|
| ||||||||||||||||||||||||||||||||||||
|
Tutorials:
Overview |
By Day (Monday, Tuesday,Wednesday) |
By Instructor | All in One File
W1 Running Web Servers Securely NEW
W2 Hacking Exposed: LIVE!
W3 Inside the Linux Kernel
W4 Network Programming with Perl NEW
W5 Cryptographic Algorithms Revealed
W6 System and Network Performance Tuning
W7 Configuring and Administering Samba Servers
W8 Computer Crime: Investigating Computer-Based Evidence NEW
W9 Solaris Internals: Architecture, Tips, and Tidbits
W10 Panning for Gold: What System Logs Tell You About Your Network Security NEW
W1 Running Web Servers Securely NEW Rik Farrow, Consultant Who should attend: Web server administrators, managers, and security consultants who manage or audit Web servers. We will examine every aspect of Web server security, from configuration and file permissions to scripting. At the end of this class, you will have learned how to harden a UNIX system for use as a Web server, configure Apache correctly for tightest security, write and audit Perl scripts for common weaknesses, and use the safest techniques for remote administration of Web servers. Among the favorite targets for hackers are Web servers, because they need to be exposed in order to be useful, and, once broached, they often provide access to internal servers. While misconfiguration of the Web server can provide a way in, CGI programming has been used so often that there are even tools designed specifically to look for weaknesses in CGI. You will learn about securing Web servers through the examples of others who were not so careful. The class begins with an in-depth description of a famous hack of a Linux server running Apache. We will look at tools for scanning Web servers, such as Whisker, that look for common mistakes, and we'll take a look at other legendary mistakes in CGI scripts. You will learn the role of Perl's taint mechanism in uncovering flaws in script design. We will explore Java's servlet mechanism and see how Java's security mechanisms can provide an additional layer of security. Topics include:
W2 Hacking Exposed: LIVE! George Kurtz and Stuart Mcclure, Foundstone, Inc. Who should attend: Network and system administrators, security administrators, and technical auditors who want to secure their UNIX/NT—based networks. Is your UNIX/NT—based network infrastructure up to meeting the challenge of malicious marauders? In this tutorial we'll present the methodologies used by today's hackers to gain access to your networks and critical data. We'll demonstrate a typical attack exploiting both well-known and little-known NT-based vulnerabilities. We'll show how NT attackers can leverage UNIX vulnerabilities to circumvent traditional security mechanisms. And we'll identify opportunities to better secure the host and networks against more esoteric attacks. All examples will be demonstrated on a live network of machines. Topics include:
W3 Inside the Linux Kernel Ted Ts'o, VA Linux Systems Who should attend: Application programmers and kernel developers. You should be reasonably familiar with C programming in the UNIX environment, but no prior experience with the UNIX or Linux kernel code is assumed. This tutorial will give you an introduction to the structure of the Linux kernel, the basic features it provides, and the most important algorithms it employs. The Linux kernel aims to achieve conformance with existing standards and compatibility with existing operating systems; however, it is not a reworking of existing UNIX kernel code. The Linux kernel was written from scratch to provide both standard and novel features, and takes advantage of the best practice of existing UNIX kernel designs. Although the material will focus on the release version of the Linux kernel, it will also address aspects of the development kernel codebase where its substance differs. It will not contain any detailed examination of the source code but will rather offer an overview and roadmap of the kernel's design and functionality. Topics include:
W4 Network Programming with Perl NEW Lincoln Stein, Perl hacker Who should attend: Novice to intermediate Perl programmers who understand the basics of input and output, loops, regular expression matches, and the array and hash data types. A working familiarity with Perl5's object-oriented syntax is also recommended. You should understand the basics of networking, including the concepts of IP addresses, DNS names, and servers. This tutorial will show you how to write robust client/server applications in Perl. We will begin with simple TCP-based clients that you can use to talk such standard services as ftp, http, mail, and news. We will then turn to writing client/server applications from scratch, using as our examples applications that range from toys (a TCP-based psychotherapist server) to full-scale applications (an Internet chat system based on multicasting). Topics include:
W5 Cryptographic Algorithms Revealed Greg Rose, Qualcomm Who should attend: Anyone interested in a fairly detailed overview of what makes cryptographic algorithms work, and, when they don't work, how they are broken. Some of the Advanced Encryption Standard finalists are covered to provide lessons in block ciphers, with the winner, Rijndael, treated in depth. Some mathematical background is required--at the very least, familiarity with common mathematical notation and polynomials, and some elementary statistical knowledge. You've been warned. Topics include (unless time runs out):
W6 System and Network Performance Tuning Marc Staveley, Soma Networks Who should attend: Novice and advanced UNIX system and network administrators, and UNIX developers concerned about network performance impacts. A basic understanding of UNIX system facilities and network environments is assumed. We will explore techniques for tuning systems, networks, and application code. Starting from a single-system view, we'll examine how the virtual memory system, the I/O system, and the file system can be measured and optimized. We'll move on to Network File System tuning and performance strategies. Detailed treatment of network performance problems, including network design and media choices, will lead to examples of network capacity planning. Application issues, such as system call optimization, memory usage and monitoring, code profiling, real-time programming, and controlling response time will be covered. Many examples will be given, along with guidelines for capacity planning and customized monitoring based on your workloads and traffic patterns. Analysis periods for particular situations will be provided. Topics include:
