you if the back up wassuccessfulor not. This cangenerallytake a few minutesto run, dependingmostlyonhow muchdatayou arebackingup.



Restore a Backup Thissectionis usedto restoreapreviousbackup.Any backupyouhave madewith theWebTool will appearlistedhere.

Simply selectwhich backupyou wantto restoreandclick on theExecutebutton.Only onebackupcanberestoredat a time. This will overwritethecurrentdataitis restoring.Examplesaregivenin thescreen-shotabove.

Deletea Existing Backup Whenyou selectto deletea backupyou will bepre-sentedwith apagethathasalist of all yourbackups.Youcanselectmultiplebackupsto deleteby selectingthecheck-boxfor thespecifiedbackuplisted.Whenyou have selectedthe appropriatebackup,click Executeandit willbedeleted.Examplesaregivenbelow in thescreen-shot.

NOTE: Backupsolderthat45 daysareautomaticallydeleted.

112 UserGuide


View the Contentsof a Backup Selectingthisoptionwill bringupascreensim-ilar thetheDeletea BackupandRestore a Backupscreens.You canselectonebackupatatimeandthenclick theExecutebutton.Theresultingscreenwill bea list of all thefiles in thebackup.It will alsolist file permissions,modifiedtimes,file paths,andfile size.

SeeWhich FilesHaveBeenChangedSinceBackup ThissectionworkslikeSec-tion 4.7.1View theContentsof a Backupon page111. You canselectyourbackupandclick Execute. Theresultwill bealist of files thathavechangedsincethethatbackupandin whatway they changed.

4.7.2 Schedulea NamedBackup

To schedulea backupyou will have a list of all your differentnamedbackupsina pull-down menu. Selectwhich backupyou would like to schedulethen,usingtheotherpull-down menu,selectif you would like to make it weeklyor nightly.Whenyouhave madeyourselectionsclick theSchedulebuttonto setit.

Oncethe Lockbox entersthe new backupinto the schedulethe pagewill reloadandyou will seethe backuplisted in the Currently ScheduledBackupssection.All scheduledbackupswill belistedin thatsection.

You alsohave two otheroptionsin this section,New NamedBackupandDeleteaNamedBackup.



Creatinga NamedBackup

SelectingtheNew NamedBackupoptionwill bringupa new screen.

Youwill alsonoticeasmallsectionabovetheCreateNamedBackupsectionwhichwill containa list of all currentnamedbackups.Themainsectioncontainsfourfields:

Name Thenamewill bea text nameto labelthisbackupwith. Thisnamewill bedisplayedonall thepreviousmenusto representthenamedbackup.

Include Hereyou canlist all the files or directoriesto be backed up. Separatedifferentfilenamesanddirectoriesby spaces.For example:

What to backup What to enter in

wholesystem /

someuserdirectories /home/user1 /home/user2

systemlogs /var/log

systemlog, kernel& homedirectories /var/log /home /boot

Exclude Excludeworksthesamewayasincludeexceptthatit excludesthespec-ified directoriesandfiles. For example:

What to Backup What to Exclude Include Exclude

homedirectories user24’s homedirectory /home /home/user24

wholesystem homedirectoriesand/usr/local / /home /usr/local

114 UserGuide


Deletinga NamedBackup

Hereyou will have the option to deletea backup. If you deletea backupfromhereit will automaticallyremove all associatedbackupfiles, if it wassetup to bescheduled.

To deletea NamedBackupselectthe nameof the backupfrom the pull-downmenuandclick the Deletebutton. You will thenbe presentedwith a screenin-formingyou if thedeletionwassuccessfulor not.

NOTE: When deletinga NamedBackupyou are deletinga backupconfigurationtype,notactualbackedupfiles. To dothatreferto DeleteanExistingBackupabove.



4.8 Changing, a User’sPassword

As discussedearliertheadministratorhastheability to changea userspasswordfrom theGD WebTool. To increasesecurity, theGD WebTool doesnot allow anyuserbut theadministratoraccessto thosesectionsof theWebTool. To allow auserto changetheir own password themselves,a separateURL is provided. By goingto:

https://lockbox.guardiandigital.com:1022

The usercan login with their normal login nameand password. In the aboveexamplereplacelockbox.guardiandigital.com with theFQDNof yourserver.

NOTE: Theaddressis verysimilar to theregularWebTool but noticetheportyouareconnectingto. Theport 1023 is usedfor theWebTool, while 1022 is theuserpassword utility, asin theexampleabove.

If thedefault GuardianDigital certificatestill remainson thesystemtheuserwillbe promptedto acceptit. Instructionson acceptinga certificatecanbe found inAppendixE onpage234.

Oncethe usersuccessfullylogs in to the systemthey will be presentedwith thefollowing screen.

116 UserGuide

Section4.8 Changinga User’sPassword

Herethey mustenterin their old password first, followedby their new passwordtwice. Thenew password is requiredtwice to doublecheckfor typingerrors.

Wheneverythingis enteredin youmayclick theChangePassword buttonfor thechangesto take effect. Thesechangestake effect immediately. Pleasenote,youcanabortthis processatany timeby clicking theAbort button.


5 G-

D UPDATE

Oneof themostimportantaspectsof securityis keepingup to datewith thelatestsoftwarepackagesandbug fixes. Using the latestsoftwarewill greatlyincreasetheoverall securityof yourLockbox. Includedwith yourLockboxis autility thatwill allow you to easilyandsecurelykeepyoursystemup to date.

TheGD Updateutility is a sectionof theGD WebTool thatwill determinewhatnew softwareis available,andinstallany updatedsoftware.Youwill bepromptedto authorizeall changes.

All new packagesaredownloadeddirectly from GuardianDigital via anSSLSe-curedconnectionto insurethehighestdegreeof securityanddataintegrity.

5.1 Running the GD Update

To startGD UpdateselecttheGD Updateiconfrom themainmenu.A connectionwill bemadewith GuardianDigital’s servers.

If you haven’t loggedinto the GD WebTool during this sessionyou will be re-quiredfor your login nameandpassword, which wasassignedto you whenyouregisteredyourLockbox.

Youwill have to wait a few momentsasa list of new packagesis createdfor yourLockboxandcomparedto whatis installedonyoursystem.Whentheoperationiscompletedyou will bepresentedwith ascreensimiliar to theonein Figure5.1a.

Hereyou will noticea list of packagesthathave beenupdatedfrom what is cur-rently installedon the system. If no packageshave beenupdatedthe pagewillreturnno new packages.You arepresentedwith thenameanddescriptionof thepackages,thepriority of thepackage,if oncethepackageis installedit requiresthe Lockbox to be rebooted,andfinally a checkboxto selectwhetheror not todownloadthepackage.

Onceyouhaveselectedwhatpackagesto downloadby checkingthecorrespsond-ing box, you canhit the DownloadPackagesbutton. After a few momentsthepackagesyouselectedwill downloadandinstallonyoursystem.Youwill thenbepresentedwith a screensimilar to theon in Figure 5.1b:

Youwill havealist of thepackagesthatweresuccessfullyinstalledandwheretheywereinstalledfrom. Yousystemhasnow beenupdatedwith theselectedpackages.Youcanclick theDonebuttonat this point to returnto theGD WebTool.

Section5.1 RunningtheGD Update

Figure9: 5.1a- GD UpdateExample

Figure10: 5.1b- GD UpdateDownloadExample


6 L OCK BOX CONNECTI VI TY

So far the only way we spoke of to connectto your Lockbox was via the GDWebTool utility. To gain remoteaccessyou have anothersecurealternative. WeprovideSSHconnectivity to yourLockbox.

Sincetelnet is extremelyinsecure,it is not providedon your secureLockbox.SSHuses1024bit encryptionto protectyourconnection.

SecureShell(SSH)is aprogramfor logginginto aremotemachine,aswell asforexecutingcommandsona remotemachine.It is intendedto replacerlogin andrsh , andprovidesecureencryptedcommunicationsbetweentwo untrustedhostsoveraninsecurenetwork.

SSHconnectsandlogs into thespecifiedhostname.Theusermustprove his/heridentityto theremotemachineusingoneof severalmethodsdependingonthepro-tocol versionused.For moreinformationon SSHpleasevisit www.openssh.com, theOpenSSHProjecthomepage.

Section6.1 Connectingfrom Windows9x/ME/NT/2000

6.1 Connecting, fr om Windows9x/ME/NT/2000

Windows-basedsystemsonly includetelnet capability. Therefore,wehave in-cludeda utility to make a secureconnectionto your Lockbox from a Windowshost.MindTermis a secureSSHclient includedon your EnGardeCD-ROM thatwasshippedwith yourLockbox. It canbefoundin thex:\dosutils\mindterm directory. Replacethe ”x”, in the previous state-mentwith thedrive letterof your CD-ROM drive. Installationinstructionsareinthenext section.

MindTermprovidesyou theability to make anSSHconnectionto yourLockbox.You will be on a secure,1024 bit encryptedconnection. MindTerm performsX-Term emulation. You also have SCPcapabilitieswhich allows you to copyfiles securelyover anSSHconnection.SCPwill befully explainedin theMenussection.

6.1.1 Installing MindTerm

We have includedan installer for Windows basedsystemsto use. You canfindtheinstallerin x:/dosutils/mindterm/setup.exe . You cantypein thecommandby clicking theStartbutton,thenselectingRun. You canalsoclick onMy Computer, selectyou CD-ROM drive, thenthe dosutilsfolder, followed bythemindtermfolder andfinally selectingthesetup.exe file. This will starttheMindTerminstaller.

Oncethe installerstarts,you will have a few options. You will have to choosethe directoryyou wish to install MindTerm into. The default is c:\ProgramFiles\mindterm . We suggestleaving the default. You can thenselecttheinstallerto createan icon on your desktopfor MindTermand/oran icon in yourStartMenu.Thesearebothturnedonby default.

Onceyou have madeyour selection,selectInstall, which will confirm your se-lections. If you are satisfiedwith your settingsselectOk and MindTerm willstart installing. You will seeall the MindTerm files scrolling in the window asthey areinstalled. Whenthe installationis donea messagebox will appearsay-ing: “MindTerm installation successful!”. You canclosethis box andnow useMindTerm. If you selectedthe option to install the icon on your desktopyouwill seeit there.If you alsohadthe installercreatetheStartMenuicon you willfind Start Menu->Programs->MindTerm->MindTerm andReadme. The readmeis detailedinformationaboutMindTermandhow to useit. We will becoveringageneralusageof MindTermin thenext section.


LOCKBOX CONNECTIVITY Chapter6

NOTE: MindTermis distributedfree.Thereareotherprogramsfor WindowssuchasTeraTermandSecure-CRT thatwill alsowork with your Lockbox.

6.1.2 Running MindTerm

MindTermusesapublic/privatekey cryptography systemto connectto yourLock-box. A publickey is akey theuseris assignedthatcanbegivenout to anyone.Atthesametime they arealsogivena privatekey thatno onecanhave. Thepublickey is thencheckedagainsttheprivatekey for authenticity. In thecaseof aLock-box they privatekey is storedon the Lockbox andMindTerm passesthe publickey to theLockboxfor authenticity.

You canstartup MindTerm by eitherdoubleclicking on the MindTerm desktopiconorchoosingit fromtheStartMenu,Start->Programs->Mindterm->Mindterm.After a few momentsyou will bedisplayedwith theMindTermscreen.

WhenyoustartedupMindTermyoumayhavenoticedaMS-DOSPromptwindowappearandit maybelocatedbehindyourMindTermwindow. Youmayminimizethis window but do not closeit. The MS-DOSPromptwindow will closewhenyoushutdown MindTerm.

122 UserGuide


At this point you will needto setup MindTermsothatit knows whereto connectto, who you areandwhat key to use. First you must have a valid useron thesystemyou aretrying to connectto. If you do not have a user, areuncertainoftheusernameor forgotyourpasswordthencontactyoursystemadministrator. Toview and/ormodify any of theinformationmentionedpleasereferto Section4.4.1UserAccountAdministration onpage70.

You are also requiredto have a key for the system. The key provides the en-crypted information MindTerm requiresincluding your password, to authorizeyou to connectto theremotehost.Whenyour accountwascreatedby thesystemadministrator, a key shouldhave beengiven to you. If you do not have this keypleasecontactyour systemadministrator. To generatea new key refer to Section4.4.4Secure ShellManagementonpage79.

To enterthis informationinto MindTermselectSetting->SSHConnection...

Thiswill popupawindow labeled“MindTerm- New Server”. Hereyouwill needto enterin theinformationmentionedabove. Eachfield will bedescribedbelow.



Server In this field you will needto enterin eithertheIP addressor thenameofthe server you aretrying to connectto. In our exampleabove we want toconnectto lockbox.guardiandigital.com . Solockbox.guardiandigital.com wasenteredin to theserverfield.

Port This field shouldbe presetto port 22, the default SSHport. We suggestleaving this asis.

Username Hereyou will needto enterin the usernameyour systemadminis-trator hasgiven you for the server. In our examplewe aretrying to loginasuseradmin. This usernamewill automaticallybepassedto MindTerm.So you will only needto supplya password whenyou login. adminwasenteredin to thefield.

Cipher In this field you will have a pull-down menugiving you a selectionofdifferent cipher methods. A cipher is a methodof encryptingplain textinformationinto encryptedinformation. Thereareseveral differentmeth-ods. By default the Lockbox is setto use3DES. Checkwith your systemadministratorto seeif they have changedthecipher.

Authentication Hereyou will needto selectyour authenticationtype. The au-thenticationtype is themethodthatwill beusedto authenticateyou whenyou log in. By default RSAis used. RSAusesa public and private keyscheme.Whenyouraccountwascreated,youshouldhavebeengivenakeyto beusedwith theserver. Formsof authenticationotherthanRSA arenotsupportedon theGuardianDigital Linux Lockbox.

Identity Hereiswhereyouwill enterin thepathtoyourkey. By defaultMindTermwill searchin c:\Windows\Java\mindterm for keys. It wouldbeap-

124 UserGuide


propriateto placeyourkey in this directorywhenit is givento youby yoursystemadministrator. You canusethe“...” buttonto browsethroughotherdirectoriesonyour localmachine.A key will generallyendwith .key.

Onceall the informationhasbeenfilled in you, canselecttheOK buttonto con-tinue.Youwill bebroughtbackto thescreenyoubeganon.

Onceyou click the OK button MindTerm will attemptto make a connection.Ifyou have never connectedto the server beforeyou will be asked if you want toaddthehostto yourhostkey list. AnswerYesto this question.

Oncethe dialog box is removed, if the connectionwas successfulyou will bepromptedfor yourpassword.



If you do not have the above screenthenyou most likely received an error. Acoupleof commonerrorsare:

Unknown Host: You will receive this error if thenameor IP addressof thehostwasnot found or is not responding.Checkwhat you enteredin the SSHOptionsscreenabove.

Server refusedour key You will receive this error if thekey you areusingdoesnot correspondto the key on the server. This canbe causedif the key onthe server haschanged,you arepointing MindTerm to the wrong key, oryour key is invalid. Doublecheckyour settingsin theSSHOptions. If youarecertainyou arepassingthecorrectkey, thena new key mayhave to begenerated.Contactyoursystemadministratorif this is thecase.

At thepasswordpromptdisplayedabove,enterin yourpasswordthatwasassignedto youby yoursystemadministrator. If youenteredin thepasswordcorrectlyyouwill now beloggedinto thesystem.

126 UserGuide


At this point youarereadyto interactwith thesystem.

Now would probablybea goodtime to save your settings.Saving your settingsallowsMindTermto storetheinformationyouenteredinto theSSHConnection...dialogsoyou don’t have to re-enterthedatain every time.



To save yoursettingsselectFile->SaveSettings.

Toexit thesystemtypeexit. Youwill bebroughtbackto theSSH Server/Alias:prompt.At thispointyoucanshutdown MindTermby clicking the’X’ in thecor-neror from themenu,File->Exit.

It is highly recommendedthatyou log out of theserver usingtheExit commandbeforeshuttingdown MindTermsoyouareproperlyloggedout.

6.1.3 Secure Copy (SCP)

TheSecureCopy (SCP)is a methodof copying files over a securedSSHconnec-tion. MindTermsupportsSCP.

To copy files to andfrom theserver via SCPyou will first needto beloggedintothesystem.Readthesectionabove on loggingin with MindTerm. You will thenhave theability to SCPby selectingFile->SCPFile Transfer....

128 UserGuide


SelectingtheSCPFile Transfer... optionwill bringyou to thefollowing screen:

Hereyou canselectfiles anddirectoriesto copy to andfrom. Wildcardsarealsoacceptedhere.

You have a few optionson this screen.TheChange Directionbuttonwill change



whetheryou arecopying files form your local machineto theserver, or copyingfiles from the server to your local machine.Clicking on the button will reversethis eachtime.

You will alsonoticethereis a check-boxfor Recursivecopy. This will allow youto enterin a directoryin thefield you arecopying from andit will automaticallycopy everythingin thatdirectoryandevery directorybelow it.

Finally you have onelastoption,Low priority. Selectingthis will allow theSCPfile transferto take placein thebackgroundsoyou canwork while it’s copying.It will take longer to copy files using this methodbut it will also free systemresourcesandbandwidth.

Whenyou are readyto start copying files you canclick the Start Copybutton.MindTermwill thenmake anSCPconnectionto theserver andstartcopying thefiles. Youwill seethefollowing dialogappeargiving youthecurrentstatusonthefile transfer.

Oncethe copy is finishedyou canclick the Donebutton to closethe dialog. Ifyou don’t needto transferany morefiles at themomentyou canclick theCloseDialog buttonin theSCPFile Transferdialogto closeit.

Youarenow donecopying yourfiles andnow maywork with them.

130 UserGuide


6.1.4 M.

ENUS

The easiestway to learnhow MindTerm works andwhat featuresit providesisto look throughthis brief walk-throughof all menusin MindTerm. Givenwithinparenthesesis thekeyboardshort-cutfor eachmenuitem whereoneexists.

File Menu

NewTerminal (Ctrl+Shift+N) This will createa new MindTerm window withthesamesettingsasthefirst MindTermwindow of this session,i.e. all pa-rameters(command-lineor applet)givento MindTermat startupwill haveeffect in eachnew terminalcreated.

CloneTerminal (Ctrl+Shift+O) This will createa new MindTermwindow withthe exact samesettingsas the window it is createdfrom. If the windowcontainsaconnectedsession,thenew window will beautomaticallyloggedin to thesameSSH-server(usingthesameauthenticationaswasusedin theoriginalwindow). Notethatthenew window will nothaveany opentunnelssincethewindow from whereit is createdhave thetunnelsopenedalready(preventingthenew window from openingthem).

Connect... (Ctrl+Shift+C) This launchesthe Connectdialog. From this dialogyoumayeitherselectto connectto ahostwhosesettingsyouhavesavedoryou maycreatesettingsfor a new host.NotewhenselectingNew Server anew dialog is shown which is identical to the onedescribedin 4.3.1SSHConnection....

Disconnect (Ctrl+Shift+D) This forcesthe currentsessionto be disconnected.Note that this will causeall tunnelsto be closedandthe shell to be aban-donedwithout loggingout. Thepreferredway to disconnectis to logoutintheshell.

Load Settings... Loadssettingsfrom a file (extension.MTP) without connectingto theserver.

SaveSettings (Ctrl+Shift+S) Savescurrentsettings.

SaveSettingsAs... Createsa new settingsfile and saves currentsettingsto it.Useful for creatinga shortnamefor a server, or for having morethanonesetof settingsfor aspecificserver.



CreateRSA/

Identity... Createsan RSA identity to be usedwith authenticationtype rsa or rhostsrsa. Two files are created,one containingthe privatekey (default nameidentity’) and one containingonly the public key (de-fault nameidentity.pub’). The contentsin the file with the extension.pubmustbecopiedto thefile authorized_keyson theserver (typically foundin~/.ssh/ ). TheseRSA key-files are identical to the onesusedwith theUnix versionof SSH.

