Translations by André Marra

<emphasis role="bold">Indexes</emphasis> - Display a formatted list of the directory's contents, if no <emphasis>DirectoryIndex</emphasis> (such as index.html) exists in the requested directory. <placeholder-1/>

The <application>mod_ssl</application> module adds an important feature to the Apache2 server - the ability to encrypt communications. Thus, when your browser is communicating using SSL, the https:// prefix is used at the beginning of the Uniform Resource Locator (URL) in the browser navigation bar.

Next, change the &lt;Directory "/path/to/rails/application/public"&gt; directive:

&lt;Directory "/path/to/rails/application/public"&gt; Options Indexes FollowSymLinks MultiViews ExecCGI AllowOverride All Order allow,deny allow from all AddHandler cgi-script .cgi &lt;/Directory&gt;

You should also enable the <application>mod_rewrite</application> module for Apache. To enable <application>mod_rewrite</application> module, please enter the following command in a terminal prompt:

[sudo] password for username: <placeholder-1/> Enter new UNIX password: <placeholder-2/> Retype new UNIX password: <placeholder-3/> passwd: password updated successfully

The process for managing local users and groups is straight forward and differs very little from most other GNU/Linux operating systems. Ubuntu and other Debian based distributions, encourage the use of the "adduser" package for account management.

To add a user account, use the following syntax, and follow the prompts to give the account a password and identifiable characteristics such as a full name, phone number, etc.

Deleting an account does not remove their respective home folder. It is up to you whether or not you wish to delete the folder manually or keep it according to your desired retention policies.

Remember, any user added later on with the same UID/GID as the previous owner will now have access to this folder if you have not taken the necessary precautions.

To verify your current users home directory permissions, use the following syntax:

The following output shows that the directory <filename class="directory">/home/username</filename> has world readable permissions:

drwxr-xr-x 2 username username 4096 2007-10-02 20:03 username

sudo chmod 0750 /home/username

After correcting the directory permissions using any of the previously mentioned techniques, verify the results using the following syntax:

drwxr-x--- 2 username username 4096 2007-10-02 20:03 username

By default, Ubuntu requires a minimum password length of 4 characters, as well as some basic entropy checks. These values are controlled in the file <filename>/etc/pam.d/common-password</filename>, which is outlined below.

If you would like to adjust the minimum length to 6 characters, change the appropriate variable to min=6. The modification is outlined below.

The <varname>max=8</varname> variable does not represent the maximum length of a password. It only means that complexity requirements will not be checked on passwords over 8 characters. You may want to look at the <application>libpam-cracklib</application> package for additional password entropy assistance.

sudo chage -l username

The output below shows interesting facts about the user account, namely that there are no policies applied:

Last password change : Jan 20, 2008 Password expires : never Password inactive : never Account expires : never Minimum number of days between password change : 0 Maximum number of days between password change : 99999 Number of days of warning before password expires : 7

To set any of these values, simply use the following syntax, and follow the interactive prompts:

sudo chage username

sudo chage -E 01/31/2008 -m 5 -M 90 -I 30 -W 14 username

Last password change : Jan 20, 2008 Password expires : Apr 19, 2008 Password inactive : May 19, 2008 Account expires : Jan 31, 2008 Minimum number of days between password change : 5 Maximum number of days between password change : 90 Number of days of warning before password expires : 14

SSH Access by Disabled Users

External User Database Authentication

Console Security

GRUB Password Security

Pass kernel options at boot up.

Password: <placeholder-1/> Retype password: <placeholder-2/> $1$s3YiK$M3lxAbqA6JLm2FbDWnClQ0

password --md5 $1$s3YiK$M3lxAbqA6JLm2FbDWnClQ0

# lockalternative=true

<emphasis>Capability entries:</emphasis> determine what privileges a confined process is allowed to use.

As an example take a look at <filename>/etc/apparmor.d/bin.ping</filename>:

#include &lt;tunables/global&gt; /bin/ping flags=(complain) { #include &lt;abstractions/base&gt; #include &lt;abstractions/consoles&gt; #include &lt;abstractions/nameservice&gt; capability net_raw, capability setuid, network inet raw, /bin/ping mixr, /etc/modules.conf r, }

<emphasis>#include &lt;tunables/global&gt;:</emphasis> include statements from other files. This allows statements pertaining to multiple applications to be placed in a common file.

<emphasis>/bin/ping flags=(complain):</emphasis> path to the profiled program, also setting the mode to <emphasis>complain</emphasis>.

<emphasis>capability net_raw,:</emphasis> allows the application access to the CAP_NET_RAW Posix.1e capability.

<emphasis>/bin/ping mixr,:</emphasis> allows the application read and execute access to the file.

After editing a profile file the profile must be reloaded. See <xref linkend="apparmor-usage"/> for details.

Creating a Profile

<emphasis>Design a test plan:</emphasis> Try to think about how the application should be exercised. The test plan should be divided into small test cases. Each test case should have a small description and list the steps to follow.

Some standard test cases are:

Starting the program.

Stopping the program.

Reloading the program.

Testing all the commands supported by the init script.

<emphasis>Generate the new profile:</emphasis> Use <application>aa-genprof</application> to generate a new profile. From a terminal: