Linux Server Security

Rating:
Summary: Good Coverage of the General Rules
Review: It used to be that Linux was so much safer than Windows because of the sheer number of people out attacking Windows. But now there several reasons for the bad guys to attack Linux:

73 (or so) of the web servers run Linux,
more than that run DNS or mail,
these tend to be powerful boxes with big communications pipes - just what the Spammers need.

As the book says it's futile to expect perfect security unless you turn off the machine, power it down, repeatedly degause its hard drive and pulverize the whole thing into dust. On the other hand, it's not too difficult to do at least a minimal amount of hardening that will dramatically increase the effort required to break into the system.

This book, written by the author of the popular Paranoid Penguin column in Linux Journal covers the general rules. It gives you a broad coverage of the types of attacks you can expect and how to counter them. It does not attempt to cover the problem of the moment, because these are changing so fast that the book would be immediately out of date.

System security is a constant struggle against the dark side of the force. If you haven't been hit yet, you will be.

Rating:
Summary: Solid, but perhaps too broad
Review: This is a somewhat high level walkthrough of all Linux related security issues, from basic networking and operating system issues, to web server configuration and scripting language security. At about 500 pages that's a tight squeeze, even for O'Reilly. Some of the coverage suffers, specifically I found the security information on PHP to be very scanty given the popularity of the language and how often web applications that use it are fraught with SQL injection vulnerabilities.

That being said, the writing is excellent, and the coverage that is there, which is at a reasonable level of depth, is solid. In addition, security is something you have to work at, so having an introduction to get you down the road is probably a good idea anyway. I'd like to see the next version have deeper information on web server security, but in the meantime this is a solid walkthrough of Linux security.