Very Computer

Does any one has a list of what policies/procedures manual should
contain for information(data) security on Unix System?

It will depend on the workplace culture as well as the Unix system.

Start by outlining who is responsible for what.  Identify various good
and bad practices in their general forms (e.g. password quality).

Avoid impossible requirements that only guarantee audit failure.

Lean toward automatic complicance rather than continual pursuit and
correction: with no rlogind/remshd you won't care how many stupid
+ signs the users put in their ~/.rhosts .

--
decoy mail addresses: obtain username via 0x4f/tcp or 0x50/tcp

Quote:>Does any one has a list of what policies/procedures manual should
>contain for information(data) security on Unix System?

I found rfc 2196 to be very usefull
see
http://www.ietf.org/rfc/rfc2196.txt?number=2196

You might want to have a look at an excellent book on UNIX security and the
procedures and policies around it, O'Reilly's Practical Unix & Internet
Security. If you do stuff with UNIX and do stuff with security this book is
a must read, in my trying-to-be humble opinion.
Info at http://www.oreilly.com/catalog/puis3/ or, if you choose to be
convinced already and make no further judgement order it directly at
http://www.amazon.com/exec/obidos/ASIN/1565921488/dnssesecurthe-20

Good luck.

Regards,

Casper
--
http://www.dsinet.org/ - Dutch Security Information Network
"Don't quote, I want to know what you have to say." -Anonymous

[original reply canceled, gave you url to wrong edition]

You might want to have a look at an excellent book on UNIX security and the
procedures and policies around it, O'Reilly's Practical Unix & Internet
Security. If you do stuff with UNIX and do stuff with security this book is
a must read, in my trying-to-be humble opinion.
Info at http://www.oreilly.com/catalog/puis3/ or, if you choose to be
convinced already and make no further judgement order it directly at
http://www.amazon.com/exec/obidos/ASIN/0596003234/qid=1046909987/sr=2...

Good luck.

Regards,

Casper
--
"Don't quote, I want to know what you have to say." -Anonymous