<chapt>介绍
<p>
撰写安全文档, 最难莫过于每个案例都是相互独立的. 需要着重考虑站点, 主机, 
或网络所处环境和安全需求. 例如, 家庭用户的安全需求则与网络银行完全不同. 
家庭用户所要面对的主要威胁来自骇客的脚本陷阱. 网络银行所必须担心的则是直接攻击. 
另外, 银行必须保证其用户数据的精确性. 简而言之, 用户必须在安全性和易用性之间作出妥协.
<!-- Is this metaphor really appropriate? Sounds like rounding errors to me, 
era -->
<p>
注意本手册只涉及与软件相关部分. 即使是世界上最好的软件也无法保护可以物理接触的计算机. 
您可以把计算机置于工作台下, 或者重兵把守的堡垒里. 然而一个正确配置的台式计算机可能比被重兵保护的充满安全漏洞的计算机更安(从软件观点来看). 很明显, 这两个方面您都要考虑.

<p>本手册仅仅在增加 Debian GNU/Linux 系统的安全方面作简要介绍. 如果您浏览过有关 Linux 安全的其它文档, 
会发现一些通用性问题可能与本手册重复. 当然, 本手册并不试图作为您的最后信息源, 而只是设法在同样的问题上提供更适合 
Debian GNU/Linux 系统的信息. 不同的发行版处理问题的方式不同(守护进程的启动就是一例); 您将发现本手册是针对 
Debian 程序和工具的.
<!-- 
# Does this approximate the intent of the original author? (FIXME: check)
# Original text said: "you will find here [sic] a different approach,
# using Debian's tools, regarding security." era
-->
<!-- IMHO yes, jfs -->

<sect id="authors">作者

<p>本手册的当前维护者是 Javier Fern&aacute;ndez-Sanguino Pe&ntilde;a <url name="jfs@computer.org" id="mailto:jfs@computer.org">. 
有关本手册任何的评论, 添加或建议, 请和他联系, 他们将会考虑添加到本手册.

<p>本手册最初只是 <url name="Alexander Reelsen" id="mailto:ar@rhwd.de"> 撰写的一篇 <em>HOWTO</em>. 
在互联网上发布后, Javier Fern&aacute;ndez-Sanguino Pe&ntilde;a <url name="jfs@debian.org" id="mailto:jfs@debian.org"> 将其合并到 
<url name="Debian 文献项目" id="http://www.debian.org/doc"> 中. 许多人为手册作出了贡献(所有贡献都在更新记录中列出), 需要特别指出以下人员做出了重要的贡献(完成了部分、章节或附录):

<list>
<item>Stefano Canepa
<item>Era Eriksson
<item>Carlo Perassi
<item>Alexandre Ratti
<item>Jaime Robles
<item>Yotam Rubin
<item>Frederic Schutz
<item>Pedro Zorzenon Neto
<item>Oohara Yuuma
<item>Davor Ocelic
</list>

<sect>手册下载
<p>
你可以从 <url name="Debian 文献项目" id="http://www.debian.org/doc/manuals/securing-debian-howto/"> 
下载或浏览最新版本的 Debian 安全手册. 或从其版本控制系统 <url name="CVS 服务器"
id="http://cvs.debian.org/ddp/manuals.sgml/securing-howto/?cvsroot=debian-doc"> 更加方便的检出.

<!-- Note to translators: adjust the en.txt to XX.txt where XX is your 
     language code -->
<p>您也可以从 Debian 文献项目站点下载 <url
id="http://www.debian.org/doc/manuals/securing-debian-howto/securing-debian-howto.zh-cn.txt"
name="文本版">. 其他格式，如PDF,(仍)还没有提供. 然而, 您可以下载或安装提供 HTML, txt 和 PDF 格式文档的 <url
id="http://packages.debian.org/harden-doc" name="harden-doc">软件包. 注意, 包中提供的文档版本和互联网上的相比可能稍旧(但是可以通过下载源码包进行构建和更新您的版本!).

<!-- 
<p>
这里可以找到旧版的 HOWTO :

<list>
<item><url name="Text-only"
id="http://www.debian.org/doc/manuals/securing-debian-howto/securing-debian-howto.zh-cn.txt">
<item><url name="HTML"
id="http://joker.rhwd.de/doc/Securing-Debian-HOWTO/Securing-Debian-HOWTO.html">
<item><url name="HTML, tarred and gzipped"
id="http://joker.rhwd.de/doc/Securing-Debian-HOWTO/Securing-Debian-HOWTO.tar.gz">
<item><url name="SGML"
id="http://joker.rhwd.de/doc/Securing-Debian-HOWTO/Securing-Debian-HOWTO.sgml">
</list>
-->
<!-- TODO: remove these stale links rather than leave references to -->
<!-- the old versions hanging around? era -->


<sect>组织信息与反馈
<p>
这是手册的正式部分. 此时，我(Alexander Reelsen)撰写了本手册的主要部分, 但是就我看来不应该停滞于此. 
自由软件伴随我成长与生活, 它是我日常使用的一部分，我猜您也如此. 任何人都可以将其反馈, 附加提示或任何其它建议寄发给我.