SCPFile Transfer... In thisdialogyoucanchoosefilesand/ordirectoriesto trans-fer to or from the SSH-server. Local file(s)/dir(s)is a space-separatedlistof files and/ordirectories(if a namecontainsa spaceencloseit in quoteslike: a file with spaces). Normal regexp’s can’t beusedfor local files/dirs,however namescanbe givenwith ONE wild-card (’* ’) in it (e.g. *.fooor foo*bar ). If absolutepath-namesarenotgiventhecurrentdirectoryisassumed(defaultsto MindTerm’shome-directory).If thefirst file/directorygivencontainsanabsolutepath-namethisdirectoryisusedascurrent-directoryfor therestof thelist (e.g. thelist /tmp/foo* *.bar will expandto allfiles startingwith FOO or endingwith .BAR in the directory /tmp ’). Re-motefiles(s)/dir(s)aregivenEXACTLY asthey wouldbewith thestandardUnix scp-client(i.e. regexps canbe used). The directoryassumedon theremotesideis theuser’shome-directory(i.e. just likewith thestandardunixscp-client).To changedirectionof thecopy-operationpresstheChange Directionbut-ton (the direction is indicatedwith the strings(source)and (destination)aftertherespective side.If directoriesareto betraversedenableRecursivecopy. To make thecopy-operationuseaslittle bandwidth/CPUaspossiblesetit to beLow priority.PressStartCopyto startthecopy operation.This will launcha smallwin-dow with progressandstatisticsof the copy operation.A copy-operationcanbecanceledatany timeby pressingtheCancelbuttonin this window.

CaptureTo File... Capturesterminal-outputto afile. Capturestartsimmediatelywhenthe file hasbeenselectedandendswhenthis menuitem is selectedagain. Notethatwhile capturingis active this is indicatedby themenuitembeingselected.

SendASCII File... Thiswill sendthecontentsof theselectedfile to theterminalas input (i.e. would be the sameas if the contentswere typed from thekeyboard)

Close (Ctrl+Shift+E) Closesthis window. Note that when closing a windowwithout logging out you areabortingthe SSH-connectionabnormally, i.e.

132 UserGuide


it is advisableto logoutin theshellbeforeclosing/exiting MindTerm.

Exit (Ctrl+Shift+X) Closesall windows andexits MindTerm. Note that whenclosingwindows without loggingout you areabortingtheSSH-connectionabnormally, i.e. it is advisableto logout in theshellbeforeclosing/exitingMindTerm.

Edit Note, the systemclip-boardis not available to appletsby default. In thiscasea local (to MindTerm)clip-boardis used.Also notethat in someim-plementationsof the Java runtime the clip-boarddoesnot work with thesystemclip-board.

Copy (Ctrl+Ins) Copiesselectedtext to clipboard.Selectionis doneby clickingandholdingdown left mouse-buttonwhile draggingthemouseovertheareato select.

Paste (Shift+Ins) Pastesthecontentsof theclipboardto theterminalasinput (i.e.wouldbethesameasif typedfrom keyboard)Copy & PasteDoesa copy followedby apaste.

SelectAll (Ctrl+Shift+A) Selectsall contentin scroll-backbufferandin terminal.Note,this operationis very time-consumingright now.

Find... (Ctrl+Shift+F ) Shows Find dialogfrom which thescroll-backbuffer andterminalcontentscanbesearchedfor words. Thesearchcanbedonecasesensitive or caseinsensitive. Eachword found is highlighted. The bell issoundedwhenno morematchesis found.

Clear Screen Clearsscreenandsetscursorpositionto upperleft corner.

Clear Scrollback Clearscontentsof scroll-backbuffer.

VT Reset Resetsterminal-settingstodefault(e.g.clearsline-draw graphicsmodewhichmightbemistakenly setby displayingabinaryfile).

Settings

SSHConnection... (Ctrl+Shift+H ) In this dialog you cansetall SSHparame-ters.To view all optionsclick thebuttonMore options.... Whenconnectedyou cansettheparametersfor thecurrentsession.Notethatsomechangeswont take effect until the next time you connectto this server. Whennotconnecteda new sessionis createdif oneis not foundwith thenameof theserver. In this caseit is thesamedialog that is shown whenselectingNew



Server... from theConnectiondialog.

Theparameterssetin this dialogare(namesasgivenin paragraph5.):

server Name (ip-address) of SSH-server port

Port which SSH-server listens on username

User name to login as on SSH-server

cipher Name of block-cipher to use, or if none isselected no encryption (note, no encryption isnormally not supported by the SSH-server)

authtyp Method of authentication, or if custom... isselected a comma- separated list of methods totry in order given

x11fwd Selects whether to allow X11-connections to beforwarded or not

display The local X11 display to forward X11 connections to

mtu Maximum packet size to use alive Keep

alive interval in seconds to use

portftp Enables port-commands to be used withFTP-tunnels, don’t enable this if you are notsure what you are doing

realsrv Real ip-address of SSH server if it is behindaddress translation (used when portftp is enabled)

localhst Address to listen on for local tunnels

idhost Sets whether to verify identity of theSSH-server using its host-key through matchingwith saved value in the file known_hosts

forcpty Force allocation of PTY, e.g. necessary toenable when executing a single command on theSSH-serverthat requires a non-dumb terminal

prvport Used to force the local outgoing portof the connection to the SSH-server to usea so called privileged port (i.e. < 1024)

134 UserGuide


remfwd Enables hosts other than the one runningMindTerm to connect through SSH-tunnels

Terminal... (Ctrl+Shift+T) In this dialogyou cansetthebasicterminalparame-ters,suchasterminaltype,size,fontandcolors.Theinitial window positioncanoptionallyalsobeset. It is givenasa stringwith thesyntax<+/-><x-position><+/-><y-position>a negative signmeansit’s relative to the rightor bottom.A valueof zeromeansalignedto theborder(i.e. left, right, top,bottom)e.g.+0-0meansalignedto bottomright corner.


te Terminal type

gm Terminal geometry, number of lines,columns and optionally initial position

fg Foreground color, name or when custom rgbis selected an rgb-value

bg Foreground color, name or when custom rgbis selected an rgb-value

cc Cursor color, name or when custom rgb isselected an rgb-value

Terminal Misc... (Ctrl+Shift+M ) This dialog containssomeextra settingsfortheterminal.


sl Number of lines to save in scroll-back buffer

sb Position of scrollbar, or disable scrollbar

sd String containing delimiter characters thatare used when click-selecting words, i.e.which characters functions as word-delimiters

bs Indicates whether backspace or delete shouldbe sent when backspace-key is pressed



de Indicates whether backspace or delete should

be sent when delete-key is pressed

Local Command-Shell Startsthelocalcommand-shellfrom whichonecanviewand set all parametersof MindTerm. The command-shellis really onlyusefulif you don’t have menus(e.g. whenrunningwithout a GUI) but forcompletenessit is availablehere.Note,thecommand-shellis only availableif enabledwith command-lineoption–cor applet-parametercmdsh.

Auto SaveSettings Enables/disablesautomaticsaving of settings,whendisabledyou mustexplicitly save settingsto file whenneeded.Whenenabledset-tings aresaved whenever you disconnectfrom a server or whenyou exitMindTerm.Notethatwhenbothauto-save andauto-loadis enabled(whichis default), settings-filesarecreatedautomaticallyandtheusernever haveto worry aboutsaving/loadingthem.

Auto Load Settings Enables/disablesautomaticloadingof settings.Whendis-abledyou mustexplicitly loadsettingsfrom file if you needto. Whenen-abled,MindTerm tries to load a settings-filewith the samenameaswhatyougiveattheSSHServer: promptor in the(Settings-> SSHConnection...)dialog. Thesefiles arelocatedin theMindTermhome-directory. Thustheserver you give at thepromptdoesnot necessarilyhave to be thenameofthe server, it is mainly the nameof the settings-fileto load. Normally theuserdoesnothave to worry aboutthesettings-filessinceit is handledauto-matically. Thoughto createshort-namesfor serversandto createmultiplesettings-filesfor a singleserver youhave to explicitly createsettings-files.

Curr ent Connections...Thisdialoglists thecurrentlyopenconnectionsthroughthetunnelsyouhavesetup. Notethatit doesn’t list thetunnelsthemselves,only active connectionsthroughthem. You canclosea tunnelby selectingit andclicking close.

136 UserGuide

Section6.2 Connectingfrom Unix

6.2 Connecting, fr om Unix

The first thing you will needto connectto your Lockbox is an SSHclient. ForUnix thereis OpenSSH.YoucandownloadOpenSSHfromhttp://www.guardiandigital.com/tools . Youwill alsofindOpenSSL,asyouwill needthis too. If youwish to downloadOpenSSLyoucanfind it athttp://www.guardiandigital.com/tools . A versionof OpenSSLandOpenSSHareincludedon theEnGardeCD-ROM.

If youareusingWindows,usetheincludedMindBright MindTermsoftware.Youcanfind it on theEnGardeCD-ROM underthedosutilsdirectory. Instructionsoninstallationandusagecanbefoundin theprevioussection.

6.2.1 UsingOpenSSH

Thefirst thingyouwill haveto dois createauser. Thisis eitherdoneby logginginasrootat theconsoleandrunningadduseror addingauserfrom theGD WebToolutility.

If you usetheGD WebTool utility to createtheuserreadSection4.4.1UserAc-countAdministration onpage70onhow to accomplishthis.

If youdecideto createtheuserfrom theconsoleusethefollowing steps:

As the root user run adduserby typing adduserat the prompt. adduserwillpromptyou for ausername.Entertheusernameyouwish to give this user.

Oncethis is doneyouwill bebackat theprompt.Younow needto givethisuserapasswordfor themto useto accesstheiraccount.Typepasswdusername. In placeof usernamewill betheusernameyouassignedto theuser. Thiswill promptyoufor a passwordandthenpromptyouagain for thepassword to confirmit.

Oncethatis doneinstallOpenSSLandOpenSSHonyourclientmachine.

NOTE: You mustberootduringtheinstallationof OpenSSLandOpenSSH.

OndistributionsusingRPM:

$ rpm -Uhv openssl-0.9.4_i386.rpm$ rpm -Uhv openssh-1.2.3_i386.rpm

In Debian(or any distribution usingDPKG):



$ dpkg -i openssl-0.9.4.dpkg$ dpkg -i openssh-1.2.3.dpkg

And from tar files:

$ tar zxvf openssl-0.9.4.tgz$ tar zxvf openssh-1.2.3.tgz$ cd openssl-0.9.4$ ./configure$ make$ make install$ cd ../openssh-1.2.3$ ./configure$ make$ make install

You now mustcreatea key for yourself. You cancreatea key with OpenSSHbytyping:

$ ssh-keygenGenerating RSA keys: ......ooooooO.................oo ooooOKey generation complete.Enter file in which to save the key (/home/nick/.ssh/identity):Enter passphrase (empty for no passphrase):Enter same passphrase again:

It will promptyoufor afilenameto savethekey in. Thedefault identity.pubwill be fine. It will thenpromptyou for a new passphrase.After enteringyourpassphrasetwice,yourpublic key will thenbegenerated.

Onceyouhaveyourkey e-mailit to yoursystemadministratorandthey will insertit in to the systemproperly. ReadSection4.4.4 Secure Shell Managementonpage79 for moreinformation. Oncethis hasbeencompletedyou will beabletosuccessfullySSHin to thesystem.

For moreinformationonSSHandusingSSHpleasereadtheSSHFAQ whichcanbefoundat:

http://www.linuxsecurity.com/docs

138 UserGuide

7 SE0

CURE E-M AI L

The Linux Lockbox provides two methodsof retreiving your e-mail remotely,secureIMAP andsecurePOP3.Both protocolshave beensecuredusingSSLandbothrequireclientsthatsupportSSLsecuredIMAP andsecuredPOP3.

SecuringIMAP andPOP3greatlyincreasesthesecurityandprivacy of personale-mail. For this reasonIMAP andPOP3areonly availablein a secureform andthereforethestandard,insecureform of IMAP andPOP3arenot availableon theLockbox.

Usingasecureform of theseprotocolsrequiresaclient thatcansupportthem.Wewill discusshow to configurebothNetscapeMail for secureIMAP andMicrosoftOutlookfor secureIMAP andsecurePOP3.

SECURE E-MAIL Chapter7

7.1 Configuring, NetscapeMail for Secure IMAP

TheNetscapeCommunicatorpackageincludesNetscapeMail. NetscapeMail iscapableof bothIMAP andPOP3but only supportsIMAP in securemode.Belowis asetof instructionsfor configuringyourNetscapeMail for secureIMAP.

NOTE: You mustallow usersto accesstheir mail from their machineby addingintheir IP addressin theSystemAccessControl Section4.6.4on page109.

To accesstheNetscapeMail you will first needto startNetscape.OnceNetscapeis loadedyou canlaunchtheMail by eitherselectingCommunicator->Messagesor by clicking themail icon in thelowercornerof thebrowserwindow.

At this point the NetscapeMail window will appear. Now pull-down the EditmenuandselectPreferencesfrom there.

After selectingPreferencesthePreferenceswindow will bedisplayed.Fromhereyouwill wantto expandtheMail & Newsgroupssectionby click on the’+’ foundin thebox. Youwill thenhaveanew groupof options.Wewill startby configuringour username,e-mailaddress,etc. Click the Identityoption from themenutreeon theleft.

140 UserGuide

Section7.1 ConfiguringNetscapeMail for SecureIMAP

Oncethewindow appearsfill in theappropriateinformation.Whenyou aredoneenteringeverythingselectMail Servers from themenutreeon the left. This willbringup theoptionsfor your incomingandoutgoinge-mailservers.



We will start be creatinga new server for the incoming mail. First deletethedefault serverNetscapeincludesby clicking on it andselectingtheDeletebutton.Thenclick theAddbutton.

142 UserGuide


Youwill1 bepresentedwith thefollowing dialog:

In the ServerNamefield you will needto enterin the nameof the mail servergivento youby yoursystemadministrator. In theexampleaboveweusedlock-box.guardiandigital.com .

Next weneedto selecttheServerType. NetscapeMail only supportssecureIMAPsoselectIMAP Serverhere.

Finally in theUserNamefield entertheusernameyou wereassignedto by yoursystemadministrator.

Next click the IMAP tab at the top of the dialog. You will be presentedwith anumberof IMAP options.



Here you will want to make sureall the checkboxes are turnedoff except fortheUsersecureconnection(SSL)option. Your screenshouldmatchthenumberabove.

144 UserGuide


After closingthe Mail ServerProperiesdialog you will seeyour mail server inthe window labled IncomingMail Servers. Finally you will have to enterin theservernamefor youroutgoinge-mail.Enterin theoutgoingservernamegiventoyou by your systemadministratorin theOutgoingmail (SMTP)serverfield andenteryourusernamein theOutgoingmail serverusernamefield.

Onceyou have completedenteringin the informationclick the OK button. ThePreferencesdialogwill closeandyouwill seetheservernameappearin yourmaillisting, whereyou Inbox is located.



You arenow readyto receive mail from the Lockbox with NetscapeMail usingsecureIMAP.

NOTE: You mustallow usersto accesstheir mail from their machineby addingintheir IP addressin theSystemAccessControl Section4.6.4on page 109.

146 UserGuide

Section7.2 ConfiguringOutlookfor SecureIMAP andPOP3

7.2 Configuring, Outlook for Secure IMAP and POP3

Microsoft Outlook 2000is capableof both IMAP andPOP3andsupportsbothprotocolsin securemode.Below is a setof instructionsfor configuringOutlook2000for secureIMAP andPOP3.

NOTE: Outlook2000is required.Previousversionof Outlookdo not supportthesefeaturesandwill notwork.

NOTE: You mustallow usersto accesstheir mail from their machineby addingintheir IP addressin theSystemAccessControl Section4.6.4on page 109.

Begin by startingupOutlook.OnceOutlookis loadedyoucancreateanew e-mailprofileby selectingtheToolsmenuandfrom thereselectOptions.

NOTE: If this is thefirst time you areusingOutlookit will automaticallystartin theInternetConnectionWizardsectionto createane-mailprofile. If this is thecaseskip down in this sectionto the InternetConnectionWizard andstartfrom there.

At this point you will bepresentedwith theOptionsscreen.FromhereselecttheMail Deliverytabandclick theAccountsbuttonfrom within there.



You will now seethe InternetAccountsdialog. Our objective is to createa newe-mailprofilefirst with basicinformation.Thenedit theprofileto allow for securePOP3or IMAP. Soherewe wantto addtheprofile,soclick theAddbutton.

148 UserGuide


You will now be promptedwith a small “pull-down” type menu. You have twooptionsin hereMail andDirectoryService. Sincewe arecreatinga new e-mailprofileselecttheMail option.

Now you will seethe InternetConnectionWizard start.The InternetConnectionWizard will go througha step-by-stepprocessto createthebasicaccount.Oncethebasicaccountis createdwewill haveto edittheaccounttoacceptsecuree-mailtransfers.

Thefirst stepin theInternetConnectionWizard is to enteryour full name.This isthenamethatwill beautomaticallydisplayedwhensomeonereceivese-mailfromyou.

Onceyouhave enteredyournamein click theNext buttonto continue.



Now you will be promptedfor your e-mail address.This hasmost likely beenassignedto youby yoursystemadministrator.

Onceyouhave enteredin youre-mailaddressclick theNext buttonto continue.

150 UserGuide


You will now bepresentedwith a few options.You first have thechoiceof usingPOP3or IMAP for your connection.Selectthis accordingto what your systemadministratorrecommendsyouuse.For theremainderof thisexamplewewill beusingPOP3.

You now have to enterthe mail server you will be contacting. In our examplebelow our incoming mail server is the sameas our outgoingserver. In manysituationssmtp.servername.com andmail.servername.com areusedfor outgoingandincomingmail servers.

Onceyouhave enteredin thepropermail server addressesandselectedthePOP3or IMAP protocolclick theNext buttonto continue.



Now you will needto enter in someaccountinformation. First enter in youraccountusernameassignedto you by your systemadministratorfollowedby thepassword. YoucanselecttheRememberpassword optionif youwish for Outlookto rememberthepassword for futuresessions.

You will alsonoticea checkboxfor Secure Password Authentication(SPA). Thisfeatureisn’t usedwith theLockboxsoleave it unchecked.

Onceyou have correctly enteredin all the requiredinformation click the Nextbuttonto continue.

152 UserGuide


Now you will needto selectwhich methodyou useto connectto the Internet.Selecttheappropriateoptionandthenclick theNext buttonto continue.



Youwill now seeaconfirmationscreeninformingyoutheprofilehasbeencreated.Click theFinishbuttonto continue.

154 UserGuide


Youwill now bereturnedto theInternetAccountsdialogandwill noticetheprofileyou createdlisted in thewindow in theMail tab. At this point we have to setuptheprofile to work with asecureserver. SelectthePropertiesbuttonon theright.



Hereyouwill seeyouhavefour tags,General, Servers, ConnectionandAdvanced.SelecttheAdvancedtagto continue.

156 UserGuide


You will now seea numberof optionsin this screen.We areonly concernedwiththe optionsdisplayedbelow the ServerPort Numbers section. You will want toselectthebox below Incomingmail (POP3), this will say(IMAP) if you selectedIMAP asyour server. Onceyou click thebox you will see995appearin thetextfield, or 993 if you selectedIMAP insteadof POP3earlier. At this point you canclick theOK buttonto finish.



YourOutlookmail client is now configuredto receivesecuree-mailvia POP3andIMAP.

NOTE: You mustallow usersto accesstheir mail from their machineby addingintheir IP addressin theSystemAccessControl Section4.6.4on page109.

158 UserGuide

8 AL L COM M ERCE

AllCommerceisascalableInternetapplicationwhichprovidesatotale-commercesolution,includingcontent,customerandinventorymanagement.It is written inPerlandlicensedundertheGnuGeneralPublicLicense(GPL).

The purposeof this documentis to provide AllCommerceadministratorswithinformationneededto install,administerandcustomizethesystem.

ALLCOMMERCE Chapter8

8.1 Intr2 oduction to AllCommerce

8.1.1 Overview

AllCommerce’s sophisticateddatabasesystemgivestheadministratorgreatflexi-bility, power andspeed.Webcontentis deliveredto theconsumerfrom informa-tion boundatruntime. TheWebis literally spunoutof customersresponses.Thissamelate bindingallows administratorscustomizationcapabilitiesbeyond thosehithertoavailablein systemsof this type.

Object-orientedprogrammerswill be comfortablewith the classsystemwithinAllCommerce.Althoughnot assophisticatedasmostdedicatedOOPplatforms,Perlprovidesapowerful systemimplementedwithin asurprisinglysimpleframe-work.

For AllCommerce,eachobjectmayhave anarbitrarynumberof attributes(vari-ants). This removesall linear restrictionsand facilitatesthe implementationofcomplex Webtopologies.It alsoprovidesextensibility andenablescomplex hostapplicationsto berunwithin theexisting framework.