W7 Configuring and Administering Samba Servers Gerald Carter, VA Linux Systems Who should attend: System and network administrators who wish to integrate Samba running on a UNIX-based machine with Microsoft Windows clients. No familiarity with Windows networking concepts will be assumed. Samba is a freely available suite of programs that allows UNIX-based machines to provide file and print services to Microsoft Windows PCs without installing any third-party software on the clients. This allows users to access necessary resources from both PCs and UNIX workstations. As Samba makes its way into more and more network shops all over the world, it is common to see "configuring Samba servers" listed as a desired skill on many job descriptions for network administrators. This tutorial will use real-world examples taken from daily administrative tasks. Topics include:
W8 Computer Crime: Investigating Computer-Based Evidence NEW Steve Romig, Ohio State University Who should attend: People who investigate computer crimes who have some familiarity with systems or network administration and a basic understanding of what the Internet is and what people commonly use it for. This tutorial picks up where Tutorial T8, "Forensic Computer Investigations: Principles and Procedures," leaves off. We will see where to find evidence in a wide variety of sources, including various flavors of UNIX, Windows, NT, and such network devices as routers and switches. Specific and detailed case studies will show how to safely recover and preserve this evidence. Real-life examples will be used to illustrate the application of the principles and suggested procedures from the introductory tutorial. Finally, we will demonstrate how to correlate evidence from different sources to build a coherent and robust reconstruction of events that comprises the "crime scene." Topics include:
W9 Solaris Internals: Architecture, Tips, and Tidbits Richard McDougall and James Mauro, Sun Microsystems, Inc. Who should attend: Software engineers, application architects and developers, kernel developers, device driver writers, system administrators, performance analysts, capacity planners, Solaris users who wish to know more about the system they're using and the information available from bundled and unbundled tools, and anyone interested in operating system internals. The installed base of Solaris systems being used for various commercial data-processing applications across all market segments and scientific computing applications has grown dramatically over the last several years, and it continues to grow. As an operating system, Solaris has evolved considerably, with some significant changes made to the UNIX SVR4 source base on which the early system was built. An understanding of how the system works is required in order to design and develop applications that take maximum advantage of the various features of the operating system, to understand the data made available via bundled system utilities, and to optimally configure and tune a Solaris system for a particular application or load. Topics include the major components of the Solaris 8 kernel. We discuss significant differences between Solaris 8 and the previous volume release (Solaris 2.6). We discuss in detail the kernel system services facilities, such as system calls, traps and interrupts, system clocks and synchronization primitives. We discuss the 64-bit kernel, loadable kernel modules, and the runtime linker. We examine the multi-threaded process model, the threads implementation, and thread scheduling at the library and kernel level. Interprocess communication, including Solaris Doors, is also covered. The kernel's virtual memory implementation, file system, and file support are also covered. Along the way, we use examples from bundled Solaris utilities (mpstat, vmstat, cpustat, etc.) and the kernel debugger (mdb) to illustrate points and provide examples. After completing this course, participants will have a solid understanding of the internals of the major areas of the Solaris kernel that they will be able to apply to systems performance analysis, tuning, load/behavior analysis, and application development.
W10 Panning for Gold: What System Logs Tell You About Your Network Security NEW Tina Bird, Counterpane Internet Security Who should attend: System administrators and network managers responsible for monitoring and maintaining the health and well-being of computers and network devices in an enterprise environment. Participants should be familiar with the UNIX operating system and basic network security, although some review is provided. The purpose of this tutorial is to illustrate the importance of a network-wide centralized logging infrastructure, to introduce several approaches to monitoring audit logs, and to explain the types of information and forensics that can be obtained with well-managed logging systems. Every device on your network--routers, servers, firewalls, application software--spits out millions of lines of audit information a day. Hidden within the data that indicates normal day-to-day operation (and known problems) are the first clues that an attacker is starting to probe and penetrate your network. If you can sift through the audit data and find those clues, you can learn a lot about your present state of security and maybe even catch attackers in the act. Topics include:
This class won't teach you how to write Perl scripts to simplify your logfiles. It will teach you how to build a log management infrastructure, how to figure out what your log data means, and what in the world you do with it once you've acquired it.
| |||||||||||||||||||||||||||
 Need help? Use our Contacts page.
Last changed: 16 Mar 2001 becca |
|
USENIX '01 Home