<p>
如果您认为您能更好的维护某个部分或章节，请与维护者联系, 您将受到欢迎. 特别是如果您发现某个部分被标记为FIXME, 
这意味着作者没有时间或关于这部分所需的知识, 请马上发邮件给他们.

<p>
本手册的主题清楚的表明及时更新相当重要, 如果您可以做到. 请贡献.

<sect>预备知识
<p>
Debian GNU/Linux 的安装并不是特别困难, 您应该可以搞定. 如果您已经有一些关于 Linux 或其它 Unix  的知识, 
并对基本安全有点熟悉, 理解本手册将更加容易, 因为本文档无法对每个细节作详细的解释(否则将是一本书, 而不是手册). 
如果您不是太熟, 那么, 您也许希望能查看一下 <ref id="references"> 有找到更加详细的信息。

<sect>需要添加一些内容(FIXME/TODO)

<p>本部分描述手册中需要修正部分的相关内容. 包含 <em>FIXME</em> 或 <em>TODO</em> 标记的一些段落说明内容(或
所需做的什么样的工作)欠缺, 本部分的目的是列举将在新的版本涉及的内容或改进版中需要做的(或可能添加的)工作。

<p>如果您觉得能为完成列表中的任何条目提供帮助(或注释), 请与主作者联系 (<ref id="authors">


<list>

<item>详述事件响应信息，也许可以从 RedHat 安全指南的 <url id="http://www.redhat.com/docs/manuals/linux/RHL-9-Manual/security-guide/ch-response.html" name="事件响应章节"> 获取一些想法.

<item>添加关于远程监控工具(检查系统可利用率)譬如 monit, daemontools 和 mon 的内容. 参见 <url
id="http://linux.oreillynet.com/pub/a/linux/2002/05/09/sysadminguide.html"> .

<item>考虑添加关于如何构建基于 Debian 的网络应用的部分(以及如基本系统, <package>equivs</package> 和 FAI 一类的信息).

<item>检查是否有 <url id="http://www.giac.org/practical/gsec/Chris_Koutras_GSEC.pdf"> 提及而这里未涉及的信息.

<item>增加关于如何在便携式电脑上设置 Debian 的内容 <url id="http://www.giac.org/practical/gcux/Stephanie_Thomas_GCUX.pdf">.

<item>增加使用 Debian GNU/Linux 配置防火墙的内容. 此部分假定要保护的是单系统(不保护其他...)并就如何测试设定进行讨论. 

<item>增加使用 Debian GNU/Linux 配置代理防火墙的内容, 以及提供代理服务的相应软件包的信息 (如 
<package>xfwp</package>, <package>xproxy</package>, 
<package>ftp-proxy</package>, <package>redir</package>, 
<package>smtpd</package>, <package>nntp-cache</package>, 
<package>dnrd</package>, <package>jftpgw</package>, <package>oops</package>, 
<package>pnsd</package>, <package>perdition</package>, 
<package>transproxy</package>, <package>tsocks</package>). 应当在手册中指出其它信息来源. 注意, Debian 现提供的是 <package>zorp</package> 软件包<em>是</em>一款代理防火墙(他们也向上游提供 Debian 包).

<item>使用 file-rc 进行服务配置的内容

<item>检查所有参考 URL, 删除/修正不再可用的部分.

<item>增加关于对一般服务器进行功能限制性替换方面的内容(Debian)。例如: 

	<list>
	<item>用 cups(软件包)本地打印?

	<item>用 lpr 远程打印

	<item>用 dnrd/maradns 替代 bind

	<item>用 dhttpd/thttpd/wn(tux?) 替代 apache

	<item>用 ssmtpd/smtpd/postfix 替代 exim/sendmail

	<item>用 tinyproxy 替代 squid

	<item>用 oftpd/vsftp 替代 ftpd

	<item>...

	</list>


<item>Debian 中更多有关内核安全补丁的内容, 包括上边提到的和具体如何使用这些补丁应用到 Debian 系统中的内容.

<list>

<item>Linux 入侵检测 (<package>lids-2.2.19</package>)

<item>Linux Trustees (在 <package>trustees</package> 软件包中)

<item><url name="NSA Enhanced Linux"
id="http://www.coker.com.au/selinux/">

<item><url name="kernel-patch-2.2.18-openwall"
id="http://packages.debian.org/kernel-patch-2.2.18-openwall">

<item><package>kernel-patch-2.2.19-harden</package>

<item><package>kernel-patch-freeswan, kernel-patch-int</package>

</list>

<item>禁用不必要的网络服务(包括 <prgn>inetd</prgn> )的内容, 这属于程序安全化部分, 但可以涉及的更广一点.

<item>有关口令转换的内容，这与策略关系更密切.

<item>策略，和用户培训策略.

<item>更多关于 tcpwrappers, 和 wrappers 的内容?

<item><file>hosts.equiv</file> 以及其它主要安全漏洞.

<item>文件共享服务方面的问题如 Samba 和 NFS? 

<item>suidmanager/dpkg-statoverrides.

<item>lpr 和 lprng.

<item>Switching off the gnome IP things.