Onesuchapplicationis AllCommerce’s sophisticatedsearchenginetechnologywhich combinesAI-lik e featureswith a built-in thesaurusto optimally associateevenobscurenaturallanguageentriesto thecorrecttargets.As anAllCommerceinstallationmatures,the searchengineimprovesits performanceby addingnewsynonymsandtheirassociatedpathsto thethesaurus.

Theclasssystem,aptly calledlineage,is necessarilya crudeone,with no inheri-tancecapabilities.Theclasssystem’s bestfeaturesaren’t familial. Thekey to itspower originatesfrom how theclasssystemhandlesthesystemstateasstoredinthedatatables.

With AllCommerce,thereis a cleanseparationbetweenthesystemstate,andtheeventswhich changethe systemstate. The stateremainsstatic while receivedeventsmerely add to the accumulatedhistory of the system. At any time thesystem’s currentstatecan be expressedas its static stateplus the effect of allaccumulatedevents.By virtue of theclasssystem,theunionof all eventclassesprovidesamapof all allowablestatetransitions–allothersareforbidden.

For moredocumentationon ZelerateAllCommercepackagepleaserefer to theirWebsitewhichcanbefoundathttp://www.zelerate.org .

160 UserGuide

Section8.2 Tutorial for CreatingaNew Store

8.2 T3 utorial for Creatinga NewStore

This tutorialwill coverstep-by-stepwhatneedsto bedoneto createa fully work-ing store.It is highly suggestedthatyoureadabouttheGuardianDigital WebToolin Section4 on page34 sincetheWebTool is whatwill beusedto completethisprocess.

For this tutorial we will becreatingtheGuardianDigital On-LineStorewith thefollowing parameters:

4 store.guardiandigital.comwill betheURL for thestore

4 thestorewill beusingtheCyberCashCashRegisterto make purchases

8.2.1 Part I - StoreCreation

Startby loggingin to theGD WebTool from your local machine.Instructionsonlogging in to the WebTool canbe found in Section4.1 ConnectingandLogginginto theGD WebTool onpage35.

Onceloggedin you will be broughtto the main screen.From this main screenselectVirtual HostManagement.

Virtual HostManagementcontainsall theutilities necessaryfor controllingvirtualhosts,SSLvirtual hosts,logsfor yourhostsandstoremanagement.

At the bottomof this menuyou will seeAllCommerce Management. From thismenuyouwantto selectCreatea New Store.

NOTE: If this menudoesnot appearthenyou maynot have AllCommerceinstalled.If you purchasedthe E-Commerceversionof the Lockbox and this menudoesnotappearpleasecontactGuardianDigital.



StoreCreation - Step1

You will now be at the first stepfor creatingan on-line store. You will seethefollowing menu:

Thefirst option thatneedsto becompletedis theFully-QualifiedDomainName(FQDN).Hereyou will enterin theFQDN. If you purchaseda domainnameyouwould enterthat in here. For the GuardianDigital On-Line Storewe areusingstore.guardiandigital.com .

You canusea new domainname,suchaswww.gdstore.com asyour storeifyou own thedomain.To buy domainyou will needto contacta domaincompanysuchasNetwork Solutions.Onceyou have purchaseda domainyou will needtosetup your DNS serversto point the IP addressof your store. If you areusinga certificateon this storeyou will needa separateIP addressfor it, unlessyou asharingthecertificatewith multiplesites.BeforeyoucansetuptheDNSproperlyyou will needto setup a NameVirtual Host. You will do this after creatingthestore,socontinuewith configuringthestore.

162 UserGuide


The next field asksyou for the storeidentifier. This is a namethat the Lockboxwill useto recognizeyourstore.Thisnamewill notappearonyoursiteanywhere.For ourexamplegdonline wasused.

NOTE: Only alphanumericcharacterscanbeenteredin here.

Administrator E-Mail Addressis thenext field. Hereyou canenterin theaddressof the administratorof this store. This would most likely be either you or theownerof [email protected] ouraddress.

Thenext two catagoriesarefor assigningfile permissionscorrectly. To give thestoreowner the ability to addimages,edit their templatesanddo basicmainte-nanceyou will have to give themaccessto their own files.



If thestoreownersnamedoesnot appearin thepull-down menuyou will have tocreatea new userandgroupfor thestoreowner. To do this readSection4.4.1onpage70.

In this first field selectthestoreownersname.Thestoreownerwill betheownerof all the files they needto edit. Thesefiles includetemplatesandimagesonly.Theremainingfiles areownedby therootuser.

After selectingthestoreowneryou will needto assigna groupto thestore.Thegroupgiven herewill have accessto edit imagesandtemplesandsomemainte-nancefiles. Thisis mostusefullif thestoreownerwill havehisown peopleeditingthestore.

Thisgroupwill only haveaccessto edit templatesandimagesandwill haveaccessto executetoolsandthestoresmaintenancefiles.

Onceyouhaveall this informationfilled in click theNext Stepbuttonto continue.


Youwill now seethefollowing menu:

164 UserGuide


The first option in this menuis the nameof the store. This field canacceptanycharacters.Thestorenamewill show up on thecustomerspagesandon thead-ministrative pages,thoughthis canbealteredin thetemplates.In this tutorial weusedGuardianDigital On-LineStore.

After enteringin thenameof thestoreenterthezip codewhereyou will beship-pingyourproductfrom. Thezip codeis usedto determineshippingcostsfor yourproducts. Sincethe Guardian Digital On-LineStore will be shippingproducts



from Upper SaddleRiver, NJ, wherewe are located,the ZIP code,07548,forUpperSaddleRiver, NJwasenteredin.

In this next field, Administrator Password you must selecta password that theadministratorof thestorewill use.You will bepromptedfor this password whenyou want to usethe backendto maintainyour store,addingandremoving prod-ucts,etc..Choosea password thatis impossibleto guessandcontainssymbolsaswell asalphanumericcharacters.Althoughthepassword is blankedout with ’* ’whenyou typeit in we usedgd%$store1 for ourpassword.

Hereyou areaskedto confirmyour password. Sinceyou areunableto view yourpassword whenyou type it in initially you areaskedagain for it. This is donetoavoid accidentaltypingerrors.

Now we have threee-mail addresssectionscomingup. The first is the e-mailaddressyou wish to usefor customerservice. You have the ability to make a

166 UserGuide


“phoney” e-mail addressthat will actuallybe pointing somewhereelse. For ourexamplewe [email protected] . Since thataddressisn’t linked to a real personwe have the e-mail beingfowardedto sev-eral otheraddressesso that multiple peoplecanget customerservicerelatede-mails.This is known ase-mailaliasing.In Section4.3.3on page42 you canreadmoreaboutaliasingandredirects.Also in Section4.4.5on page82 canbefoundinformationon configuringyour mail accountsto maintainthe e-mail addressesproperly.

After enteringthecustomerserviceaddressin you will needto enterin theordere-mailaddress.

And finally thee-mailaddressfor webrelatede-mail.



Now you have to selectif you wish to useCyberCashasyour paymentsoftware.CyberCashis fully supportedbut othersoftwarewill work aswell, but will notbeconfigurablevia the GD WebTool. For moreinformationon obtaininga Cyber-Cashaccount,settingupamerchantaccountwith yourbankandusingCyberCashrefereto Section8.3onpage180.For informationonconfiguringCyberCashwiththeGD WebTool refer to Section4.3.8on page64. For our examplewe chosetouseCyberCash.

Next youwill needto enterthestatein whichthestoreresides,notwhereproductswill be shippedfrom. This will help determinethe amountof tax to charge acustomer.

168 UserGuide


This is the5 amountof salestax thatyourstatecharges.Thetaxmustbeenteredinasaprecentage.In New Jersey thestatetax is 6%,so06.00 wasenteredin.

Sinceevery item in the store,useraccountandshippingis storedin a databasea databasepassword is requiredfor databaseaccess.We recommendfollowingtherulesspokenof earlierin this example.We usedstore%$db in theexamplebelow.

As above with theadminstratorpassword, verificationis required.Enterin yourpasswordagain to confirmthepassword.

Finally we have onelaste-mail addressthatneedsto besupplied.This is thee-mail addressfrom which replieswill be sent. Repliesaresentfor a numberof



reasonincluding to confirm an order, whenan orderhasbeencompleted,whenthereis a problemwith an order, etc. The addressfollows the samerules wespoke of earlierwith thethreepreviousaddresses.For our examplewe [email protected] .

Whenyou have finishedenteringin datafor the necessaryfield click the “NextPage” buttonto continue.

170 UserGuide



Thenext screenyouwill needto configureyoursecureconnectionusingSSL.SSLwill beusedwhenatransactionis madein yourstoreor whenauseris enteringinpersonalinformation.You have threeoptionsto choosefrom first.

You cancompletelydisableSSLif you like. We recommendyou DON’T do this.This will allow anyoneto scanincomingandoutgoingdataduringa transaction.If youwon’t behandlingtransactionsthenyoumaywantto turn thisoff. Youcanfind moreinformationaboutSSLandhow it workswith yourstoreonpage66.



Your secondoption is to uploada certificateandkey. This is usefulif you havereceiveda certificatesignedandwish to useit with your store.If you don’t haveacertificateyouwill wantto do thenext step.

This givesyou theoptionto createanunsignedcertifcate.To geta signedcertifi-cateyouwill needto generateaCSRandsubmitit to a CA. Directionsonhow todo this canbefoundon page66. You maywant to do this in themeantimeuntilyou geta signedone.Theadvantageof having a signedcertificateis it provesthestorevalidity to thecustomerensuringthemof a securemoney transactionwhenthey make their purchases.

If you have a signedcertificateandkey andyou wish to uploadthemthenfollowthesenext few steps.If not skippastthemto generateanew certificateandkey.

This is askingyou for the locationof your SSL certificate. This is the locationon your local machine,not on theserver. You cantype in the locationor usetheBrowse... buttonto locateit. In ourexamplewe useda Windows machineto saveourcertificateonandwesavedit on theWindowsdesktop.

172 UserGuide


Onceyou have selectedyour SSLCertificatefile you will needto supplythecor-respondingkey. If you uploadthewrongkey your certificatewill not work. Thiswill preventtheWebserver from starting.

Onceyouhaveenteredin yourSSLKey youcanclick thePreview Storebuttontocontinue.

If you don’t have a certificateandkey to uploadbut do wish to useSSLto secureyourstorethenyouwill needto generatea certificateandkey here.

The first entry box is the Authority Name. This is the nameof the hostthe cer-tificatewill beusedon. TheGD WebTool will fill thefield in automaticallyfromtheinformationyou enteredin theprevioussteps.You shouldnot needto changethis. We left thedefault in theexamplebelow.

Now we have to enterin theOrganization. TheGD WebTool will placethenameof thestorein this field automatically. If thestorenameis theorganizationthenyoucanleavethisfield alone.Otherwisechangeit to theappropriateorganization.Thedefaultwasusedin ourexample.



Next we have theDepartment. Thedepartmentis a sub-catagoryof thecompanyname.You shouldenterin thenameof thedepartmentthathascontrolover thisstore.In theexamplebelow weusedSales .

An e-mail addressis requirednext. This is an authoritive contactanddoesnothave to be an e-mail addresswith the storesdomain. This can be an individ-uals address,for examplethe storesowner or systemadministrator. Questionsandotherinformationregardingthecertificatewill bereferencedandsentto thisaddress.

Next thenameof thecity in which thephysicalserver residesis required.Enterin the city name,a ZIP codeis not required. In our examplewe usedUpper

174 UserGuide


Saddle River , the locationof GuardianDigital, Inc. Our serversarelocatedon thesamelocationsoit is valid to usethatcity name.

You mustnow entertheStatein which thecity you enteredpreviously is locatedin. In ourexampleweenteredNew Jersey sinceUpperSaddleRiver is locatedin New Jersey.

Lastly is the country. This is a two letter codefor your country, for the UnitedStatesenterin US.

Uponcompletingall therequiredfieldsclick thePreview Storebuttonto continue.




You will now bepresentedwith all your configurationoptionsfrom theprevioussteps.Doublecheckover all thefields,andmake changesif needed.If changesweremadeyoumayclick thePreview Storebuttonto updatethechangesandviewthem.

If everything is configuredproperly click the CreateStore button to createthestore.

176 UserGuide


After clicking6 theCreateStore buttonyou’re browserwill bewaiting for a reply.The server is creatingyour store. This will take a few moments.Pleasedo notstopyour browserasthis caninteruptthestorecreationprocessandresult in anincompletestore.

Oncethe creationprocesshasbeencompletedyou will be returnedto the mainVirtual Host Managementscreen. You will be notified if therewere problemsduringstorecreation.

Thestoreis now configuredandstoredon thesystem.Therearestill a few morestepsremainingbeforethestorewill befully functional.

8.2.2 Part II - NameVirtual Hosts

We needto configurethe server nameproperlyso whensomeonegoesto viewyour site thereis a route to get to the server. You will needto createa NameVirtual Host.

FromthemainVirtual HostManagementmenuselectSetupNameVirtual Host.

Youwill now beat theNameVirtual Hostmenu.If this is yourfirst timehereyouwill only seea form to enterin namevirtual hosts. If not, you will seea list ofyournamevirtual hostsabove theform.

Youwill needto createtwo namevirtual hostsfor astore.Whatyouneedto enterin is theIP addressyou will beusingwith thestore.You will first have to enteritandselectport 80 for standardHTML transactions.



After enteringin the IP addressclick the Add New IP button. You will now seetheIP andport you just enteredin displayed.

Now enterin the IP addressagain andselectport 443. This is usedto transferHTML overanSSLprotectedconnection.

Again, after enteringin the dataclick the Add New IP button. You will seetheport andaddressappear. You arenow donesettingupyournamevirtual host.

8.2.3 Part III - DNSConfiguration

You now have your FQDN setup to an IP addressfor your store. You will nowneedto setup your storeso it canbeaccessedfrom theInternet.This is accom-plishedby enteringin theproperinformationinto your DNS. If you arebehindafirewall youmayneedto make configurationchangedto it.

To properlyconfigureDNSpleasereferto thedocumentationthatcamewith yourDNS server. If your DNS server is a GuardianDigital Linux Lockbox thenyoucangetinstructionsin Section4.4.6onpage85. Youwill needtheIP addressandthefully-qualifieddomainname(FQDN) to setupDNS.

8.2.4 Part IV - Fir ewall / Proxy Configuration

You will needyour firewall documentationto configureyour firewall to allowcostumersto accessyourstore.You will needthefollowing portsopened:

80 StandardHTML transactions

443 SecureHTML transactions

Thereis additionalfirewall and proxy server information that can be found inAppendixD onpage228.

OnceDNS is configuredandyour firewall is configuredyou’re storeis readytostarthaving itemsaddedto it andthelayoutdone.

178 UserGuide


8.2.5 P7

art V - Store Content Configuration

Thepagelayout is donethrougha seriesof templates.Thetemplatesareusedtogeneratethepagessoyouwill notneedto edit everypagecreatedeachtime.

Youwill alsoneedto setup theproductsfor salein yourstorethroughtheadmin-strative back-end.Thereis too muchinformationto cover in this brief tutorial.Howeveryoucanfind documentationon theGuardianDigital websiteat:

http://support.guardiandigital.com

Onceyouhaveyour itemsin yourstoreandthelayoutcompletedyouarereadytoopento thepublic.



8.3 Using8

CyberCashCashRegisterwith Your Store

GuardianDigital, Inc. hasmodifiedtheAllCommercepackageincludedwith yourLockbox to have fully integratedsupportfor theCyberCashCashRegistercreditcardvalidationsoftware. With this implementationyou will be ableto setup acleanservicefor your customersto usetheir credit cardson-line for immediatepurchases.Thereare two main partsto settingup this service. First you willneedto setup theCyberCashaccountandbankingservices.Secondyou have toconfigurethesoftware.We will describehow to doboth.

8.3.1 Settingup a Merchant Credit Card Account

Every merchantneedsa merchantcredit card account. Justas in the physicalworld, a merchanton the Internetneedsto establisha merchantaccountwith anacquiringfinancialinstitution in orderto acceptcreditcards.Even if a merchantalreadyhasa merchantaccount,they maynot have the typeof accountrequiredfor acceptingtransactionsover the Internet. A typical merchantaccountsetupprocesscantake anywherefrom 48 hoursto 14 businessdaysto complete.How-ever, CyberCashoffersanonlineapplicationthatcangiveyouapproval in amatterof minutes.You canalsocontacta CashRegistercompatiblefinancialinstitution.This taskis amongthemostcritical to thesuccessof theWebstore. We recom-mendvisiting CyberCash’s Web site andcontactingthemfor moreinformation,www.cybercash.com .

Youcanskip therestof thissectionif youareonly goingto berunningCashReg-isterona testbasis.

NOTE: YoumustrunCashRegisterin testmodeif youdonothaveanaccountsetup.

Thefollowingareguidelinesandinstructionstohelpmerchantsgetstartedquickly:

8.3.2 About Merchant Accounts

Therearetwo typesof merchantaccountsfor acceptingcreditcards:

4 Card PresentAccount

This typeof accountrequirestheconsumerandmerchantto bephysically at thesamelocationduring the time of the transaction.For a cardpresenttransaction,thecreditcardis typically swipedthroughacardreader(or physicalpoint-of-saleterminal),andtheconsumersignsanauthorizationslip, or salesreceipt.

180 UserGuide

Section8.3 UsingCyberCashCashRegisterwith YourStore

4 Mail9

Order/TelephoneOrder(MOTO) or CardNot PresentAccount

In aMOTO transaction,themerchantandshopperarenot in thesamephysicallo-cation,andthereis nocardswipedor signaturereceived.Thismethodof paymentwasoriginally adoptedfor mail orderandcatalogbusinesses.All Internettrans-actionsaretreatedasMOTO transactionsandrequireaMOTO merchantaccount.

If the merchantcurrentlyacceptscredit cardsbut is not sureif he or shehasaMOTO account,heor sheshouldcontacta merchantfinancialinstitution. If themerchantalreadyhasa MOTO account,he or sheis readyto setup a merchantaccountto acceptonlinepayments.

8.3.3 Feesand Rates

As a merchantinitiatestheprocessof settingup a relationshipwith anacquiringfinancial institution, it is importantto checkmore than one sourceto comparecosts.Feesandrateswill vary widely, basedon the financialinstitution andtherisksassociatedwith themerchant,includingthe:

4 Typeof productsandservicesbeingsold

4 Market in which themerchantcompetes

4 Methodin whichproductsandservicesarebeingsoldanddelivered

4 Thepricesof theseproductsandservices

4 Theexpectedvolumeof transactions

4 Whatformsof paymentthemerchantwill accept

4 Themerchant’s credithistory

Regardlessof thesefactors,a merchantshouldexpectto paythefinancialinstitu-tion:

4 Applicationfee,setup feeor both

4 Discountrate(i.e. percentof eachtransaction),typically not morethan4%

4 Per-transactionand/ormonthlyfees



4 Largefeesfor research,fraudanddisputeresolution

4 Additional feesfor valueaddedservices

Somebankswill resellCashRegisterservicesto merchantsdirectly. Thesebanksmayhave their own CashRegisterfeestructuredifferentfrom theCyberCashdi-rectprice.

8.3.4 UnderstandingCredit Card ProcessingModels

Not only aretheremany rulesandregulationssurroundingcreditcardspayments,therearemany proceduresandprocessingmethodsto a transaction.For exam-ple, thereare two parts to a credit card transaction:the authorizationand thecapture. Within thesetypestherearemany processesthat occur, including pro-cessing,billing, reporting,authorization,andsettlement.

For moredetailedinformationon establishinganInternetmerchantaccount,andto becomemorefamiliarwith theseveralcomponentsof thecreditcardacceptingprocess,contacta financial institution for an overview of credit cardprocessingmodels.

8.3.5 BeforeGetting Started

Ask for a merchanthandbookthat explainshow to acceptcredit cardpayments,how to handleandresolve disputes,andhow to processvoids,returnsandpartialcredits. Also understandthe rights of consumersand the rights of merchants,andbecomefamiliar with AddressVerificationServices(AVS) andother frauddetectionmechanisms.

8.3.6 SettingUp a Merchant Account

New Account:

If a merchantdoesnot currentlyhave a MOTO account,the merchantmustsetup a new accountwith an acquiringfinancial institution. Therearea numberoffinancialinstitutionsthathave designedanaccountprocessspecificallyfor Inter-netmerchantsby partneringwith Internetpaymentservices,suchasCyberCash.CyberCashoffersanonlineapplicationthatcangive you approval in a matterofminutes.YoumayalsocontactaCashRegistercompatiblefinancialinstitution.

182 UserGuide


ExistingAccount:

If a merchantalreadyhasa MOTO account,he or sheshouldcontacthis or herfinancialinstitution or oneof its agentsto let themknow they would like to useCyberCashto acceptInternet transactions.Thereare more than 26,000finan-cial institutionsin the United States.CyberCashworks with over 95% of thosefinancial institutionsin the United States,allowing merchantsto maintaintheirrelationshipswith their existing financialinstitutions. If themerchant’s financialinstitutiondoesnot supportCyberCash,themerchantcanfill out anonlineappli-cationor contacta CashRegistercompatiblefinancialinstitution.

8.3.7 Settingup the Merchant Account to AcceptOnline Payments

Regardlessof whethera merchantneedsa new MOTO accountor would like tokeepan existing MOTO account,a merchantshoulddo the following to acceptcreditcardpaymentsover theInternet:

1. Ask thefinancialinstitutionif they areauthorizedto underwritecreditcardservicesto merchants.

2. Inform the financial institution to set up the merchantaccountto acceptcredit cardsover the Internetusingthe merchant’s choiceof Internetpay-mentservices,suchasCyberCash.

3. Ask the financial institution to explain the detailsof establishinga mer-chantaccount,includingtheapplicationandapproval process,thefeesandcharges,andrequirementsfor openingadepositaccountfor doingbusiness.

4. Planfor themerchantaccountsetupprocessto take from 48hoursup to 14businessdaysto complete.

8.3.8 After the Merchant Account is Approved

Oncethe financial institution approves the merchantfor online commerce,thefinancialinstitutionwill typically performthefollowing tasks:

1. Issuethemerchanta MerchantID (MID)

2. Issuethemerchanta TerminalID (TID)



To processa merchant’s transactions,an Internetpaymentservicetypically re-quiresspecific information on the merchant’s account,including the MID andTID. CyberCash,for example,acceptsmerchantaccountinformationfrom onlycredit card processorsto ensurethe protectionof this sensitive data from onetrustedsource.

The credit cardprocessorin this casewould communicatethe MID andTID toCyberCashoncethemerchant’s accounthasbeenapproved.

CyberCashwill immediatelyaddthemerchantbankaccountinformationinto theInternetMerchantRegistration(IMR) system.If themerchanthasalreadyregis-teredfor service,CyberCashwill sendanemailindicatingthattheserviceis readyto go live uponrequestfrom themerchant.If themerchanthasnot yet registeredwith CyberCash,when the merchantusesthe IMR, the pendingbank accountinformation is automaticallylinked during the sign-upprocessto acceleratethemerchant’s ability to go live.

As thefinancialinstitution is processingthemerchant’s accountandworking onthesetasks,the merchantcancontinueto integratehis or herstorefrontwith thepaymentcomponent(s)andregisterwith anInternetpaymentservice.

Pleaserefertohttp://www.cybercash.com/cashregister/support/for the latest information concerningCashRegister and to sign-upwith Cyber-Cash.

8.3.9 Editing the CashRegistertemplates

TheCashRegistertemplatesarestorein/home/httpd/store-name/bits/eng/html/mck . They are standardHTML with a few variablesthrown in whereCashRegisterknows whereto placevariableinformation.

You canedit thetemplatesvia theGD WebTool by following theon-lineinstruc-tionsor edit themby hand.Hereis a brief descriptionof eachtemplatenameandwhatit contains:

customReceipt.temContainsthereceipttheuserwill seeuponasuccessfultrans-action.

customRedirectResponseThis is thepageto beredirectedto if youusetheredi-rectoption.

184 UserGuide


tempDifficulties.tem: This pagewill display any errorsthat occurredtrying toconnectto CyberCash’ssystems.

failFullfillment.tem Thispagewill displaywhentherewereproblemswith vali-datingthecreditcard

scriptErr or.tem This pagegetsdisplayedwhenthescript receivesanunknownmessage

thanks.tem The default “thank you for your purchase”page. Not usedin thisimplementation.

msw*.tem Templatesfor usingMicrosoftWallet.

Pleaserefer to http://www.cybercash.com for moreinformationandup-dateddocumentationon theCyberCashCashRegister.


9 The Linux Intrusion DetectionSystem(LIDS)

9.1 Intr oduction to LIDS

With therapidpaceof developmentandopensourcenatureof Linux, programsareoftenevaluatedfor securityvulnerabilities.Betweenthetime theknown securityvulnerabilitiesare found, additionalprotectionis available to provide an extralayerof security, until thesystemcanbeupdated.

SinceLinux is anart of theopensourcecommunity, securityholesmaybefoundmoreeasilybut canalsobepatchedjust asquickly andeasily. But whentheholeis disclosedto thepublic,andtheadministratoris unableto patchthehole,it couldpotentiallycompromiseyour system.With the typical Linux systems,a crackerhasabsolutecontrol if superuseraccessis gained. With the addedprotectionofLIDS, this andmany otherpotentialproblemscanbereduced.

LIDS providestheability to controlall accessto files, processes,binaries,mem-ory, raw devices,drives,etc.Oneof themainfeaturesof LIDS is protectionfromthesuperuser, known onaLinux systemastherootuser.

NOTE: LIDS requiresadvancedadministrationskills to manageproperlyandthere-foreshouldnotbemodifiedby inexperiencedusers.

Theroot userhascontrolover every singleaspectof thesystem.They canmountandunmountdrives,deleteandcreatefiles, remove users,accessthe database,

Section9.1 Introductionto LIDS

edit theW;

ebpage,shutdown thesystem,etc.Soyoucanseethepossiblesecurityhazardhere.If someonemanagedto gain root access,theentiresystemcouldbeput into the crackerscontrol. Hereis a numberof securityenhancementsLIDShasto protectthesystemfrom this threat.

4 Everysinglefile canbeprotected.Giving eachfile its own setof read,write,or appendrulesthateventheroot usermustobey. For example,if you setyour log files to appendonly, no onecould go in anddeleteany traceofthemselveson thesystem.You cansetthe login binaryasread-onlyanditcannot bereplaced.Even if therewasa possibleway to overwrite thefileLIDS would know it’s not thesamefile becauseit indexesthefiles by theirinodes,not their file names.

4 Files canalsobe completelyhiddenfrom view andonly be accessiblebyspecificprograms.For example,if you want to protectyour ApacheSSLserver key from everyoneincluding root, you canhide the file so to everyuser, includingroot, it doesn’t exist, but at thesametime it allows Apacheto have full accessto thefile soit cangettheinformationit needsfrom it.

4 LIDS canalsoprotectprocessesfrom beingkilled by the root user. Thiscouldbeusedto protectyour databaseserver, your Webserver, your mailserver, etc. from beingtakenoff-line by anintruder.

4 You canhave full control of the Linux kernel “capabilities”. The currentLinux capabilitiescontrolwhata processcanandcan’t do. Changingthesecapabilitiesgivesyou morecontrolover your system.By settingthecapa-bilities to your needsyou canpreventall usersfrom rebootingthesystem,mountingandunmountingdisks,changingnetwork settings,/dev control,ownershipcontrol,loadingandunloadingof kernelmodules,andmany oth-ers.

4 Root hasthe ability to turn LIDS off locally for just the currentsessionor globally. This canbe configuredso it canonly be donelocally, and/orremotely. It alsorequiresa password which is protectedby RipeMD-160encryption.

4 A built in port scannerallows you to disablepromiscuousmodeandstilldetectport scans.

4 All attemptson thesystemareloggedandif any usertried to breakoneoftheLIDS rules,ane-mailis immediatelysenttoapredefinede-mailaddress.(A cell phoneor a pagercanbeconfiguredto bealertedwhenthis happensalsosoyou know whensomeoneis makinganattemptonyoursystem.)


TheLinux IntrusionDetectionSystem(LIDS) Chapter9

Someminor drawbacksto this increasedmethodof security is it could hindertheuseof certainprogramsby denying themaccessto neededfiles if configuredincorrectly. It alsomakesit moredifficult to administerthesystemfrom thecon-solebut theincludedGD WebTool includesenhancementsthatintegratewill withLIDS.

188 UserGuide

Section9.2 UsingLIDS

9.2 Using8

LIDS

LIDS isalwaysrunningonyourLockbox.If youwill bedoingyouradministrationvia theGD WebTool youcanskip this section,but it’s suggestedreadinganyway.

Minimal maintenanceis requiredto keepLIDS running. Managementof LIDSonserversthatareco-locatedwith GuardianDigital is includedwith yoursupportcontract.

Youmaysometimesneedto changetheconfigurationor addnew packagesrequir-ing you to disableLIDS. TheGD WebTool will automaticallyenableanddisableLIDS while youadministerthesystem.For adminstrationfrom ashell,aprogramcalledlidsadm is usedto interfacewith LIDS.

First youhave to disableLIDS. After loggingin asroot type:

/sbin/lidsadm -S -- -LIDS

This will promptyou for your password. After enteringyour password LIDS isdisabledfor the currentsessionyou are in. This methodwill still apply all theLIDS resourcesettingsand rules to every other useron the systemwhile youadministerthesystem.Optionally, issuing:

/sbin/lidsadm -S -- -LIDS_GLOBAL

will disableLIDS globally. While in this modeno LIDS ruleswill beappliedtoany useror resource.Usethis with caution.Onceyou have LIDS turnedoff youmay configureyour capabilities,file permissions,resourcepermissions,etc. Ifyou changedtheLIDS configurationwhile LIDS wasturnedoff you will needtoreloadtheconfigurationfile into LIDS. BeforeturningLIDS onenterthis:

/sbin/lidsadm -S -- +RELOAD_CONF

This will make sureyou have thelatestconfigurationloadedinto LIDS. It is sug-gestedyou run this commandevery time you make a changeto theLIDS config-uration.To turnLIDS protectionbackonafteradministrationsimply issue:

/sbin/lidsadm -S -- +LIDS

or to enableit globally:



/sbin/lidsadm -S -- +LIDS_GLOBAL

Yoursystemisnow protectedagainbyLIDS. Whenenabling,disablingandreload-ing theconfigurationinformationwith lidsadmyou will bepromptedfor a pass-wordevery time. Youwill seethefollowing message:

SWITCH

WARNING: Only system administrators should enable/disableLIDS. Disabling LIDS can open your Lockbox to possible at-tacks. Make sure you read the LIDS section in your in-cluded manual before manually changing options in LIDS.Incorrect configurations can have drastic effects.

enter password:

At this point youcanenterin yourpassword.

9.2.1 Using the lidsadm Utility

Thelidsadmutility is a smallprogramyou will useto administeryourLIDS con-figuration. It storesall configurationinformationin /etc/lids/lids.conf .If you areusingtheGD WebTool for administeringLIDS you do not needto uselidsadm.

Somebasiclidsadmoptionsareasfollows:

/sbin/lidsadm -A Add a new entry

/sbin/lidsadm -D Delete an entry

/sbin/lidsadm -Z Delete all entries

/sbin/lidsadm -U Update all entries

/sbin/lidsadm -L List current entries, requires LIDS to be turned off

/sbin/lidsadm -P Creates a new password. It will store the passwordin Ripe MD-160 encryption

/sbin/lidsadm -S Switch LIDS on/off and capabilities

/sbin/lidsadm -r View current status of LIDS

/sbin/lidsadm -h Help

Thenext sectionwill containmoredetailedinformationaboutthelidsadmoptions

190 UserGuide


9.2.2 Adding<

an Entry

Using this option allows you to adda new item to the LIDS config. You havetheoptionsto adda singlefile with anattribute,give a file permissionto overrideanotherfiles permissions,andchangethecapabilitiesof a file.

lidsadm -A [-s subject] -o object [-t] -j TARGET

To protecta file enterthe filenameandpathusing the -o flag, followed by theattribute,READ, WRITE, IGNORE,DENY, or APPENDunderthe-j attribute. Ifyour objectis a capabilitysettingyou needto usethe -t flag to tell lidsadmit’s aspecialoption. -s is usedto point theobjectto asubject.In thecaseof capabilitiesyou, arepointing a capabilityto the subjector giving the subjectthe capability.Sameideawith file protections.If you deny accessto a file but want thesubjectto useit, you point to thedeniedfile(object) to thefile to give accessto(subject)thentell it whatkind of accessto give it -j. Here’sanexampleof protectingafile:

lidsadm -A -o /path/to/protected_file -j DENY

Now to givea binaryfull accessto thefile thatwasdeniedto everyoneelse:

lidsadm -A -s /path/to/binary \-o /path/to/protected_file -j WRITE

We alsowantto give thebinarythecapabilityto chown, which hasbeendisabledearlierby LIDS:

lidsadm -A -s /path/to/binary \-t -o CAP_CHOWN-j INHERIT

Whenchanginga files capabilitieswe useINHERIT or NO_INHERIT insteadofthe READ...APPENDcommands.Using INHERIT gives the file accessto thecapability while the NO_INHERIT turns off the files abilities to usethe givencapability. In a latersectioncapabilitiesareexplainedin moredetail. In thenextsessionanexampleof apackagebeingprotectedis given.

NOTE: Don’t forgettodoa lidsadm-S–+RELOAD_CONFafterchangesweremadesothey takeeffectwhenyou reloadLIDS.



9.2.3 Deleting=

an Entry

Deletinganentryis anextremelysimpletaskandthereis noneedto go into greatdetail. If thereis a file you no longer want to be protectedor wish to changeprotectionon, you needto deletethe entry from the LIDS config. Simply issuethefollowing commandto accomplishthis task:

lidsadm -D [-s file] [-o file]

and the file will be removed from the configuration. You can now enternewattributesfor thefile, if you like.

9.2.4 Deletingand Updating All Entries

Lidsadmgivesyou theability to deleteandupdateall thefile entriesin your con-figuration.Issuing:

lidsadm -Z

will deleteevery entryin yourLIDS configurationandyou will bestartingwith acleanconfigurationfile. Theoriginal configurationshippedon your box is storedin /usr/bin/lids_default_config/andcanbe executedto revert LIDS back to it’soriginal configuration.

Updatingall thefile entriesworksa little differently. Theconfigurationfiles arelinked to LIDS by their inodenumber, not their filename. If a file getsdeletedandreplacedlaterit maynotbeprotectedby lids becauseof theinodechange.Byissuing:

lidsadm -U

lidsadmwill go throughyour configurationandcheckevery file makingchangesasnecessary. Thisshouldberanif youupgradeapackagetoosinceit’smorethanlikely oneor moreof thefiles will beoverwrittenandtheinodewill change.

192 UserGuide


9.2.5 P7

assword Creation

LIDS usesa userdefinedpassword it storesin encryptedform(RipeMD-160), in/etc/lids/lids.pw . To createa new passwordsimply type:

lidsadm -P

It will promptyou twice for your new password andthenchangethe password.This will obviously only work if LIDS is turnedoff. Onceyou have donethisevery time you needto reloadtheconfigurationandturn LIDS on or off you willhave to enteryourpassword in plaintext.

9.2.6 Viewing LIDS Status

Youcanuse:

lidsadm -r

to view thecurrentrunningstatusof LIDS. This canbeusefulfor writing scriptsthatneedto know if LIDS is turnedonor not.

9.2.7 Viewing the Curr ent LIDS Configuration

Youcanusethe:

lidsadm -L

option to view a list of all thefiles andtheir attributesin theconfiguration.Youmust have LIDS disabledto run this commandsince it requiresaccessto the/etc/lids/lids.conf file.



9.3 Pr>

otectingYour Files

The Linux Lockbox comeswith a default configurationfor protectingyour filesbasedon your configurationoptionsandinstalledpackages.If packagesarere-moved,or addedLIDS will have to beupdated.Mostof thiscanbeeasilyaccom-plishedusingtheGD WebTool application.

If youwishto doadministrationof LIDS from theconsoleyouwill needto usethelidsadmprogram.Usingthecommandsdescribedin theprevioussectionwe willremove, addandupdatefiles on theLockbox. Beforeany administrationcanbedoneyoumustfirst turnoff LIDS. TurnLIDS off only onyoursession.Unlessyouareworkingin multiplesessionsandfeelsafeleaving yoursystemunprotectedforthetime.

lidsadm -S -- -LIDS

Now with LIDS disabledyoucanproceedwith yourwork.

9.3.1 An Example: Protectinga FreshlyInstalled Package

For this examplewe addeda packagecalledmy_package.rpm.my_package.rpmhasaconfigurationfile in /etc , a binaryin /sbin , a log is kept/var/log/my_package.log andstoresuserdatain /var/lib/my_package/. my_package.rpm alsorequiressetuidandsetgidaccess.Without re-configuringLIDS this applicationwon’t functionproperly. Hereis whatneedstobe doneto addthis packageto your LIDS configuration. Issuingthe followingcommandwill give you a list of thefiles anRPM uses.Thoughit won’t tell youif it needs,read,write and/orappendaccessto them.

rpm -qpl package_name.rpm

Thefirst thing wewantto do now is protecttheconfigurationfile. Theconfigura-tion file neverneedsto bechangedby theprogramsowecangive it READ accessonly. If you wantto make changesin thefuturesimply disableLIDS, make yourchangesandenableLIDS. Hereis how to protectour configfile for READ onlyaccess:

lidsadm -A -o /etc/my_package.conf -j READ

194 UserGuide

Section9.3 ProtectingYourFiles

Now thefile is in theLIDS configurationfile andsetasreadonly. Weusedthe-Aoption to ADD a new object. The -o objectis the file my_package.confandit’s-j attribute is READ. Valid attributesareREAD, WRITE, APPEND,DENY, andIGNORE.

NOTE: Thesearecasesensitiveandthereforemustbewrittenin all uppercaseletters.

We have successfullyprotectedtheconfigurationfile. Next we will tacklethelogfile. The log file is simply a file thatmaintainsa list of programevents.Thefileneverchangespreviousinformationandthereforecanbesetto APPENDonly. Sowe issuea similar commandastheoneusedfor theconfigurationfile:

lidsadm -A -o /var/log/my_package.log \-j APPEND

Thiscommandis almostthesameasaboveexceptwesetthelog file to APPEND.Next wewantto protecttheuserdata.We wantto beableto readandwrite to theuserdata,but wedon’t wantroot to havetheability to view thedata,sinceit couldbeprivateinformation. This is alsoa securemethodof protectingsensitive datafrom anintruder, if they gain rootaccess.Firstwehave to deny everybodyaccessfrom the userdata. Therecould be a slight problemif the userdatadirectorycontainsdozens,maybehundredsof files. Thiscouldbequitecumbersometypingin eachfile nameinto lidsadm.Well thelidsadmprogramallows you to protectadirectoryandeverythingunderit. Sonow letsprotectthedirectory:

lidsadm -A -o /var/lib/my_package/ -j DENY

Now everyoneis deniedaccessto that directoryandeverythingin it. In fact, ifyou get a directory listing of /var/lib the my_package/ directorywillnot even be visible. So now it’s safe. Too safenow actually. You have to giveyour my_packagebinary accessto the datafor it to run properly. To give thebinary, andonly thebinary, accessto thedata,we canissuethis command:

lidsadm -A -s /sbin/my_package_binary \-o /var/lib/my_package -j IGNORE

Oncethat is issuedit gives /sbin/my_package_binary full accessto ev-erythingin the /var/lib/my_package directory. In the exampleabove we



-A added? a new -o objectbut this time linked it to a -s subject.Sonow theuserdatais completelyprotectedand is not hinderingthe usageof the my_packageapplication.

Finally we needto protectthebinaryfrom beingdeleted.Sowe cansimply setitasreadonly. We canusethesamecommandthatweusedfor theconfigfile:

lidsadm -A -o /sbin/my_package_binary -j READ

When initially securingthe systemthe entire /sbin directory was protected.To add /sbin/my_package_binary separatelyyou cando what wasdoneabove or you canupdateall theitemsin theLIDS config. Doing this will addthe/sbin/my_package_binary to theconfig

lidsadm -U

Wearenow left with onelastproblem.Themy_package_binaryneedssetuidandsetgidpermissionsto runproperly. By defaultthesetuidandsetgidcapabilitiesaredisabledby LIDS (moreconcerningcapabilitieswill beexplainedin thefollowingsections).Usinglidsadmyoucanassigncapabilitiesto aspecificfile. Thelidsadmcommandis similar to addinga file:

lidsadm -A -s /sbin/my_package_binary -t \-o CAP_SETUID -j INHERIT

lidsadm -A -s /sbin/my_package_binary -t \-o CAP_SETGID -j INHERIT

Now the/sbin/my_package_binary will inherit thesetuidandsetgidcapa-bilities in thekernelgiving it permissionto use.The-t flag is usedto tell lidsadmtheobjectis special,or nota file in thiscase.

