SELinux: NSA's Open Source Security Enhanced Linux
| |||||||||||||||||||||||||||||
|
| |||||||||||||||||||||||||||||
| Sort customer reviews by: | |||||||||||||||||||||||||||||
|
Show All Reviews on Page
Hide All Reviews on Page
| |||||||||||||||||||||||||||||
| SELinux: NSA's Open Source Security Enhanced Linux | |||||||||||||||||||||||||||||
|
The intensive search for a more secure operating system has often left everyday, production computers far behind their experimental, research cousins. Now SELinux (Security Enhanced Linux) dramatically changes this. This best-known and most respected security-related extension to Linux embodies the key advances of the security field. Better yet, SELinux is available in widespread and popular distributions of the Linux operating system--including for Debian, Fedora, Gentoo, Red Hat Enterprise Linux, and SUSE--all of it free and open source. SELinux emerged from research by the National Security Agency and implements classic strong-security measures such as role-based access controls, mandatory access controls, and fine-grained transitions and privilege escalation following the principle of least privilege. It compensates for the inevitable buffer overflows and other weaknesses in applications by isolating them and preventing flaws in one application from spreading to others. The scenarios that cause the most cyber-damage these days--when someone gets a toe-hold on a computer through a vulnerability in a local networked application, such as a Web server, and parlays that toe-hold into pervasive control over the computer system--are prevented on a properly administered SELinux system. The key, of course, lies in the words "properly administered." A system administrator for SELinux needs a wide range of knowledge, such as the principles behind the system, how to assign different privileges to different groups of users, how to change policies to accommodate new software, and how to log and track what is going on. And this is where SELinux is invaluable. Author Bill McCarty, a security consultant who has briefed numerous government agencies, incorporates his intensive research into SELinux into this small but information-packed book. Topics include:
|
|||||||||||||||||||||||||||||
| Reader Reviews 1 - 14 of 14 | |||||||||||||||||||||||||||||
| Review Date |
Review Rating(5 High) |
Review Helpful to: |
Customer Review | Reviewer Info |
Permanent Link |
||||||||||||||||||||||||
| Reader Reviews Below Sorted by Newest First | |||||||||||||||||||||||||||||
| 06-21-08 | 5 | (NA) |
| Reviewer | Permalink | ||||||||||||||||||||||||
|
This book is a great introduction to the topic of SELinux because of the information on its developmental background and lucid description of the objectives, advantages and maintenance of a SELinux system. I would recommend this book to someone who has a firm grasp of basic security concepts and programming principles and is interested in getting exposure to the security enhanced model of Linux.
(Review Data Last Updated: 2008-11-30 06:35:24 EST)
|
|||||||||||||||||||||||||||||
| 07-17-07 | 3 | (NA) |
| Reviewer | Permalink | ||||||||||||||||||||||||
|
Really only skimming over the problem, could be more in depth, since most online documentation about SELinux is really skimming over the subject too, or just overly dated.
(Review Data Last Updated: 2008-06-22 04:57:02 EST)
|
|||||||||||||||||||||||||||||
| 04-08-05 | 3 | 13\14 |
| Reviewer | Permalink | ||||||||||||||||||||||||
|
Personally, I prefer books to focus either concepts or detailed implementation instructions not both. For complex topics like SELinux, you typically cannot fit the conceptual and pragmatic within one book. McCarty's SELINUX is no exception. SELINUX provides an excellent overview of concepts but struggles with policy implementation methods and procedures. I suspect the topic is simply too large for one volume. What implementation advice presented is clear and concise but you will have to search elsewhere for more detailed deployment advice.
Despite these issues, this book is recommended reading for anyone considering implementing SELinux. The conceptual overview is some of the best I've seen since SELinux got its start. Using charts, diagrams and examples, McCarty presents an excellent overview of the nuts and bolts of SELinux. Understanding the principles of Role-Based Access Control, Type Enforcement, and Security Objects is critical to both using SELinux and justifying its use. The latter may be a bigger hurdle than many anticipate. The chapters on these areas will arm you with sufficient understanding to make a clear case of why SELinux can and should be implemented in many Linux-based computing environments. While there are brief examples throughout, the book's third chapter on SELinux installation presents a well-documented, step-by-step guide to installing SELinux. If you've never installed SELinux, these sections will prove very valuable. With clearly numbered steps and command line examples, you can have SELinux installed and configured with a default policy within an hour. As a mix between the pragmatic and conceptual, SELINUX is a good start on this topic. Entry level SELinux users will probably not learn too much from this book, but if your are looking for a introduction to SELinux concepts along with some pragmatic advice for getting started, then this book may be for you. (Review Data Last Updated: 2007-07-17 23:07:21 EST)
|
|||||||||||||||||||||||||||||
| 04-07-05 | 3 | 11\12 |
| Reviewer | Permalink | ||||||||||||||||||||||||
|
Personally, I prefer books to focus either concepts or detailed implementation instructions not both. For complex topics like SELinux, you typically cannot fit the conceptual and pragmatic within one book. McCarty's SELINUX is no exception. SELINUX provides an excellent overview of concepts but struggles with policy implementation methods and procedures. I suspect the topic is simply too large for one volume. What implementation advice presented is clear and concise but you will have to search elsewhere for more detailed deployment advice.