<item>讨论 pam_chroot (参阅 <url id="http://lists.debian.org/debian-security/2002/debian-security-200205/msg00011.html">)
以及其在限制用户方面的应用.  介绍有关 <url id="http://online.securityfocus.com/infocus/1575"> 的信息.
例如, 在 Debian(while as
flash is not) 中提供 <package>Pdmenu</package>.

<item>有关 pam_chroot 的讨论, 更多信息参见
<url id="http://www.linuxfocus.org/English/January2002/aritcle225.shtml">,
<url id="http://www.networkdweebs.com/chroot.html"> 和 
<url id="http://www.linuxsecurity.com/feature_stories/feature_story-99.html">

<item>关于程序 chroot jails 的讨论. 增加 <package>Compartment</package>
和 <package>chrootuid</package> 的内容，同时也介绍一些其他软件 (makejail, jailer) 的内容.

<!-- No longer available in that URL
<item>增加由 Karl Hegbloom 提供的关于 chrooting Bind 9 的内容, 参见 <url id="http://people.pdxlinux.org/~karlheg/Secure_Bind9_uHOWTO/Secure_Bind_9_uHOWTO.xhtml">.
-->

<item>增加由 Pedro Zornenon 提供的关于 potato 中 chrooting Bind 8 的内容:(, 参见 
<url id="http://people.debian.org/~pzn/howto/chroot-bind.sh.txt"> (包括所有脚本?).

<item>更多关于日志分析软件的内容 (即 logcheck 和 logcolorise).

<item>'高级'路由(安全相关的通讯规则)

<item>限制 <prgn>ssh</prgn> 对于某些运行命令的访问.

<item>dpkg-statoverride 的使用.

<item>对用户共享 CD 刻录机的安全方法.

<item>为网络显示提供网络声音的安全方法(以便使用 X 服务器的硬件运行 X 客户端的声音)

<item>安全的网络浏览器.

<item>在 <prgn>ssh</prgn> 上设置 ftp.

<item>使用加密回环文件系统.

<item>加密整个文件系统.

<item>steganographic 工具.

<item>为一个组织设置 PKA .

<item>使用 LDAP 管理用户. 在 www.bayour.com 处有 Turbo Fredrikson 撰写的 Debian 下的 ldap+kerberos HOWTO.

<item>如何删除降低生成系统效能的信息，譬如 /usr/share/doc ，/usr/share/man (是的，不太安全).

<item>更多有关 lcap 基于软件包的 README 文件(不仅如此, <url id="http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=169465"
name="Bug #169465">) 和源自LWN的文章: <url id="http://lwn.net/1999/1202/kernel.php3"
name="内核开发">.

<item>增加 Colin 的关于如何为整个 Sid 系统设定一个 chroot 环境的内容(<url id="http://people.debian.org/~walters/chroot.html">)

<item>增加有关在一个给定系统上运行多功能 snort 嗅探器的内容(查看向 snort 提交的问题报告)

<item>增减有关配置蜜罐的内容 (<package>honeyd</package>)

<item>有关描述 FreeSwan (orphaned) 和 OpenSwan 的内容.
VPN 部分需要重写.
</list>

<sect id="changelog">更新记录/历史
<sect1>Version 3.1版 (2005年1月)
<p>Changes by Javier Fern&aacute;ndez-Sanguino Pe&ntilde;a
<list>
<item>Added clarification to ro /usr with patch from Joost van Baal
<item>Apply patch from Jens Seidel fixing many typos.
<item>FreeSWAN is dead, long live OpenSWAN.
<item>Added information on restricting access to RPC services (when
they cannot be disabled) also included patch provided by Aarre Laakso.
<item>Update aj's apt-check-sigs script.
<item>Apply patch Carlo Perassi fixing URLs.
<item>Apply patch from Davor Ocelic fixing many errors, typos, urls, grammar
and FIXMEs. Also adds some additional information to some sections.
<item>Rewrote the section on user auditing, highlight the usage of script
which does not have some of the issues associated to shell history.
</list>

<sect1>3.0 版(2004年12月)
<p>Changes by Javier Fern&aacute;ndez-Sanguino Pe&ntilde;a
<list>
<item>Rewrote the user-auditing information and include examples on how
to use script.
</list>
<sect1>2.99 版(2004年3月)

<p>Changes by Javier Fern&aacute;ndez-Sanguino Pe&ntilde;a
<list>
<item>Added information on references in DSAs and CVE-Compatibility.
<item>Added information on apt 0.6 (apt-secure merge in experimental)
<item>Fixed location of Chroot daemons HOWTO as suggested by Shuying Wang.
<item>Changed APACHECTL line in the Apache chroot example (even if its
not used at all) as suggested by Leonard Norrgard.
<item>Added a footnote regarding hardlink attacks if partitions are
not setup properly.
<item>Added some missing steps in order to run bind as named as
provided by Jeffrey Prosa.
<item>Added notes about Nessus and Snort out-of-dateness in woody
 and availability of backported packages.
<item>Added a chapter regarding periodic integrity test checks.
<item>Clarified the status of testing regarding security updates.
(Debian bug 233955)
<item>Added more information regarding expected contents in securetty
(since it's kernel specific).
<item> Added pointer to snoopylogger (Debian bug 179409)
<item> Added reference to guarddog (Debian bug 170710)
<item> Apt-ftparchive is in apt-utils, not in apt (thanks to 
Emmanuel Chantreau for pointing this out)
<item>Removed jvirus from AV list.
</list>
</sect1>