To make certaineverythingin yourLIDS configurationis setproperlyissuinga:

lidsadm -L

will presentyouwith a list of all theitemsin theconfigurationandtheirattributes.You musthave lidsadmturnedoff to usethis option. Now the entirepackageisdone.Reloadtheconfiginto LIDS andfinally enableLIDS again:

196 UserGuide

Section9.4 ProtectingYourFiles

lidsadm@ -S -- +RELOAD_CONFlidsadm -S -- +LIDS

Now youarereadyto go.

When LIDS is initially configuredfor your Lockbox a script was createdthatcontainsall file attributes. This script canbe run at any time to resetyou backto the systemdefaults. Additionally you cancreateyour own script file for anyadditionsyou make. This makesit mucheasierif you make a mistake andhaveto startover from scratch.A simplecommandto launchyour scriptwill put youbackwhereyou wereinsteadof typing everythingbackin. If you areusingtheGD WebTool this is alreadydonefor you. Thescriptcanbesomethingbasic,hereis asamplescriptusingtheexampleabove:

#!/bin/bash#### LIDS configuration - 9/13/00##### Configuration for my_package.rpm#

lidsadm -A -o /etc/my_package.conf -j READlidsadm -A -o /var/log/my_package.log -j APPENDlidsadm -A -o /var/lib/my_package/ -j DENYlidsadm -A -s /sbin/my_package_binary \

-o /var/lib/my_package -j IGNORElidsadm -A -o /sbin/my_package_binary -j READlidsadm -A -s /sbin/my_package_binary -o CAP_SETUID \

-j INHERITlidsadm -A -s /sbin/my_package_binary -o CAP_SETGID \

-j INHERIT##### End my_package.rpm configuration

You canevenaddthis to your /etc/rc3.d/ (/etc/rc.d/rc3.d/ for RedHatsystems)sothe LIDS configurationis freshenedon every boot up. Justmake sureit’s donebeforethekernelis sealed(lidsadm-I ). Moreinformationaboutsealingthekernelis explainedin latersections.

If this packageis ever removed you will have to deletethe entries. Using thescript methodabove, deleteout all the entriesthen lidsadm-Z and run all thescriptsagain. Otherwiseyou canissuea lidsadm-D for eachfile entryyou have.For fileswith multipleentries,youonly needenterit in once.Lidsadmwill deleteall entriesfor thatfile.



9.4 KA ernel Capabilities

Whena processis createdit is givena setof capabilitiesfrom thekernel. Thesecapabilitiestell theprocesswhatit canandcannotdo. LIDS givesyou theabilityto alter thesecapabilitiesin the kernel. You canset the capabilitiesto apply toall processesor only specificprocesses.We saw how to applycapabilitiesto onlyspecificprocessespreviously in the Adding an Entry sectionand in the aboveexample.

ThedefaultcapabilitiessetthatLIDS usedis definedin the/etc/lids/lids.cap file. This file containsa list of thecapabilitiesby name,with a numberanda + or - symbolbeforeit. A + enablesthe listed capability following it anda -disablesit. Beforeeachcapability is a descriptionof what the capabilitydoes.We suggestyou keepthe default capabilities.You canalsofind a list of all thecapabilitiesanddefinitionsat theendof thissectionandby just typing lidsadmor lidsadm -h . Issuing:

lidsadm -I

setsall the capabilitieslisted in the /etc/lids/lids.cap file. By default,in the Lockbox, the commandis enteredinto the /etc/rc.local file so thekernelis sealedduringbootup. WhenLIDS is disabledthecapabilitiesreturntotheir original settingsandwhenyou enablethe kernelagain they returnto theirpreviousstate.

Earlier we setcapabilitiesto a binary. We wereactually linking a capabilityaprocessthebinarycreates:

lidsadm -A -s /path/to/binary -t -o CAP_NAME

All processes,however areprotectedfrom beingkilled by anyonebut theownerof theprocess.This toocanbeavoidedwith theabove process.

9.4.1 Capability Namesand Descriptions

Hereis a list of all thecapabilitiessupportedby LIDS andwhattheir functionis.

CAP_CHOWN In a systemwith the _POSIX_CHOWN_RESTRICTEDoptiondefined,this overridestherestrictionof changingfile ownershipandgroupownership.

198 UserGuide

Section9.4 KernelCapabilities

CAP_DAC_OVERRIDEB Override all DAC access,including ACL executeaccessif _POSIX_ACL isdefined.ExcludingDACaccesscoveredbyCAP_LINUX_IMMUTABLE.

CAP_DAC_READ_SEARCH Overridesall DAC restrictionsregardingreadandsearchonfilesanddirectories,includingACL restrictionsif _POSIX_ACLis defined.ExcludingDAC accesscoveredbyCAP_LINUX_IMMUTABLE.

CAP_FOWNER Overridesall restrictionsconcerningallowedoperationsonfiles,wherethefile ownerID mustbeequalto theuserID, exceptwhereCAP_FSETID is applicable.It doesn’t overrideMAC andDAC restrictions.

CAP_FSETID Overridesthe following restrictionsthat the effective userIDshall matchthe file owner ID whensettingthe S_ISUID andS_ISGIDbits on that file; that the effective groupID (or oneof the supplementarygroupIDs) shallmatchthefile ownerID whensettingtheS_ISGID bit onthat file; that the S_ISUID andS_ISGID bits areclearedon successfulreturnfrom chown(2) (not implemented).

CAP_KILL Overridestherestrictionthattherealor effectiveuserID of apro-cesssendingasignalmustmatchtherealor effectiveuserID of theprocessreceiving thesignal.

CAP_SETGID

4 Allowssetgid(2)manipulation

4 Allowssetgroups(2)

4 Allows forgedgidsonsocket credentialspassing.

CAP_SETUID

4 Allowsset*uid(2)manipulation(includingfsuid).

4 Allows forgedpidsonsocket credentialspassing.

CATP_SETPCAP Transferany capability in your permittedset to any pid,remove any capabilityin

yourpermittedsetfrom any pid.



CAP_LINUX_IMMUTABLEC Allow modificationof S_IMMUTABLEandS_APPENDfile attributes.

CAP_NET_BIND_SERVICE Allows binding to TCP/UDPsocketsbelow1024.

CAP_NET_BROADCAST Allow read/writeof device-specificregisters

CAP_NET_ADMIN

4 Allow broadcasting,listento multicast.

4 Allow interfaceconfiguration

4 Allow administrationof IP firewall, masqueradingandaccounting

4 Allow settingdebug optiononsockets

4 Allow modificationof routingtables

4 Allow settingarbitraryprocess/ processgroupownershipon sockets

4 Allow bindingto any addressfor transparentproxying

4 Allow settingTOS(typeof service)

4 Allow settingpromiscuousmode

4 Allow clearingdriver statistics

4 Allow multicasting

CAP_NET_RAW

4 Allow useof RAW sockets

4 Allow useof PACKET sockets

CAP_IPC_LOCK

4 Allow lockingof sharedmemorysegments

4 Allow mlock andmlockall (which doesn’t really have anything to do withIPC).

200 UserGuide

Section9.4 KernelCapabilities

CAP_IPC_OWNERD OverrideIPCownershipchecks.

CAP_SYS_MODULE Insertandremove kernelmodules.

CAP_SYS_RAWIO

4 Allow ioperm/iopl and/dev/por t access

4 Allow /dev/mem and/dev/kmem access

4 Allow raw blockdevices(/dev/[sh]d?? ) access

CAP_SYS_CHROOT Allow useof chroot()

CAP_SYS_PTRACE Allow ptrace() of any process

CAP_SYS_PACCT Allow configurationof processaccounting

CAP_SYS_ADMIN

4 Allow configurationof thesecureattentionkey

4 Allow administrationof therandomdevice

4 Allow device administration(mknod)

4 Allow examinationandconfigurationof disk quotas

4 Allow configuringthekernel’s syslog(printk behavior domainname)

4 Allow settingthedomainname

4 Allow settingthehostname

4 Allow callingbdflush()

4 Allow mount() andumount() , settingupnew smbconnection

4 Allow someautofsroot ioctls

4 Allow nfsservctlAllow VM86_REQUEST_IRQ

4 Allow to read/writepci configonalpha

4 Allow irix_prctl onmips(setstacksize )



4 AlloE w flushingall cacheon m68k(sys_cacheflush )

4 Allow removing semaphores

4 Usedinsteadof CAP_CHOWN to chown IPC messagequeues,semaphoresandsharememory

4 Allow locking/unlockingof sharedmemorysegment

4 Allow turningswapon/off Allow forgedpidsonsocket credentialspassing

4 Allow settingread-aheadandflushingbuffersonblockdevices

4 Allow settinggeometryin floppy driver

4 Allow turningDMA on/off in xd driver

4 Allow administrationof mddevices(mostlytheabove,but someextraioctls)

4 Allow tuningtheidedriverAllow accessto thenvramdevice

4 Allow administrationof apm_bios,serialandbttv (TV) device

4 Allow manufacturercommandsin isdnCAPI supportdriver

4 Allow readingnon-standardizedportionsof pci configurationspace

4 Allow DDI debug ioctl onsbpcddriver

4 Allow settingupserialports

4 Allow sendingraw qic-117commands

4 Allow enabling/disablingtaggedqueuingon SCSIcontrollersandsendingarbitrarySCSIcommands

4 Allow settingencryptionkey on loopbackfile system

CAP_SYS_BOOT Allow useof reboot()

CAP_SYS_NICE

4 Allow raisingpriority andsettingpriority onother(differentUID) processes

4 Allow useof FIFOandround-robin(realtime)schedulingonown processesandsettingtheschedulingalgorithmusedby anotherprocess.

202 UserGuide

Section.0 KernelCapabilities

CAP_SYS_RESOURCEF4 Overrideresourcelimits. Setresourcelimits.

4 Overridequotalimits.

4 Overridereservedspaceonext2 file system

4 NOTE: ext2 honorsfsuidwhencheckingfor resourceoverrides,soyoucanoverrideusingfsuid too

4 Overridesizerestrictionson IPC messagequeues

4 Allow morethan64hzinterruptsfrom thereal-timeclock

4 Overridemaxnumberof consolesonconsoleallocation

4 Overridemaxnumberof keymaps

CAP_SYS_TIME

4 Allow manipulationof systemclock

4 Allow irix_stimeonmips

4 Allow settingthereal-timeclock

CAP_SYS_TTY_CONFIG

4 Allow configurationof tty devices

4 Allow vhangup() of tty


A QG

UI CK START GUI DE

This appendixis intendedto give an overview of the functionsof the GuardianDigital WebTool. After readingthisappendix,thereadershouldbeabletoperformthestepsrequiredto setupadomainto receivemail, configureDNSservices,andserveWebpages.If yourLockboxwill notbeusedto performall of thefunctionslisted above, it is especiallyimportantthat you readthe UserGuideandhave afull understandingof eachof theservicesyouwill beconfiguring.

Beforefollowing the examplebelow, your Lockbox shouldhave alreadyunder-goneinitial configurationandbepluggedin andoperatingonanetwork. Informa-tion regardingthe initial configurationcanbe found in Section3 Installing yourLockboxon page22.

To obtaina fastandmostaccuratesetup,follow thestepsin thedescribedorder.Onceyouhavesuccessfullycompletedeachstep,proceedin orderto thenext step.Therearefour primarystepsrequiredto configuretheLockbox:

1. Configurethenetwork interface

2. ConfiguretheDNS Server

3. ConfiguretheMail Server

4. ConfiguretheWebServer to preparefor normalandsecurewebsites

After theinitial configurationof your GuardianDigital Linux Lockbox,thebasicsystemandnetworking functionsareoperatingcorrectlyandis readyto configureasamplestore.Wewill beconfiguringourexampleLockboxto usethefollowinginitial valuesenteredwhentheLockboxwasconfigured:

Hostname: myserver

Domain Name: mydomain.com

IP Addr ess: 192.168.1.70

Netmask: 255.255.255.0

Gateway: 192.168.1.1

Primary DNSAddr ess: 192.168.1.70

SectionA.1 Network Interfaces

SecondaryDNS Addr ess: 192.168.1.60

In this example,we will becreatingthedomainlinuxlockbox.com thatwillbehostingourDNS,routingmail, andservingwebpages.

A.1 Network Interfaces

Beforeany interfacesarecreatedyouwill needto know thefollowing:

4 EachSSL-basedwebsiterequiresits own IP address.If moreSSL-basedwebsitesareto beserved,thena new interfacemustbecreatedon anotherIP addressfor eachwebsite.

4 Therecanbemany normalwebsiteson thesameIP address,givena NameVirtual Host definedin the Web server. Seethe Section4.3 Virtual HostManagementon page39 in theUserGuidefor moreinformationon NameVirtual Hosts.

Example:

In theWebTool, click onSystemManagement, andthenclick onNetworkConfig-uration. Therewill alreadybeaninterfacedefinedas:

We want to setup a separateIP addressfor www.linuxlockbox.com , sincewe will becreatinga Secure WebServeron it. Click on Adda New Interfacetodo this. We arenow promptedfor our information,atwhichpointweenter:

IP Addr ess: 192.168.1.71

Netmask: 255.255.255.0

After clicking theCreatebuttonthePersistentInterfacesscreenwill look like:


QUICK START GUIDE AppendixA

We have now successfullyconfiguredournetwork interface.

A.2 DNS Server

TheDNS Server is the mechanismthatprovidesnameto IP address,andIP ad-dressto namemappings.It alsoprovidesthe informationnecessaryfor mail tobeproperlyrouted. DNS wascreatedbecauseIP addressesareoftenhardto re-member. DNS is usedto mapthat addressto a name,which is mucheasiertoremember.

When typing http://www.guardiandigital.com into a Web browser,for example,theDNSservertranslatesthehostname(www.guardiandigital.com ) into theIPaddressassociatedwith www.guardiandigital.com . Thebrowserthensendstherequestto that IP addressandrespondswith theinforma-tion availableat thataddress.

DNS containsa numberof uniquecharacteristicsabouteachhost. Eachcharac-teristic forms a ’record’ in the databasethat storesthe DNS information. DNS"zones"areregionsof IP addressesor namesfor which a particularorganizationis responsible.

Addr essRecords This is a recordthatprovidesa hostnameto beassignedto anIP address.All hostnamesareassociatedwith anIP address.

NameServer Records This is a recordthat defineswhat nameservers are re-sponsiblefor thezone.In mostcases,thiswill bethesameasthehostnameof themachine.Do notaltertheserecordsunlessyouhaveanexplicit reasonto.

NameAlias Records Thisis arecordwhichprovidesan"alias"for apre-existinghostname.Theremaybemultiplealiasesfor asinglehostname.

Mail Server Records This is a recordwhich providestheinformationnecessaryto correctlyroutemail to correctlydeliver electronicmail. Multiple e-mailserversmaybedefinedfor thesamedomain,eachwith a differing priority.Serversdefinedwith a lowernumberhaveahigherpriority andmail will bedeliveredto thesehostsfirst.

206 UserGuide

SectionA.2 DNSServer

Example:HBecausewearecreatinganew domain(linuxlockbox.com ), wemustcreatea new forward zonefor it. Beforeyour Lockbox canbe configuredto provideDNSfor thisdomain,it musthavebeenlistedamongthelist of authoritativenameserversfor this domain.

FromtheSystemManagementmenu,selectDNSManagement. Thenext stepwillbeto createanew masterzone.Click on theCreatea New MasterZonelink.

Leave theForward (Namesto Addresses)buttoncheckedsincethat is thetypeofzoneto be created.Keepthe default valueof Masterserver. The restthe inputlookslike:

Domain name: linuxlockbox.com

Email Addr ess: [email protected]

Leave theAllow transfers from...setto Allow None, andtheAllow queriesfrom...set to Allow Any. For more informationon thesefields pleaserefer to the fullmanual.

Click on the Createbutton to seethe new zonein the zonelisting. To addtherecordsfor ourexample,click on the linuxlockbox.comlink.

Addr essRecords

Hostname: www.linuxlockbox.com

Addr ess: 192.168.1.71

Hostname: mail.linuxlockbox.com

Addr ess: 192.168.1.71

NameAlias Records

Alias: sales.linuxlockbox.com

RealName: www.linuxlockbox.com

Mail Server Records



MailI

Server: mail.linuxlockbox.com

Priority: 10

At thispointwehavesuccessfullycreatedwww.linuxlockbox.com andmail.linuxlockbox.com to go to 192.168.1.71 .

We have now successfullyconfiguredtheDNSrecordsfor oursampledomain.

A.3 Mail Server

Themail serverprovidesthemechanismto delivere-mailto a recipienton theIn-ternet.Whenane-mailis sent,themail server is instructedto deliver themessageto theremotemail server responsiblefor therecipient’s domain.

Example:

To configuree-mail for our new domain,we must createa new Mail Domain.FromtheSystemManagementsectionselectMail ServerManagement. Thense-lect DomainManagement.

We wantto Create[a] New Domainwith thefollowing values:

Domain: linuxlockbox.com

Postmaster: ryan

This assumesthat thereis a usernamedryan on the system.Now the Lockboxhasbeenconfiguredto receive mail for linuxlockbox.com . The local userryan hasbeendefinedasthe Postmaster. More informationon the "Postmaster"accountis availablein Section4.4.5Mail ServerManagement onpage82.

Oncethemail domainis created,individual useraccountscanbeaddedby click-ing on the linuxlockbox.com link:

Example1:

E-Mail Username: administrator

Recipient: christi

208 UserGuide

SectionA.4 WebServer

ExampleJ 2:

E-Mail Username: info

Recipient: christi

Example3:

E-Mail Username: webmaster

Recipient: ryan

Example4:

E-Mail Username: sales

Recipient: [email protected]

Herefour e-mailaddressesaredefined.Thefollowing tableshowsthedestinationof variouse-mailaddressesaccordingto theexamplesdefinedabove:

Mail SentTo: Final Recipient:[email protected] christi

[email protected] christi

[email protected] ryan

[email protected] [email protected]

[email protected] ryan

We have now successfullyconfiguredourMail Server.

A.4 WebServer

The Web Server is the mechanismfor servingwebsites.Therearetwo typesofwebsites:normalandsecure. Securewebsitesutilize SSLencryptionto providesecurityfor sensitive applicationssuchase-commerce.Normalwebsitesaresim-ply sitesthatdonot utilize SSL.

Securewebsitesrequiretwo things:acertificateandakey. It canbethoughtof inthefollowing context:

K thecertificateis whatverifiesyour identity (authentication)



K theL key is whatprovidesthesecurity(encryption)

The certificateandkey arealsotightly tied into eachother; they area matchingpair.

The first time a userconnectsto a securesite, their browserwill storethe cer-tificate. Every subsequenttime the userconnectsto the site it verifies that thecertificateis thesameto ensureasecureconnection.Thisprovidestheencryptionportionof theprocess.

For moreinformationoncertificiatespleasereferto thefull UserGuide.

Example:

To configuretheWebserver for our new domain,we mustsetthemup in Section4.3Virtual HostManagementonpage39.

To createthe normalsite, go to Virtual Host Management, andselectCreateaVirtual Host. We usethefollowing values:

Addr ess: 192.168.1.71

Administrator E-Mail : [email protected]

Server Name: www.linuxlockbox.com

Webmaster: ryan

For Group, we wantto first Create[a] Groupnamedlockboxweb, andthenselectit.

Group: lockboxweb

If a databaseis necessaryfor this site, thenwe checkthe Createa databaseforthis siteboxandenterin thevalues:

Username: lockboxweb

Password: l!ock#b0x

210 UserGuide

SectionA.4 WebServer

We have now successfullycreatedthenormalwebsite.

Likewise, to createthe securesite, go to Virtual Host Management, and selectCreateanSSLVirtual Host. We usethefollowing values:

Addr ess: 192.168.1.71

Administrator E-Mail: [email protected]

Server Name: www.linuxlockbox.com

Webmaster: ryan

Group: lockboxweb

We have now successfullycreatedthesecurewebsite.

