Linux安全安全

————Windows&LinuxWindows&Linux20032003--77--1919PartIPartIWindowsWindowsWindowsWindowsWindowsWindowsWindowsWindowsWindows2000Windows2000WindowsWindowsWindowsWindows2000Architecture2000Architecture((accounts)accounts)((groups)groups)((useraccounts)useraccounts)WindowsWindowsID(SID)ID(SID)……universalgroupsuniversalgroupsglobalgroupsglobalgroupslocallocalgroupsgroupsAccountIdentifier:Securityidentifier(SID)AccountIdentifier:Securityidentifier(SID)SS--11--NN--Y1Y1--Y2Y2--Y3Y3--Y4Y4SomewellSomewell--knownknownSIDsSIDsSIDSIDWindowsNTWindowsNT((TCB)TCB)ReferencemonitorAccessvalidationrequestsAuditgenerationrequestsKernelmodeusermodeLocalsecuritypolicydatabaseLocalSecurityAuthorityAuditLogfileAuthenticationServiceAccountdirectoryServicesUserAccountDatabaseWinlogonAdministraticeToolsAuditmessagessecuritypolicyLocalSecurityAuthorityLocalSecurityAuthorityLocalSecurityAuthority:LocalSecurityAuthority:AprotectedsubsystemofMicrosoftAprotectedsubsystemofMicrosoft®®WindowsWindowsNT/WindowsNT/Windows®®2000that2000thatauthenticatesandlogsusersontotheauthenticatesandlogsusersontothelocalsystem.Inaddition,LSAmaintainslocalsystem.Inaddition,LSAmaintainsinformationaboutallaspectsoflocalinformationaboutallaspectsoflocalsecurityonasystem,collectivelysecurityonasystem,collectivelyknownastheLocalSecurityPolicyofknownastheLocalSecurityPolicyofthesystem.thesystem.LSAAuthenticationModelLSAAuthenticationModelLSALogonSessionsLSALogonSessionslogonlogonlogofflogoffSecurityAccessTokenSecurityAccessTokenSIDSIDSIDsSIDsOwnerOwnerDefaultDiscretionaryAccessControlListDefaultDiscretionaryAccessControlList(DACL)(DACL)…………ObjectSecurityObjectSecurity(())((securitydescriptor)securitydescriptor)OwnerSIDOwnerSIDGroupGroupSIDsSIDsDiscretionaryACLDiscretionaryACLAuditAuditSystemACLSystemACLObjectSecurityObjectSecurityAccessControlListmanipulationAccessControlListmanipulationAccessCheckAccessCheckAuditGenerationAuditGenerationSecuritytokenUserGroupsPrivilegesUserYprocessAccessobjectXSecurityReferencemonitorSecuritydescriptorOwnerDACLSACLUserYUserXACLACEACEAccessmaskUserY…AccessmaskAccessdeterminationNTFSfileobjectsecurityNTFSfileobjectsecurityTokenUserxxxNTFS1.fileSD2.SDAccessCheck3.Yes/No4.WindowsExplorerFile,Properties,SecurityFileAccesspolicypolicyAuditingAuditingCategories:Success/FailureeventsCategories:Success/FailureeventsLogonandLogoffLogonandLogoffFileandObjectAccessFileandObjectAccessUseofUseofUserrightsUserrightsUserandGroupManagementUserandGroupManagementSecuritySecurityPolicyChangesPolicyChangesRestart,ShutdownsystemRestart,ShutdownsystemProcessProcessTrackingTrackingPrivilegesPrivilegesAllowspecialabilitiesoverandaboveaccessrightsAllowspecialabilitiesoverandaboveaccessrightsFinegrained:OnePrivilege=oneAbilityFinegrained:OnePrivilege=oneAbilityWindowsNThas23definedprivileges,suchas:WindowsNThas23definedprivileges,suchas:Backupfilesanddirectories,changethesystemtimeBackupfilesanddirectories,changethesystemtimeLogonRightsLogonRightsLogononLocally(Forinteractivelogon)LogononLocally(Forinteractivelogon)Accessthiscomputerfromnetwork(forremotelogon)Accessthiscomputerfromnetwork(forremotelogon)Logonasaservice(startserviceprocessesunderspecificLogonasaservice(startserviceprocessesunderspecificserviceaccount)serviceaccount)Logonasabatchjob(submitjobstobatchqueues)Logonasabatchjob(submitjobstobatchqueues)Authentication:Authentication:WinlogonWinlogonProcessingProcessingWinlogonWinlogonModelModelDistinctdesktopsDistinctdesktopsEverysystemisauthenticatedEverysystemisauthenticated(windowstation)(windowstation)WinlogonWinlogonArchitectureArchitectureWinlogonWinlogonGINADLLGINADLLMultiplenetworkMultiplenetworkprovidersprovidersWinlogonGINANPsWinlogonWinlogonWinlogonLSAAuthPkgAccountDBGINANetlogonWin32ShellNetlogonAuthPkgAccountDBAD/DCCTRL+ALT+DELLSA(LocalSecurityLSA(LocalSecurityAuthority):InteractiveAuthenticationAuthority):InteractiveAuthentication&&NoninteractiveNoninteractiveAuthenticationAuthenticationWindowsWindowsNetworkconnectionsecurityNetworkconnectionsecurityAuthenticationAuthenticationintegrityintegrityprivacyprivacySecuredistributedapplicationsSecuredistributedapplicationsAuthenticatedRPCAuthenticatedRPCDCOMsecurityDCOMsecurityClientServerRPCruntimeSSPSSPRPCruntimeWindowsRegistry(WindowsRegistry())WindowsWindowsWindowsWindowsWindowsNT/2000WindowsNT/2000RegEdt32RegEdt32Windows2000Windows2000((activeactivedirectory)directory)Windows2000Windows2000Windows2000Windows2000DNSDNS————————————LDAPLDAPLDAP://CN=smith,OU=users,OU=receivables,DC=us,LDAP://CN=smith,OU=users,OU=receivables,DC=us,DC=DC=qwickbankqwickbank,DC=com,DC=com————KerberosKerberos————ACLACL————((GC,globalcatalog)GC,globalcatalog)————USN(USN())…………KerberosKerberosPKIPKIWindows2000Windows2000SAMSAMSAM:SecurityAccountsManager,SAM:SecurityAccountsManager,samsamsamsamsamsamsamsamsyskeysyskeyWindows2000Windows2000NDISTDI:TransportDriverInterfaceNetworkAPIInterprocesscommWindows2000Windows2000IPSecIPSecNetBIOSNetBIOSoverTCP/IPoverTCP/IPNetBIOSNetBIOSNetBIOSNetBIOS((//))IBMIBMMSMSNetBIOSNetBI