[B! secu2007] takehikomã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

takehikom id:takehikom

secu2007ã«é–¢ã™ã‚‹takehikomã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (33)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

ã€å†…é–£åºœã€‘ å€‹äººæƒ…å ±ä¿è·
å†…é–£åºœã‚¦ã‚§ãƒ–ã‚µã‚¤ãƒˆã®å¸¸æ™‚æš—å·åŒ–ã«ã‚ˆã‚‹ã€Œhttps:ã€ã¸ã®åˆ‡ã‚Šæ›¿ãˆ Always on TLS of Cabinet Office Website 2019(ä»¤å’Œå…ƒ)å¹´11æœˆæ›´æ–° Update,November,2019 å†…é–£åºœã‚¦ã‚§ãƒ–ã‚µã‚¤ãƒˆã¯ã€2018å¹´11æœˆ29æ—¥ã‚ˆã‚Šã€å¸¸æ™‚æš—å·åŒ–é€šä¿¡ï¼ˆTLS1.2ï¼‰ã¨ãªã‚Šã€URLãŒä»¥ä¸‹ã®ã¨ãŠã‚Šã€ã€Œhttps:ã€ã«å¤‰æ›´ã¨ãªã‚Šã¾ã—ãŸã€‚â€» ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯æ©Ÿèƒ½ç‰ã«ã€Œhttp:ã€ã§å§‹ã¾ã‚‹URLã‚’ç™»éŒ²ã—ã¦ã„ã‚‹å ´åˆã‚„ã€ãƒªãƒ³ã‚¯ã‚’è²¼ã£ã¦ã„ã‚‹å ´åˆç‰ã¯ã€ã€Œhttps:ã€ã‹ã‚‰å§‹ã¾ã‚‹URLã«åˆ‡ã‚Šæ›¿ãˆã¦ã„ãŸã ãã¾ã™ã‚ˆã†ã€ãŠé¡˜ã„ã„ãŸã—ã¾ã™ã€‚ â€»å‚è€ƒ:2018å¹´11æœˆã‹ã‚‰2019å¹´10æœˆã¾ã§ã¯ã€httpã«ã‚ˆã‚‹æŽ¥ç¶šã‚’å¯èƒ½ã¨ã™ã‚‹è‡ªå‹•é·ç§»ã®çµŒéŽæŽªç½®ã‚’ã¨ã£ã¦ãŠã‚Šã¾ã—ãŸã€‚ å†…é–£åºœãƒ›ãƒ¼ãƒ ãƒšãƒ¼ã‚¸ï¼ˆhttps://www.cao.go.jp/ï¼‰ å†…é–£åºœå…±é€šæ¤œç´¢ã‚·ã‚¹ãƒ†ãƒ Cabinet Office has
takehikom 2007/07/14
secu2007

20070713
ãƒªãƒ³ã‚¯
ISOã®å†…éƒ¨ç›£æŸ»ã¨ã¯
takehikom 2007/07/14
secu2007

20070713
ãƒªãƒ³ã‚¯
æƒ…å ±ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒžãƒã‚¸ãƒ¡ãƒ³ãƒˆã‚·ã‚¹ãƒ†ãƒ - Wikipedia
æƒ…å ±ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒžãƒã‚¸ãƒ¡ãƒ³ãƒˆã‚·ã‚¹ãƒ†ãƒ ï¼ˆã˜ã‚‡ã†ã»ã†ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒžãƒã‚¸ãƒ¡ãƒ³ãƒˆã‚·ã‚¹ãƒ†ãƒ ã€ISMS: Information Security Management Systemï¼‰ã¯ã€çµ„ç¹”ã«ãŠã‘ã‚‹æƒ…å ±è³‡ç”£ã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã‚’ç®¡ç†ã™ã‚‹ãŸã‚ã®æž çµ„ã¿ã€‚æƒ…å ±ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒžãƒã‚¸ãƒ¡ãƒ³ãƒˆã¨ã¯ã€ISMSã‚’ç–å®šã—ã€å®Ÿæ–½ã™ã‚‹ã“ã¨ã€‚[1] ISMSã®ç›®æ¨™ã¯ã€ãƒªã‚¹ã‚¯ãƒžãƒã‚¸ãƒ¡ãƒ³ãƒˆãƒ—ãƒã‚»ã‚¹ã‚’é©ç”¨ã™ã‚‹ã“ã¨ã«ã‚ˆã£ã¦ã€æƒ…å ±ã®æ©Ÿå¯†æ€§ã€å®Œå…¨æ€§åŠã³å¯ç”¨æ€§ã‚’ç¶æŒã—ã€ã‹ã¤ã€ãƒªã‚¹ã‚¯ã‚’é©åˆ‡ã«ç®¡ç†ã—ã¦ã„ã‚‹ã¨ã„ã†ä¿¡é ¼ã‚’åˆ©å®³é–¢ä¿‚è€…ã«ä¸Žãˆã‚‹[2][3]ã“ã¨ã€‚ ISMSã®æ¨™æº–ã¯ISO 27001ãŠã‚ˆã³ãã‚Œã¨åŒç‰ãªJIS Q 27001ã«è¦å®šã•ã‚Œã¦ãŠã‚Šã€æœ¬ç¨¿ã¯2016å¹´æ™‚ç‚¹ã®ã“ã‚Œã‚‰æ¨™æº–ã®æœ€æ–°ç‰ˆ ISO/IEC 27001:2013ï¼ˆJIS Q 27001:2014ã¨åŒç‰ï¼‰ã‚’åŸºã«ã€ISMSã‚’èª¬æ˜Žã™ã‚‹ã€‚ ISMSã‚’è¦å®šã—ãŸISO/IEC 27001:2013ã¯ã€I
takehikom 2007/07/14
secu2007