Oncethis is done,thefollowing directoriesfor thenormalsitewill becreated:

/home/httpd/www.linuxlockbox.com-80/cgi-bin/home/httpd/www.linuxlockbox.com-80/html/home/httpd/www.linuxlockbox.com-80/logs

And thefollowing directoriesfor thesecuresite:

/home/httpd/www.linuxlockbox.com-443/cgi-bin/home/httpd/www.linuxlockbox.com-443/html/home/httpd/www.linuxlockbox.com-443/logs/home/httpd/www.linuxlockbox.com-443/ssl

Oncethe above stepshave beencompleted,the Lockbox is readyto serve web-pagesfor thefollowing sites:

http://www.linuxlockbox.com/https://www.linuxlockbox.com/

Thenext stepis to populateyoursiteswith content.For moreinformationon thisandthemany otheraspectsof theWebTool, pleasereferto theUserGuide.


B I SM

O CODES

B.1 Curr encyCodes(ISO 4217)Neededfor AllCommerce

ADP AndorranPeseta

AED UnitedArabEmiratesDirham

AFA AfghanistanAfghani

ALL AlbanianLek

ANG NetherlandsAntillian Guilder

AOK AngolanKwanza

ARA ArgentinianAustral

ATS AustrianSchilling

AUD AustralianDollar

AWG ArubanFlorin

BBD BarbadosDollar

BDT BangladeshiTaka

BEF BelgianFranc

BGL BulgarianLev

BHD BahrainiDinar

BIF BurundiFranc

BMD BermudianDollar

BND BruneiDollar

BOB BolivianBoliviano

BRC BrazilianCruzeiro

BSD BahamianDollar

SectionB.1 Currency Codes(ISO4217)Neededfor AllCommerce

BTN BhutanNgultrum

BUK BurmaKyat

BWP BotswanianPula

BZD BelizeDollar

CAD CanadianDollar

CHF SwissFranc

CLF ChileanUnidadesdeFomento

CLP ChileanPeso

CNY Yuan(Chinese)Renminbi

COP ColombianPeso

CRC CostaRicanColon

CSK CzechKoruna

CUP CubanPeso

CVE CapeVerdeEscudo

CYP CyprusPound

DDM EastGermanMark (DDR)

DEM DeutscheMark

DJF Djibouti Franc

DKK DanishKrone

DOP DominicanPeso

DZD AlgerianDinar

ECS EcuadorSucre

EGP EgyptianPound

ESP SpanishPeseta

ETB EthiopianBirr


ISO CODES AppendixB

FIM FinnishMarkka

FJD Fiji Dollar

FKP FalklandIslandsPound

FRF FrenchFranc

GBP British Pound

GHC GhanaianCedi

GIP GibraltarPound

GMD GambianDalasi

GNF GuineaFranc

GRD GreekDrachma

GTQ GuatemalanQuetzal

GWP Guinea-BissauPeso

GYD GuyananDollar

HKD HongKongDollar

HNL HonduranLempira

HTG HaitianGourde

HUF HungarianForint

IDR IndonesianRupiah

IEP Irish Punt

ILS IsraeliShekel

INR IndianRupee

IQD Iraqi Dinar

IRR IranianRial

ISK IcelandKrona

ITL ItalianLira

214 UserGuide


JMD JamaicanDollar

JOD JordanianDinar

JPY JapaneseYen

KES KenyanSchilling

KHR Kampuchean(Cambodian)Riel

KMF ComorosFranc

KPW NorthKoreanWon

KRW (South)KoreanWon

KWD Kuwaiti Dinar

KYD CaymanIslandsDollar

LAK LaoKip

LBP LebanesePound

LKR Sri LankaRupee

LRD LiberianDollar

LSL LesothoLoti

LUF Luxembourg Franc

LYD LibyanDinar

MAD MoroccanDirham

MGF MalagasyFranc

MNT MongolianTugrik

MOP MacauPataca

MRO MauritanianOuguiya

MTL MalteseLira

MUR MauritiusRupee

MVR Maldive Rufiyaa


ISO CODES AppendixB

MWK Malawi Kwacha

MXP MexicanPeso

MYR MalaysianRinggit

MZM MozambiqueMetical

NGN NigerianNaira

NIC NicaraguanCordoba

NLG DutchGuilder

NOK NorwegianKroner

NPR NepaleseRupee

NZD New ZealandDollar

OMR OmaniRial

PAB PanamanianBalboa

PEI PeruvianInti

PGK PapuaNew GuineaKina

PHP PhilippinePeso

PKR PakistanRupee

PLZ PolishZloty

PTE PortugueseEscudo

PYG ParaguayGuarani

QAR QatariRial

ROL RomanianLeu

RWF RwandaFranc

SAR SaudiArabianRiyal

SBD SolomonIslandsDollar

SCR SeychellesRupee

216 UserGuide


SDP SudanesePound

SEK SwedishKrona

SGD SingaporeDollar

SHP St. HelenaPound

SLL SierraLeoneLeone

SOS SomaliSchilling

SRG SurinameGuilder

STD SaoTomeandPrincipeDobra

SUR USSRRouble

SVC El SalvadorColon

SYP SyrianPotmd

SZL SwazilandLilangeni

THB ThaiBhat

TND TunisianDinar

TOP TonganPa’anga

TPE EastTimor Escudo

TRL TurkishLira

TTD TrinidadandTobagoDollar

TWD TaiwanDollar

TZS TanzanianSchilling

UGS UgandaShilling

USD US Dollar

UYP UruguayanPeso

VEB VenezualanBolivar

VND VietnameseDong


ISO CODES AppendixB

VUV VanuatuVatu

WST SamoanTala

YDD DemocraticYemeniDinar

YER YemeniRial

YUD New Yugoslavia Dinar

ZAR SouthAfrican Rand

ZMK ZambianKwacha

ZRZ ZaireZaire

ZWD ZimbabweDollar

218 UserGuide

SectionB.2 LanguageCodes(ISO 639-2)Neededfor AllCommerce

B.2 LanguageN

Codes(ISO 639-2)Neededfor AllCommerce

A list of themostrecentlanguageISO codescanbefoundat http://lcweb.loc.gov/standards/iso639- 2/englangn.html

Becauseof thelargenumberof languagecodes,only a smallnumberof themarelistedhere:

baq Basque

dut Dutch

eng English

fre French

ger German

gre Greek,Modern(post1453)

ita Italian

per Persian

por Portuguese

rus Russian

spa Spanish

wel Welsh


C GO

ENERAL L I NUX

C.1 Intr oduction

In this sectionwe will discusssomebasicLinux knowledgefor administeringyour Lockbox from theconsoleor anSSHconnection.This sectionis moreforadvancedusers.You have to becareful,you cancorruptthesystemconfigurationresultingin improperoperationof yourLockbox.

C.1.1 Root Accesson Your Lockbox

su is a small programthat givesyou the ability to login asthe root userfrom aremoteconnection.To helpincreasesecurityyou arepreventedfrom runningsu.The only waysto gain root accessis to either login asroot from the consoleormake anSSHconnectionto theLockboxastherootuser.

All loginsviaSSH, bothrootloginsandnormaluserloginsareloggedin /var/log/syslog andarefilteredinto /var/log/audit/ssh_authorization.log , /var/log/audit/su_logins.log , and/var/log/audit/su_failed.log . Youcanfindconsoleloginsin the/var/log/audit/pam.logwhichwill containall successfulandfailedlogin attemptsfrom theconsole.

SectionC.2 BasicBashCommands

C.2 BasicP

BashCommands

Bash,or theBourneAgainShell,is thesuccessorto sh. Bashis thedefaultsystemshell you will beusingto interfacewith your Lockboxwhenyou login via SSHor theconsole.Herewe will cover somebasiccommandsfor moving aroundthesystemanddoing someminor work. If you will be doing mostof your editingfrom thecommandline wehighly recommendpickingupabookonusingbashorgeneralUnix commands.

NOTE: You will find /bin/sh on your system.It is really a link to /bin/bash .This is donefor compatibilityreasons.

C.2.1 Moving Ar ound the System

When you first login you will be sitting in your homedirectory. Most likely/home/username/ . Youcangeta listing of thedirectorycontentsby typing:

$ ls

or for a longview of thelisting with timestamps,file permissionsandfile owner-shipstype:

$ ls -l

Youcanmove from directoriesby typing

$ cd directory-name

cd by itself will bringyoubackto yourhomedirectory.

Directoriesarereferencedwith a slash( / ). / beingtheroot directory. Soto goto the/etcdirectoryyousimply type

$ cd /etc

to referencethecurrentdirectorywe usea singleperiod,’.’ andto referencethepreviousdirectorywe usetwo periods,’..’. So if you arein your homedirectoryandyouwantto go to adifferentusersdirectoryyoucantype:


GENERAL L INUX AppendixC

$ cd ../different-user

which is equivalentto:

$ cd /home/different-user

At any pointusingtheTAB key aftertypingafew charactersin at thebashpromptwill make bashfill in therestof thefile or directorynamethatmatcheswhatyouhave typed. If thereis morethanonematch,tapthetabkey twice andit will listall thematches.

C.2.2 File Manipulation

Therearemany waysto alter files on your system.You cancopy, delete,move,changeattributesetc.Hereis thethreebasicfile manipulationcommands,cp,rm,andmv -> Copy, remove andmove. They areusedasfollows:

$ cp file1 file2ex: $ cp /home/nick/new_httpd.conf /etc/httpd/conf/httpd.conf

$ rm fileex: $ rm /home/nick/new_httpd.conf

$ mv file1 file2ex: $ mv /home/nick/new_httpd.conf /etc/httpd/conf/httpd.conf

You alsohave controlover theattributesandownershipof a file. Runningchownandchgrpyou canchangethefilesownerships:

$ chown nick *.html$ chgrp nick *.html

Theabovetwo commandswill giveusernick completeownershipovereveryhtmlfile in thecurrentdirectory. You canshortentheabove commandby typing:

$ chown nick:nick *.html

This changesboth theownershipandgroupin oneshot. You canchangethefilepermissionsusingthechmodprogram.By typing:

$ chmod 644 *.html

Thatwill changetheaccessto read/writeby theownerandreadonly by usersinthespecifiedgroupandall users.Therearemany moreoptions,too many to listhere,chmodcanuse.

222 UserGuide

SectionC.2 BasicBashCommands

C.2.3 EditingQ

a File

Youbasicallyhave two optionsfor file editingfrom theconsole,Vi andPico.

Vi hasthe mostdifficult learningcurve but is the mostpowerful editor. Pico ismucheasierto learn.All thecommandsarelaid out in front of you. Pico,howevercanhave somestrangeeffectson files andis not nearlyaspowerful astheothertwo editors.

YourLockboxcomeswith Vi andPicoinstalledonit. To loadtheVi editorsimplytype:

$ vi fileToEdit

To startthePicoeditortype:

$ pico fileToEdit

If youdon’t entera filenameit will startby editinga blankdocument.

We recommendusingVi if you will bedoingmostof your editingfrom thecon-sole. If you don’t have experiencewith vi you’ll want to useoneof the manyresourcesasit’susemaynot beimmediatelyobvious.



C.3 FileR

SystemStructur e

The EnGardeLinux systemis designedwith the file systemstandardsin mind.Here is a brief breakdown of the directoriesandtheredescriptions(taken fromFilesystemHierarchy Standard- ver2.1):

/ - the root directory|-bin Essential command binaries|-boot Static files of the boot loader|-dev Device files|-etc Host-specific system configuration|-home User home directories

|-lib Essential shared libraries and| kernel modules

|-mnt Mount point for mounting a| filesystem temporarily|-root Home directory for the root user|-sbin Essential system binaries|-tmp Temporary files|-usr Secondary hierarchy|-var Variable data

This is justabrief summaryof themainrootfile system.For moredetailedinfor-mationyoucandownloadtheFilesystemHierarchy Standardfrom http://www.pathname.com/fhs/ or you can view the PDF or PostScript(.PS) file in-cludedin the documentdirectoryon the EnGardeCD includedwith your Lock-box.

224 UserGuide

SectionC.4 ServicesandDaemons

C.4 SerS vicesand Daemons

Linux hastheability to startandstopservicesanddaemonson thefly. A serviceis generallysomethinglike POP3or an FTP server andaremanagedusingfilesin the /etc/inet.d/ directory. You canalsohave servicesranfrom theinit.dscripts.Herearea few commandswith their results:

$ /etc/init.d/crond startStarting crond: [ OK ]$ /etc/init.d/d stopShutting down crond: [ OK ]$ /etc/init.d/crond restartShutting down crond: [ OK ]Starting crond: [ OK ]$ /etc/init.d/crond statuscrond (pid 18529 18525 18522) is running

Not all commandsin this directoryhave theabove options.To geta list of whateachonecando, typethefilenameby itself.

This is primarily usedif youneedto shutdown adaemonfor maintenanceor otherreasons.Remember, when you make modificationsto configurationfiles for adaemon,you generallyhave to restartthat daemonbeforethe changescantakeeffect.



C.5 GrT oupsand Users

File and directory permissionsare the basicmeansfor providing securityon asystem.They arealsothelastline of defenseagainstanunauthorizeduserreadingor modifying information that doesnot belongto them. A properlyconfiguredsystemcontainsfiles and directorieswhich are only accessibleto the usersinwhich wereauthorizedto accessthosefiles anddirectories.Thesetof rulesthata file or directory is given to tell it who can and can’t accessit are known aspermissions.Thesefile anddirectorypermissionsareassignedby bothuserandgroup.

Eachfile anddirectoryhasthreesetsof permissionsassociatedwith it. It givespermissionsto owner, groupandother. Below is theresultof a sampledirectorylisting producedby executingls -l , displayedwith eachfield brokendown:

Field 1: Permissionsfor this file. We will breakdown theseninefile permis-sionsettingsin thenext section.

Field 2: Numberof hard links to this file or directory. Theselinks can bedirectories.

Field 3: Ownerof thefile. Theusersusernameis displayed,if no usernameis associatedwith theownerthentheuserID numberis displayed.

Field 4: Thegroupto which thefile belongs.A groupnamewill bedisplayedhere,if no groupnameis associatedwith theID thentheID numberis displayed.

Field 5: This is thesizeof thefile in bytes.

Field 6: Thedateof thelasttime thefile wasmodified.

Field 7: Thenameof thefile.

Therearethreeoptionsfor file permissions.Read(r), write (w) andexecute(x).Thesethreeoptionscaneachbeassignedto the user, groupandother attributesof eachfile anddirectory. We canbreakdown field oneabove asfollows:

226 UserGuide

SectionC.5 GroupsandUsers

1222333444U-rw-r--r--

1. SpecialFlag

2. Ownerpermissions

3. Grouppermissions

4. Otherpermissions

We have Sasa specialattribute.Hereis a list of specialattributes:

K d - Directory

K s - socket

K b - blockspecialfile (IE: /dev/hda )

K c - characterspecialfile (IE: /dev/tty )

K l - syboliclink

K p - namedpipe

Next we have the owner of the file, followed by the groupandfinally the other.Eachonecanhave theirown setof read,write andexecutablepermissions.


D FV

I REWAL L S AND PROXY SERVERS

D.1 Configuring a Fir ewall or Proxy Server

A firewall is a systemdesignedto keepeverythingbehindit safefrom theoutsideworld. It scansincomingconnectionsanddetermineswhetheror not theconnec-tion matchesoneof a list of pre-definedaccesscontrol rule, acceptsor rejectingtheconnection.

If youLockboxwill bepositionedbehindfirewall youwill needto configureyourfirewall to allow the Lockbox accessto the outsideworld. Below are a list ofportsandwhat they are. You maynot have all of the listedportsopenedon yourLockboxif youdon’t have it configuredto. For example,if yourLockboxis notaDNSserver youwill not have theDNSport53opened.

22/tcp This is the SSHport. If you want to allow anyonefrom outsidetoSSHinto yourmachineyoumustopenthis port

25/tcp This is the SMTP service. If this machinewill be receiving e-mailthis portmustbeavailable.

53/tcp&udp This is theDNS service.You will needto have this opened.Config-uringDNSto work throughafirewall or proxyservercanbedifficultandit is recommendedto refer to your firewall manualfor completeinstructions.

80/tcp If the Lockbox is going to be a Web server you will needto enableaccessto this port.

443/tcp If theLockbox is a Webserver andwill behostinga securesiteyouwill needto openthis port to supportSSL

993/tcp If theLockboxwill beoffering SecureIMAP you will needto havethis port open.

995/tcp SecurePOP3will be availablefrom this port if the Lockbox is run-ning it.

1022/tcp This is the userpassword changerportion of the GD WebTool. Ifyou want to give outsideusersto availability to changetheir ownpasswordvia theGD WebTool youwill needto openthis port up.

SectionD.1 ConfiguringaFirewall or ProxyServer

1023/tcp This is theactualGD WebTool for theadministrator. If you will beadministratingthis from outsideyouwill needto opentheport.

For moreinformationaboutfirewalls therearemany booksandon-linedocumen-tation. Refer to your firewall documentationfor specificinstructionson how topermit theseservicesthroughyour firewall. Additionally, herearea few refer-ences:

K Zwicky, Cooper& Chapman.Building InternetFirewalls,June2000.Copy-right O’Reilly & Associates,Inc. 2000.

K Mark Grennan,[email protected] andProxyServer HOWTO,Feb. 26,2000.Copyright Mark Grennan,2000.


FIREWALLS AND PROXY SERVERS AppendixD

D.2 DisablingW

Proxy Settingsin Your Browser

You will needto disableproxy andfirewall settingsin your browserin ordertoaccessthe inital configurationtool on the Lockbox. Directionsaregiven belowfor bothNetscapeNavigatorandInternetExplorer.

D.2.1 NetscapeNavigator

To disablethe proxy settingsin NetscapeNavigator you will needto be at themain NetscapeNavigator window. Click the Edit menubutton and thenselectPreferencesfrom thepull-down menu.

You will thenbebroughtto thePreferencesmenu.By clicking on theAdvancedoptionin themenu“tree” on theleft will bringup theProxySettings.

230 UserGuide

SectionD.2 DisablingProxySettingsin YourBrowser

Click theradiobuttonlabeledDirectconnectionto theInternetandthenclick Ok.YourNetscapebrowseris now readyto connectto yourLockbox.

D.2.2 Inter net Explorer

To disabletheproxy settingsin InternetExploreryou will needto beat themainInternetExplorerwindow. Click the Tools menubutton andthenselectInternetOptionsfrom thepull-down menu.


FIREWALLS AND PROXY SERVERS AppendixD

Onceyou selectInternetOptionsyou will bepresentedwith theInternetOptionsdialogbox. At thetop of thebox therearea list of tabs,selectConnection. FromtheConnectionsectionclick theLanSettingsbutton.

After clicking the Setupbutton the proxy information will be displayed. Youwant to turn off all your proxy server settingsso you have to make sureall thecheckboxesareNOT checked.Oncethis is doneclick theOK buttonto finish.

232 UserGuide

SectionD.2 DisablingProxySettingsin YourBrowser

Youarenow readyto connectto yourLockboxwith InternetExplorer.


E CX ERTI FI CATES

E.1 GeneralCertificate Inf ormation

Herewe will just briefly cover somebasiccertificateinformationyou mayneedto know to getyourcertificatesproperlyworking.

A new certificateis only valid for 365days,or 1 year. After this periodyou mustgetanew certificate.If youhaveasignedcertificateyouhave theoptionto renewthatcertificate,whichusuallyrequiresa fee.

E.1.1 Getting a Certificate Signed

The two mostcommoncertificatecompaniesareVerisignandThawte. To get acertificatesigned,generatea CSRasdescribedin CertificateManagementfoundin Section4.3andfollow theirdirectionsto sendit to theappropriateCA.

They will thenrequestproof of your right to usethecertifiedorganizationname(Articlesof incorporation),proofof yourregistrationof thedomainnameyouwillbeusing(from theInterNICwhoisdatabase),to obtainyourdomainnamedetailsgo to:

http://rs.internic.net

And finally a letterof authorizationfrom anagentof your company or organiza-tion.

Onceeverythingis authorizedthey will sendyoubackasignedcertificate.PleasereadtheirWebsites:

http://www.verisign.comhttp://www.thawte.com

for detailedinformationon submittinga certificateto besignedor go directly totheir registrationpages:

http://digitalid.verisign.com/s er ver /e nro ll Int ro .ht mhttp://www.thawte.com/certs/ser ve r/r eques t. htm l

If you get a certificatesignedby a smallerCertificateAuthority, NetscapeandInternetExplorermaybring up a warningthat it doesnot recognizetheCA. Thismaymakesomeusersuncomfortableandinsecureaboutusingyoursite.However,oneof theseCAscanprovideyouwith asignedcertificateatamuchreducedcost.