<sect1>2.98版 (2003年12月)
<p>Changes by Javier Fern&aacute;ndez-Sanguino Pe&ntilde;a 
<list>
<item>Fixed URL as suggested by Frank Lichtenheld.
<item>Fixed PermitRootLogin typo as suggested by  Stefan Lindenau.
</list>

</sect1>
<sect1>Version 2.97 (september 2003)
<p>Changes by Javier Fern&aacute;ndez-Sanguino Pe&ntilde;a
<list>

<item>Added those that have made the most significant contributions to
this manual (please mail me if you think you should be in the list and
are not).

<item>Added some blurb about FIXME/TODOs

<item>Moved the information on security updates to the beginning of
the section as suggested by Elliott Mitchell.

<item>Added grsecurity to the list of kernel-patches for security but
added a footnote on the current issues with it as suggested by Elliott
Mitchell.

<item>Removed loops (echo to 'all') in the kernel's network security
script as suggested by Elliott Mitchell.

<item>Added more (up-to-date) information in the antivirus section.

<item>Rewrote the buffer overflow protection section and added more
information on patches to the compiler to enable this kind of
protection.

</list>


<sect1>2.96版 (2003年8月)
<p>Changes by Javier Fern&aacute;ndez-Sanguino Pe&ntilde;a 
<list>
<item>Removed (and then readded) appendix on chrooting Apache. The appendix
is now dual-licensed.
</list>

<sect1>2.95版 (2003年6月)
<p>Changes by Javier Fern&aacute;ndez-Sanguino Pe&ntilde;a 
<list>
<item>Fixed typos spotted by Leonard Norrgard.
<item>Added a section on how to contact CERT for incident handling
(<url id="#after-compromise">)
<item>More information on setting up a Squid proxy.
<item>Added a pointer and removed a FIXME thanks to Helge H. F.
<item>Fixed a typo (save_inactive) spotted by  Philippe Faes.
<item>Fixed several typos spotted by Jaime Robles.
</list>

<sect1>2.94版 (2003年4月)
<p>Changes by Javier Fern&aacute;ndez-Sanguino Pe&ntilde;a
<list>
<item>Following Maciej Stachura's suggestions I've expanded the section on
limiting users.
<item>Fixed typo spotted by Wolfgang Nolte.
<item>Fixed links with patch contributed by Ruben Leote Mendes.
<item>Added a link to David Wheeler's excellent document on the footnote
about counting security vulnerabilities.
</list>

<sect1>2.93版 (2003年3月)
<p>Changes made by Frederic Schutz.
<list>
<item>rewrote entirely the section of ext2 attributes
(lsattr/chattr)
</list>

<sect1>2.92版 (february 2003年2月)
<p>Changes by Javier Fern&aacute;ndez-Sanguino Pe&ntilde;a and Frédéric Schütz.

<list>
<item>Merge section 9.3 ("useful kernel patches") into section 4.13 ("Adding
   kernel patches"), and added some content.
<item>Added a few more TODOs
<item>Added information on how to manually check for updates and also about
cron-apt. That way Tiger is not perceived as the only way to do automatic
update checks.
<item>Slightly rewrite of the section on executing a security updates due
to Jean-Marc Ranger comments.
<item>Added a note on Debian's installation (which will suggest the user
to execute a security update right after installation)
</list>

<sect1>2.91版 (2003年1月/2月)
<p>Changes by  Javier Fern&aacute;ndez-Sanguino Pe&ntilde;a (me).

<list>
<item>Added a patch contributed by  Frédéric Schütz.
<item>Added a few more references on capabilities thanks to Frédéric.
<item>Slight changes in the bind section adding a reference to BIND's 9
online documentation and proper references in the first area (Hi Pedro!)
<item>Fixed the changelog date - new year :-)
<item>Added a reference to Colin's articles for the TODOs.
<item>Removed reference to old ssh+chroot patches.
<item>More patches from Carlo Perassi.
<item>Typo fixes (recursive in Bind is recursion), pointed out by 
Maik Holtkamp.
</list>

<sect1>2.9版 (2002年12月)
<p>Changes by  Javier Fern&aacute;ndez-Sanguino Pe&ntilde;a (me).
<list>
<item>Reorganised the information on chroot (merged two sections, it didn't make much sense to have them separated)
<item>Added the notes on chrooting Apache provided by Alexandre Raitti.
<item>Applied patches contributed by Guillermo Jover.
</list>

<sect1>Version 2.8 (november 2002)
<p>Changes by  Javier Fern&aacute;ndez-Sanguino Pe&ntilde;a (me).
<list>
<item>Applied patches from Carlo Perassi, fixes include: re-wrapping the
lines, url fixes, and fixed some FIXMEs
<item>Updated the contents of the Debian security team FAQ.
<item>Added a link to the Debian security team FAQ and the Debian Developer's
reference, the duplicated sections might (just might) be removed in the future.
<item>Fixed the hand-made auditing section with comments from Michal Zielinski.
<item>Added links to wordlists (contributed by Carlo Perassi)
<item>Fixed some typos (still many around).
<item>Fixed TDP links as suggested by John Summerfield.
</list>