20070713
ãƒªãƒ³ã‚¯
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ - Wikipedia
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ï¼ˆè‹±: securityï¼‰ å±é™ºã‚„è„…å¨ã‹ã‚‰è§£æ”¾ã•ã‚ŒãŸçŠ¶æ…‹[1]ã€‚ã“ã®æŠ½è±¡çš„ãªæ¦‚å¿µã‹ã‚‰ä¸‹ã®ã‚ˆã†ãªã•ã¾ã–ã¾ãªã€ã‚ˆã‚Šå…·ä½“çš„ãªæ¦‚å¿µãŒæ´¾ç”Ÿã—ã¦ã„ã‚‹ã€‚ ä¸Šè¿°ã®ã€Œå±é™ºã‚„è„…å¨ã‹ã‚‰è§£æ”¾ã•ã‚ŒãŸçŠ¶æ…‹ã€ã‚’å®Ÿç¾ã™ã‚‹ãŸã‚ã®æ®µå–ã‚Šã‚„æ‰‹æ®µã€‚äººã€ä½å±…ã€è³‡ç”£ã€çµ„ç¹”ã€åœ°åŸŸç¤¾ä¼šã€å›½å®¶ãªã©ã‚’è„…å¨ã‹ã‚‰å®ˆã‚‹ã•ã¾ã–ã¾ãªè¨ˆç”»ãƒ»æ®µå–ã‚Šã‚„æ‰‹æ®µã‚’æŒ‡ã—ã†ã‚‹ã€‚ã€Œå±é™ºã€ã‚„ã€Œè„…å¨ã€ã¯åˆ†é‡Žã”ã¨ã«ã•ã¾ã–ã¾ãªã‚‚ã®ã‚’æŒ‡ã—å¾—ã‚‹ã€‚ ï¼ˆå€‹äººï¼‰å€‹äººã®èº«ä½“ã€å€‹äººã®è²¡ç”£ã€ä½å±…ãªã©ã‚’è„…å¨ã‹ã‚‰å®ˆã‚‹ã“ã¨ã€‚æ—¥æœ¬èªžã§ã¯è¦å‚™ã¨è¨³ã™ã“ã¨ãŒå¤šã„ã€‚ä¸€èˆ¬å®¶åºã‚’è·ã‚‹ã¨ã„ã†æ„å‘³ã§ãƒ›ãƒ¼ãƒ ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã¨ã‚‚ã€‚ãªãŠ20å¹´ã»ã©å‰ã¾ã§ã¯ãã†ç†è§£ã™ã‚Œã°ã‚ˆã‹ã£ãŸãŒã€æœ€è¿‘ã§ã¯æ—¥æœ¬ã§ã‚ã‚Œæ¬§ç±³ã§ã‚ã‚Œè‹¥ã„äººãŒæ—¥å¸¸ä¼šè©±ã§ã€Œã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã€ã«ã¤ã„ã¦è©±ã—åˆã£ã¦ã„ãŸã‚‰ã€ãŸã„ã¦ã„è‡ªå®…ã®ç‰©ç†çš„ãªè¦å‚™ã®ã“ã¨ã¯æŒ‡ã—ã¦ãŠã‚‰ãšã€ã‚€ã—ã‚å½“ç¯€ã®æœ«å°¾ã®ã€ŒIT ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã€ã€Œã‚³ãƒ³ãƒ”ãƒ¥ãƒ¼ã‚¿ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã€ã€Œãƒãƒƒãƒˆãƒ¯ãƒ¼ã‚¯ãƒ»ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã€ã®ã“ã¨
takehikom 2007/07/14
secu2007

20070713
ãƒªãƒ³ã‚¯
è¨ˆç®—è¤‡é›‘æ€§ç†è«– - Wikipedia
è¨ˆç®—è¤‡é›‘æ€§ç†è«–ï¼ˆã‘ã„ã•ã‚“ãµãã–ã¤ã›ã„ã‚Šã‚ã‚“ã€è‹±: computational complexity theoryï¼‰ã¨ã¯ã€è¨ˆç®—æ©Ÿç§‘å¦ã«ãŠã‘ã‚‹è¨ˆç®—ç†è«–ã®ä¸€åˆ†é‡Žã§ã‚ã‚Šã€ã‚¢ãƒ«ã‚´ãƒªã‚ºãƒ ã®ã‚¹ã‚±ãƒ¼ãƒ©ãƒ“ãƒªãƒ†ã‚£ã‚„ã€ç‰¹å®šã®è¨ˆç®—å•é¡Œã®è§£æ³•ã®è¤‡é›‘æ€§ï¼ˆè¨ˆç®—å•é¡Œã®å›°é›£ã•ï¼‰ãªã©ã‚’æ•°å¦çš„ã«æ‰±ã†ã€‚è¨ˆç®—é‡ç†è«–ã€è¨ˆç®—ã®è¤‡é›‘ã•ã®ç†è«–ã€è¨ˆç®—è¤‡é›‘åº¦ã®ç†è«–ã¨ã‚‚ã„ã†ã€‚ ã€Œè¨ˆç®—é‡ã€ã¨ã€Œè¨ˆç®—è¤‡é›‘æ€§ã€ã¯ã¨ã‚‚ã« computational complexity ã«å¯¾å¿œã™ã‚‹èªžã§ã‚ã‚‹ãŒã€å€‹ã€…ã®ã‚¢ãƒ«ã‚´ãƒªã‚ºãƒ ã®åŠ¹çŽ‡ã«ç€ç›®ã™ã‚‹æ–‡è„ˆã§ã¯ã€Œè¨ˆç®—é‡ã€ãŒåºƒãç”¨ã„ã‚‰ã‚Œã‚‹ã®ã«å¯¾ã—ã€å•é¡Œã«å†…åœ¨ã™ã‚‹æœ¬è³ªçš„å›°é›£ã•ã‚’è¡¨ã™æ„è˜ã‹ã‚‰ã¯ã€Œè¤‡é›‘æ€§ã€ã€Œè¤‡é›‘ã•ã€ãŒå¥½ã¾ã‚Œã‚‹å‚¾å‘ãŒã‚ã‚‹ã€‚ è¨ˆç®—è¤‡é›‘æ€§ç†è«–ã¯è¨ˆç®—å¯èƒ½é–¢æ•°ã®è¨ˆç®—ã®è¤‡é›‘ã•ã‚’æ‰±ã†ã€‚è¨ˆç®—ç†è«–ã®ã‚‚ã†ä¸€ã¤ã®é‡è¦ãªåˆ†é‡Žã§ã‚ã‚‹è¨ˆç®—å¯èƒ½æ€§ç†è«–ã§ã¯å•é¡Œã®è§£æ³•ãŒã‚ã‚‹ã‹ã©ã†ã‹ã ã‘ã‚’æ‰±ã„ã€ãã®è¤‡é›‘ã•ã‚„å¿…è¦ã¨ã™ã‚‹è¨ˆç®—è³‡æºé‡ã¯å•ã‚ãªã„ç‚¹ãŒç•°ãªã‚‹ã€‚ å…·ä½“çš„ã«
takehikom 2007/07/14
secu2007

20070706
ãƒªãƒ³ã‚¯
Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã‚’ä½œã‚‹å‰ã«çŸ¥ã‚‹ã¹ã10ã®è„†å¼±æ€§ â€• ï¼ IT
Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ãŒæ”»æ’ƒè€…ã«ä»˜ã‘è¾¼ã¾ã‚Œã‚‹è„†å¼±æ€§ã®å¤šãã¯ã€è¨è¨ˆè€…ã‚„é–‹ç™ºè€…ã®ãƒ¬ãƒ™ãƒ«ã§æŽ’é™¤ã™ã‚‹ã“ã¨ãŒã§ãã¾ã™ã€‚å®Ÿè£…ã«å¿™ã—ã„æ–¹ã‚‚ã€æœ€è¿‘ã‚ˆãç‹™ã‚ã‚Œã‚‹è„†å¼±æ€§ã®ãƒˆãƒƒãƒ—10ã‚’çŸ¥ã‚‹ã“ã¨ã§æ‰‹ã£å–ã‚Šæ—©ãæ¦‚è¦ã‚’çŸ¥ã‚Šã€é–‹ç™ºã®éš›ã«ãã®å˜åœ¨ã‚’æ„è˜ã—ã¦ã‚»ã‚ãƒ¥ã‚¢ãªWebã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã«ã—ã¦ã„ãŸã ã‘ã‚Œã°å¹¸ã„ã§ã™ã€‚ Webã®ä¸–ç•Œã‚’è„…ã‹ã™è„†å¼±æ€§ã‚’é †ä½ä»˜ã‘ OWASPï¼ˆOpen Web Application Security Projectï¼‰ã¯ã€ä¸»ã«Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å‘ä¸Šã‚’ç›®çš„ã¨ã—ãŸã‚³ãƒŸãƒ¥ãƒ‹ãƒ†ã‚£ã§ã€ãã“ã§ã®èª¿æŸ»ã‚„é–‹ç™ºã®æˆæžœç‰©ã‚’èª°ã§ã‚‚åˆ©ç”¨ã§ãã‚‹ã‚ˆã†ã«å…¬é–‹ã—ã¦ã„ã¾ã™ã€‚ ãã®ä¸ã®ã€ŒOWASP Top Ten Projectã€ã¨ã„ã†ãƒ—ãƒã‚¸ã‚§ã‚¯ãƒˆã§ã¯ã€å¹´ã«1å›žWebã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã®è„†å¼±æ€§ãƒˆãƒƒãƒ—10ã‚’æŽ²è¼‰ã—ã¦ã„ã¾ã™ã€‚2004å¹´ç‰ˆã¯æ—¥æœ¬èªžã‚’å«ã‚€å„å›½èªžç‰ˆãŒæä¾›ã•ã‚Œã¦ã„ã¾ã™ãŒã€2007å¹´ç‰ˆã¯ç¾åœ¨ã®ã¨ã“ã‚è‹±èªžç‰ˆã®ã¿ãŒæä¾›ã•
takehikom 2007/06/29
secu2007

20070629
ãƒªãƒ³ã‚¯
http://www.ipa.go.jp/security/awareness/vendor/programming/b06_01.html
takehikom 2007/06/29
secu2007

20070629
ãƒªãƒ³ã‚¯
ï¼»ã‚»ã‚ãƒ¥ã‚¢OS SELinuxå…¥é–€ï¼½æœ€çµ‚å›ž SELinuxã¨LIDSã®æ©Ÿèƒ½ãƒ»æ€§èƒ½ã‚’æ¯”è¼ƒã™ã‚‹
ä»Šå›žã¯ï¼ŒITProã‚ªãƒ¼ãƒ—ãƒ³ã‚½ãƒ¼ã‚¹ãƒ»ã‚µã‚¤ãƒˆï¼ˆå½“ã‚µã‚¤ãƒˆï¼‰ã§ç´¹ä»‹ã—ã¦ã„ã‚‹2ç¨®é¡žã®ã‚»ã‚ãƒ¥ã‚¢OSã€ŒSELinuxã€ã¨ã€ŒLIDSã€ã®æ©Ÿèƒ½ãƒ»æ€§èƒ½ã®é•ã„ã‚’è§£èª¬ã™ã‚‹ã€‚ã€ŒLinuxã‚·ã‚¹ãƒ†ãƒ ã®ã‚¢ã‚¯ã‚»ã‚¹åˆ¶å¾¡æ©Ÿèƒ½ã‚’å¼·åŒ–ã™ã‚‹ã€ã¨ã„ã†ç›®çš„ã¯åŒã˜ã ãŒï¼Œã‚¢ã‚¯ã‚»ã‚¹åˆ¶å¾¡ã®ãã‚ç´°ã‹ã•ã‚„è¨å®šã®ç°¡å˜ã•ãªã©ã§ã¯å¤§ããªé•ã„ãŒã‚ã‚‹ã€‚ã‚·ã‚¹ãƒ†ãƒ ã«é©ã—ãŸã‚»ã‚ãƒ¥ã‚¢OSã‚’å°Žå…¥ã™ã‚‹ãŸã‚ã«ï¼Œä¸¡ã‚»ã‚ãƒ¥ã‚¢OSã®é•ã„ã‚’çš„ç¢ºã«æŠŠæ¡ã—ã¦ãŠã“ã†ã€‚ ä¸¡ã‚»ã‚ãƒ¥ã‚¢OSã¨ã‚‚ã«å¼·åˆ¶ã‚¢ã‚¯ã‚»ã‚¹åˆ¶å¾¡ã‚’ã‚µãƒãƒ¼ãƒˆ SELinuxã¨LIDSã¯ã¨ã‚‚ã«ï¼Œã€ŒOSã®ã‚¢ã‚¯ã‚»ã‚¹åˆ¶å¾¡æ©Ÿèƒ½ã‚’å¼·åŒ–ã™ã‚‹ã“ã¨ã§ï¼ŒãŸã¨ãˆä¾µå…¥ã•ã‚ŒãŸå ´åˆã§ã‚‚æ”»æ’ƒè€…ã«å¤§ããªæ¨©é™ã‚’ä¸Žãˆãšã«ï¼Œäº‹å®Ÿä¸Šæ”»æ’ƒã‚’ç„¡åŠ›åŒ–ã™ã‚‹ã€ã“ã¨ã‚’ç‹™ã£ã¦é–‹ç™ºã•ã‚Œã¦ã„ã‚‹ã€‚ ã“ã‚Œã‚’å®Ÿç¾ã™ã‚‹ãŸã‚ã«SELinuxã¯ï¼Œã€ŒTEï¼ŒRBACï¼Œãƒ‰ãƒ¡ã‚¤ãƒ³é·ç§»ã€ã¨ã„ã†æ©Ÿèƒ½ã‚’æŒã¤ï¼ˆSELinuxå…¥é–€ç¬¬2å›žå‚ç…§ï¼‰ã€‚ä¸€æ–¹LIDSã¯ï¼Œã€Œã‚¢ã‚¯ã‚»ã‚¹åˆ¶å¾¡ãƒªã‚¹ãƒˆï¼ˆä»¥ä¸‹ï¼ŒACLï¼‰ï¼Œã‚±ãƒ¼ãƒ‘ãƒ“ãƒªãƒ†ã‚£ï¼Œã‚«
takehikom 2007/06/29
secu2007

20070629
ãƒªãƒ³ã‚¯
DynamicDNS (è‡ªå®…ã§ã‚¤ãƒ³ã‚¿ãƒ¼ãƒãƒƒãƒˆã‚µãƒ¼ãƒãƒ¼)
iptables ã¨ã¯ã€ãƒ‘ã‚±ãƒƒãƒˆãƒ•ã‚£ãƒ«ã‚¿ã‚’è¡Œã†ã‚½ãƒ•ãƒˆã‚¦ã‚§ã‚¢ã§ã™ã€‚ å¤–éƒ¨ã‹ã‚‰æ¥ã‚‹ãƒ‡ãƒ¼ã‚¿ï¼ˆãƒ‘ã‚±ãƒƒãƒˆï¼‰ã‚„ã€å¤–éƒ¨ã¸å‡ºã‚‹ãƒ‘ã‚±ãƒƒãƒˆã‚’æ¤œæŸ»ã—ã€é€šéŽã‚’è¨±å¯ãƒ»æ‹’å¦ã®åˆ¤å®šã‚’ã—ã¦ã€NATï¼ˆã‚¢ãƒ‰ãƒ¬ã‚¹å¤‰æ›ï¼‰ã‚’å®Ÿç¾ã™ã‚‹äº‹ãŒå¯èƒ½ã§ã™ã€‚ ãƒ‘ã‚±ãƒƒãƒˆé€šéŽã®è¨±å¯ãƒ»æ‹’å¦ã‚’é©åˆ‡ã«è¨å®šã™ã‚‹ã“ã¨ã«ã‚ˆã‚Šã€ãƒ•ã‚¡ã‚¤ãƒ¤ã‚¦ã‚©ãƒ¼ãƒ«ã¨ã—ã¦æ´»ç”¨ã™ã‚‹äº‹ãŒå‡ºæ¥ã¾ã™ã€‚ iptables ã¯ã€Linux ãƒžã‚·ãƒ³ã‚’ãƒ«ãƒ¼ã‚¿ã¨ã—ã¦ä½¿ç”¨ã™ã‚‹æ™‚ã«ã‚‚ã‚ˆãä½¿ç”¨ã•ã‚Œã¾ã™ãŒã€ä»Šå›žï¼¤ï¼¤ï¼®ï¼³ã‚µãƒ¼ãƒã« ã€€ iptables ã‚’å°Žå…¥ã—ã€ã‚ˆã‚Šã‚»ã‚ãƒ¥ã‚¢ãƒ¼ãªç’°å¢ƒã‚’æ§‹ç¯‰ã—ã¾ã™ã€‚ iptables ã¯ Kernel2.4ç³»ã® Linux ã§å‹•ä½œã—ã¾ã™ã€‚ ä»Šå›žã®ï¼¤ï¼¤ï¼®ï¼³ã‚µãƒ¼ãƒã¯Vine Linux 2.5 ã‚’ä½¿ç”¨ã—ã¾ã—ãŸã®ã§iptablesã¯ã‚¤ãƒ³ã‚¹ãƒˆãƒ¼ãƒ«ã•ã‚Œã¦ã„ã¾ã—ãŸã€‚ Kernel ï¼ˆ 2.2ç³» ï¼‰ã¯ ipchains ã§ Firewall ã‚’å®Ÿç¾ã—ã¦ã„ã¾ã—ãŸã€‚ ä»Šã¯éŽæ¸¡æœŸã§ã™ã‹ã‚‰
takehikom 2007/06/29
iptablesã«ã¤ã„ã¦

secu2007

20070629
ãƒªãƒ³ã‚¯
Security1-2. ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°
takehikom 2007/06/29
secu2007

20070629
ãƒªãƒ³ã‚¯
ï¼ ITï¼šWebã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã«æ½œã‚€ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒ›ãƒ¼ãƒ«ï¼ˆ2ï¼‰- Page1
é¡§å®¢ãƒ‡ãƒ¼ã‚¿ãŒã™ã¹ã¦ç›—ã¾ã‚Œã‚‹ï¼Ÿï¼ï½žOSã‚„ãƒ‡ãƒ¼ã‚¿ãƒ™ãƒ¼ã‚¹ã¸ã®æ”»æ’ƒï½žï¼šWebã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã«æ½œã‚€ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒ›ãƒ¼ãƒ«ï¼ˆ2ï¼‰ï¼ˆ1/2 ãƒšãƒ¼ã‚¸ï¼‰ â€»ã”æ³¨æ„ ä»–ç¤¾ãŠã‚ˆã³ä»–çµ„ç¹”ã®Webã‚µã‚¤ãƒˆãªã©ã¸ã®ãƒãƒ¼ãƒˆã‚¹ã‚ãƒ£ãƒ³ãŠã‚ˆã³ãƒ‡ãƒ¼ã‚¿ã®å–å¾—ãªã©ã®è¡Œç‚ºã§å¾—ãŸæƒ…å ±ã‚’ä¾µå…¥ãªã©ã«æ‚ªç”¨ã™ã‚‹ã‹ã€ã¾ãŸã¯åŒã˜ç›®çš„ã‚’æŒã¤ç¬¬ä¸‰è€…ã«æä¾›ã—ãŸæ™‚ç‚¹ã§é•æ³•ã¨ãªã‚Šã¾ã™ã€‚ã”æ³¨æ„ãã ã•ã„ã€‚ æœ¬ç¨¿ã®å†…å®¹ã‚’æ¤œè¨¼ã™ã‚‹å ´åˆã¯ã€å¿…ãšå½±éŸ¿ã‚’åŠã¼ã•ãªã„é™ã‚‰ã‚ŒãŸç’°å¢ƒä¸‹ã§è¡Œã£ã¦ä¸‹ã•ã„ã€‚ ã¾ãŸã€æœ¬ç¨¿ã‚’åˆ©ç”¨ã—ãŸè¡Œç‚ºã«ã‚ˆã‚‹å•é¡Œã«é–¢ã—ã¾ã—ã¦ã¯ã€ç†è€…ãŠã‚ˆã³æ ªå¼ä¼šç¤¾ã‚¢ãƒƒãƒˆãƒžãƒ¼ã‚¯ãƒ»ã‚¢ã‚¤ãƒ†ã‚£ã¯ä¸€åˆ‡è²¬ä»»ã‚’è² ã„ã‹ãã¾ã™ã€‚ã”äº†æ‰¿ãã ã•ã„ã€‚ ã€Œç¬¬1å›ž ã‚µãƒ¼ãƒã®ãƒ•ã‚¡ã‚¤ãƒ«ãŒä¸¸è¦‹ãˆï¼Ÿï¼ã€ã§ã¯ã€ã€ŒForceful Browsingï¼ˆå¼·åˆ¶çš„ãƒ–ãƒ©ã‚¦ã‚ºï¼‰ã€ã‚„ã€ŒPath Traversalï¼ˆãƒ‘ã‚¹ã®ä¹—ã‚Šè¶Šãˆï¼‰ã€ã«ã‚ˆã£ã¦ã€ä»»æ„ã®ãƒ•ã‚¡ã‚¤ãƒ«ã‚’èªã¿å‡ºã•ã‚Œã¦ã—ã¾ã†å±é™ºæ€§ã«ã¤ã„ã¦ç´¹ä»‹ã—ãŸã€‚ ä»Šå›žã¯ã€Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§
takehikom 2007/06/29
SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ã«ã¤ã„ã¦

secu2007

20070629
ãƒªãƒ³ã‚¯
apache ã‚’ Digest èªè¨¼å¯¾å¿œã«ã™ã‚‹ï½œapacheï½œ@OMAKASE
ã¯ã˜ã‚ã«http ã®èªè¨¼èªå®šæ–¹å¼ã«ã¯ä¸»ã« BASIC èªè¨¼ãŒä½¿ã‚ã‚Œã¦ã„ã¾ã™ã€‚ã—ã‹ã—é€šä¿¡çµŒè·¯ä¸Šã«ãŠã„ã¦ãƒ‘ã‚±ãƒƒãƒˆã‚’ç›—è´ã•ã‚Œã‚‹ã“ã¨ã«ã‚ˆã‚Šç°¡å˜ã« id Password ãŒ çŸ¥ã‚Œã¦ã—ã¾ã„ã¾ã™ã€‚ ãã“ã§Basic èªè¨¼ã‚ˆã‚Šã‚‚ãƒ‘ã‚±ãƒƒãƒˆç›—è´ã«å¼·ã„ Digest èªè¨¼ã‚’åˆ©ç”¨ã™ã‚‹ãƒ¢ã‚¸ãƒ¥ãƒ¼ãƒ« mod_auth_digest.so ã‚’ çµ„ã¿è¾¼ã¿ãŸã„ã¨æ€ã†ã€‚ README ã‚’èªã‚ã°åˆ†ã‹ã‚‹ãŒ apache1.3. ã«ãŠã„ã¦ mod_auth_digest.so ã¯ This code isn't supported officially. ã¨ã‚ã‚‹ã‚ˆã†ã«ã¾ã é–‹ç™ºãƒ†ã‚¹ãƒˆæ®µéšŽã§ã‚ã‚‹äº‹ã‚’ä»˜ã‘åŠ ãˆã¦ãŠã Basicèªè¨¼ã¨Digestèªè¨¼ã®ç‰¹å¾´ Basic èªè¨¼ èªè¨¼æƒ…å ±ã®é€ä¿¡ã«ã¯ãƒ—ãƒ¬ã‚¤ãƒ³ãƒ†ã‚ã‚¹ãƒˆã‚’ MIME ã‚¨ãƒ³ã‚³ãƒ¼ãƒ‰ã—ãŸã‚‚ã® ãƒ‘ã‚±ãƒƒãƒˆã‚’ç›—è´ã•ã‚Œã‚‹ã¨ç°¡å˜ã«ãƒ‡ã‚³ãƒ¼ãƒ‰å‡ºæ¥ã¦ã—ã¾ã† å¯¾å¿œã—ã¦ã„ã‚‹ãƒ–ãƒ©ã‚¦ã‚¶ãŒå¤šã„ (ã»ã¼å…¨ã¦ã®ãƒ–ãƒ©ã‚¦ã‚¶
takehikom 2007/06/29
secu2007

20070629
ãƒªãƒ³ã‚¯
FTP, FTPS, SFTP
FTP(File Transfer Protocol)ã¯ãƒ›ã‚¹ãƒˆé–“ã§ãƒ•ã‚¡ã‚¤ãƒ«è»¢é€ã‚’è¡Œã†ã¨ãã«ä½¿ã‚ã‚Œã‚‹ãƒ—ãƒãƒˆã‚³ãƒ«ã§ã‚ã‚‹ã€‚HTTPã‚ˆã‚Šå¤ãã‹ã‚‰ä½¿ã‚ã‚Œã¦ã„ã‚‹ãŒã€ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ã‚„ãƒ‡ãƒ¼ã‚¿ãªã©é€šä¿¡å†…å®¹ãŒå¹³æ–‡ã§æµã‚Œã‚‹ãŸã‚(è¦ã™ã‚‹ã«æš—å·åŒ–ã•ã‚Œãšã«åž‚ã‚Œæµã—çŠ¶æ…‹)ã€æ‚ªæ„ã®ã‚ã‚‹è€…ãŒãƒ‘ã‚±ãƒƒãƒˆã‚ãƒ£ãƒ—ãƒãƒ£ã‚’ã™ã‚‹ã¨è»¢é€å†…å®¹ã‚’ç›—ã¿è¦‹ã•ã‚Œã¦ã—ã¾ã†ã¨ã„ã†æ·±åˆ»ãªå•é¡ŒãŒã‚ã‚‹ã€‚ ã“ã“ã§ã¯æš—å·åŒ–ã—ã¦ã‚»ã‚ãƒ¥ã‚¢ãªãƒ•ã‚¡ã‚¤ãƒ«è»¢é€ã‚’è¡Œã†æ–¹æ³•ã‚’è§£èª¬ã™ã‚‹ã€‚ FTP æš—å·åŒ–ã•ã‚Œãªã„ä¸€èˆ¬çš„ãª FTPã¯ä»¥ä¸‹ã®ã‚ˆã†ãªæ§‹æˆã§ã‚ã‚‹ã€‚ â”â”â”â”â”â”â”“ â”â”â”â”â”â”â”â”“ â”ƒFTPã‚µãƒ¼ãƒ â”£â”€â”€â”€ã‚¤ãƒ³ã‚¿ãƒ¼ãƒãƒƒãƒˆâ”€â”€â”€â”€â”«FTP â”ƒ â”ƒ â”ƒ â”ƒã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆâ”ƒ â”—â”â”â”â”â”â”› â”—â”â”â”â”â”â”â”› ãƒ»Tiny FTP Daemon ãƒ»FFFTP ãƒ»War FTP Daemon ãƒ—ãƒãƒã‚¤ãƒ€ã®ã‚µãƒ¼ãƒã‚„ãƒ¬ãƒ³ã‚¿ãƒ«ã‚µãƒ¼ãƒä¸Šã«è‡ªåˆ†ã®ãƒ›ãƒ¼ãƒ ãƒšãƒ¼ã‚¸ã‚’æŒã£ã¦ã„ã‚‹ã¨ã€ãƒ•
takehikom 2007/06/25
secu2007

20070622
ãƒªãƒ³ã‚¯
https://www.unixuser.org/~euske/doc/openssh/jman/
takehikom 2007/06/25
secu2007

20070622
ãƒªãƒ³ã‚¯
RC4ã¨ã¯ ã‚³ãƒ³ãƒ”ãƒ¥ãƒ¼ã‚¿ã®äººæ°—ãƒ»æœ€æ–°è¨˜äº‹ã‚’é›†ã‚ã¾ã—ãŸ - ã¯ã¦ãª
DESç‰ã®ä¸€å®šã®ãƒ–ãƒãƒƒã‚¯å˜ä½ã§æš—å·åŒ–ã‚’è¡Œã†ãƒ–ãƒãƒƒã‚¯æš—å·ã«å¯¾ã—ã€1ãƒ“ãƒƒãƒˆæ¯Žã«æš—å·åŒ–ã‚’è¡Œã†ã‚¹ãƒˆãƒªãƒ¼ãƒ æš—å·ã®ä¸€ç¨®ã§ã€éµé•·ã‚’è‡ªç”±ã«è¨å®šã§ãã‚‹ã€ã‚¢ãƒ«ã‚´ãƒªã‚ºãƒ ãŒå˜ç´”ã§ãã‚Œãªã‚Šã«å®‰å…¨ã§ã‚ã‚‹ã¨ã„ã£ãŸç‰¹å¾´ã‹ã‚‰SSLç‰ã§åºƒãåˆ©ç”¨ã•ã‚Œã¦ã„ã‚‹ã€‚
takehikom 2007/06/25
SSL/TLSã®ã¨ã“ã‚ã§æ›¸ã„ãŸã€ŒRC4ã€ã¨ï¼ŒSSHã®ã¨ã“ã‚ã§æ›¸ã„ãŸã€ŒArcfourã€ãŒãƒªãƒ³ã‚¯ã—ã¦ã„ã‚‹ï¼Ž

secu2007

20070622
ãƒªãƒ³ã‚¯
é«˜æœ¨æµ©å…‰ï¼ è‡ªå®…ã®æ—¥è¨˜ - PKIã‚ˆãã‚ã‚‹å‹˜é•ã„(1)ã€Œã‚ªãƒ¬ã‚ªãƒ¬è¨¼æ˜Žæ›¸ã§ã‚‚SSLã¯æ£å¸¸ã«æ©Ÿèƒ½ã™ã‚‹ã€
â– PKIã‚ˆãã‚ã‚‹å‹˜é•ã„(1)ã€Œã‚ªãƒ¬ã‚ªãƒ¬è¨¼æ˜Žæ›¸ã§ã‚‚SSLã¯æ£å¸¸ã«æ©Ÿèƒ½ã™ã‚‹ã€ ã€Œã‚ªãƒ¬ã‚ªãƒ¬è¨¼æ˜Žæ›¸ã‚¯ã‚¤ã‚ºã€ãªã‚‹ã‚‚ã®ãŒå®Ÿæ–½ã•ã‚Œã¦ã„ãŸã‚ˆã†ã ã€‚ (1) æ¡ˆå†…æ–‡ã®å‰åŠã«ã‚ã‚‹ã€Œæš—å·åŒ–ã¯æ£å¸¸ã«è¡Œã‚ã‚Œã¾ã™ã€ã¯æ£ã—ã„ã§ã—ã‚‡ã†ã‹ã€‚ è¨å•ãŒæ‚ªã„ã€‚æ¡ˆã®å®šã€æ£å¸¸ã ã¨å›žç”ã™ã‚‹äººãŒç¾ã‚Œã€æ¨¡ç¯„è§£ç”ã‚’è¦‹ã¦ ã€Œé–“é•ã£ã¦ã„ãªã‹ã£ãŸã‚ˆã†ã ã€ãªã©ã¨è¨€ã£ã¦ã„ã‚‹ã€‚ ãŸã¨ãˆã°ã€ é‡‘åº«ã®ä¸Šã«ãã®éµãŒç½®ã„ã¦ã‚ã‚Šã¾ã™ã€‚ã“ã®é‡‘åº«ã¯æ£å¸¸ã«æ©Ÿèƒ½ã—ã¦ã„ã‚‹ã§ã—ã‚‡ã†ã‹ï¼Ÿ ã¨å•ã†ã“ã¨ã®ãƒã‚«ãƒã‚«ã—ã•ãªã‚‰ç†è§£ã§ãã‚‹ã ã‚ã†ã‹ã€‚ã‚ã‚‹ã„ã¯ã€ å…±é€šéµæš—å·ã«ã‚ˆã‚‹æš—å·åŒ–é€šä¿¡ã‚’ã—ã¦ã„ã¾ã™ã€‚éµã¯ä¸€ç·’ã«é…é€ã—ã¾ã™*1ã€‚ã“ã®æš—å·ã¯æ£å¸¸ã«æ©Ÿèƒ½ã—ã¦ã„ã‚‹ã§ã—ã‚‡ã†ã‹ï¼Ÿ ãªã‚‰ã©ã†ã‹ã€‚æš—å·ãã®ã‚‚ã®ã¯ä½œå‹•ã—ã¦ã„ã‚‹ã ã‚ã†ãŒã€ãã‚Œã‚’è¨€ã£ãŸã¨ã“ã‚ã§ä½• ã‹æ„å‘³ãŒã‚ã‚‹ã®ã‹ï¼Ÿ ã¤ã¾ã‚Šã€ãƒ—ãƒãƒˆã‚³ãƒ«å…¨ä½“ã¨ã—ã¦æ£å¸¸ã«æ©Ÿèƒ½ã—ã¦ã„ã‚‹ã‹ãŒ å•ã‚ã‚Œã¦ã„ã‚‹æ–‡è„ˆã«ãŠã„ã¦ã€å€‹ã€…ã®æš—å·ã‚¢ãƒ«ã‚´ãƒªã‚ºãƒ ãŒä½œå‹•ã—ã¦ã„ã‚‹ã‹ã©ã†ã‹ ã‚’äº‘ã€…ã™
takehikom 2007/06/25
secu2007

20070622
ãƒªãƒ³ã‚¯
SSL è¨¼æ˜Žæ›¸ã€€æ¯”è¼ƒ
SSLãƒ—ãƒãƒã‚¤ãƒ€ãƒ¼ã¯ã€2ã¤ã®ã‚«ãƒ†ã‚´ãƒªã«åˆ†é¡žã•ã‚Œã‚‹ï¼š ä¿¡ é ¼ã•ã‚ŒãŸèªè¨¼å±€ Verisignã€GeoTrustã¨Thawteã®ã‚ˆã†ãªï¼ˆCAï¼‰ ä¸€ æ™‚çš„-ç–‘ä¼¼èªè¨¼å±€ Comodoã¨XRampã®ã‚ˆã†ãªï¼ˆCAï¼‰ æœ€æ–°ã®SSLè¨¼æ˜Žæ›¸ãƒ—ãƒãƒã‚¤ ãƒ€ãƒ¼News VeriSignã¯ã€GeoTrustã‚’è²·åŽ Verisignã¯ã€ç±³å›½æ™‚é–“ã®9æœˆ5æ—¥ï¼ˆç«ï¼‰ã€ é›»åèªè¨¼ã‚µãƒ¼ãƒ“ã‚¹åŠã³ãƒãƒƒãƒˆãƒ¯ãƒ¼ã‚¯ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã‚µãƒ¼ãƒ“ã‚¹ã‚’æä¾›ã™ã‚‹ã‚¸ã‚ªãƒˆãƒ©ã‚¹ãƒˆã‚¤ãƒ³ã‚¯ï¼ˆæœ¬ç¤¾ï¼šç±³å›½ãƒžã‚µ ãƒãƒ¥ãƒ¼ã‚»ãƒƒãƒ„å·žï¼‰ã®è²·åŽã‚’å®Œäº†ã—ãŸã¨ç™ºè¡¨ã€‚ ã“ã“ã§èªã¿å–ã‚Œã¾ã™ QuickSSL Premiumã®ï¼„109ã®ãƒ—ãƒãƒ¢ãƒ¼ã‚·ãƒ§ãƒ³ OnlineSSL.jpã¯QuickSSL Premiumï¼ˆGeoTrustãƒ–ãƒ©ãƒ³ãƒ‰ã®SSLã‚µãƒ¼ãƒè¨¼æ˜Žæ›¸ï¼‰ã®ï¼„109ã®ãƒ—ãƒãƒ¢ãƒ¼ã‚·ãƒ§ãƒ³ã‚’é–‹å§‹ã™ã‚‹ã¨ç™ºè¡¨ã—ã¾ã—ãŸã€‚ ã“ã“ã§èªã¿å– ã‚Œã¾ã™ SSLreviewã§ã¯ã€ãã®å†…å®¹ã¯ã‚·ãƒ³ãƒ—ãƒ«ã§ã™ã€‚ï¼ SSLè¨¼æ˜Ž
takehikom 2007/06/25
SSLè¨¼æ˜Žæ›¸ã®å“è³ªã«ã¤ã„ã¦ã®æƒ…å ±ãŒã‚ã‚‹ï¼Žä¼æ¥ã‚µã‚¤ãƒˆã§ã‚ã‚‹ç‚¹ã«ã¯æ³¨æ„ï¼Ž

secu2007

20070622
ãƒªãƒ³ã‚¯
http://edocs.beasys.co.jp/e-docs/tuxedo/tux81/security/publicke.htm
takehikom 2007/06/25
æš—å·ã‚¹ã‚¤ãƒ¼ãƒˆã®å…·ä½“ä¾‹ã‚ã‚Š

secu2007

20070622
ãƒªãƒ³ã‚¯
SSL-TLS æš—å·åŒ– ã¯ã˜ã‚ã« - Apache HTTP ã‚µãƒ¼ãƒ
Please note This document refers to the 2.0 version of Apache httpd, which is no longer maintained. Upgrade, and refer to the current version of httpd instead, documented at: Current release version of Apache HTTP Server documentationYou may follow this link to go to the current version of this document. æ¨™æº–è¦æ ¼ã®è‰¯ã„æ‰€ã¯ã€ãŸãã•ã‚“ã®è¦æ ¼ã‹ã‚‰é¸ã¹ã‚‹ã¨ã„ã†ã“ã¨ã ã€‚ ãã—ã¦ã€ã‚‚ã—æœ¬å½“ã«ã©ã®è¦æ ¼ã‚‚æ°—ã«å…¥ã‚‰ãªã‘ã‚Œã°ã€ ä¸€å¹´å¾…ã¤ã ã‘ã§æŽ¢ã—ã¦ã„ãŸè¦æ ¼ãŒç¾ã‚Œã‚‹ã€‚ -- A. Tanenbaum, "In
takehikom 2007/06/25
secu2007

20070622
ãƒªãƒ³ã‚¯
GnuPGã®è£æŠ€ - OpenPGP in Japanese
takehikom 2007/06/17
secu2007

20070615
ãƒªãƒ³ã‚¯
1 2 æ¬¡ã®ãƒšãƒ¼ã‚¸