SectionE.2 AcceptinganUnsignedCertificate

E.1.2 Certificates,Y

IP and Virtual Host Issues

A certificateis boundto a domainnameregardlessof the IP address.Thereforeif you registera certificateyou will registerit underyour domainname.Unfortu-natly dueto currentprotocalrestrictionsyou canonly have onecertificateper IPaddress.

UsingaseparateIP for eachdomainnamelocatedonyourLockboxwill giveyoutheability to assigna separatecertificateto eachdomain.

E.2 Acceptingan UnsignedCertificate

During the initial login during the configurationof your Lockbox and/orwhenconnectingto theGD WebTool youwill bepromptedwith thefollowing screen:

Your browserwill askyou if you want to acceptthe certificateattachedto yourLockbox. Thereasonfor this is GuardianDigital hassignedthecertificateandisnotaCertificateAuthority (CA) suchasVerisignandThawte. Having thiscertifi-catesignedby aCA is notnecessarysinceyoucanverify thatyouareconnectingto yourown Lockbox.


CERTIFICATES AppendixE

YouwillZ wantto acceptthis certificate.Click theNext buttonto continue.

This next screenwill displaybrief informationconcerningthe certificate.Thereis a button you canclick, More Infor... for detailedinformationconcerningthecertificate.Click Next to continue.

236 UserGuide


Now you will beaskedin whatway you wantto acceptthis certificate.You havethreeoptionshere.Thefirst optionwill only acceptthecertificatefor thecurrentsession.So whenyou shutyour browserdown you will be promptedwith thesamescreensthenext timeyou try to login to theGD WebTool.

Thesecondoptionwill tell your browserto never acceptthecertificate.This willlock yououtof GD WebTool.

Finally thethird optionwill acceptthecertificateuntil it expires.Whenit expiresanda new certificateis put in it’s placeyou will be promptedagain with thesesamemenus.

If you will bedoingyour administrationvia theGD WebTool on thecurrentma-chineit is recommendedyouselectAcceptthiscertificateforever (until it expires)option.Onceyouhave madeyourdecisionselecttheNext button.


CERTIFICATES AppendixE

This fourthscreenwill inform youof thepossibilityof fraudandinsecuritywhenusingan unsignedcertificate. Sinceyou know the Lockbox andcertificatebothcamefrom GuardianDigital you canbecertainyour connectionanddatawill besecure.

238 UserGuide


This is thefinal stepandwill inform youof yourdecisionto acceptthecertificateandverify your options.Click Finish to fully acceptthecertificateandentertheGD WebTool.


F L[

I CENSES

F.1 GNU Public License(GPL)

Version2, June1991

Copyright (C) 1989,1991FreeSoftwareFoundation,Inc. 59TemplePlace- Suite330,Boston,MA 02111-1307,USA

Everyoneis permittedto copy anddistributeverbatimcopiesof this licensedocu-ment,but changingit is notallowed.

Preamble

The licensesfor mostsoftwarearedesignedto take away your freedomto shareandchangeit. By contrast,theGNU GeneralPublicLicenseis intendedto guar-anteeyourfreedomto shareandchangefreesoftware–tomakesurethesoftwareisfreefor all its users.ThisGeneralPublicLicenseappliesto mostof theFreeSoft-wareFoundation’s softwareandto any otherprogramwhoseauthorscommit tousingit. (SomeotherFreeSoftwareFoundationsoftwareis coveredby theGNULibrary GeneralPublicLicenseinstead.)Youcanapplyit to yourprograms,too.

When we speakof free software, we are referring to freedom,not price. OurGeneralPublicLicensesaredesignedto make surethatyou have the freedomtodistributecopiesof freesoftware(andchargefor thisserviceif youwish),thatyoureceivesourcecodeor cangetit if youwantit, thatyoucanchangethesoftwareorusepiecesof it in new freeprograms;andthatyouknow youcando thesethings.

To protectyour rights, we needto make restrictionsthat forbid anyoneto denyyou theserightsor to askyou to surrendertherights. Theserestrictionstranslateto certainresponsibilitiesfor you if youdistributecopiesof thesoftware,or if youmodify it.

For example,if you distribute copiesof sucha program,whethergratisor for afee,you mustgive therecipientsall therightsthatyou have. You mustmake surethatthey, too, receive or cangetthesourcecode.And you mustshow themthesetermssothey know their rights.

Weprotectyourrightswith two steps:(1) copyright thesoftware,and(2)offer youthis licensewhichgivesyoulegal permissionto copy, distributeand/ormodify thesoftware.

Also, for eachauthor’sprotectionandours,wewantto makecertainthateveryoneunderstandsthat thereis no warrantyfor this free software. If the software is

SectionF.1 GNU PublicLicense(GPL)

modified\ by someoneelseandpassedon,wewantits recipientsto know thatwhatthey have is not the original, so that any problemsintroducedby otherswill notreflecton theoriginalauthors’reputations.

Finally, any freeprogramis threatenedconstantlyby softwarepatents.We wishto avoid the dangerthat redistributorsof a free programwill individually obtainpatentlicenses,in effect making the programproprietary. To prevent this, wehave madeit clearthatany patentmustbelicensedfor everyone’s freeuseor notlicensedatall.

The precisetermsandconditionsfor copying, distribution andmodificationfol-low.

TERMSAND CONDITIONSFORCOPYING,DISTRIBUTION AND MODI-FICATION

0. This Licenseappliesto any programor otherwork which containsa noticeplacedby thecopyright holdersayingit maybedistributedunderthetermsof thisGeneralPublicLicense.TheProgram,below, refersto any suchprogramor work,andawork basedontheProgrammeanseithertheProgramor any derivativeworkundercopyright law: thatis to say, a work containingtheProgramor a portionofit, eitherverbatimor with modificationsand/ortranslatedinto anotherlanguage.(Hereinafter, translationis includedwithout limitation in the termmodification.)Eachlicenseeis addressedasyou.

Activities other than copying, distribution and modificationare not coveredbythis License;they areoutsideits scope.Theactof runningtheProgramis not re-stricted,andtheoutputfrom theProgramis coveredonly if its contentsconstitutea work basedon theProgram(independentof having beenmadeby runningtheProgram).Whetherthatis truedependsonwhattheProgramdoes.

1. You maycopy anddistributeverbatimcopiesof theProgram’s sourcecodeasyoureceive it, in any medium,providedthatyouconspicuouslyandappropriatelypublishon eachcopy anappropriatecopyright noticeanddisclaimerof warranty;keepintact all the noticesthat refer to this Licenseand to the absenceof anywarranty; and give any other recipientsof the Programa copy of this Licensealongwith theProgram.

You maychargea feefor thephysicalactof transferringa copy, andyou mayatyouroptionoffer warrantyprotectionin exchangefor a fee.

2. You maymodify your copy or copiesof theProgramor any portionof it, thusformingawork basedontheProgram,andcopy anddistributesuchmodificationsor work underthe termsof Section1 above, provided that you alsomeetall oftheseconditions:


L ICENSES AppendixF

a) You mustcausethe modifiedfiles to carry prominentnoticesstatingthat youchangedthefiles andthedateof any change.

b) Youmustcauseany work thatyoudistributeor publish,thatin wholeor in partcontainsor is derived from the Programor any part thereof,to be licensedasawholeatno chargeto all third partiesunderthetermsof this License.

c) If themodifiedprogramnormallyreadscommandsinteractively whenrun,youmustcauseit, whenstartedrunningfor suchinteractive usein themostordinaryway, to print or displayanannouncementincludinganappropriatecopyright no-tice and a notice that there is no warranty(or else,sayingthat you provide awarranty)andthatusersmayredistributetheprogramundertheseconditions,andtelling the userhow to view a copy of this License. (Exception: if the Programitself is interactive but doesnot normallyprint suchanannouncement,your workbasedon theProgramis not requiredto print anannouncement.)

Theserequirementsapplyto themodifiedwork asawhole. If identifiablesectionsof thatwork arenot derivedfrom theProgram,andcanbereasonablyconsideredindependentandseparateworks in themselves, thenthis License,andits terms,do not apply to thosesectionswhenyou distribute themasseparateworks. Butwhenyoudistributethesamesectionsaspartof awholewhich is awork basedonthe Program,the distribution of the wholemustbe on the termsof this License,whosepermissionsfor otherlicenseesextendto theentirewhole,andthusto eachandeverypartregardlessof whowroteit.

Thus, it is not the intent of this sectionto claim rights or contestyour rights towork written entirely by you; rather, the intent is to exercisethe right to controlthedistribution of derivative or collective worksbasedon theProgram.

In addition, mereaggregation of anotherwork not basedon the ProgramwiththeProgram(or with a work basedon theProgram)on a volumeof a storageordistributionmediumdoesnotbringtheotherwork underthescopeof thisLicense.

3. Youmaycopy anddistributetheProgram(or awork basedon it, underSection2) in objectcodeor executableform underthe termsof Sections1 and2 aboveprovidedthatyoualsodooneof thefollowing:

a)Accompany it with thecompletecorrespondingmachine-readablesourcecode,whichmustbedistributedunderthetermsof Sections1 and2 aboveonamediumcustomarilyusedfor softwareinterchange;or,

b) Accompany it with awrittenoffer, valid for at leastthreeyears,to giveany thirdparty, for a chargeno morethanyour costof physically performingsourcedistri-bution, a completemachine-readablecopy of the correspondingsourcecode,to

242 UserGuide


bedistrib] utedunderthetermsof Sections1 and2 aboveonamediumcustomarilyusedfor softwareinterchange;or,

c) Accompany it with the informationyou received as to the offer to distributecorrespondingsourcecode. (This alternative is allowedonly for noncommercialdistribution and only if you received the programin object codeor executableform with suchanoffer, in accordwith Subsectionb above.)

The sourcecodefor a work meansthe preferredform of the work for makingmodificationsto it. For anexecutablework, completesourcecodemeansall thesourcecodefor all modulesit contains,plus any associatedinterfacedefinitionfiles,plusthescriptsusedto controlcompilationandinstallationof theexecutable.However, as a specialexception, the sourcecodedistributed neednot includeanything that is normally distributed (in either sourceor binary form) with themajorcomponents(compiler, kernel,andsoon)of theoperatingsystemonwhichtheexecutableruns,unlessthatcomponentitself accompaniestheexecutable.

If distribution of executableor object codeis madeby offering accessto copyfrom a designatedplace,thenoffering equivalentaccessto copy thesourcecodefrom thesameplacecountsasdistribution of thesourcecode,even thoughthirdpartiesarenot compelledto copy thesourcealongwith theobjectcode.

4. You may not copy, modify, sublicense,or distribute the Programexcept asexpresslyprovided underthis License. Any attemptotherwiseto copy, modify,sublicenseor distributetheProgramis void, andwill automaticallyterminateyourrights underthis License.However, partieswho have received copies,or rights,from youunderthisLicensewill nothavetheir licensesterminatedsolongassuchpartiesremainin full compliance.

5. Youarenot requiredto acceptthisLicense,sinceyouhave notsignedit. How-ever, nothingelsegrantsyou permissionto modify or distribute the Programorits derivative works.Theseactionsareprohibitedby law if you do not acceptthisLicense.Therefore,by modifyingor distributing theProgram(or any work basedon theProgram),you indicateyouracceptanceof thisLicenseto doso,andall itstermsandconditionsfor copying, distributingor modifying theProgramor worksbasedon it.

6. Eachtime you redistribute theProgram(or any work basedon theProgram),the recipientautomaticallyreceivesa licensefrom the original licensorto copy,distributeor modify theProgramsubjectto thesetermsandconditions.You maynot imposeany furtherrestrictionsontherecipients’exerciseof therightsgrantedherein. You arenot responsiblefor enforcingcomplianceby third partiesto thisLicense.


L ICENSES AppendixF

7. If, asaconsequenceof acourtjudgmentor allegationof patentinfringementorfor any otherreason(not limited to patentissues),conditionsareimposedon you(whetherby court order, agreementor otherwise)that contradictthe conditionsof this License,they do not excuseyou from the conditionsof this License. Ifyou cannotdistribute so asto satisfysimultaneouslyyour obligationsunderthisLicenseandany otherpertinentobligations,thenasa consequenceyou maynotdistribute the Programat all. For example,if a patentlicensewould not permitroyalty-freeredistributionof theProgramby all thosewhoreceivecopiesdirectlyor indirectly throughyou, then the only way you could satisfyboth it and thisLicensewouldbeto refrainentirelyfrom distribution of theProgram.

If any portionof this sectionis heldinvalid or unenforceableunderany particularcircumstance,thebalanceof thesectionis intendedto applyandthesectionasawholeis intendedto applyin othercircumstances.

It is not thepurposeof this sectionto induceyou to infringe any patentsor otherpropertyright claimsor to contestvalidity of any suchclaims;thissectionhasthesolepurposeof protectingthe integrity of the free softwaredistribution system,which is implementedby public licensepractices.Many peoplehave madegen-erouscontributionsto thewide rangeof softwaredistributedthroughthatsystemin relianceon consistentapplicationof thatsystem;it is up to theauthor/donortodecideif heor sheis willing to distributesoftwarethroughany othersystemanda licenseecannotimposethatchoice.

This sectionis intendedto make thoroughlyclearwhat is believedto bea conse-quenceof therestof this License.

8. If the distribution and/oruseof the Programis restrictedin certaincountrieseitherby patentsor by copyrightedinterfaces,theoriginal copyright holderwhoplacestheProgramunderthis Licensemayaddanexplicit geographicaldistribu-tion limitation excludingthosecountries,sothatdistribution is permittedonly inor amongcountriesnot thusexcluded.In suchcase,this Licenseincorporatesthelimitation asif written in thebodyof this License.

9. TheFreeSoftwareFoundationmaypublishrevisedand/ornew versionsof theGeneralPublicLicensefrom time to time. Suchnew versionswill be similar inspirit to thepresentversion,but maydiffer in detail to addressnew problemsorconcerns.

Eachversionis given a distinguishingversionnumber. If the Programspecifiesa versionnumberof this Licensewhich appliesto it andany later version,youhave theoptionof following thetermsandconditionseitherof thatversionor ofany laterversionpublishedby theFreeSoftwareFoundation.If theProgramdoes

244 UserGuide


not specifya versionnumberof this License,you may chooseany versioneverpublishedby theFreeSoftwareFoundation.

10. If youwishto incorporatepartsof thePrograminto otherfreeprogramswhosedistributionconditionsaredifferent,write to theauthorto askfor permission.Forsoftwarewhich is copyrightedby theFreeSoftwareFoundation,write to theFreeSoftwareFoundation;we sometimesmake exceptionsfor this. Our decisionwillbe guidedby the two goalsof preservingthe free statusof all derivativesof ourfreesoftwareandof promotingthesharingandreuseof softwaregenerally.

NO WARRANTY

11. BECAUSETHEPROGRAMISLICENSEDFREEOFCHARGE,THEREISNO WARRANTY FORTHE PROGRAM, TO THE EXTENT PERMITTEDBYAPPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITINGTHE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THEPROGRAM AS IS WITHOUT WARRANTY OF ANY KIND, EITHER EX-PRESSEDOR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IM-PLIEDWARRANTIESOFMERCHANTABILITY AND FITNESSFORA PAR-TICULAR PURPOSE.THE ENTIRE RISK AS TO THE QUALITY AND PER-FORMANCEOFTHE PROGRAM IS WITH YOU. SHOULDTHE PROGRAMPROVE DEFECTIVE,YOU ASSUMETHE COSTOFALL NECESSARY SER-VICING, REPAIR OR CORRECTION.

12. IN NOEVENTUNLESSREQUIREDBY APPLICABLELAW ORAGREEDTOIN WRITING WILL ANY COPYRIGHTHOLDER,ORANY OTHERPARTYWHO MAY MODIFY AND/OR REDISTRIBUTE THE PROGRAM AS PER-MITTED ABOVE, BE LIABLE TO YOU FORDAMAGES,INCLUDING ANYGENERAL,SPECIAL,INCIDENTAL ORCONSEQUENTIAL DAMAGESARIS-ING OUT OFTHE USEORINABILITY TO USETHE PROGRAM (INCLUD-ING BUT NOT LIMITED TO LOSSOFDATA ORDATA BEING RENDEREDINACCURATE OR LOSSESSUSTAINED BY YOU OR THIRD PARTIES ORA FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PRO-GRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN AD-VISED OFTHE POSSIBILITYOF SUCHDAMAGES.

END OF TERMSAND CONDITIONS

TheGuardianDigital Linux LockboxCopyright c^

2000GuardianDigital, Inc.

This programis freesoftware;you canredistribute it and/ormodify it underthetermsof theGNUGeneralPublicLicenseaspublishedby theFreeSoftwareFoun-dation;eitherversion2 of theLicense,or (at youroption)any laterversion.


L ICENSES AppendixF

Thisprogramis distributedin thehopethatit will beuseful,but WITHOUT ANYWARRANTY; without even the implied warrantyof MERCHANTABILITY orFITNESSFOR A PARTICULAR PURPOSE.Seethe GNU GeneralPublic Li-censefor moredetails.

You shouldhave receiveda copy of theGNU GeneralPublicLicensealongwiththisprogram;if not,write to theFreeSoftwareFoundation,Inc.,59TemplePlace- Suite330,Boston,MA 02111-1307,USA.

246 UserGuide

SectionF.2 BSD License

F.2 BSDP

License

Copyright (c) 2000,GuardianDigital, Inc. All rightsreserved.

Redistribution andusein sourceandbinaryforms,with or without modification,arepermittedprovidedthatthefollowing conditionsaremet:

Redistributionsof sourcecodemustretaintheabove copyright notice,this list ofconditionsandthefollowing disclaimer.

Redistributions in binary form must reproducethe above copyright notice, thislist of conditionsandthefollowing disclaimerin thedocumentationand/orothermaterialsprovidedwith thedistribution.

Neitherthenameof theGuardianDigital, Inc. nor thenamesof its contributorsmay beusedto endorseor promoteproductsderived from this softwarewithoutspecificprior writtenpermission.

THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS ANDCONTRIBUTORS“ASIS” AND ANY EXPRESSORIMPLIED WARRANTIES,INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OFMERCHANTABILITY AND FITNESSFORA PARTICULAR PURPOSEAREDISCLAIMED. IN NO EVENT SHALL THE REGENTSORCONTRIBUTORSBE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EX-EMPLARY, ORCONSEQUENTIAL DAMAGES(INCLUDING, BUT NOT LIM-ITED TO, PROCUREMENTOFSUBSTITUTEGOODSORSERVICES;LOSSOF USE,DATA, OR PROFITS;OR BUSINESSINTERRUPTION) HOWEVERCAUSED AND ON ANY THEORY OF LIABILITY , WHE-THER IN CON-TRACT, STRICT LIABILITY , OR TORT (INCLUDING NEGLIGENCE OROTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFT-WARE, EVEN IF ADVISED OF THE POSSIBILITYOFSUCHDAMAGE.


L ICENSES AppendixF

F.3 A_

pacheLicense

TheApacheSoftwareLicense,1

Copyright (c) 2000TheApacheSoftwareFoundation.All rightsreserved.


1. Redistributionsof sourcecodemustretaintheabove copyright notice,thislist of conditionsandthefollowing disclaimer.

2. Redistributionsin binary form mustreproducetheabove copyright notice,this list of conditionsand the following disclaimerin the documentationand/orothermaterialsprovidedwith thedistribution.

3. The end-userdocumentationincludedwith the redistribution, if any, mustincludethefollowingacknowledgment:"Thisproductincludessoftwarede-velopedby theApacheSoftwareFoundation(http://www.apache.org/ )." Alternately, this acknowledgmentmay appearin the softwareitself,if andwhereversuchthird-partyacknowledgmentsnormallyappear.

4. Thenames"Apache"and"ApacheSoftwareFoundation"mustnot beusedto endorseor promoteproductsderived from this software without priorwrittenpermission.Forwrittenpermission,[email protected] .

5. Productsderived from this softwaremaynot becalled"Apache",nor may"Apache" appearin their name,without prior written permissionof theApacheSoftwareFoundation.

