📄 security.html
字号:
<!doctype html public "-//w3c//dtd html 4.0 transitional//en"><html><head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"> <meta name="GENERATOR" content="Mozilla/4.76C-CCK-MCD Caldera Systems OpenLinux [en] (X11; U; Linux 2.4.2 i686) [Netscape]"> <title>OpenSLP Users Guide - Security</title></head><body text="#000000" bgcolor="#FFFFFF" link="#0000EE" vlink="#551A8B" alink="#FF0000"><h2>Security</h2><hr WIDTH="100%"><h3>Protecting the daemon against attacks</h3>The following measures have been taken to protect the OpenSLP daemon fromattacks:<ul><li>The OpenSLP daemon (slpd) must run as root initially in order to bind tothe well known SLP port. However, slpd will relinquish root privilegesand suid() to the daemon user (if it exists).</li><li>If slpd includes paranoid SLP message checking code . This slowsdown the operation of slpd slightly but ensures that malformed or intentionallymalicious SLP messages will not cause segmentation faults in the daemon.</li></ul><h3>Protecting the integrity of service registrations</h3>As of version 0.9.0, OpenSLP fully supports the SLPv2 message authenticationblocks to ensure that registrations can not be modified in transit andthat they are sent to and received from valid agents. Whenproperly installed and configured, OpenSLP will automatically provide thislevel of security to all SLP enabled applications with out any need torecompile or relink. Installation of secure OpenSLP is a littleinvolved...<p>Currently, OpenSLP uses DSS signatures to ensure the authenticity andintegrity of certain SLP messages. In order to do this, administratorsneed to: build a security enabled OpenSLP, provide (or generate)a DSA public and private keys, and setup the /etc/slp.spi file. The administrator also has to ensure that OpenSSL crypto libraries areproperly installed before secure OpenSLP will work.<p>Step 1: Since we not sure how many installations will requireOpenSLP security so the security features are not currently builtin by default. To build a security into open slp OpenSLP you willhave to use --enable-security on the ./configure command line<p>Step 2: Generate DSA public and private key files in PEM formatusing the OpenSSL command line. I'll provide details on exactlyhow this is done when I get more time in the mean time, you can figureit out by reading the openssl man pages.<p>Step 3: Copy the private DSA key PEM key file to very safe locationson hosts that will be registering services. The public DSA key PEMfile goes on all hosts that will be registering services and on all hoststhat will be finding services.<p>Step 4: Edit the /etc/slp.spi file to assign an SPI to the DSA keys. Details on how to do this are documented in the comments of the slp.spifile<br> <h3>User Level Access Control</h3>Plans have been made to provide a mechanism that will enforce user levelaccess control that will allow the administrator to specify the users orgroups that can register services with SLP.<br> <h3>Help</h3>If you find a security hole in OpenSLP, <i>please</i> bring it tothe attention of the <a href="mailto:matt@caldera.com">OpenSLPmaintainer</a>. Thanks.</body></html>⌨️ 快捷键说明
复制代码
Ctrl + C
搜索代码
Ctrl + F
全屏模式
F11
切换主题
Ctrl + Shift + D
显示快捷键
?
增大字号
Ctrl + =
减小字号
Ctrl + -