apply universally to all users of the system, and theyaffect file accesses at a much deeper level than file permissions orACLs. In Linux, you can see and modify the attributes that are setfor a given file by using the lsattr and chattr commands,respectively. At the time of this writing, file attributes in Linuxare available only when using the ext2 and ext3 filesystems. Thereare also kernel patches available for attribute support in XFS andReiserFS. One useful attribute for protecting log files isappend-only. When this attribute is set, the file cannot be deleted,and writes are only allowed to append to the end of the file. To set the append-only flag under Linux, run this command: chattr +a filenameSee how the +a attribute works: create a file and set its append-onlyattribute: touch /var/log/logfileecho "append-only not set" > /var/log/logfilechattr +a /var/log/logfileecho "append-only set" > /var/log/logfilebash: /var/log/logfile: Operation not permittedThe second write attempt failed, since it would overwrite the file.However, appending to the end of the file is still permitted: echo "appending to file" >> /var/log/logfilecat /var/log/logfileappend-only not setappending to fileObviously, an intruder who has gained root privileges could realisethat file attributes are being used and just remove the append-onlyflag from our logs by running chattr -a. To prevent this, we need todisable the ability to remove the append-only attribute. Toaccomplish this under Linux, use its capabilities mechanism. The Linux capabilities model divides up the privileges given tothe all-powerful root account and allows you to selectively disablethem. In order to prevent a user from removing the append-onlyattribute from a file, we need to remove the CAP_LINUX_IMMUTABLEcapability. When present in the running system, this capabilityallows the append-only attribute to be modified. To modify the set ofcapabilities available to the system, we will use a simple utilitycalled lcap (http://packetstormsecurity.org/linux/admin/lcap-0.0.3.tar.bz2).To unpack and compile the tool, run this command: tar xvfj lcap-0.0.3.tar.bz2 && cd lcap-0.0.3 && makeThen, to disallow modification of the append-only flag, run: ./lcap CAP_LINUX_IMMUTABLE./lcap CAP_SYS_RAWIOThe first command removes the ability to change the append-only flag,and the second removes the ability to do raw I/O. This is needed sothat the protected files cannot be modified by accessing the blockdevice they reside on. It also prevents access to /dev/mem and/dev/kmem, which would provide a loophole for an intruder toreinstate the CAP_LINUX_IMMUTABLE capability. To remove thesecapabilities at boot, add the previous two commands to your systemstartup scripts (eg /etc/rc.local). You should ensure thatcapabilities are removed late in the boot order, to prevent problemswith other startup scripts. Once lcap has removed kernelcapabilities, they can be reinstated only by rebooting the system. Before doing this, you should be aware that adding append-onlyflags to your log files will most likely cause log rotation scriptsto fail. However, doing this will greatly enhance the security ofyour audit trail, which will prove invaluable in the event of anincident. Automatically encrypted connectionsDifficulty: Expert Application: FreeS/WAN One particularly cool feature supported by FreeS/WAN isopportunistic encryption with other hosts running FreeS/WAN. Thisallows FreeS/WAN to transparently encrypt traffic between all hoststhat also support opportunistic encryption. To do this, each hostmust have a public key generated to use with FreeS/WAN. This key