THIS SOFTWARE IS PROVIDED “AS IS” AND ANY EXPRESSEDOR IM-PLIEDWARRANTIES,INCLUDING, BUT NOT LIMITED TO,THEIMPLIEDWARRANTIES OF MERCHANTABILITY AND FITNESSFORA PARTICU-LAR PURPOSEARE DISCLAIMED. IN NO EVENT SHALL THE APACHESOFTWAREFOUNDATION ORITSCONTRIBUTORSBELIABLE FORANYDIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSE-QUENTIAL DAMAGES(INCLUDING, BUT NOT LIMITED TO, PROCURE-MENT OF SUBSTITUTEGOODSOR SERVICES; LOSSOF USE,DATA, ORPROFITS;OR BUSINESSINTERRUPTION) HOWEVER CAUSEDAND ONANY THEORY OF LIABILITY , WHETHER IN CONTRACT, STRICT LIA-BILITY, ORTORT (INCLUDING NEGLIGENCEOROTHERWISE)ARISING

248 UserGuide

SectionF.3 ApacheLicense

IN ANY WAY OUT OF THE USEOF THIS SOFTWARE, EVEN IF ADVISEDOFTHE POSSIBILITYOFSUCHDAMAGE.

This softwareconsistsof voluntarycontributionsmadeby many individualsonbehalfof theApacheSoftwareFoundation.For moreinformationon theApacheSoftwareFoundation,pleasesee<http://www.apache.org/ >. Portionsofthis softwarearebaseduponpublic domainsoftwareoriginally written at theNa-tional Centerfor SupercomputingApplications,University of Illinois, Urbana-Champaign.


L ICENSES AppendixF

F.4 OpenSSLa License

Copyright (c) 1998-2000TheOpenSSLProject.All rightsreserved.


1. Redistributionsof sourcecodemustretaintheabove copyright notice,this listof conditionsandthefollowing disclaimer.

2. Redistributionsin binaryform mustreproducetheabove copyright notice,thislist of conditionsandthefollowing disclaimerin thedocumentationand/orothermaterialsprovidedwith thedistribution.

3. All advertisingmaterialsmentioningfeaturesor useof this softwaremustdis-play the following acknowledgment:"This productincludessoftwaredevelopedby theOpenSSLProjectfor usein theOpenSSLToolkit. (http://www.openssl.org/ )"

4. The names"OpenSSLToolkit" and"OpenSSLProject"mustnot be usedtoendorseor promoteproductsderivedfrom thissoftwarewithoutprior writtenper-mission.Forwrittenpermission,[email protected] .

5. Productsderived from this softwaremay not be called"OpenSSL"nor may"OpenSSL"appearin theirnameswithoutpriorwrittenpermissionof theOpenSSLProject.

6. Redistributionsof any form whatsoevermustretainthefollowing acknowledg-ment:"This productincludessoftwaredevelopedby theOpenSSLProjectfor usein theOpenSSLToolkit (http://www.openssl.org/ )"

THIS SOFTWARE IS PROVIDED BY THE OpenSSLPROJECT“AS IS” ANDANY EXPRESSEDOR IMPLIED WARRANTIES, INCLUDING, BUT NOTLIMITED TO,THE IMPLIED WARRANTIESOFMERCHANTABILITY ANDFITNESSFORA PARTICULAR PURPOSEAREDISCLAIMED. IN NOEVENTSHALL THE OpenSSLPROJECTORITS CONTRIBUTORSBE LIABLE FORANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,EXEMPLARY, ORCON-SEQUENTIAL DAMAGES(INCLUDING, BUT NOT LIMITED TO,PROCURE-MENT OF SUBSTITUTEGOODSOR SERVICES; LOSSOF USE,DATA, ORPROFITS;OR BUSINESSINTERRUPTION) HOWEVER CAUSEDAND ONANY THEORY OF LIABILITY , WHETHER IN CONTRACT, STRICT LIA-BILITY, ORTORT (INCLUDING NEGLIGENCEOROTHERWISE)ARISINGIN ANY WAY OUT OF THE USEOF THIS SOFTWARE, EVEN IF ADVISEDOFTHE POSSIBILITYOFSUCHDAMAGE.

250 UserGuide

SectionF.4 OpenSSLLicense

ThisproductincludescryptographicsoftwarewrittenbyEricYoung([email protected] ). ThisproductincludessoftwarewrittenbyTim Hudson([email protected] ).


G GO

L OSSARY

attrib utes (ext2fs-specific)In addition to standardUnix permissions,the ext2file systemcontainsadditionalattributes,which thefile systemdriver hon-ors whenever the file is accessedor modified. Attributesaresetor unsetby the CHATTR command,andit is commonto refer to thebits setby thename. The “immutable” bit is particularlypopularamongsystemadmin-istratorstrying to protectcritical files from unintentionaldestructionby aninattentive ROOT user.

authentication Theprocessof knowing that thedatareceivedis thesameasthedatathatwassent,andthattheclaimedsenderis in facttheactualsender.

backup (or archive) Both of thesetermsareusedasnounsandverbs.Thenounform refersto any copy of a setof files (andthemeta-dataassociatedwiththem)on someform of removablemedia.Theverbform refersto any pro-cessof creatingsucha set.An extra copy of a setof files to non-removablestorageis sometimesreferredto as“a backup”– but this is morepreciselyreferredto as“ replication” or “mirroring” or (in somecases)“versioncon-trol”

bastionhost A computersystemthat mustbe highly securedbecauseit is vul-nerableto attack,usuallybecauseit is exposedto theInternetandis amainpoint of contactfor usersof internalnetworks. It getsits namefrom thehighly fortified projectson the outerwalls of medieval castles. Bastionsoverlookcritical areasof defense,usuallyhaving strongwalls,roomfor ex-tra troops,andtheoccasionalusefultub of boiling hot oil for discouragingattackers.

broadcast Thebroadcastaddressis a specialaddressthatevery hoston thenet-work listensto in additionto its own uniqueaddress.Thisaddressis theonethatdatagramsaresentto if every hoston thenetwork is meantto receiveit. Certaintypesof datalike routinginformationandwarningmessagesaretransmittedto thebroadcastaddressso thatevery hoston thenetwork canreceive it simultaneously. Therearetwo commonlyusedstandardsfor whatthe broadcastaddressshouldbe. The mostwidely acceptedoneis to usethe highestpossibleaddresson the network asthe broadcastaddress.Anexampleon aninternalnetwork would be192.168.1.255.For somereasonothersiteshave adoptedtheconventionof usingthenetwork addressasthebroadcastaddress.In practiceit doesn’t mattervery muchwhich you use

SectionG.0

but you mustmake surethatevery hoston thenetwork is configuredwiththesamebroadcastaddress.

buffer overflow Commoncodingstyle is to never allocatelargeenoughbuffers,andto not checkfor overflows. Whensuchbuffersoverflow, theexecutingprogram(daemonor set-uidprogram)canbe tricked in doing someotherthings. Generallythis worksby overwriting a function’s returnaddressonthestackto point to anotherlocation.

denial of service An attackthat consumesthe resourceson your computerforthingsit wasnot intendedto bedoing, thuspreventingnormaluseof yournetwork resourcesfor legitimatepurposes.

DNS SeeDomainNameServer.

Domain NameServer TheDomainNameSystem(DNS) is thesoftwarethat isresponsiblefor convertinghostnamesinto numbersthatcomputerscanun-derstand.For example,thenamewww.guardiandigital.comcorrespondstothe host IP address63.87.101.80andvice versa. The DNS server, some-timescalledanameserver, is theprocessthatrunsontheLockboxawaitingincomingnameservicerequests.

dual-homedhost A general-purposecomputersystemthathasat leasttwo net-work interfaces.

fir ewall A componentor setof componentsthat restrictsaccessbetweena pro-tectednetwork andtheInternet,or betweenothersetsof networks.

FQDN SeeFully-QualifiedDomainName.

forward zone A forward zonecontainsa listing of the hostnamesin that zonewith theircorrespindingIP addresses.A reversezonerepresentsaddress-to-domainmapping,suchas63.87.101.80 to www.guardiandigital.com .

forwarder A forwarder is usedfor nameservers that may not necessarilybedirectly-connectedto theInternet.This maybedueto beingbehinda fire-wall, or insideof a corporatenetwork. Forwarderswill insteadonly querya specifiedadditionalnameserver for its DNS information.

Fully-Qualified Domain Name Domainnamesreflectthedomainhierarchy. Do-main namesarewritten from mostspecific(a hostname)to leastspecific(a top-level domain),with eachpart of the domainseparatedby a dot ’.’.A fully qualifieddomainname(FQDN) startswith a specifichostandendswith a top-level domain.An exampleof this couldbe:


GLOSSARY AppendixG

Name Type

lockbox.guardiandigital.com FQDNlockbox MachineNameguardiandigital.com DomainNamecom Domain

full backup This is probablythemostconfusingtermthat relatesto thesubjectof backups.It oftendoesnot mean“comprehensive.” A “ full” backupdoesnot necessarilymeanthat it includesevery file on a wholesystem.“Full”in thosecasesmeans“ includingall files in a givendatasetwithout regardto previousbackups.” In otherwords,it means“not incremental” andnot“differential.”It is betterto usethephrase“ level zero” to make this distinction.

GNU GNU’sNot Unix, arecursiveacronym. This is thenameof aprojectstartedby RichardM. Stallman,andis themissionof theFSF(FreeSoftwareFoun-dation),whichhefounded.The purposeof the GNU project is to producea “free” operatingsystemand suite of applications,utilities, and programmingtools that are non-proprietaryandunencumbered.Somemight saythey areencumberedbytheGPL(seeGPL for moreinformation).WhenLinus Torvaldscreatedandreleasedhis versionversionof Linux, itwasnoaccidentthattherewasa largebodyof freelyavailableutilities, andprogrammingtools that could be incorporatedinto Linux distributions- itbenefittedfrom the ongoingandasyet incompleteGNU project’s interimdevelopment.

GPL To protectthe GNU projectsoftwarefrom beingappropriatedfor propri-etaryuseby hardwarevendors,theFreeSoftwareFoundationreleasedtheirsoftwareundertheGPL or GeneralPublicLicense.

hard link An entry in a directory that containsa pointerdirectly the the inodebearingthe file’s meta-data. All non-symlinkdirectoryentriesare“ hardlinks.”

host A computersystemattachedto a network.

host key A key thehostwill storelocally andusedfor authenticationwhenauserkey, storedon theuserssystem,is passedto it. If bothkeys arevalid thenboththehostanduser.

254 UserGuide

SectionG.0

IP spoofingb IP Spoofingis a complex technicalattackthat is madeup of severalcomponents.It is a securityexploit thatworksby tricking computersin atrust relationshipinto thinking thatyou aresomeonethatyou really aren’t.Thereis an extensive paperwritten by daemon9,route,andinfinity in theVolumeSeven,IssueForty-Eightissueof PhrackMagazine.

ISO639-2 Languagecodes.SeeAppendixA.2 for abrief listing.

ISO4217 Countrycurrency codes.SeeAppendixA.1 for listings.

ISO9660 Themostcommonfile systemfoundonCD-ROMs.

Kernel Unix systemshave a kernelthatprovidesa systemcall interface(includ-ing IOCTL() I/O devicecontrolinterface)to allow programsto interfacedi-rectlywith hardwareandfiles. TheLinux kernelprovidesfile systems,net-working supportfor TCP/IPandotherprotocols,anddevice drivers.Thesecanbebuilt into akernel“statically” or asloadablemodules.

LIDS SeeLinux InstrusionDetectionSystem.

Linux Instrusion DetectionSystem The Linux IntrusionDetectionSystemal-lowsfinetuningof controlover resourcesandfile permissions.For detailedinformationconcerningLIDS andusingLIDS pleasereadsection9.

loadablemodules Portionsof kernel codethat have beencompiledseparatelyandthatcanbeloadedduringnormaloperationusingmodprobeor insmod.If you have LIDS runningit sealstheability to loadmodulesafter thesys-tem hasbooted. You mustshutLIDS off first, thenload your module(s).InformationoncontrollingLIDS canbefoundin Section9.

non-repudiation Thepropertyof areceiverbeingableto provethatthesenderofsomedatadid in factsendthedataeventhoughthesendermight laterdenyeverhaving sentit.

OpenSource Programsfor whichtheoriginalsourcecodeis available,for whichrelatively permissive opportunitiesto modify thecodeandsharetheresultswith othersexist, andwhicharedevelopedby peoplewhoseprimarymeansof communicationwith eachotheris theInternet.

ownership Theuser(UID) and/orgroup(GID) that is associatedwith a file, di-rectory, process,or processgroup.

packet Thefundamentalunit of communicationon theInternet.


GLOSSARY AppendixG

packet filteringb Theactiona device takesto selectively control theflow of datato andfrom a network. Packet filters allow or block packets,usuallywhileroutingthemfrom onenetwork to another(mostoftenfrom theInternettoan internalnetwork, andvice-versa). To accomplishpacket filtering, yousetup rulesthatspecifywhattypesof packets(thoseto or from aparticularIP addressor port) areto beallowedandwhattypesareto beblocked.

perimeter network A network addedbetweenaprotectednetwork andanexter-nalnetwork, in orderto provideanadditionallayerof security. A perimeternetwork is sometimescalleda DMZ.

pid Processidentifier. A numberusedby thekernelto keeptrackof thesystem-level resourcesnecessaryto switchbetweenthisprocessandothersrunningon thesystem.It is easilyvisible to a systemadministratorby useof thepscommand.In theGD WebTool, section4,youwill find detailedinstructionsonviewing anddeletingprocessesvia theWebTool.

proxy server A programthat dealswith externalserverson behalfof internalclients. Proxy clients talk to proxy servers, which relay approved clientrequeststo realservers,andrelayanswersbackto clients.

reversezone Seeforward zone.

root Root is the “superuser”of the system.Generallythe systemadministratorwill login with root privilegesto administerthesystem.You cannot loginremotelyasroot, only from theconsole.It is not recommendedto login asrootunlessyou needto sinceaccidentalerrorscanbeeasilymade.

Secure Shell A secureshell is a telnet type connectionmadeto a remotehost.This connectionis protectedwith SSL1024bitencryption.Secureshell isalsoknown for shortasSSH.

shared libraries Sharedlibrariesareobjectfiles that aredynamicallylinked toexecutablebinaryprograms.UnderLinux, sharedlibrariescanbestoredina numberof directories(usually listed in /etc/ld.so.conf ). Sharedlibraries typically includefiles under/usr/lib . If the sharedlibrariesare deletedor becomedamaged,or of the /etc/ld/so.cache file iscorrupted,thenprogramsthat rely on themwill fail to execute.Almost allnormalprogramsona systemrely onglibc.

signal UnderUnix andLinux, the signal is the mostfundamentalandcommonform of interprocesscommunications(IPC). It is alsothebasisfor “event-driven” programmingunderthesesystems.EachUnix implementationde-finesasetof signalsthatareaassociatedwith variousasynchronousevents,

256 UserGuide

SectionG.0

suchasa terminalsendingan“interrupt request”(SIGINT) or a changeinwindow size(SIGWINCH).

SSH SeeSecureShell

superuser An informalnamefor ROOT.

symlink Symboliclink. An entryin a directorythatis not a file, but containsthenameof anotherfile thatshouldnormallybeaccessedinstead.Contrastsahardlink.

Umask A settingin a Unix processthatmodifiesthepermissionson newly cre-atedfiles. It is generallyrepresentedasa three-digitoctalnumberthatwillbelogically ANDedagainstthemode666(rw-rw-rw). Executebitsarenotonnewly createdfiles in any case.

Unix Theoperatingsystemafterwhich Linux is modeled.Althoughoftenusedto refer to any operatingsystemthat provides featuresandprogramminginterfacesthat emulateUnix, the term is a trademarklegally held by TheOpenGroup.

userkey seehostkey.

virtual memory Memorybeyondwhatis actuallyavailable,but whichprogramsbelieve is actuallyavailablememoryin thesystem.Seepaging, andswap-ping.

zonetransfer A zonetransferis whena secondarynameserver, alsosometimesreferredto asaslaveserver, for azonegetsthezonedatafrom anothernameserver that is authoritative for the zone,called its masterserver. Whenasecondarynameserver startsup, it contactsits masterserver andrequestsa copy of thezonedatafor which it is responsible,storingit in theeventarequestis madefor informationin thatzone.


H Rc

EFERENCES

1. Albitz, Paul & Liu, Cricket. DNSand BIND, Third Edition. O’Reilly &Associates,Inc. 1998.

2. Carling,M, Degler, Stephen,andDennis,James.LinuxSystemAdministra-tion. New RidersPublishing,2000.

3. Mark Grennan.Firewall andProxyServerHOWTO, Feb. 26,2000.http://www.linuxdoc.org/HOWTO/Firewall-HOWTO.html.CopyrightMarkGrennan,2000

4. Hunt,Craig. TCP/IPNetworkAdministration. O’Reilly & Associates,Inc.1993

5. Laurie,Ben& Lauri, Peter, ApacheTheDefinitive Guide,SecondEdition,O’Reilly & Associates,Inc.. 1999.

6. Dave WreskiandKevin Fenzi,LinuxSecurityHow-to.http://www.linuxsecurity.com/docs/HOWTO/Security-HOWTO/, 2000

7. Wreski,Dave. It’ s a BadBadBadworld! But UnderstandingtheABC’s ofLinuxSecurityCanMake It Better!. Linux Magazine,October1999,Vol 1,Num6, pg31

8. Wreski, Dave. SystemSecurity. Linux Magazine,October2000, Vol 2,Issue10,pg34.

9. Yarger, RandyJay, Reese,George& King, Tim. MySQL& mSQL.O’Reilly& Associates,Inc. 1999

10. Zwicky, Cooper& Chapman.Building InternetFirewalls,June2000.Copy-right O’Reilly & Associates,Inc. 2000.

11. Ziegler, RobertL. LinuxFirewalls. New RidersPublishing,2000.

12. Zwicky, ElizabethD., Cooper, Simon, & Chapman,D. Brent. BuildingInternetFirewalls. O’Reilly & Associates,Inc. 2000.

Indexactive network connections,103AddressVerificationServices(AVS),

182alerts,106,107Aliases,45AllCommerce,159apache,42

backupcreatenamed,114createnew, 111delete,112deletenamed,115restore,112schedulenamed,113system,111view changedfiles,113view contentsof, 112

CashRegister, 180templates,184

changepassword,26,27,116ClientMachine,23codes

currency, 212language,219

connecting,24,35connectivity, 120

unix, 137windows,121

creditcard,180processingmodels,182

CyberCash,180

daily summary, 106directorystructure,53disk usage,103DNS,85

addressrecord,93client,76DomainName,88masterserver, 30,88,99masterservers,90Network, 88primaryserver, 30,88,99secondaryserver, 30,88slave server, 30,88zone

createnew master, 86createnew slave,89type,88

domainname,29

e-mail,82configuration,83Netscape,140Outlook,147secure,139

IMAP, 139,140,147POP3,139,147

Error404,57

FQDN,57,253Fully-QualifiedDomainName,57

gateway, 30GD Update,38groupconfigure,72

hostname,29

IE, 24,35Installing,22interface,edit,74IP address,29ISO4217,212

259

ISO639-2,d 219

kernelcapabilities,198

key generationOpenSSH,138user, 81

key management,80

LIDS, 186example,194examplescript,197file protection,194usage,189

lidsadm,189addentry, 191deleteandupdateall, 192deleteentry, 192passwordcreation,193using,190view configuration,193view status,193

LockboxConnectivity, 120log

analysis,55rotation,100statistics,56

logfile management,100loggingin, 35login banner, 110

mail, 82merchant

account,180feesandrates,181

merchantaccount,180creation,182

MindTerm,121installing,121running,122usage,131

netmask,30Netscape,24,35network

configuration,73interfaces,73

New User, 28,71

OpenSSH,137key generation,138usage,137

PID, 100,101postfix

management,82processmanagement,100processes,view, 101

RAID, 9Redirects,45

SecureShellManagement,79security, 19,37,105

alerts,106,107servername,40servicesmonitor, 104SSH,70

definition,79edit,79management,79user, 28

SSL,35connection,121

storecreation,56delete,64deletion,64edit,64

subnet,30mask,30

systemaccesscontrol,109

260

backup,38management,37,70statistics,102status,37,100time,78

timezone,31trustedhost,30,79

update,38,118user

account,70edit,72

UserAccessControl,56

virtual host,41delete,53edit,42management,37,39named

create,55delete,55

secure,41ssl,41

virtual interfacecreate,75

webdirectory, 53WebTool, 1, 22,34

AccessControl,108connecting,35login, 35mainmenu,37password,105usage,37

Windows,121

261

guardian digital lockbox u manualredes-linux.com/manuales_english/seguridad/engarde-1.0.1.pdf ·...

Documents