<sect1>Version 2.7 (october 2002)
<p>Changes by  Javier Fern&aacute;ndez-Sanguino Pe&ntilde;a (me).  Note: I still
have a lot of pending changes in my mailbox (which is currently
about 5 Mbs in size).
<list>
<item>Some typo fixes contributed by Tuyen Dinh, Bartek Golenko and 
Daniel K. Gebhart.
<item>Note regarding /dev/kmem rootkits contributed by Laurent Bonnaud 
<item>Fixed typos and FIXMEs contributed by Carlo Perassi.
</list>

<sect1>Version 2.6 (september 2002)
<p>Changes by Chris Tillman, tillman@voicetrak.com. 
<list>
<item>Changed around to improve grammar/spelling.
<item>s/host.deny/hosts.deny/ (1 place)
<item>Applied Larry Holish's patch (quite big, fixes a lot of FIXMEs)
</list>

<sect1>Version 2.5 (september 2002)
<p>Changes by Javier Fern&aacute;ndez-Sanguino Pe&ntilde;a (me). 
<list>
<item>Fixed minor typos submitted by Thiemo Nagel.
<item>Added a footnote suggested by Thiemo Nagel.
<item>Fixed an URL link.
</list>

<sect1>Version 2.5 (august 2002)

<p>Changes by Javier Fern&aacute;ndez-Sanguino Pe&ntilde;a (me). There were many
things waiting on my inbox (as far back as February) to be included,
so I'm going to tag this the <em>back from honeymoon</em> release :)

<list>

<item>Applied a patch contributed by Philipe Gaspar regarding the
Squid which also kills a FIXME.

<item>Yet another FAQ item regarding service banners taken from the
debian-security mailing list (thread "Telnet information" started 26th
July 2002).

<item>Added a note regarding use of CVE cross references in the
<em>How much time does the Debian security team...</em> FAQ item.


<item>Added a new section regarding ARP attacks contributed by Arnaud
"Arhuman" Assad.

<item>New FAQ item regarding dmesg and console login by the kernel. 

<item>Small tidbits of information to the signature-checking issues in
packages (it seems to not have gotten past beta release).

<item>New FAQ item regarding vulnerability assessment tools false
positives.

<item>Added new sections to the chapter that contains information on
package signatures and reorganised it as a new <em>Debian Security
Infrastructure</em> chapter.

<item>New FAQ item regarding Debian vs. other Linux distributions.

<item>New section on mail user agents with GPG/PGP functionality in the
security tools chapter.

<item>Clarified how to enable MD5 passwords in woody, added a pointer
to PAM as well as a note regarding the max definition in PAM.

<item>Added a new appendix on how to create chroot environments (after
fiddling a bit with makejail and fixing, as well, some of its bugs),
integrated duplicate information in all the appendix. 

<item>Added some more information regarding <PRGN>SSH</PRGN> chrooting and its
impact on secure file transfers.  Some information has been retrieved
from the debian-security mailing list (June 2002 thread: <em>secure
file transfers</em>).

<item>New sections on how to do automatic updates on Debian systems as
well as the caveats of using testing or unstable regarding security updates.

<item>New section regarding keeping up to date with security patches
in the <em>Before compromise</em> section as well as a new section
about the debian-security-announce mailing list.

<item>Added information on how to automatically generate strong passwords.

<item>New section regarding login of idle users.

<item>Reorganised the securing mail server section based on the
<em>Secure/hardened/minimal Debian (or "Why is the base system the way
it is?")</em> thread on the debian-security mailing list (May 2002).

<item>Reorganised the section on kernel network parameters, with
information provided in the debian-security mailing list (May 2002,
<em>syn flood attacked?</em> thread) and added a new FAQ item as well.

<item>New section on how to check users passwords and which packages
to install for this.

<item>New section on PPTP encryption with Microsoft clients discussed
in the debian-security mailing list (April 2002).

<item>Added a new section describing what problems are there when binding any 
given service to a specific IP address, this information was written based on 
the bugtraq mailing list in the thread: <em>Linux kernel 2.4 "weak end host" 
issue (previously discussed on debian-security as "arp problem")</em> (started 
on May 9th 2002 by Felix von Leitner).

<item>Added information on <prgn>ssh</prgn> protocol version 2.

<item>Added two subsections related to Apache secure configuration
(the things specific to Debian, that is).

<item>Added a new FAQ related to raw sockets, one related to /root, an
item related to users' groups and another one related to log and
configuration files permissions.

<item>Added a pointer to a bug in libpam-cracklib that might still be
open... (need to check)

<item>Added more information regarding forensics analysis (pending more 
information on packet inspection tools such as <prgn>tcpflow</prgn>).

<item>Changed the "what should I do regarding compromise" into a bullet
list and included some more stuff.

<item>Added some information on how to set up the Xscreensaver to lock
the screen automatically after the configured timeout.

<item>Added a note related to the utilities you should not install in
the system. Included a note regarding Perl and why it cannot be
easily removed in Debian. The idea came after reading Intersect's
documents regarding Linux hardening.

