<commit_before>.\" Copyright (C) 1998 <NAME>. All rights reserved.
.\"
.\" Redistribution and use in source and binary forms, with or without
.\" modification, are permitted provided that the following conditions
.\" are met:
.\" 1. Redistributions of source code must retain the above copyright
.\"    notice, this list of conditions and the following disclaimer.
.\" 2. Redistributions in binary form must reproduce the above copyright
.\"    notice, this list of conditions and the following disclaimer in the
.\"    documentation and/or other materials provided with the distribution.
.\"
.\" THIS SOFTWARE IS PROVIDED BY AUTHOR AND CONTRIBUTORS ``AS IS'' AND
.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
.\" ARE DISCLAIMED.  IN NO EVENT SHALL AUTHOR OR CONTRIBUTORS BE LIABLE
.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
.\" SUCH DAMAGE.
.\"
.\" $FreeBSD$
.\"
.Dd September 8, 2006
.Dt SECURITY 7
.Os
.Sh NAME
.Nm security
.Nd introduction to security under FreeBSD
.Sh DESCRIPTION
Security is a function that begins and ends with the system administrator.
While all
.Bx
multi-user systems have some inherent security, the job of building and
maintaining additional security mechanisms to keep users
.Dq honest
is probably
one of the single largest undertakings of the sysadmin.
Machines are
only as secure as you make them, and security concerns are ever competing
with the human necessity for convenience.
.Ux
systems,
in general, are capable of running a huge number of simultaneous processes
and many of these processes operate as servers \(em meaning that external
entities can connect and talk to them.
As yesterday's mini-computers and mainframes
become today's desktops, and as computers become networked and internetworked,
security becomes an ever bigger issue.
.Pp
Security is best implemented through a layered onion approach.
In a nutshell,
what you want to do is to create as many layers of security as are convenient
and then carefully monitor the system for intrusions.
.Pp
System security also pertains to dealing with various forms of attacks,
including attacks that attempt to crash or otherwise make a system unusable
but do not attempt to break root.
Security concerns can be split up into
several categories:
.Bl -enum -offset indent
.It
Denial of Service attacks (DoS)
.It
User account compromises
.It
Root compromise through accessible servers
.It
Root compromise via user accounts
.It
Backdoor creation
.El
.Pp
A denial of service attack is an action that deprives the machine of needed
resources.
Typically, DoS attacks are brute-force mechanisms that attempt
to crash or otherwise make a machine unusable by overwhelming its servers or
network stack.
Some DoS attacks try to take advantages of bugs in the
networking stack to crash a machine with a single packet.
The latter can
only be fixed by applying a bug fix to the kernel.
Attacks on servers can
often be fixed by properly specifying options to limit the load the servers
incur on the system under adverse conditions.
Brute-force network attacks are harder to deal with.
A spoofed-packet attack, for example, is
nearly impossible to stop short of cutting your system off from the Internet.
It may not be able to take your machine down, but it can fill up Internet
pipe.
.Pp
A user account compromise is even more common than a DoS attack.
Many
sysadmins still run standard
.Xr telnetd 8 ,
.Xr rlogind 8 ,
.Xr rshd 8 ,<commit_msg>Add a missing word.<commit_after>.\" Copyright (C) 1998 <NAME>. All rights reserved.
.\"
.\" Redistribution and use in source and binary forms, with or without
.\" modification, are permitted provided that the following conditions
.\" are met:
.\" 1. Redistributions of source code must retain the above copyright
.\"    notice, this list of conditions and the following disclaimer.
.\" 2. Redistributions in binary form must reproduce the above copyright
.\"    notice, this list of conditions and the following disclaimer in the
.\"    documentation and/or other materials provided with the distribution.
.\"
.\" THIS SOFTWARE IS PROVIDED BY AUTHOR AND CONTRIBUTORS ``AS IS'' AND
.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
.\" ARE DISCLAIMED.  IN NO EVENT SHALL AUTHOR OR CONTRIBUTORS BE LIABLE
.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
.\" SUCH DAMAGE.
.\"
.\" $FreeBSD$
.\"
.Dd September 8, 2006
.Dt SECURITY 7
.Os
.Sh NAME
.Nm security
.Nd introduction to security under FreeBSD
.Sh DESCRIPTION
Security is a function that begins and ends with the system administrator.
While all
.Bx
multi-user systems have some inherent security, the job of building and
maintaining additional security mechanisms to keep users
.Dq honest
is probably
one of the single largest undertakings of the sysadmin.
Machines are
only as secure as you make them, and security concerns are ever competing
with the human necessity for convenience.
.Ux
systems,
in general, are capable of running a huge number of simultaneous processes
and many of these processes operate as servers \(em meaning that external
entities can connect and talk to them.
As yesterday's mini-computers and mainframes
become today's desktops, and as computers become networked and internetworked,
security becomes an ever bigger issue.
.Pp
Security is best implemented through a layered onion approach.
In a nutshell,
what you want to do is to create as many layers of security as are convenient
and then carefully monitor the system for intrusions.
.Pp
System security also pertains to dealing with various forms of attacks,
including attacks that attempt to crash or otherwise make a system unusable
but do not attempt to break root.
Security concerns can be split up into
several categories:
.Bl -enum -offset indent
.It
Denial of Service attacks (DoS)
.It
User account compromises
.It
Root compromise through accessible servers
.It
Root compromise via user accounts
.It
Backdoor creation
.El
.Pp
A denial of service attack is an action that deprives the machine of needed
resources.
Typically, DoS attacks are brute-force mechanisms that attempt
to crash or otherwise make a machine unusable by overwhelming its servers or
network stack.
Some DoS attacks try to take advantages of bugs in the
networking stack to crash a machine with a single packet.
The latter can
only be fixed by applying a bug fix to the kernel.
Attacks on servers can
often be fixed by properly specifying options to limit the load the servers
incur on the system under adverse conditions.
Brute-force network attacks are harder to deal with.
A spoofed-packet attack, for example, is
nearly impossible to stop short of cutting your system off from the Internet.
It may not be able to take your machine down, but it can fill up your Internet
pipe.
.Pp
A user account compromise is even more common than a DoS attack.
Many
sysadmins still run standard
.Xr telnetd 8 ,
.Xr rlogind 8 ,
.Xr rshd 8 ,
{'fraction_non_alphanumeric': 0.04952501583280557, 'fraction_numerical': 0.0037998733375554147, 'mean_word_length': 4.23607427055703, 'pattern_counts': {'":': 0, '<': 5, '<?xml version=': 0, '>': 5, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '484741', 'n_tokens_mistral': 2093, 'n_tokens_neox': 1868, 'n_words': 1218}