2 - Raspberry PI Community Projects

a desktop machine is far from being as critical as one on a DNS server. Another interesting directive
allows storing the mappings between IP addresses and MAC addresses (these uniquely
identify a network card), so as to allow detecting ARP spoofing attacks by which a compromised
machine attempts to masquerade as another such as a sensitive server.
CAUTION
Range of action
The effectiveness of snort is limited by the traffic seen on the monitored network
interface. It will obviously not be able to detect anything if it cannot
observe the real traffic. When plugged into a network switch, it will therefore
only monitor aacks targeting the machine it runs on, which is probably
not the intention. The machine hosting snort should therefore be plugged
into the “mirror” port of the switch, which is usually dedicated to chaining
switches and therefore gets all the traffic.
On a small network based around a network hub, there is no such problem,
since all machines get all the traffic.
14.4. Introduction to SELinux
14.4.1. Principles
SELinux (Security Enhanced Linux) is a Mandatory Access Control system built on Linux's LSM (Linux
Security Modules interface. In practice, the kernel queries SELinux before each system call to
know whether the process is authorized to do the given operation.
SELinux uses a set of rules — collectively known as a policy — to authorize or forbid operations.
Those rules are difficult to create. Fortunately, two standard policies (targeted and strict) are
provided to avoid the bulk of the configuration work.
With SELinux, the management of rights is completely different from traditional Unix systems.
The rights of a process depend on its security context. The context is defined by the identity of
the user who started the process, the role and the domain that the user carried at that time. The
rights really depend on the domain, but the transitions between domains are controlled by the
roles. Finally, the possible transitions between roles depend on the identity.
388 The Debian Administrator's Handbook