<item>Added information on lvm and journalling file systems, ext3
recommended. The information there might be too generic, however. 

<item>Added a link to the online text version (check).

<item>Added some more stuff to the information on firewalling the
local system, triggered by a comment made by Hubert Chan in the mailing list.

<item>Added more information on PAM limits and pointers to Kurt
Seifried's documents (related to a post by him to bugtraq on April 4th
2002 answering a person that had ``discovered'' a vulnerability in
Debian GNU/Linux related to resource starvation).

<item>As suggested by Julian Munoz, provided more information on the
default Debian umask and what a user can access if he has been given a
shell in the system (scary, huh?)

<item>Included a note in the BIOS password section due to a comment
from Andreas Wohlfeld.

<item>Included patches provided by Alfred E. Heggestad fixing many of
the typos still present in the document.

<item>Added a pointer to the changelog in the Credits section since
most people who contribute are listed here (and not there).

<item>Added a few more notes to the chattr section and a new section
after installation talking about system snapshots. Both ideas were
contributed by Kurt Pomeroy.

<item>Added a new section after installation just to remind users to
change the boot-up sequence.

<item>Added some more TODO items provided by Korn Andras.

<item>Added a pointer to the NIST's guidelines on how to secure DNS
provided by Daniel Quinlan.

<item>Added a small paragraph regarding Debian's SSL certificates
infrastructure.

<item>Added Daniel Quinlan's suggestions regarding <prgn>ssh</prgn> 
authentication and exim's relay configuration.

<item>Added more information regarding securing bind including changes
suggested by Daniel Quinlan and an appendix with a script to make some of the
changes commented on in that section.

<item>Added a pointer to another item regarding Bind chrooting (needs to be 
merged).

<item>Added a one liner contributed by Cristian Ionescu-Idbohrn to
retrieve packages with tcpwrappers support.

<item>Added a little bit more info on Debian's default PAM setup.

<item>Included a FAQ question about using PAM to provide services without
shell accounts.

<item>Moved two FAQ items to another section and added a new FAQ
regarding attack detection (and compromised systems).

<item>Included information on how to set up a bridge firewall
(including a sample Appendix). Thanks go to Francois Bayar who sent
this to me in March.

<item>Added a FAQ regarding the syslogd's <em>MARK</em>
<em>heartbeat</em> from a question answered by Noah Meyerhans and
Alain Tesio in December 2001.

<item>Included information on buffer overflow protection as well as
some information on kernel patches.

<item>Added more information (and reorganised) the firewall
section. Updated the information regarding the iptables package and
the firewall generators available.

<item>Reorganized the information regarding log checking, moved
logcheck information from host intrusion detection to that section.

<item>Added some information on how to prepare a static package for
bind for chrooting (untested).

<item>Added a FAQ item regarding some specific servers/services 
(could be expanded with some of the
recommendations from the debian-security list).

<item>Added some information on RPC services (and when it's necessary).

<item>Added some more information on capabilities (and what lcap does). 
Is there any good documentation on this? I haven't found any documentation on 
my 2.4 kernel.

<item>Fixed some typos.

</list>

<sect1>Version 2.4
<p>Changes by Javier Fern&aacute;ndez-Sanguino Pe&ntilde;a.
<list>
<item>Rewritten part of the BIOS section.
</list>

<sect1>Version 2.3
<p>Changes by Javier Fern&aacute;ndez-Sanguino Pe&ntilde;a.
<list>
<item>Wrapped most file locations with the file tag.
<item>Fixed typo noticed by Edi Stojicevi.
<item>Slightly changed the remote audit tools section.
<item>Added some todo items.
<item>Added more information regarding printers and cups config file
(taken from a thread on debian-security).
<item>Added a patch submitted by Jesus Climent regarding access of
valid system users to Proftpd when configured as anonymous server.
<item>Small change on partition schemes for the special case of mail
servers.
<item>Added Hacking Linux Exposed to the books section.
<item>Fixed directory typo noticed by Eduardo P&eacute;rez Ureta.
<item>Fixed /etc/ssh typo in checklist noticed by Edi Stojicevi.
</list>
<sect1>Version 2.3
<p>Changes by Javier Fern&aacute;ndez-Sanguino Pe&ntilde;a.
<list>
<item>Fixed location of dpkg conffile.
<item>Remove Alexander from contact information.
<item>Added alternate mail address.
<item>Fixed Alexander mail address (even if commented out).
<item>Fixed location of release keys (thanks to Pedro Zorzenon for pointing 
this out).
</list>
<sect1>Version 2.2
<p>Changes by Javier Fern&aacute;ndez-Sanguino Pe&ntilde;a.
<list>
<item>Fixed typos, thanks to Jamin W. Collins.
<item>Added a reference to apt-extracttemplate manpage
(documents the APT::ExtractTemplate config).
<item>Added section about restricted SSH. Information based on that
posted by  Mark Janssen, Christian G. Warden and Emmanuel Lacour on
the debian-security mailing list.
<item>Added information on antivirus software.
<item>Added a FAQ: su logs due to the cron running as root.
</list>
<sect1>Version 2.1
<p>Changes by Javier Fern&aacute;ndez-Sanguino Pe&ntilde;a.
<list>
<item>Changed FIXME from lshell thanks to Oohara Yuuma.
<item>Added package to sXid and removed comment since it *is* available.
<item>Fixed a number of typos discovered by Oohara Yuuma.
<item>ACID is now available in Debian (in the acidlab package)
 thanks to Oohara Yuuma for noticing.
<item>Fixed LinuxSecurity links (thanks to Dave Wreski for telling).
</list>
<sect1>Version 2.0
<p>Changes by Javier Fern&aacute;ndez-Sanguino Pe&ntilde;a. I wanted to 
change to 2.0 when all the FIXMEs were, er, fixed but I ran out
of 1.9X numbers :(
<list>
<item>Converted the HOWTO into a Manual (now I can properly say RTFM)