Despite these issues, this book is recommended reading for anyone considering implementing SELinux. The conceptual overview is some of the best I've seen since SELinux got its start. Using charts, diagrams and examples, McCarty presents an excellent overview of the nuts and bolts of SELinux. Understanding the principles of Role-Based Access Control, Type Enforcement, and Security Objects is critical to both using SELinux and justifying its use. The latter may be a bigger hurdle than many anticipate. The chapters on these areas will arm you with sufficient understanding to make a clear case of why SELinux can and should be implemented in many Linux-based computing environments. While there are brief examples throughout, the book's third chapter on SELinux installation presents a well-documented, step-by-step guide to installing SELinux. If you've never installed SELinux, these sections will prove very valuable. With clearly numbered steps and command line examples, you can have SELinux installed and configured with a default policy within an hour. As a mix between the pragmatic and conceptual, SELINUX is a good start on this topic. Entry level SELinux users will probably not learn too much from this book, but if your are looking for a introduction to SELinux concepts along with some pragmatic advice for getting started, then this book may be for you. (Review Data Last Updated: 2007-04-11 10:22:04 EST)
|
|||||||||||||||||||||||||||||
| 03-13-05 | 4 | 10\10 |
| Reviewer | Permalink | ||||||||||||||||||||||||
|
Selinux is a conscious attempt to fundamentally rework and improve linux security. Previously, or more to the point, in most current linux machines, the security was somewhat of an ad hoc approach. This is mitigated by a formidable array of open source IDS tools like Ethereal and Snort that let a sysadmin often successfully depend her network and machines.
But as the frequency and virulence of malware attacks has increased, the Selinux of this book may be a timely reinforcing of the operating system. As McCarty explains, this book is geared towards a sysadmin, as opposed to a programmer. It discusses the new things you should know. Especially the concepts of role based access model and of domains. The former has shades of DEC's VMS, which had a very mature implementation. Or those of you with mainframe experience may also recognise familiar ideas. Programmers may find the book a little sparse, as mentioned above. But possibly McCarty is devising a sequel for them. (Review Data Last Updated: 2007-06-26 19:17:16 EST)
|
|||||||||||||||||||||||||||||
| 03-12-05 | 4 | 10\10 |
| Reviewer | Permalink | ||||||||||||||||||||||||
|
Selinux is a conscious attempt to fundamentally rework and improve linux security. Previously, or more to the point, in most current linux machines, the security was somewhat of an ad hoc approach. This is mitigated by a formidable array of open source IDS tools like Ethereal and Snort that let a sysadmin often successfully depend her network and machines.
But as the frequency and virulence of malware attacks has increased, the Selinux of this book may be a timely reinforcing of the operating system. As McCarty explains, this book is geared towards a sysadmin, as opposed to a programmer. It discusses the new things you should know. Especially the concepts of role based access model and of domains. The former has shades of DEC's VMS, which had a very mature implementation. Or those of you with mainframe experience may also recognise familiar ideas. Programmers may find the book a little sparse, as mentioned above. But possibly McCarty is devising a sequel for them. (Review Data Last Updated: 2006-08-24 09:41:17 EST)
|
|||||||||||||||||||||||||||||
| 02-06-05 | 5 | 6\9 |
| Reviewer | Permalink | ||||||||||||||||||||||||
|
So what makes Selinux more secure than standard Linux? Primarily it is the implementation of role-based access control, sandboxing, and an audit facility that allows the system to log any attempts to exceed specified permissions. It does all this without conflicting with the normal permissions of Linux. If you are able to access a file through normal discretionary access control then the role-based mandatory access control provides additional security to determine if you can run the file or not. The only way to open a file is if both systems agree that you should be able to open it.
The author covers installation, configuration, administering, and setting up a security policy. The presentation of SeLinux is straightforward and the security model is presented in a writing style that makes it clear and understandable to the reader. SeLinux: NSA's Open Source Security Enhanced Linux is highly recommended as both a Linux security solution and an excellent book on how to utilize all the resources of SeLinux. (Review Data Last Updated: 2007-06-26 19:17:16 EST)
|
|||||||||||||||||||||||||||||
| 12-21-04 | 5 | 5\7 |
| Reviewer | Permalink | ||||||||||||||||||||||||
|
Bill McCarty's book is all of the above and the requirements have been met for a throughly enjoyable read.
You don't have to be a Linux geek to appreciate the security mechanisms that Information Assurance Directorate of the NSA and the myriad of contributors have helped to create. These go way beyond IT systems decisions and at their base level represent good business management practice. The days of using insecure, bloated operating systems to power your business are over. In this age of real competitive and even terroristic threats affecting your companies data, you owe it to your self to investigate the security mechanisms put forth in this book and give your business the competitive edge. (Review Data Last Updated: 2007-06-26 19:17:16 EST)
|
|||||||||||||||||||||||||||||
| 12-20-04 | 5 | 5\7 |
| Reviewer | Permalink | ||||||||||||||||||||||||
|
Bill McCarty's book is all of the above and the requirements have been met for a throughly enjoyable read.
