Review of Network Security with OpenSSL

ISBN 0-596-00270-X Price £28.50 UK
John Viega, Matt Messier & Pravir Chandra
Preface, 10 Chapters, 1 Appendix, Collophon and Index in 369 pages

    1 Introduction
    2 Command-line Interface
    3 Public Key Infrastructure
    4 Support Infrastructure
    5 SSL/TLS Programming
    6 Symmetric Cryptography
    7 Hashes and MACs
    8 Public Key Algorithms
    9 OpenSSL in other languages
    10 Advanced Programming topics

          Appendix A
                Problems and Common Errors
            Appendix B
                Credits
            Appendix C
                Porting to other systems
            Appendix D
                Porting to other systems
            Appendix E
                Environment Variables
            Appendix F
                MySQL Regular Expressions

Many system administrators are now using open source software to protect their systems from hackers/crackers and script kiddies. Anyone who is subscribed to any interenet based tecnical support list will see e-mail about OpenSSH or OpenSSL more than once a week. Network Security with OpenSSL shows some of the many aspects of how to configure and use OpenSSL in a way that is the most sensible or most useful.

Network security is the kind of thing that most companies seem to forget about. On an increasingly insecure small blue green planet like ours this shouldn't be so. E-mail sent over an untrusted network should be encrypted and so should other data. Cryptography was always at the centre computing and communications technology. It should be used wisely instead of being left on the shelf. As the book rightly explains it's likely that SSL and its successor TLS probably doesn't provide the ultimate tool for absolute security but it does take the end user and system administrator along the path towards a more secure world. In the early pages there is a section entitled "Goals of Cryptography". The sub-sections are entitled with the words, confidentiality, integrity, authentication, non-repudiation with a view to stopping such network attacks as .... snooping, tampering, spoofing, hijacking and capture replay. At this point the reader might notice a certain similarity to another O'Reilly book which is called OpenSSH. The goal of the book is to document SSL cryptography and explain what it is rather than to make false claims of a misleading nature.

The first chapter goes into SSL in some depth although some of us would probably want some more. The OpenSSL library is discussed and an overview of the security risks involved. Stunnel is also shown which can be used with POP mail servers to secure e-mail. Since the slapper worm is a recent event which affected the mod_ssl component of Apache servers it isn't discussed here. If you want that kind of thing there are plenty of sites on the internet for more information. One such site is www.securityfocus.com . The command line interface is introduced and discussed in chapter two. PKI which our own Government claim to be a part of their IT strategy is explained in chapter three. The support infrastructure is discussed in chapter four. The OpenSSL IO API is taken apart it might be that some people would want more of this than is available in this publication. Probably of greatest interest to those of us reading the UKUUG Newsletter is chapter five. This explains SSL/TLS programming methods. It starts with the fact that the API can be daunting for inexperienced programmers and finishes with the fact that they have kept things simple so that the people who are new to SSL programming don't get confused. There are more advanced texts elsewhere. Symetric cryptography and how to use OpenSSL with triple DES and other cryptographic algorithms is what makes up the most of chapter six and on a similar note chapter seven shows hashes and MAC's. Chapter eight goes into the public key algorithms that OpenSSL exports. Chapter nine explains OpenSSL in other languages such as Perl and Python with Net::SSLeay and M2Crypto. Although chapter ten shows some advanced programming topics it's a bit short on facts and you might find what you are looking for somewhere else.

Seen from the perspective of someone who doesn't know anything about OpenSSL this publication is probably a godsend. If you have to learn more about OpenSSL then it's probably a good idea to get hold of this book.

The Colophon which can be found at the back of every O'Reilly book is well worth a look in. " The animals on the cover of Network Security with OpenSSL are seals and sea lions. Seals and sea lions are related; both are marine mammals belonging to the order Pinnipedia. Sea lions, along with fur seals, are members of the eared sealed familly. Eared seals, as their name implies, have external ears on either side of the head. These ears are covered by small flaps. All other seals, or true seals, lack external ears, having only small, wrinkled openings where their ears would otherwise be. Another principle difference between eared seals and true seals is the functionality of their rear flippers. Eared seals can turn their rear flippers forward to move about on land. Ture seals cannot, and can move on land only by rolling, sliding, or wriggling from place to place. Despite the awkwardness of both seals and sea lions on land, both swim very gracefully usinf undulating motions of their front flippers. Fish and squid are the main staples of the seal and sea lion diet. These mammals cane dive to great depths - up to 2000 feet in some species - in search of food. Seals and sea lions have long been hunted for their blubber and their fur. There are eighteen living species of seal and four major species of sea lion in existence. Some species are endangered or threatened. All are currently protected. "

O'Reilly like to produce distinctive covers for their books which complement their distinctive approach to technical subjects thus breathing new life and and personality into potentially dry subjects.

Richard is the organiser for Sheffield Linux User's Group
– you can view their web site at – http://www.sheflug.co.uk.