<item>Added more information regarding tcp wrappers and Debian (now
many services are compiled with support for them so it's no longer
an <prgn>inetd</prgn> issue).

<item>Clarified the information on disabling services to make it more
consistent (rpc info still referred to update-rc.d)

<item>Added small note on lprng.

<item>Added some more info on compromised servers (still very rough)

<item>Fixed typos reported by Mark Bucciarelli.

<item>Added some more steps in password recovery to cover the cases
when the admin has set paranoid-mode=on.

<item>Added some information to set paranoid-mode=on when login in
console.

<item>New paragraph to introduce service configuration.

<item>Reorganised the <em>After installation</em> section so it is
more broken up into several issues and it's easier to read.

<item>Wrote information on how to set up firewalls with the standard
Debian 3.0 setup (iptables package).

<item>Small paragraph explaining why installing connected to the
Internet is not a good idea and how to avoid this using Debian tools.

<item>Small paragraph on timely patching referencing to IEEE paper.

<item>Appendix on how to set up a Debian snort box, based on what Vladimir
sent to the debian-security mailing list (September 3rd 2001)

<item>Information on how logcheck is set up in Debian and how it can be
used to set up HIDS.

<item>Information on user accounting and profile analysis.

<item>Included apt.conf configuration for read-only /usr copied from Olaf
Meeuwissen's post to the debian-security mailing list

<item>New section on VPN with some pointers and the packages available
in Debian (needs content on how to set up the VPNs and Debian-specific
issues), based on Jaroslaw Tabor's and Samuli Suonpaa's post to
debian-security.

<item>Small note regarding some programs to automatically build chroot jails

<item>New FAQ item regarding identd based on a discussion in the
debian-security mailing list (February 2002, started by Johannes Weiss).

<item>New FAQ item regarding <prgn>inetd</prgn> based on a discussion in the
debian-security mailing list (February 2002).

<item>Introduced note on rcconf in the "disabling services" section.

<item>Varied the approach regarding LKM, thanks to Philipe Gaspar 

<item>Added pointers to CERT documents and Counterpane resources
</list>

<sect1>Version 1.99
<p>Changes by Javier Fern&aacute;ndez-Sanguino Pe&ntilde;a.
<list>
<item>Added a new FAQ item regarding time to fix security vulnerabilities.
<item>Reorganised FAQ sections.
<item>Started writing a section regarding firewalling in Debian GNU/Linux
(could be broadened a bit)
<item>Fixed typos sent by Matt Kraai
<item>Fixed DNS information
<item>Added information on whisker and nbtscan to the auditing section.
<item>Fixed some wrong URLs
</list>
<sect1>Version 1.98
<p>Changes by Javier Fern&aacute;ndez-Sanguino Pe&ntilde;a.
<list>
<item>Added a new section regarding auditing using Debian GNU/Linux.
<item>Added info regarding finger daemon taken from the security mailing list.
</list>
<sect1>Version 1.97
<p>Changes by Javier Fern&aacute;ndez-Sanguino Pe&ntilde;a.
<list>
<item>Fixed link for Linux Trustees
<item>Fixed typos (patches from Oohara Yuuma and Pedro Zorzenon)
</list>

<sect1>Version 1.96
<p>Changes by Javier Fern&aacute;ndez-Sanguino Pe&ntilde;a.
<list>

<item>Reorganized service installation and removal and added some new notes.

<item>Added some notes regarding using integrity checkers as intrusion
detection tools.

<item>Added a chapter regarding package signatures.

</list>

<sect1>Version 1.95
<p>Changes by Javier Fern&aacute;ndez-Sanguino Pe&ntilde;a.
<list>

<item>Added notes regarding Squid security sent by Philipe Gaspar.

<item>Fixed rootkit links thanks to Philipe Gaspar.

</list>

<sect1>Version 1.94
<p>Changes by Javier Fern&aacute;ndez-Sanguino Pe&ntilde;a.
<list>

<item>Added some notes regarding Apache and Lpr/lpng.

<item>Added some information regarding noexec and read-only partitions.

<item>Rewrote how users can help in Debian security issues (FAQ item).
</list>

<sect1>Version 1.93
<p>Changes by Javier Fern&aacute;ndez-Sanguino Pe&ntilde;a.
<list>

<item>Fixed location of mail program.