You don't have to be a Linux geek to appreciate the security mechanisms that Information Assurance Directorate of the NSA and the myriad of contributors have helped to create. These go way beyond IT systems decisions and at their base level represent good business management practice. The days of using insecure, bloated operating systems to power your business are over. In this age of real competitive and even terroristic threats affecting your companies data, you owe it to your self to investigate the security mechanisms put forth in this book and give your business the competitive edge. (Review Data Last Updated: 2006-08-24 09:41:17 EST)
|
|||||||||||||||||||||||||||||
| 12-13-04 | 5 | 7\7 |
| Reviewer | Permalink | ||||||||||||||||||||||||
|
Bill McCarty has done a top notch job of explaining Security Enhanced Linux as well as the security model itself. I've attempted so many time to "get it" about SELinux and not until I read this book did it make sense.
Bill's organization of the material makes a huge difference. He breaks the subject down into easily understandable chunks. The reader can follow the simple road until everything makes sense. And, SE Linux does make sense. It should be implemented everywhere. Another thing compelled me to get this book -- it's size. This is a relatively small book. I remember thinking that I could read it without spending two weeks in a study mode. I was right about that. I read it in quick order. I especially like O'Reilly books. I aslo like Bill's editor, Andy Oram. With the two of them collaborating, you're going to get an interesting book, topics that flow well and a professional product worth much more than the list price. I'm glad I found this book. I want to congratulate all parties involved for creating an excellent product. I also want to say thank you for enabling me to work with Security Enhanced Linux. (Review Data Last Updated: 2007-06-26 19:17:16 EST)
|
|||||||||||||||||||||||||||||
| 12-12-04 | 5 | 7\7 |
| Reviewer | Permalink | ||||||||||||||||||||||||
|
Bill McCarty has done a top notch job of explaining Security Enhanced Linux as well as the security model itself. I've attempted so many time to "get it" about SELinux and not until I read this book did it make sense.
Bill's organization of the material makes a huge difference. He breaks the subject down into easily understandable chunks. The reader can follow the simple road until everything makes sense. And, SE Linux does make sense. It should be implemented everywhere. Another thing compelled me to get this book -- it's size. This is a relatively small book. I remember thinking that I could read it without spending two weeks in a study mode. I was right about that. I read it in quick order. I especially like O'Reilly books. I aslo like Bill's editor, Andy Oram. With the two of them collaborating, you're going to get an interesting book, topics that flow well and a professional product worth much more than the list price. I'm glad I found this book. I want to congratulate all parties involved for creating an excellent product. I also want to say thank you for enabling me to work with Security Enhanced Linux. (Review Data Last Updated: 2006-08-24 09:41:17 EST)
|
|||||||||||||||||||||||||||||
| 11-19-04 | 5 | 6\7 |
| Reviewer | Permalink | ||||||||||||||||||||||||
|
This book is a must read for beginners exploring the powers of SELinux and trying to setup a custom system. it has all the information needed to give a basic grounding of how everything is organised and how security is incorporqated into the kernel. it deals with the structural as well as the functional organization of the various components involved. although not exhaustive in examples there is a considerable number of'em on which one can work out his own specific interest.
(Review Data Last Updated: 2007-06-26 19:17:16 EST)
|
|||||||||||||||||||||||||||||
| 11-18-04 | 5 | 6\7 |
| Reviewer | Permalink | ||||||||||||||||||||||||
|
This book is a must read for beginners exploring the powers of SELinux and trying to setup a custom system. it has all the information needed to give a basic grounding of how everything is organised and how security is incorporqated into the kernel. it deals with the structural as well as the functional organization of the various components involved. although not exhaustive in examples there is a considerable number of'em on which one can work out his own specific interest.
(Review Data Last Updated: 2006-08-24 09:41:17 EST)
|
|||||||||||||||||||||||||||||
| 10-28-04 | 5 | 7\8 |
| Reviewer | Permalink | ||||||||||||||||||||||||
|
Some geeks feel that the best day every would be the day that the NSA releases all their secrets to the open. I disagree, the best thing the NSA could ever have done was release SELinux. I have been a faithful user for a long time and feel it is very robust and well designed. Role Based Access Control and Mandatory Access Control are a necessity in todays computer age and it is amazing that it took the NSA to finally get it right.
This book is a very comprehensive look at the outer workings of SELinux. It seems to be the only book or organized literature out there. I hope one day the NSA will begin their own free documentation process. (Review Data Last Updated: 2006-07-07 10:53:01 EST)
|
|||||||||||||||||||||||||||||
| Reader Reviews 1 - 14 of 14 | |||||||||||||||||||||||||||||
| All Books | Arts | Biography | Click Here For An A-Z Index Of All 213 Best-Seller Subjects | Business | Children's | Comics | ||||||
| Computers | Cooking | Engineering | Entertainment | Health | History | Home | Horror | Humor | Law | Fiction | Medicine | Mystery |
| Nonfiction | Outdoors | Parenting | Professional | Reference | Religion | Romance | Science | Sci-Fi | Sports | Teens | Travel | |