<item>Added some new items to the FAQ.
</list>

<sect1>Version 1.92
<p>Changes by Javier Fern&aacute;ndez-Sanguino Pe&ntilde;a.
<list>

<item>Added a small section on how Debian handles security

<item>Clarified MD5 passwords (thanks to `rocky')

<item>Added some more information regarding harden-X from Stephen van Egmond

<item>Added some new items to the FAQ

</list>

<sect1>Version 1.91
<p>Changes by Javier Fern&aacute;ndez-Sanguino Pe&ntilde;a.
<list>

<item>Added some forensics information sent by Yotam Rubin.

<item>Added information on how to build a honeynet using Debian GNU/Linux.

<item>Added some more TODOS.

<item>Fixed more typos (thanks Yotam!)

</list>

<sect1>Version 1.9
<p>Changes by Javier Fern&aacute;ndez-Sanguino Pe&ntilde;a.
<list>

<item>Added patch to fix misspellings and some new information (contributed
by Yotam Rubin)

<item>Added references to other online (and offline) documentation both in a 
section (see <ref id="references">) by itself and inline in some sections.

<item>Added some information on configuring Bind options to restrict
access to the DNS server.

<item>Added information on how to automatically harden a Debian system
(regarding the harden package and bastille).

<item>Removed some done TODOs and added some new ones.

</list>

<sect1>Version 1.8
<p>Changes by Javier Fern&aacute;ndez-Sanguino Pe&ntilde;a.
<list>

<item>Added the default user/group list provided by Joey Hess to the
debian-security mailing list.

<item>Added information on LKM root-kits (<ref id="LKM">)
 contributed by Philipe Gaspar.

<item>Added information on Proftp contributed by Emmanuel Lacour. 

<item>Recovered the checklist Appendix from Era Eriksson.

<item>Added some new TODO items and removed other fixed ones.

<item>Manually included Era's patches since they were not all included in 
the previous version.

</list>
<sect1>Version 1.7
<p>Changes by Era Eriksson.
<list>
<item>Typo fixes and wording changes
</list>
<p>Changes by Javier Fern&aacute;ndez-Sanguino Pe&ntilde;a.
<list>
<item>Minor changes to tags in order to keep on removing the tt tags
and substitute prgn/package tags for them.
</list>

<sect1>Version 1.6 
<p>Changes by Javier Fern&aacute;ndez-Sanguino Pe&ntilde;a.
<list>
<item>Added pointer to document as published in the DDP (should
supersede the original in the near future) 
<item>Started a mini-FAQ
(should be expanded) with some questions recovered from my mailbox.
<item>Added general information to consider while securing.
<item>Added a paragraph regarding local (incoming) mail delivery.
<item>Added some pointers to more information.  
<item>Added information regarding the printing service.  
<item>Added a security hardening checklist.  
<item>Reorganized NIS and RPC information.
<item>Added some notes taken while reading this document on my new
Visor :) 
<item>Fixed some badly formatted lines.  
<item>Fixed some typos.  
<item>Added a Genius/Paranoia idea contributed by Gaby
Schilders.
</list>
<sect1>Version 1.5 

<p>Changes by Josip Rodin and Javier Fern&aacute;ndez-Sanguino Pe&ntilde;a.

<list>
<item>Added paragraphs related to BIND and some FIXMEs.  <!-- Removed
this because I found no evidence for it in the diffs. // era Rewrote
style in order to make it more formal.  -->
</list>
<sect1>Version 1.4
    <p>
    <list>
    <item>Small setuid check paragraph <item>Various minor cleanups
    <item>Found out how to use <tt>sgml2txt -f</tt> for the txt
    version</item>
    </list>
<sect1>Version 1.3
    <p>
    <list>
    <item>Added a security update after installation paragraph
    <item>Added a proftpd paragraph 
    <item>This time really wrote something about XDM, sorry for last time
    </list>
<sect1>Version 1.2
    <p>
    <list>
    <item>Lots of grammar corrections by James Treacy, new XDM
    paragraph
    </list>
<sect1>Version 1.1
    <p>
    <list>
    <item>Typo fixes, miscellaneous additions
    </list>
<sect1>Version 1.0
    <p>
    <list>
    <item>Initial release
    </list>



<sect>荣誉与感谢!
<p>
<list>
<item>Alexander Reelsen 撰写了原始文档. 

<item>Javier Fern&aacute;ndez-Sanguino 为原始文档增加了更多信息.

<item>Robert van der Meulen 提供了 quota 章节和很多好主意.

<item>Ethan Benson 校正了 PAM 章节和一些好的建议.

<item>Dariusz Puchalak 为一些章节提供一些信息.

<item>Gaby Schilders 提供了一个很棒的 Genius/Paranoia 主意.

<item>Era Eriksson 弄顺了许多地方的语法并提供附录清单.

<item>Philipe Gaspar 撰写了 LKM 部分.

<item>Yotam Rubin 对很多拼写错误进行了修正, 并为 bind 的版本和 md5 密码提供了参考信息.

<item>这里包括所有为文档改善提供建议的名单(参见 <ref id="changelog">)

<item>(Alexander) 所有鼓励我撰写本 HOWTO 的朋友
(这后来变成了手册).

<item>整个 Debian 项目.
</list>

