text:
UNIX Computing Security/UNIX filesystem

Suggested topics: volume managers, file systems, files, directories, ls, find, chown, chgrp, chmod, umask, setuid, setgid, device files, ACLs.

Most of the data used by a computer is stored on disk drives. These are physical devices with a relative high access latency, compared to, say, physical memory, but large storage capacity. On a server system a disk drive can be located inside the same cabinet as the CPU, an adjacent expansion cabinet, attached to the network as an appliance, or attached as part of a Storage Area Network. Some sites may also employ removeable disk media that can be loaded by an operator or a robotic device.

Filesystem and files
The filesystem is the method by which data on a device, such as a disk drive, is laid out. It includes information that the operating system can use to find specific data content and who is allowed to access that data. All of this data is organized into a series of files, which are an essential means of managing information on a computer system. The data in a file is organized in a format that applications can understand. The location of a file on a directory tree is called its path.

In UNIX, as on many other modern operating systems, files are stored in a tree structure with the branch nodes being called directories. A directory is a special type of file that can reference zero or more other files and directories, allowing the data to be organized and access managed. Directory trees are contained in one or more filesystems.

In UNIX the filesystem contains the following information available for each file:

 * Unique inode number
 * The length of the file in bytes
 * The identifier of the device that contains the file
 * File type
 * A set of permissions bits, or mode
 * Identifier of the file's owner, or uid
 * Identifier of the file's group, or gid
 * File creation date and time
 * File last access date and time
 * File last modification date and time
 * The total number of hard links to the inode

The typical UNIX file types are as follows:

 * Block file
 * Raw file
 * Regular file
 * Directory
 * Named pipe
 * Symbolic link
 * Socket

A hard link is a type of file that references another file on the same device and file system by means of its inode number. A symbolic link is a type of file that contains the path information to another file.

File permissions
Information about a file's statistics can be viewed by means of the  command in combination with the   "long listing" option. Here is an example:

$ ls -l /usr/bin/vi -r-xr-xr-t 6  bin  bin  604880  Sep  3 2003 /usr/bin/vi

The left-most field of the  output displays the mode of a file. This is an integer field that is normally 2 bytes (16 bits) in length. Each bit within the mode is a binary flag that represents a type of security access setting.

The number to the right of the mode shows the total number of hard links to the file, including the original file. So this case the command has five other hard links. Next are the names of the file owner and group, followed by the file size in bytes, the date or time of the last modification, and the file name or path.

The  displays the mode information as a field of ten characters. The first (left-most) character shows the type of the file. The common types are as follows:

 * — Ordinary file
 * — Block special file
 * — Character special file
 * — Directory
 * — Door (Solaris)
 * — Symbolic link
 * — Network special file (HP-UX)
 * — Named pipe
 * — Socket

The remaining nine characters consist of three groups of three characters each. Each of these groups describe a set of file permissions that determine whether a file can be read, write, and executed as a program. (They can also cover certain special execution modes. More on that in a moment.)

These permissions are indicated by an,   and  , respectively. Thus an  in the group set indicates that any member of the file group can read, modify, or run the file as a program (or script). The  above is missing the write flag, so members of the group would not necessarily be able to modify the file.

From left to right, the first set of three characters indicates the permission settings for the owner of the file. The middle set are the permission settings for the file group, and the last set to the right are the permissions for every body else (usually referred to as "world".)

Set ID on execute
The mode can also contain special flags that set the permissions of a file when it is executed. That is, if a file is a program or a script, the set permissions bits will determine the owner or group under which it will run. Normally when a job is run, it uses the user and group of the account that executes the file. This controls the type of access that the job gains.

For example, suppose a command myjob has permissions  and is run by the file owner, user bill in group research. The process that executes the myjob command is given the owner bill and group research. The job can access any file that can also be accessed from the account bill.

Now suppose the myjob file is given owner root, and the set permissions bit for the user are activated by the System Administrator. The resulting file has permission bits, where the s indicates that the set user ID on execution flag has been set. Because the file still belongs to group research, the user bill is able to run it. When the job is run now, however, it has access to any file that can be accessed by root (which is usually any file on the system.)

A similar effect occurs when the set group ID on execution flag has been set. The resulting file permission bits may now appear as. When this file is executed, the job runs as though the user belonged to the same group as the file's group identifier. That is, if the group identifier were set to, when the file was executed it would have access to any file that can be accessed by the group sys.

It is important to point out at this point that the set ID feature can potentially compromise the security of a system. A file that is owned by root that has the set user ID flag has the same access privileges as the System Administrator. If this file can also be modified by any user, say, then it can be exploited to elevate that user's privileges, or perform other unauthorized activities. Even if the file can not be modified by a user, it may still contain vulnerabilities that can be exploited to gain unauthorized privileges.

For this reason, the existence of files with set user ID or set group ID permissions should be carefully monitored by the System Administrator. Selected system commands require these mode settings in order to function properly. However any other files with these settings, particularly when they can be modified by a user, can represent an unacceptible level of risk to a system. Batch jobs can be run at regular intervals to search for the existence of these files and to bring them to the attention of the System Administrator.

Note: On Linux, when a shell script is executed, all setuid and setgid permissions are ignored intentionally by system.

Directory permissions
The permissions on a directory have a somewhat different meaning than they do for files. The ead permissions on a directory allow the   command, with no arguments to list the contents of that directory. However the read mode only allows the file name to be read, not the file permissions, owner, or size. You also can not change directory with the  command to a directory where you only have read permissions, nor read the content of files in that directory.

If a directory allows you, or execute permissions, you can   to that directory and read the contents of any files in that directory for which you have read privileges. You can also do a "long list" of the directory using the  command. If a directory allows you execute but not read permissions, you get an error if you tried to use  to list the directory. However, if you knew that a particular file existed in that directory and if that file allowed you read privileges, you could do a "long list" of that file.

As a simple example:

$ id uid=234(myacct) gid=100(mygrp) $ mkdir test $ touch test/test.txt $ chmod 100 test $ chmod 640 test/test.txt $ cd test $ ls . unreadable total 0 $ ls -l test.txt -rw-r-  1 myacct mygrp     0 Dec 9 12:00 test.txt

See the appropriate manual pages for further information on these commands.

 * set user ID or set group ID permissions
 * sticky bit.

under construction...

Setting file permissions
The permissions for a file can be set using the,  , and   commands. The  is given a valid account name or numerical identifier, and is used to set the owner of a file or set of files. Likewise  can be used to set the group for a file. (On some operating systems, the  can be used to set both the owner and group of a file. Finally   can set the file mode.

Here is an example of a combined  command that sets the file owner to root and the group to sys:

$ chown root:sys /usr/local/bin/bigjob

The original format for the  command allows the entire mode to be set for a file or set of files. This is done by passing the command a three or four digit number that defines the mode settings. Each of the last three digits in the number represents one of the sets of permission flags, as discussed above. A one (1) enables the execute mode, a two (2) sets the write mode, and a four (4) sets the read mode. Any combination of these modes can be set by adding up the appropriate values.

For example:

$ chmod 550 /usr/local/bin/bigjob

has a 5 for the user permissions, a 5 for the group permissions, and a 0 for the world permissions. A 5 is equal to a 1 plus 4, so this is enabling the read (4) and execute (1) flags for both the user and group. The world gets no privileges for this file.

More recently the  command has been enhanced to allow a comma-separated list of symbolic operations. This allows a more refined approach to modifying the mode of a file. A symbolic operation determines who it affects, the type of operation, and the affected permissions. For example:

$ chmod u+x,g-w,o=r /usr/local/bin/bigjob

Here the,  , and   represent the user, group, and other (world) permissions, respectively. The,  , and   modify the permissions by adding, deleting, or setting the bits specified by the   (red),   (write), or   (execute) mode bits. This example gives the user execute permissions, removed write permissions for the file's group, and limits other (world) to read operations only.

The,   and   commands normally have a recursive option that acts upon a directory and all files under that directory tree. This option is typically activated with the, but see the manual pages for your particular operating system. When combined with the symbolic operations of the  command, this can provide a powerful tool for managing permissions on a directory. For example:

$ chmod -R o-w /usr/bin

will recursively remove any world permission bits on the  directory, or any files or directories under that directory tree.

Searching for file permissions
The  can be a powerful tool for searching the file systems for files or directories with particular permission settings, as well as certain file owners and groups. In the example below (which was written for HP-UX) the  command is being used to search the   directory tree for any files that allow world write permissions.

$ /usr/bin/find /usr/bin -type f -perm -002 -exec ls -l {} \;

The parameters passed to the  command form an expression that determines what the command is seeking in the directory tree. The arguements  restricts the search to files, instead of, say, directories, symbolic links, device files, and so forth. The  sets the type of permissions to find; the minus before the number means to only match on the values that are set in the number. In this case the two in the third digit matches the world write bit. Finally the fancy  causes the command   to be executed on any file that met the prior conditions. (The odd  clause at the end is a terminator of the command.)  Some variant of find has the   option which can replace.

The example below shows a search of the  directory tree for any files with an owner that is not in the password database.

$ /usr/bin/find /home -nouser -exec ls -l {} \;

If any accounts have been removed from the password database, a command such as this can be used to search for orphaned files.

Note that whenever the System Administrator is performing a lengthy search of the file system, it can be considerate of the users to run the  at a lower priority using the   command. Otherwise the job may impact disc access performance. Also some care needs to be exercised to avoid searches of network-mounted directory trees as this can significantly slow the search time; this can be achieved with the help of  option which limits   to search only the current filesystem.

umask
Each UNIX session has a file mode creation mask that defines the initial value of the permission bits when a new file is created. This mask consists of a series of bit flags that determine whether a particular permissions setting will be turned on or off. This value is similar to the number that is passed to the  command, except that the values are used in the negative sense. That is, when a value is set in the mask the corresponding permission bit will be turned off when a file is created.

The command  can be used to display the mask for the current session.

$ umask 027 $ touch testfile.txt $ ls -al testfile.txt -rw-r- 1  bilbo  users    0    Jan 18 07:41 testfile.txt

In this example, the first zero affects the owner's permissions on the file. A zero means that all of the permission bits will be set, so the file owner can have read, write, and execute permissions on that file. (Note that in the example above, the system creates a file with the execute permissions turned off, regardless of the setting of the .) The middle number two affects the permissions for the file group. A '2' will turn off the write permission bit, so members of the group will only be able to read or execute the file. Finally the seven in the last digit will turn off all permissions for world.

To change the mask for the session, the  command can be executed with the new mask passed as a parameter.

$ umask 077 $ umask 077 $ touch testfile2.txt $ ls -al testfile2.txt -rw--- 1  bilbo  users    0    Jan 18 07:47 testfile.txt

A  setting of   is recommended for optimal security. The user will then need to manually modify the permissions on a file or directory in order to make it available to others. Conversely, a  setting of   results in the weakest security setting, as anybody on the system can have access to the file unless the user remembers to restrict the permissions. In order to apply a base  setting, the System Administrator can include a   command in the shell startup files such as.

title: UNIX Computing Security/UNIX filesystem


text:
UNIX Computing Security/Securing accounts

Suggested topics: shell environment, password aging, password strength, dot files, restricted shells, dormant accounts, secure terminals and root access.

The users of a Unix system are most likely not nearly as knowledgeable about the security aspects of their system as are the System Administrators. So it is important to use the configuration capabilities of the system to configure these accounts so that they are reasonably secure. Such configuration can be applied to the default user security settings, the environments in which programs will be run, and so forth. There may also be special restrictions needed for certain accounts depending on access and data security requirements on the server.

Once an account is in use, the System Administrator will still need to employ a certain level of vigilance to make certain the access is not abused, or even coopted by an inappropriate person. Passwords need to be checked for strength and periodically updated. Unused or unneeded accounts need to be disabled so that they are not employed for inappropriate purposes.

Home directory
When an account is first created, it is normally given a separate home directory. This is a directory, usually under the  or possibly the   directory tree where the user can store their data files and where custom startup and configuration files are located. (These can include,  ,  , and so forth.)

The home directory should be protected in such a manner that the user owns it and the group identifier of the directory matches the account's default group. In addition the home directory is normally given permissions that restrict access by other users. Permission modes of  or   are common.

Many System Administrators provide a default set of startup, or "dot" files that are copied into the new home directory. These can provide, for example, useful aliases and site-specific operations. However these default files need to be properly secured or else they may be tampered with and any new accounts quickly compromised.

Missing home directories
In cases where the home directory does not exist for a particular user account, the default action on many Unix systems is to start the login session at the top-level, or slash (/) directory. This is also the default directory for the  (super-user) account. So this can potentially lead to permissions problems with the startup configuration files, and other unexpected behavior.

As a remedy for this case, the home directory for the  account can be located under its own directory tree. (For example, ). Normally this directory should be placed on the same file system as slash so that the directory is always present when the system is booted. Having a private directory for  also provides a somewhat more secure location for any tools and scripts the System Administrator might want to run.

Once a private root home directory is implemented, the System Administrator can then modify the "dot" files under the slash directory and use them to provide a default set of startup files for their users.

Note that having a user log in using a home directory of slash is generally not a good idea, and it is often indicative of a problem with the system. Some versions of Unix provide a means of disabling user logins whenever their home directory is not found.

Shell environment
Many of the shells available for use on Unix systems allow environmental variables to be configured. Some of these variables can have security implications, and a few can be configured to enhance the system security.

Session timeout
When a Unix session is left unattended for a period of time, it only takes a few moments for an unscrupulous individual to take advantage of the situation to increase their own access privileges. For example, suppose that a System Administrator has walked away from their desk for a minute and a person types in a few commands at the shell prompt:

root$ touch /tmp/rubbish root$ chmod 4777 /tmp/rubbish root$ exit

This creates a world-editable file that can be modified to run commands that can grant root privileges to anybody executing it. That individual now owns the system. It is for situations like this that it is important for unattended sessions to either be locked down or disconnected.

Certain shell types, including the Korn Shell, Bash, and some vendor versions of the Bourne Shell, will support a time out variable, either TMOUT or TIMEOUT. When this variable is set it gives the number of seconds of no activity before the shell expires. (A value of zero means no timeout.) This variable can be used to expire shells when a user or system administrator is drawn away from active login session for a period of time. Typically this variable would be set to some value, such as 300 (or 5 minutes), that will limit the period of vulnerability. It is normally set in a global shell startup file such as  or.

PATH
Unix shell sessions use an environment variable called PATH to determine the location of commands and other programs that can be executed from the shell command line. This variable is set to a colon-separated list of valid directories on the system. When a command is typed at the shell prompt, the system searches through each of the directories in the PATH looking for a program with a matching name. When a match is found the search ceases and the program is executed. (For reasons of efficiency, the directory path to recently executed commands can get stored in a cache.)

$ echo $PATH /usr/bin:/usr/bin/X11:/usr/contrib/bin:/usr/local/bin:.

In Unix a single period within the path name or an empty entry  is used to represent the current working directory. Suppose an account contains just such a period in its PATH variable, and the user decides to execute a command. If the command was not located in one of the directories listed prior to the period, the system will then check the user's current working directory for a matching file. If it is found, the system will then attempt to execute the file. As the user's current working directory may be anywhere on the system where the account has access permissions, it is easy to see why this may pose a security problem.

This potential vulnerability is particularly true for the root account. Suppose root has a period at the start of their PATH variable, then a user calls up to report a problem in their home directory. It would be normal for the System Administrator to change directory to the user's home location and perform a directory listing using the  command. However if the user has placed a file called  in their home directory, the system will then try to execute it. This file could easily be a shell script that exploits the permissions of the root account to grant the user enhanced permissions, then simply replicates the actions of the  call. The System Administrator might never even be aware of the inappropriate activity.

For this reason it is important that the root account in particular never have a period in its PATH variable. Note that if the value of the PATH variable begins or ends with a period, the system will treat this just like a period. So, in addition, the root PATH variable should never begin or end with a colon, or have two colons next to each other with no directory in between. In any event it is often preferable for the System Administrator to type in the full command path rather than relying on the system.

If it is necessary for a user's PATH variable to include a period, it should be placed at the very end of the PATH. This will cause the system to check all of the standard directories containing executables before trying the current working directory. Setting the PATH in the shell startup script, such as, or in the   file on some vendor releases, can help the System Administrator manage the use of the PATH variable for most user accounts.

Another concern with the PATH variable is whether any of the directories in the PATH allow user's to modify the contents. The permissions on the directories in the PATH should all restrict write permissions, and all files within those directories should not allow write permissions. Otherwise an unscrupulous user can modify one or more of the commands, and expect other users and even root to execute their modified file. Periodic checks of the permissions on these directories and files is necessary to help maintain a secure system.

Dot files
These files are normally located in the home directory of an account and contain various startup and configuration settings and procedures. These are of interest to the System Administrator because in certain cases they can introduce weaknesses into the security of a Unix system.

An alert System Administrator will regularly search their system for the presence of these files, then check the permissions and contents for potential security issues. In addition to improper settings added by users, the files may be modified by an intruder so that they can regain access at some future date.

.forward
The  program includes support for this file that is intended to forward e-mail messages to a new address (after a user has relocated their account, for example). The contents of this file can contain a comma-separated list of addresses. The problem with regard to security, however, is that an address can also be a system command. For example:

sample_address@no.such.com, "|/var/tmp/give_me_access"

When an e-mail message arrives, it is forwarded to the addresses in the  file. It is also passed as standard input to the program listed in strings. This could, for example, be a script written by the user to execute commands contained within the mail message.

It may be common practice to initially disable a user account by disabling the password. However if the user has configured their  file to execute a command, they can still perform actions on the system. An unscrupulous individual may exploit this access for inappropriate activities.

ForwardPath
Beginning with version 8 of the  program, the ForwardPath option can be used to define alternate locations for the   file. The ForwardPath option is set in the  configuration by means of the   line (or " "). For example:

OJ/var/forward/$u.forward:$z/.forward

This will cause  to first check for a file under a   directory with the name of the user's account followed by a. (Thus bob.forward would be interpreted as the  file for the user account named bob.) If the file is not found, then   will check for a   file in the user's home directory.

Whenever a new user account is created, the System Administrator can then create a  file in the controlled directory. (This can be automated as part of the account creation tools.) After the user has established that they are sufficiently well-trained with UNIX to properly configure their own  file, the   file can be removed.

.netrc
Users may want to use the  command for, say, batch downloads of files from a remote site. In order to automate this process, they can configure a  file to provide access without the need to input a password. Once this is done, a script can be run to transfer files using, say, a scheduled batch task. Unfortunately the format of the  file stores the password in plain text. Anybody who has read access to the  file can also obtain the user's login password.

The  process has a built-in restriction that partially alleviates this problem. If the user's  file can be read by anybody except the owner, the automatic login process will fail. This serves to force the owner to restrict the permissions on this file. However this is only a partial solution. A preferable approach for most purposes would be to use the host authentication method of the  command instead.

More recently, the library has allowed to use the   file with all protocols.

.rhosts
The  file can provide an autologin capability for a user when running the remote login command (usually  .) This bypasses the normal login process and immediately connects the user with the system. As you'd expect, this capability can introduce a number of potential vulnerabilities to a system.

Suppose that three systems are set up so that A has a trust relationship with B, but A does not necessarily trust C. The establishment of  for an account to connect between A—B and B—C, can provide a back door for an individual to get from C to A. That is, somebody who manages to obtain inappropriate access to C can use the   file to obtain access to A, even though C is not trusted by A (and may even have network access blocked).

Another issue with the  file is the method used to enter the allowed account access. The file can be set up to allow access from any host. For example:

+ joebob

will allow the account joebob to connect from any host without entering a password. Unfortunately, the account may belong to an entirely different person on another system, or it could be deliberately established on a compromised system to allow inappropriate access.

Due to the security dangers inherent in its use, it is usually better to disable the  capability where possible.

license: Creative Commons - Attribution Share-Alike - https://creativecommons.org/licenses/by-sa/4.0/


text:
UNIX Computing Security/System processes

System processes of UNIX consist of those processes that are not user services or user processes. One of the most known is init.

Init
The parent of all processes. init will take ownership of orphaned processes. Process ID is almost always 1.

Viewing processes
For example, a user may list the status of his or her processes using the  command, thus:

$ ps -f UID        PID  PPID  C     STIME TTY      TIME CMD john_doe 15265 15254  0  11:18:13 pts/5   00:00 -sh john_doe 11407 15265  1  13:52:09 pts/5   00:00 ps -f

The user with the account name  is the owner of the two processes with process identifiers 15265 and 11407. That user can send signals to those two processes using the  command. However the system can prevent that user from using the  command on processes he does not own.


text:
UNIX Computing Security/Remote access

Suggested topics: modems, ftp, rlogin, ssh, UUCP, NFS, Samba, and Apache.

Telnet
Telnet was once an extremely popular method of remote access. However, it has been almost entirely replaced by SSH. Perhaps the only remaining legitimate use of Telnet is low-level debugging of other internet protocols such as HTTP and SMTP.

The  command is used to establish a connection with another host that can be accessed via the network, and communicate with it using the TELNET protocol. Typically  is used to connect to a user login via the standard TELNET port. For the default configuration, the login password is sent across the network in clear-text form. That is to say, if the network packets between the two hosts are being read by some intermediary, then the password string will appear in the packets in a readable form. Likewise any data sent through during the session will also appear in readable form, including any other secure information sent to the remote hosts.

Normally, if you want to maintain the security of your communications, the default configuration of telnet should only be employed on network segments that you are highly confident are secure. Establishing such a network is becoming increasingly difficult, however, unless of course it is kept physically isolated. (Even then it is never possible to be 100% certain.)

A method of securing the password using  is to configure it to run as a   client, when this functionality is available. The  client will support secure authentication, and help maintain the secrecy of the password string. However this will not provide an encrypted session, so data transmission subsequent to the login will remain vulnerable to interception.

Something that can be said in favor of, from a security perspective, is that it typically lacks the means to bypass the login sequence that is available to the Berkeley remote login commands, such as. This reduces the risk of back-door access methods of the later commands.

The  service can normally be configured to display a text banner prior to the presentation of the login prompt. This banner can be useful for presenting a carefully-worded warning to anybody accessing the system. So in this sense it is like a "Do Not Trespass" sign on a piece of property. If somebody is presented this warning prior to login, then they can not claim ignorance of what they were trying to access. The presence and consistent use of a login banner can be useful in the event that a prosecution of an individual for unauthorized access becomes necessary.

/etc/securetty
The  file is used to enable login security. When the file exists, the root account is only allowed to login via the listed devices in the file, one per line. To prevent direct remote connection via the root account, a recommended practice is to only include the single entry  within this file. Note that this does not prevent a System Administrator from connecting to the system via their user account and then executing an  to become root. In fact this is a recommended method as it allows usage of the root account to be logged.

When the  file is created it should be properly restricted to prevent modification from any accounts except root. Thus an owner and group of  and a file mode of   would effectively secure this file.

ftp
The File Transfer Protocol is intended to allow the reliable transmission of files between two systems on the network. It has two network ports, usually 20 and 21, and uses tcp for reliable packet transfer. (Port 20 is employed for data transfer, while port 21 is used for session control.)

Connecting to a remote system via  requires a login at the destination. However unless a secure authentication system such as kerberos has been enabled, the password will be transmitted across the network in the clear. That is, anybody using a packet sniffer to intercept the session packets will be able to read the password. In addition, any data files are also sent in unencrypted form. This uprotected version of  should only be used across a secure network, or in cases where security is not an issue. (See anonymous ftp below.) For encrypted login and file transmission, the Secure Shell software can be used. However, at least at present, the  command equivalent does not have as rich a set of supported commands as does the standard version of.

There are several other features of  that can present a security issue for the System Administrator. The first of these is the use of the  file in a user's home directory. This file can be configured to allow automatic connection to a remote site without the need to provide an account name or password. However, any passwords stored in  are in an unencrypted form. So if an unauthorized person is able to gain read access to the  file (such as by compromising the system) they may also be able to gain access to other remote systems. To prevent this situation, many System Administrators will regularly search their systems for  files and then either remove them or check their contents.

The ftp daemon can be configured to allow a form of access that is known as "anonymous ftp". This allows any individual from a remote site to connect by typing "anonymous" at the login prompt, then entering any string as a password. (By convention the password is usually entered in the form of an e-mail address, but this is a courtesy only.) An improperly configured anonymous ftp capability can present a host of weaknesses that can be exploited by an intruder.

The instructions for how to properly configure an anonymous ftp account are usually given in the manual pages for the ftp daemon. If this service is required, great care should be taken to follow the documented instructions. In particular, the  file should not include encrypted password information, and only the ls command should be in the   directory and have 111 permissions.

More here...

Many vendors have adopted the wu-ftpd flavor of the File Transfer Protocol. This incorporates additional features in the ftp configuration, many of which can be used to enhance the security of a system.

More to come...

Sendmail
The  program is used to send, relay, and receive electronic mail using SMTP (Simple Mail Transfer Protocol). Unfortunately it has had a spotted history with respect to security vulnerabilities and exploits. For this reason it is important to take advantage of any security features that have been added to, and to apply the latest security patches to this product as they become available.

On each system where it is loaded,  reads a file that is used to store a list of mail aliases. These aliases are e-mail addresses that the  program translates into another form, such as a distribution list of e-mail addresses. One of the built-in features of the alias list is the ability to execute a shell command using a prog mailer.

Here is an example of just such an entry: save_debug_message  : "|/usr/local/bin/record_bug.sh",debug_log

When an e-mail message is sent to the save_debug_message address on this server, its  daemon executes the   command and passes the mail message to the script as standard input.

As you might expect, this capability can readily introduce security vulnerabilities into the system. Messages with arbitrary content can be sent to this address, and if it does not securely process the data a suitably-formatted e-mail could potentially be used to compromise the system. Likewise if the script is not securely protected, users on the system can modify it for their own purposes. A user with a terminated account might even be able to regain access by this means.

A capability that was introduced to try and limit the amount of damage that an aliased command could introduced was the use of the  shell. When the  process is configured to use   as the prog mailer, it limits the capabilities of the script being executed. The System Administrator can restrict the commands that can be run in the script to a small set of "safe" commands. The prog mailer is configured in the  configuration file using the   option.

Under construction...

title: UNIX Computing Security/Remote access


text:
UNIX Computing Security/Log files and auditing

Suggested topics: syslog, lpd's log, mail log, install, Audit, and IDS.

Log files are generated by system processes to record activities for subsequent analysis. They can be useful tools for troubleshooting system problems and also to check for inappropriate activity. The UNIX releases are preconfigured to record certain information in log files, but configuration settings are available to increase the amount of information recorded.

Log files can be very useful resources for security incident investigations. They can also be essential for prosecution of criminal activity. For these reasons log files should be periodically backed up to separate media, and precautions need to be taken to prevent tampering with the log files. It is expected that an unauthorized intruder into a computing system will attempt to remove any trace of their activities from the system log files.

For log files that tend to grow significantly in size over the course of time, it can be good practice to periodically rotate the logs. That is to say, rename the current log file to a name in a sequence, and start a new log. Here is an example of rotating a log file called :

$ cd /var/adm $ test -f mylog.2 && mv -f mylog.2 mylog.3 $ test -f mylog.1 && mv -f mylog.1 mylog.2 $ test -f mylog.log && cp -p mylog mylog.1 $ :>mylog

The effect of this is to rotate the log through three copies before it is finally overwritten. A script can be used to run this periodically, thus keeping the log file trimmed. (The log files should be backed up to media at some point.) Rotating the log files helps minimizes the disk space usage, thus avoiding a denial of service event due to a full file system.

Syslog
The system log is a log file that is maintained by the  daemon. This log file can collect a variety of useful information, including panic conditions, data corruption, hardware errors, as well as warnings and tracking information. This log file can be written to from a shell or script by means of the  command. Messages are sent to the  daemon, which processes them according to a configuration defined by a special file (such as  ).

Events passed to the  are defined by a set of facilities and log levels. Combinations of facilities and log levels can be processed in different manners, or ignored altogether. For example, all error messages can be copied to the  file and e-mailed to the System Administrator, alerts can be printed to the console, mail debug messages can be added to a   file, and so forth.

Certain services or daemons can be configured to log information to the  file. These can include the  file, which on some systems can be configured to provide additional logging information. Among the types of information that can be logged is remote user login attempts and successes, including the client host from where the user is connecting. In some circumstances this can be useful for helping tracing the origin of an inappropriate or erroneous connection.

Some versions of  can be configured to read log messages broadcast over the network. However it is possible to flood this socket with invalid messages, thus leading to a rapid growth of the log file and a potential denial of service. For this reason it is often a good idea to disable this network logging capability in the  startup.

There are several options for maintaining a system log that is difficult if not impossible for an intruder to clean up. These can be configured by means of the  file.

 * A printer can be dedicated to recording log messages on hard copy. The old line printers were especially useful for this purpose as the messages could be viewed immediately, rather than waiting for a page to fill.
 * The daemon can forward messages to a secure system on the network. If the server is compromised, the messages will still be stored safely on the remote host.
 * The log messages can be copied to a device that is configured for write-once, read-many operations. This could be a CD-ROM recording or a specially-configured tape drive.

The System Administrator should also be wary of misleading log messages. Users can add log entries using the  command, and this can be employed as a prank or nuisance factor.

Other logs
There are other log files that can sometimes be useful in tracking accesses and activities.

 * The line printer daemon is normally used to dispatch an output job to a printer. This can either print to a locally attached device, or forward the print jobs to a remote printer on a different server. The print jobs are recorded in a log file, usually giving the printer name, the account running the print job, and the date and time. This could potentially be useful in tracking access attempts.

 * The  daemon can be used to send and receive electronic mail between UNIX systems using SMTP (Simple Mail Transfer Protocol). The daemon can be configured to log information about e-mail messages sent, received, and relayed. It can be used to troubleshoot e-mail issues as well as to look for unusual mail activity. The log messages are sent to the system via the , which is often configured to save mail-related messages to a dedicated log file.

Auditing
Auditing is normally a built-in capability that can be activated on a UNIX system. It is a requirement for C-2 trusted system security.

The audit system must be activated in order to begin collecting data. This data acquisition does come at a cost, as it can consume as much as 10% of the system CPU time. The data is stored in a file, which can then be analyzed using the available audit system commands.

The audit subsystem can collect data on events, system calls, and user activities. Auditing can collect a significant amount of data, which can then be examined for information about the system calls being run, the users calling the system commands, and the modifications made.

The particulars of the auditing configuration can vary depending on the particular flavor of the UNIX OS, so it is best for the System Administrator to review the manual pages on the subject. Usually there is an audit man page, which is a good place to start.

As the audit file can potentially grow without bounds, management of the file is necessary, usually on a daily basis. This can be done by rotating the log files and backing up the logs to separate media. The audit capability typically has a threshold setting that will cause the auditing to switch to an alternate log file under certain conditions. This audit file is often placed on a different file system in case the threshold switch is triggered by the original file system reaching a disk usage limit.

The audit logs should be regularly monitored to check for activity that needs to be tracked. Usually this can be achieved by means of a cron job that summarizes the log entries and looks for inappropriate events. In addition, regularly storing the audit event logs on separate media can be useful for the purposes of investigation of unauthorized access, &c.


text:
UNIX Computing Security/Physical security

Suggested topics: server room, media storage and network connections.

The physical security of your computing infrastructure is at least as important as the measures that are applied at the software level. Unauthorized individuals gaining access to a server room can intercept network transmissions, cause servers to reboot from inserted media, or perform malicious destruction of your systems and data.

Companies that value their server computing resources will typically place the systems in isolated rooms with carefully managed environments and protections against power outages. Access to server rooms is limited by means of locks that can require combination codes, special digital cards, or biometric devices. The interior can be monitored using surveillance systems, such as ceiling-mounted camera domes. Perimeter defense is provided by building access mechanisms and security personnel.

However not all the computing infrastructure can be protected to this degree. Access to the network and internal servers can be acquired by accessing an office terminal or workstation. Data can be removed or stolen by the theft of a laptop or disk drive. It is also a simple matter to obtain valuable data, then to copy it onto media for easy removal.

Reboot
When an intruder has physical access to a server, they may be able to reboot the system from alternate media. With the system up, they may be able to mount up the file systems on the server and make whatever changes they would like. When the system is rebooted normally, they may have inserted changes that allow unauthorized privileges. Removalable media devices, such as CD-ROM, floppy disk, magnetic tape or USB disks (including USB pen drives) should be removed from the list of bootable devices, or placed after the primary boot device.

If a removable media device is not present, the system can still be booted into single-user mode. If this level has not been protected by a login prompt, the system can be modified with privileges equivalent to root. Vendors will typically implement a Boot Authentication feature only allows authorized users to boot a system to Single-user mode. Boot authentication can take the form of a BIOS supported power-on password or a specialized program, such as the Linux sulogin command which requires a password before granting access in Single-user mode.

More later...


text:
UNIX Computing Security/Data security

Suggested topics: backups to media, recovery, encryption and disaster recovery.

Backup is very essential in an environment where your data is precious, and that to a subset of data for almost any computer user, when planning for a backup system, there are some questions you need to answer:

 * What do i want to back up?
 * How often do I want to back up?
 * Where to save the backup?
 * How long do I need the backup?
 * How long does it take to get the backup to replace a damaged system after a disaster?
 * What's the format I want my backup to be in?
 * How to back up?
 * How to minimize backup time when doing frequent backups?
 * How to verify the integrity and accuracy of my backups?

If you are designing your system in a way to make it easy to back up, you could take in consideration selecting a filing system that supports useful features, such as snapshots, XFS support, and ufs2 for (free?) BSD, LVM on Linux has nice snapshot features too.

backup tools
backup tools can be devided according to what they backup, file/directory backup tools, disk backup tools and data backup tools (database dumps for example)

UNIX systems provide many tools that help in backing up files, most commonly known is the tar command which allows creating archives and preserver ownership/time-date/permessions on the files being archived. those tar archives can also easily be compressed, using gzip for example.

another tool to backup is "dump" and "restore", which dumps entire filing systems and treats it as a collection of disk blocks, can be configured in /etc/fstab
 * cpio
 * tar(Guide_to_Unix/Commands/File_Compression):
 * tar puts multiple files and directories in one archive, note that tar actually stands for Tape Archive, so it inherents a lot from the ar command (archive), tar can compress archives too, some of the options that can be passed to tar are:
 * c : create archive
 * x : extract archive
 * t : list
 * z : work with gz compression to create compressed archives or extract compressed archives or list the content.
 * v : operate verbosely (print out what files were progressed)
 * f file: to specify the file name you are dealing with.
 * rdiff

remote backup

 * rsync
 * tar to remote machine:
 * tar czf uwe@remotehost:/path/remote localpath
 * tar over ssh tunneling
 * example

tar czf - someDir | ssh user@domain tar -C somDirToExtractTo xzf -

open source backup systems

 * amanda
 * bacula
 * backupninja
 * backupPC

disaster recovery tool

 * mondo

data base backup
A fine idea that can be used for database backup is based on a combination of volume snapshots and table locking, the idea is that to keep you database consistent and minimize the time you lock the tables, you can do the following:
 * 1) lock the tables
 * 2) take a volume snapshot (very short time)
 * 3) unlock the tables
 * 4) read the tables with an appropriate tool from the volume snapshot

Continuous Data Protection (CDP) and Near-CDP

 * Near CDP is basically snapshot and replication.
 * CDP is a little different, when RPO is very little, as little as few seconds, then CDP is needed.

hardware involved in backup solutions

 * NAS
 * SAN
 * Tape

title: UNIX Computing Security/Data security


text:
User talk:Delfeld

Hello and welcome to Wikibooks!

Here are some tips to help you get started:
 * You can sign your name on Talk and vote pages using four tildes, like this: ~).
 * Remember to conduct any editing experiments in the sandbox.
 * Check out our help page if you need additional help.
 * Eventually, you might want to read the Manual of Style and Policies and Guidelines.
 * Remember to maintain a Neutral point of view.
 * Explore, be bold in editing pages, and have fun!

You will find more resources in Community Portal.

Good luck! --Lord Voldemort (Dark Mark)  18:39, 11 November 2005 (UTC)

title: User talk:Delfeld


text: Template:User CVU2-en

title: Template:User CVU2-en


text:
User talk:Its partha here~enwikibooks

Hello and welcome to Wikibooks!

Here are some tips to help you get started:
 * You can sign your name on Talk and vote pages using four tildes, like this: ~~~~.
 * Remember to conduct any editing experiments in the sandbox.
 * Check out our help page if you need additional help.
 * Eventually, you might want to read the Manual of Style and Policies and Guidelines.
 * Remember to maintain a Neutral point of view.
 * Explore, be bold in editing pages, and have fun!

You will find more resources in Community Portal.

Good luck! --Lord Voldemort (Dark Mark)  18:53, 11 November 2005 (UTC)

Your account will be renamed
Hello,

The developer team at Wikimedia is making some changes to how accounts work, as part of our on-going efforts to provide new and better tools for our users like cross-wiki notifications. These changes will mean you have the same account name everywhere. This will let us give you new features that will help you edit and discuss better, and allow more flexible user permissions for tools. One of the side-effects of this is that user accounts will now have to be unique across all 900 Wikimedia wikis. See the announcement for more information.

Unfortunately, your account clashes with another account also called Its partha here. To make sure that both of you can use all Wikimedia projects in future, we have reserved the name Its partha here~enwikibooks that only you will have. If you like it, you don't have to do anything. If you do not like it, you can pick out a different name.

Your account will still work as before, and you will be credited for all your edits made so far, but you will have to use the new account name when you log in.

Sorry for the inconvenience.

Yours, Keegan Peterzell Community Liaison, Wikimedia Foundation 23:14, 17 March 2015 (UTC)

Renamed
 This account has been renamed as part of single-user login finalisation. If you own this account you can |log in using your previous username and password for more information. If you do not like this account's new name, you can choose your own using this form after logging in: . -- Keegan (WMF) (talk) 05:03, 19 April 2015 (UTC)

title: User talk:Its partha here~enwikibooks


text:
User talk:Torbjørn~enwikibooks

Hello and welcome to Wikibooks!

Here are some tips to help you get started:
 * You can sign your name on Talk and vote pages using four tildes, like this: ~~~~.
 * Remember to conduct any editing experiments in the sandbox.
 * Check out our help page if you need additional help.
 * Eventually, you might want to read the Manual of Style and Policies and Guidelines.
 * Remember to maintain a Neutral point of view.
 * Explore, be bold in editing pages, and have fun!

You will find more resources in Community Portal.

Good luck! --Lord Voldemort (Dark Mark)  18:55, 11 November 2005 (UTC)

Your account will be renamed
Hello,

The developer team at Wikimedia is making some changes to how accounts work, as part of our on-going efforts to provide new and better tools for our users like cross-wiki notifications. These changes will mean you have the same account name everywhere. This will let us give you new features that will help you edit and discuss better, and allow more flexible user permissions for tools. One of the side-effects of this is that user accounts will now have to be unique across all 900 Wikimedia wikis. See the announcement for more information.

Unfortunately, your account clashes with another account also called Torbjørn. To make sure that both of you can use all Wikimedia projects in future, we have reserved the name Torbjørn~enwikibooks that only you will have. If you like it, you don't have to do anything. If you do not like it, you can pick out a different name.

Your account will still work as before, and you will be credited for all your edits made so far, but you will have to use the new account name when you log in.

Sorry for the inconvenience.

Yours, Keegan Peterzell Community Liaison, Wikimedia Foundation 23:50, 17 March 2015 (UTC)

Renamed
 This account has been renamed as part of single-user login finalisation. If you own this account you can |log in using your previous username and password for more information. If you do not like this account's new name, you can choose your own using this form after logging in: . -- Keegan (WMF) (talk) 05:36, 19 April 2015 (UTC)

title: User talk:Torbjørn~enwikibooks


text:
User talk:WhiteTimberwolf

Hello and welcome to Wikibooks!

Here are some tips to help you get started:
 * You can sign your name on Talk and vote pages using four tildes, like this: ~~~~.
 * Remember to conduct any editing experiments in the sandbox.
 * Check out our help page if you need additional help.
 * Eventually, you might want to read the Manual of Style and Policies and Guidelines.
 * Remember to maintain a Neutral point of view.
 * Explore, be bold in editing pages, and have fun!

You will find more resources in Community Portal.

Good luck! --Lord Voldemort (Dark Mark)  18:57, 11 November 2005 (UTC)

title: User talk:WhiteTimberwolf


text:
User talk:Ralbury

Hello and welcome to Wikibooks!

Here are some tips to help you get started:
 * You can sign your name on Talk and vote pages using four tildes, like this: ~~~~.
 * Remember to conduct any editing experiments in the sandbox.
 * Check out our help page if you need additional help.
 * Eventually, you might want to read the Manual of Style and Policies and Guidelines.
 * Remember to maintain a Neutral point of view.
 * Explore, be bold in editing pages, and have fun!

You will find more resources in Community Portal.

Good luck! --Lord Voldemort (Dark Mark)  18:59, 11 November 2005 (UTC)

title: User talk:Ralbury


text:
User talk:Hartsu

Hello and welcome to Wikibooks!

Here are some tips to help you get started:
 * You can sign your name on Talk and vote pages using four tildes, like this: ~~~~.
 * Remember to conduct any editing experiments in the sandbox.
 * Check out our help page if you need additional help.
 * Eventually, you might want to read the Manual of Style and Policies and Guidelines.
 * Remember to maintain a Neutral point of view.
 * Explore, be bold in editing pages, and have fun!

You will find more resources in Community Portal.

Good luck! --Lord Voldemort (Dark Mark)  18:59, 11 November 2005 (UTC)

title: User talk:Hartsu


text:
User talk:Adam1213

My talk page on wikipedia
Hello and welcome to Wikibooks!

Here are some tips to help you get started:
 * You can sign your name on Talk and vote pages using four tildes, like this: ~~~~.
 * Remember to conduct any editing experiments in the sandbox.
 * Check out our help page if you need additional help.
 * Eventually, you might want to read the Manual of Style and Policies and Guidelines.
 * Remember to maintain a Neutral point of view.
 * Explore, be bold in editing pages, and have fun!

You will find more resources in Community Portal.

Good luck! --Lord Voldemort (Dark Mark)  19:01, 11 November 2005 (UTC)

title: User talk:Adam1213


text:
User talk:Sceptre

Hello and welcome to Wikibooks!

Here are some tips to help you get started:
 * You can sign your name on Talk and vote pages using four tildes, like this: ~~~~.
 * Remember to conduct any editing experiments in the sandbox.
 * Check out our help page if you need additional help.
 * Eventually, you might want to read the Manual of Style and Policies and Guidelines.
 * Remember to maintain a Neutral point of view.
 * Explore, be bold in editing pages, and have fun!

You will find more resources in Community Portal.

Good luck!

And the redirect from your user page does not work... in case you weren't aware. --Lord Voldemort (Dark Mark)  19:02, 11 November 2005 (UTC)

title: User talk:Sceptre


text:
User talk:Unformed

Hello and welcome to Wikibooks!

Here are some tips to help you get started:
 * You can sign your name on Talk and vote pages using four tildes, like this: ~~~~.
 * Remember to conduct any editing experiments in the sandbox.
 * Check out our help page if you need additional help.
 * Eventually, you might want to read the Manual of Style and Policies and Guidelines.
 * Remember to maintain a Neutral point of view.
 * Explore, be bold in editing pages, and have fun!

You will find more resources in Community Portal.

Good luck! --Lord Voldemort (Dark Mark)  19:05, 11 November 2005 (UTC)

title: User talk:Unformed


text:
User talk:130.208.152.80

Welcome to Wikibooks, collection of open-content textbooks! You don't have to log in to read or edit articles on Wikibooks, but creating an account is quick, free and non-intrusive, requires no personal information, and gives you many benefits, including:
 * The use of a username of your choice
 * The ability to view all your contributions via a "My contributions" link
 * Your own user page
 * Your own talk page which, if you choose, also allows users to send you messages without knowing your e-mail address
 * The use of your own personal watchlist to which you can add articles that interest you
 * The ability to rename pages
 * The ability to upload images
 * The ability to customize the appearance and behavior of the website
 * The eligibility to become an administrator
 * The right to be heard in votes and elections
 * Your IP address will no longer be visible to other users.

We hope that you choose to become a Wikibooks and create an account. We hope you enjoy your time here on Wikibooks as a Wikibookian! --Lord Voldemort (Dark Mark)  19:09, 11 November 2005 (UTC)

title: User talk:130.208.152.80


text:
User talk:216.36.149.212

Please stop adding nonsense to Wikibooks. It is considered vandalism. If you would like to experiment, use the sandbox. Thank you.

title: User talk:216.36.149.212


text:
User talk:204.248.50.26

Please stop. If you continue to vandalize pages, you will be blocked from editing Wikibooks.

title: User talk:204.248.50.26


text: User talk:81.195.8.127

title: User talk:81.195.8.127


text:
User talk:67.11.252.100

Welcome to Wikibooks, collection of open-content textbooks! You don't have to log in to read or edit articles on Wikibooks, but creating an account is quick, free and non-intrusive, requires no personal information, and gives you many benefits, including:
 * The use of a username of your choice
 * The ability to view all your contributions via a "My contributions" link
 * Your own user page
 * Your own talk page which, if you choose, also allows users to send you messages without knowing your e-mail address
 * The use of your own personal watchlist to which you can add articles that interest you
 * The ability to rename pages
 * The ability to upload images
 * The ability to customize the appearance and behavior of the website
 * The eligibility to become an administrator
 * The right to be heard in votes and elections
 * Your IP address will no longer be visible to other users.

We hope that you choose to become a Wikibooks and create an account. We hope you enjoy your time here on Wikibooks as a Wikibookian! --Lord Voldemort (Dark Mark)  19:23, 11 November 2005 (UTC)

title: User talk:67.11.252.100


text:
Formal Logic/Sentential Logic/Disjunctions in Derivations

= Disjunctions in Derivations =

Disjunctions in derivations are, as the current inference rules stand, difficult to deal with. Using an already derived disjunction by applying Disjunction Elimination (DE) is not too bad, but there is an easier to use alternative. Deriving a disjunction in the first place is more difficult. Our Disjunction Introduction (DI) rule turns out to be a rather anemic tool for this task. In this module, we introduce derived rules which provide alternative methods for dealing with disjunctions in derivations.

Modus Tollendo Ponens
We start with a new (to be) derived rule of inference. This will provide a useful alternative to Disjunction Elimination (DE).

 * Modus Tollendo Ponens, Form I (MTP)
 * $$(\varphi \lor \psi)\,\!$$
 * $$\underline{\lnot \varphi \quad \quad}\,\!$$
 * $$\psi\,\!$$

 * Modus Tollendo Ponens, Form II (MTP)
 * $$(\varphi \lor \psi)\,\!$$
 * $$\underline{\lnot \psi \quad \quad}\,\!$$
 * $$\varphi\,\!$$

Modus Tollendo Ponens is sometimes known as Disjunctive Syllogism and occasionally as the Rule of the Dog.

Supporting theorems
This new rule requires the following two supporting theorems.

 * $$\mathbf{T16.} \quad (\mathrm{P} \lor \mathrm{Q}) \land \lnot \mathrm{P} \rightarrow \mathrm{Q}\,\!$$

 * $$\mathbf{T17.} \quad (\mathrm{P} \lor \mathrm{Q}) \land \lnot \mathrm{Q} \rightarrow \mathrm{P}\,\!$$

Example derivation
For an example using MTP, we redo the example derivation from Constructing a Complex Derivation.

 * $$\mathrm{P} \land \mathrm{R} \rightarrow \mathrm{T},\ \ \mathrm{S} \land \lnot \mathrm{T},\ \ \mathrm{S} \rightarrow \lnot \mathrm{Q}\,\!$$ ∴  $$\mathrm{P} \lor \mathrm{Q} \rightarrow \lnot \mathrm{R}\,\!$$

After Line 4, we did not bother with subderivations for deriving the antecedent lines needed for DE. Instead, we went straight to a subderivation for the conclusion's consequent. At line 8, we applied MTP.

Conditional Disjunction
The next derived rule significantly reduces the labor of deriving disjunctions, thus providing a useful alternative to Disjunction Introduction (DI).

 * Conditional Disjunction (CDJ)
 * $$\underline{(\lnot \varphi \rightarrow \psi)}\,\!$$
 * $$(\varphi \lor \psi)\,\!$$

Supporting theorem

 * $$\mathbf{T18.} \quad (\lnot \mathrm{P} \rightarrow \mathrm{Q}) \rightarrow \mathrm{P} \lor \mathrm{Q}\,\!$$

Example derivation
This derivation will make use of T12 (introduced at Derived Inference Rules) even though its proof was left to the reader as an exercise. The correctness the following derivation, particularly Line 2, assumes that you have indeed proved T12.

 * ∴ $$(\mathrm{P} \rightarrow \mathrm{Q}) \lor (\mathrm{Q} \rightarrow \mathrm{R})\,\!$$

Here we attempted to derive the desired conditional by first deriving the antecedent line needed for CDJ.


text:
Consciousness Studies/Other Explanations

Consciousness-only is the foundation of a buddhist theory known as vijnanavada. Proponents, notably the Yogacara school, suggest that the sum of experience exists only in our minds. Philosophers recognition of this view as subjective idealism is a matter of discussion because these traditions often deny the existence of ontological subject. These views are rooted in the denial of existence of any kind of ontological substance (as Matter, Soul, God, etc.). Consciousness-only views can also be found in taoist philosophy, notably Lao Tzu and Chuang Tzu.


text: User:Whiteknight/Sandbox

title: User:Whiteknight/Sandbox


text:
Wikijunior:Ancient Civilizations/Khmer

The people of Cambodia are the descendants of the Khmer empire.

What Country did they live in?
The Khmer people lived in the country today known as Cambodia. Cambodians to this day introduce themselves as Khmer. At its largest the Khmer kingdom extended into what is now Thailand, Laos, and Vietnam.

How did the civilization rise and fall?
Little is known about the origin of the Khmer people before their arrival in south east Asia. But legend says that a race called Mon-Khmer used to live in eastern India, which is now present day Bangladesh. Traces of Mon-Khmer culture and vocabulary still exist in the Bengali vocabulary. The oldest Khmer settlement in Cambodia was established around 1000 BCE. From the 1st to 6th century CE, Cambodia was the part of the south Asian kingdom, Funan. The first kingdom of the Khmer people was built by King Jayavarman II and later he was succeeded by his son Jayavarman III. During the reign of these two monarchs, the Great Angkor kingdom of Cambodia was built. Later in 1431 Angkor was captured and destroyed by the Siamese (current day Thailand). After this, the French claimed Cambodia as a colony. Independence from France was granted in 1953. This was followed by the establishment of a totalitarian government intermixed with episodes of anarchy and feudalism.

What did their buildings look like?
Khmer people lived in houses made of bamboo and wood. These houses were built so that they were raised off of the ground on poles. Much of area around the Mekong river where the Khmer lived flooded during summer monsoons. This type of house was very practical and kept the inhabitants dry.

During the Angkorian kingdom the Khmer also built many fine stone temples. The Khmer were accomplished stone workers. One of the most famous of these temples is Angkor Wat. Angkor Wat, first constructed in the twelfth century, is the largest religious structure in the world. It has five large domes which are shaped like flower buds surrounded by terraces. Most of the temple is built from sandstone blocks. Carved reliefs in the walls show various religious scenes. The temple is surrounded by a moat.

What did they eat?
Archaeological findings prove that Khmer people's diet consisted of fish and rice in 1000 BCE. For many hundreds of years the Khmer have used irrigation to bring water to their rice paddies. There are also stone carvings dating back hundreds of years showing large fisheries. It wasn't just fish and rice though, the Khmer also ate other water creatures including crabs, frogs, shrimp and snails. They also grew a variety of vegetables and fruits. The coconut has been an important addition to the Khmer diet.

According to accounts by a visitor from China during ancient times, the Khmer ate soup from bowls made from woven leaves. Still today, a Cambodian meal almost always includes a soup, which is eaten with the other courses. Fish is the nation's mainstay, and dried fish are used in many dishes. Soups are sometimes made with coconut milk. 'Salad' dishes are flavored with coriander, mint and lemon grass - three flavors which find their way into many Cambodian dishes.

What did they wear?
Men wore Sarongs and women wore Sampots. Both garments are a kind of loose fitting skirt gathered at the waist. Both men and women were generally bare from the waist up. Bas relief sculptures show both men and women wearing elaborate beaded necklaces, ear-rings, bracelets, anklets and elaborate head-dresses.

What did their writing look like?
The Khmer script developed from the Pallava script of India. The oldest inscription in Khmer dates from 611 CE. It is engraved in stone. Khmer is written left to right like English or Latin. The symbols it uses are more complex than the letters used in English. Some of the symbols have hooks and loops as well as dots and flowing lines.

Khmer writing uses symbols to represent consonants and vowels. Khmer has fewer symbols for vowels than the language has vowel sounds. Because of this, most vowel signs have two possible pronunciations, depending on which consonant is being used.

What did they believe?
The Khmer practiced a number of religions as well as the variety of belief systems. The Khmer Empire's official religions included Hinduism and Mahayana Buddhism and Theravada Buddhism.

This religious diversity is reflected in the Khmer of today as well. The descendants of the Khmer have religious beliefs and practices which combine the tenets of Theravada Buddhism with ancestor-spirit worship, astrology, and shamanism. The wat (Buddhist temple) is the center of religious life for many Khmer. When sick they often consult a kru khmae (shaman/healer) for herbal medicine and spiritual healing. Khmer beliefs also rely on astrology, a remnant of their Hinduism. A fortune teller, called hao-ra, is consulted before major events like beginning an important journey or determining the proper location for building new structures.

Are some of them famous even today?
Prince Norodom Sihanouk won Cambodia's independence from France. Pol Pot was an infamous dictator, and killed more than one million people by execution, starvation and in forced labor camps during his rule of Cambodia. Photographer Dith Pran had a book and movie made about his life called The Killing Fields. He helped chronicle the atrocities of the Pol Pot regime.

What is left of them today?
Many Cambodians are descendants of the Khmer, and the Khmer language is the official language of Cambodia.

Wikijunior Alte Zivilisationen/ Aksumiter Wikijunior Alte Zivilisationen/ Khmer

title: Wikijunior:Ancient Civilizations/Khmer


text: Template:Image warning

title: Template:Image warning


text:
User talk:Mattbarton.exe

Various
Is this the right place to point out that the Rhetoric section uses "they," a plural pronoun to refer to a singular antecedent throughout many passages? It's challenging to edit around this, but it can be done. If this is the sort of editing that this projects seeks, I'll undertake it; but I don't want to overwrite someone's extensive effort without a heads up or a courtesy note to acknowledge the overall worth and value of the core contribution. Sorry if this is the wrong place to post; I'm learning the ropes. M.Johnson Tarnowski (Old Word Wolf)

Sure, why not. Needs to be consistent across book, less formal.

Good work on the Rhetoric and Composition book. It's interesting to see it come together. liblamb 21:54, 11 November 2005 (UTC)

Re your msg on my talk page (missplased on my user page ;) ). You did forget to point out what pages you meant I was doing "dramatic" cuts to. I guess it was my removal of possible Copyright violation (and "confirmed" copyright violation) Pictures on the [Rhetoric and Composition] modules. I'v taken notice of you'r comment and will use the talk page for "greyzone cuts". Sincerly Oyvind 22:21, 19 November 2005 (UTC)

There is no problem with the title img on [Rhetoric and Composition]. Have put it back up, in a little more "annonymus" size. Oyvind 11:04, 20 November 2005 (UTC)

User page
May I propose that you edit your user page and introduce yourself shortly, perhaps mentioning that you are a major contributor to Rhetoric and Composition? I think you and your students made a great job on the book, unless I am mistaking your identity. Thanks a lot for your work. --Dan Polansky (talk) 20:10, 9 September 2008 (UTC)

Saylor.org's English Composition
Hi there! Your Rhetoric and Composition textbook looks like a great project. I have a similar project just starting in conjunction with the Saylor Foundation. Please take a look at our textbook Saylor.org's English Composition and add some contributions! --Azin (discuss • contribs) 18:36, 31 May 2012 (UTC)

title: User talk:Mattbarton.exe


text: User talk:84.13.71.3

title: User talk:84.13.71.3


text:
User:Hyperpasta

Wikipedia:User:hyperpasta

title: User:Hyperpasta


text:
User talk:Hyperpasta

Copyright problem with Image:Tiger Finder Screen.png
--Derbeth talk 22:16, 11 November 2005 (UTC)

Image:Tiger Righthand Menu Bar.png
You cannot tag such images as GFDL, because you do not have their copyrights. Change tag in your images from GFDL to screenshot. --Derbeth talk 08:56, 25 November 2005 (UTC)

Mac OS X Tiger
Be all that as it may, I've yet to find any book, online or otherwise, that doesn't go into the history of the Mac pre-1984. I see where you're trying to work on a compromise of background and information pertinent to just the Mac, but you might want to re-order it so that it's chronological. --JohnDBuell 22:38, 25 January 2006 (UTC)

Re: Apple Macintosh
Thank you! Well, I don't think I'll b contributing to Wikibooks in a major way in the foreseeable future (I get less work done on Wikipedia and Commons than i'd like even now), so I won't join your project. I've linked it from w:Wikipedia:WikiProject Macintosh however, maybe some other contributors will follow it ;) Anyway, if the Tiger book is the only one with real value, the redirect is perfect for now. Keep up the good work, and maybe I'll eventually come over here and do some work after all. --Grm wnr 20:09, 18 June 2006 (UTC)

spell checking in Safari
Hi Hyperpasta - I noticed you added a lot of the content over at the Meet the Applications/Safari page. I wondered about the spell checking section of Safari - see Talk:Mac OS X Tiger/Meet the Applications/Safari. Just popped in here for something ... might have to stick around and make myself an account!--70.41.146.174 09:09, 30 May 2007 (UTC)

Your images marked PD ineligible
Screenshots of copyrighted software are not public domain. You need to provide fair-use information including relevant rationale. See the notice I added earlier above for another image tagged for fair use but with incomplete rationale. Find them in Category:Images with unknown copyright status. They will be deleted in a week if not given proper licensing information. -- Adrignola talk contribs 18:53, 25 June 2009 (UTC)

title: User talk:Hyperpasta


text:
User talk:Revolución~enwikibooks

Welcome
Come introduce yourself at the new users page. If you have any questions, you can ask there or contact me personally.--Derbeth talk 22:49, 11 November 2005 (UTC)

Copyright problem with Image:Swahili area.gif
--Derbeth talk 22:49, 11 November 2005 (UTC)

Your account will be renamed
Hello,

The developer team at Wikimedia is making some changes to how accounts work, as part of our on-going efforts to provide new and better tools for our users like cross-wiki notifications. These changes will mean you have the same account name everywhere. This will let us give you new features that will help you edit and discuss better, and allow more flexible user permissions for tools. One of the side-effects of this is that user accounts will now have to be unique across all 900 Wikimedia wikis. See the announcement for more information.

Unfortunately, your account clashes with another account also called Revolución. To make sure that both of you can use all Wikimedia projects in future, we have reserved the name Revolución~enwikibooks that only you will have. If you like it, you don't have to do anything. If you do not like it, you can pick out a different name.

Your account will still work as before, and you will be credited for all your edits made so far, but you will have to use the new account name when you log in.

Sorry for the inconvenience.

Yours, Keegan Peterzell Community Liaison, Wikimedia Foundation 23:37, 17 March 2015 (UTC)

Renamed
 This account has been renamed as part of single-user login finalisation. If you own this account you can |log in using your previous username and password for more information. If you do not like this account's new name, you can choose your own using this form after logging in: . -- Keegan (WMF) (talk) 05:25, 19 April 2015 (UTC)

title: User talk:Revolución~enwikibooks


text:
Swahili

First Steps

 * /Introduction/
 * /Pronunciation/
 * /Greetings/
 * /Personal Pronouns/
 * /Common Phrases/
 * /References and materials/

First Lesson

 * Verbs (General Structure, Subject Prefixes, Negation, Infinitive)
 * Present (+Habitual)
 * Nouns (Overview, Concept of Noun Classes, Concord)
 * M/W

Second Lesson

 * M/Mi
 * Imperative and Subjunctive
 * Past (Simple Past and Past Perfect)
 * Questions

Third Lesson

 * Ji/Ma
 * Future
 * /Possesives/
 * Hotelini (Ordering at the Restaurant)

Fourth Lesson

 * Ki/Vi
 * Locative
 * /Demonstratives/ (Here, There and beyond)
 * Directions (Telling the Way)

Fifth Lesson

 * N/N
 * Passive
 * /Numbers/
 * Cooking

Sixth Lesson

 * U/N
 * Object
 * Family

Seventh Lesson

 * Conditional
 * "Already"
 * Public Transport

Eighth Lesson

 * Relative
 * Participle
 * /Time/

Ninth Lesson

 * Single Syllable

Verbs

 * General (General Structure, Subject Prefixes, Negation)
 * Present (+Habitual)
 * Imperative
 * Past (Simple Past and Past Perfect)
 * Future
 * Subjunctive
 * "Already"
 * Passive
 * Object
 * Conditional
 * Relative
 * Participle
 * Locative
 * Single Syllable
 * Overview

Adjectives

 * General
 * /Colors/

Nouns

 * General (Overview, Concept of Noun Classes, Concord)
 * M/W
 * M/Mi
 * Ji/Ma
 * Ki/Vi
 * N/N
 * U/N
 * Overview

Questions

 * General

Numbers

 * /Numbers/

Demonstratives

 * /Demonstratives/ (Here, There and beyond)

Possesives

 * /Possesives/

Time

 * /Time/

Other

 * Informal/Spoken Language
 * Regional differences

Topics

 * /Greetings/
 * Hotelini (Ordering at the Restaurant)
 * Directions (Telling the Way)
 * Cooking
 * Family
 * Public Transport

סוואהילי

title: Swahili


text:
Canadian Criminal Evidence/Introduction

Preface
This text was written as a reference on the law of evidence in criminal law. The audience for this text will be mostly criminal law practitioners, police officers, and law students, who need a convenient way to look up principles and case law. Where possible there are links to cited cases on CanLII for ease of reference.

Organization of the Book
This book is set out in three sections. First section covers the basic elements that make up the rules of evidence, such as basis for accepting evidence, burdens and standards of proof, as well as shortcuts to proof.

The second section cover the types of evidence the law recognizes. Specifically, oral, document or real evidence. These chapters cover the requirements for these types of evidence to be accepted into evidence, including competency of witnesses and authentication of certain types of evidence.

The final section covers the many rules that limit or exclude evidence. This includes a variety of principles from opinion evidence, character evidence, hearsay, admissions, and privilege.

title: Canadian Criminal Evidence/Introduction


text:
Canadian Criminal Evidence/Acceptance of Evidence

Introduction
Evidence provides a means of allowing facts to be proved for the purpose of deciding issues in litigation. Only evidence that is admissible, material and relevant can be considered. Even then evidence can often have the side-effect of creating prejudice, and if the prejudicial effect is more significant than the probative value, it might be ruled inadmissible for that reason.

For a trier-of-fact to receive evidence, the judge must be satisfied that the evidence is:
 * 1) relevant,
 * 2) material,
 * 3) not barred by rules of admissibly, and
 * 4) not subject to discretionary exclusion.

Once relevance and materiality is established the remaining steps tend to reduce the scope of admissibility by excluding evidence.

Relevance
Evidence must be relevant before it can be admissible; irrelevant evidence must be excluded.

Relevance is "assessed in the context of the entire case and the positions of counsel. It requires a determination whether, as a matter of human experience and logic, the existence of a particular fact, directly or indirectly, makes the existence or non-existence of a material fact more probable than it would be otherwise".

Certain evidence does not cease to be relevant or become irrelevant simply because it can support more than one inference.

Relevance is sometimes divided into 1) logical relevance and 2) legal relevance. Logical relevance, as discussed above, refers to the connection between two facts. Legal relevance is the cost/benefit analysis of the admission of evidence on the basis of probative value outweighing prejudicial effect.

Materiality
Evidence must be material to be considered by a court. Material evidence refers to evidence that is contributes to proving a fact that is of consequence to the trial. That is, there must be a relationship between the evidence and a legal issue put to the court.

Rules of Admissibility
All courts can only consider admissible evidence.

Where evidence is relevant and material the evidence should be admitted unless their exclusion is justified.

Much of the entirety of the rules of evidence concern the question of what is admissible evidence. As such, admissibly of evidence can be better understood as evidence that is not prohibited by an exclusionary rules. To name the most frequently encountered rules of exclusion include:
 * 1) hearsay
 * 2) opinion
 * 3) witness competence
 * 4) character
 * 5) illegally obtained evidence
 * 6) conduct on other occasions

In addition to this, there is always a residual common law discretion to exclude evidence.

Discretionary Exclusion
Even where evidence is relevant, material, and admissible, the court retains a discretionary ability to exclude evidence where the probative value of the evidence is exceeded by its prejudicial effect.

The law is primarily inclusionary and will tend to admit all evidence that is logically probative of some fact in issue, subject to the rules of exclusion and exception. Where it does not fall into an exclusion or exception issues with the evidence only goes to weight.

The discretionary power allows for a cost-benefit analysis to determine if the value of the evidence to determine the case correctly "is worth the cost of its introduction to the litigation process." This will involve considering the prejudicial effect including the misleading effect and time consumption.

The onus is upon the accused to establish that evidence otherwise admissible should be excluded as prejudicial.

The court should consider the discretion to exclude evidence as follows:
 * 1) The judge must determine the probative value of the evidence assessing its tendency to prove a fact in issue in the case including the credibility of the witnesses.
 * 2) The judge must determine the prejudicial effect of the evidence because of its tendency to prove matters which are not in issue... or because of the risk that the jury may use the evidence improperly to prove a fact in issue.
 * 3) The judge must balance the probative value against the prejudicial effect having regard to the importance of the issues for which the evidence is legitimately offered against the risk that the jury will use it for other improper purposes, taking into account the effectiveness of any limiting instructions.

In a jury setting, the judge must be scrupulous to only permit evidence that is "worthy of jury consideration" and "not whether the jury should accept and act upon the evidence."

In non-jury settings, the judge need not be as scrupulous. The judge is performing a gate-keeping function and so is capable of distinguishing prejudicial evidence. It is unreasonable that the judge is prejudiced from merely hearing evidence.

Where prejudices exist the judges are capable of self-warning of the risks of the evidence. This will often be considered sufficient precaution. A judge who is satisfied he are not prejudice should be taken at his word. R v O’Brien, 2011 SCC 29 (CanLII) at para 18, [2011] 2 SCR 485 (“The trial judge was entitled to be taken at his word.”)

The exercise of this discretion requires substantial deference on appeal absent error in principle.

Probative value
Probative value concerns the weight put on evidence and not its admissibility.

Determining the probative value of evidence includes considering the "frailties of the evidence, the inferences that may reasonably be drawn from it and the availability of other evidence to prove the same fact."

Probative value includes considering its reliability.

The reliability factor is particularly important when considering expert evidence.

Prejudicial Effect
Although the first rule of evidence is to admit all relevant evidence there are certain types of relevant evidence that should not be admitted as it will have a prejudicial effect on the fairness of the trial. It is said that there are three grounds of excluding evidence on the basis of it prejudice: "moral", "logical", and "time".

Prejudice is not simply evidence that is harmful to the defence case, but rather it is evidence that will create unfairness by misuse, over consumption of time, or distraction/confusion of issues. The impact will effect "fairness and the integrity of the proceedings"

All judges have a discretion to exclude any evidence on the basis that its prejudicial effect will out-weigh the probative value.

Where evidence is relevant to one count but irrelevant and possibly prejudicial to another count, the court may still admit the evidence but provide a limiting instruction to the jury on the limited use of the evidence.

When the evidence is called by the defence the balance between probative value and prejudicial effect is weighed further in the side of admission. A judge should only exclude evidence where the prejudicial effect "substantially outweighs" the probative value.

When dealing with a jury we must presume that limiting instructions and cautions will be followed and the evidence will be "confined within its proper bounds".

In review, the absence of objection will be a factor in considering if the evidence is significantly prejudicial.

Moral and Logical Prejudice
First, there is evidence of moral prejudice which has the potential of creating outrage in the jury and could influence them to make their decision based on emotion. For example, a jury may get the urge to punish an accused for past bad acts even though they are not at issue in the trial. Second, there are logical prejudices that suggest to the jury to make improper inferences, such as relating the accused race with a particular disposition.

In a non-jury setting, concerns of reasoning prejudice and moral prejudice are lessened.

Time Consumption
Prejudice arises from evidence that consumes too much time and resources. The trier-of-fact should not have their time wasted with minor evidence that will waste their time and confuse them from the real issues.

The time consumption should be commensurate to its value.

Trial Fairness
The conduct of the trial, including the admission of evidence, should "not result in the trial being unfair because the accused has been denied a full opportunity to prepare his case, challenge and answer the Crown’s case."

When considering hearsay tendered by accused the judge may relax the rules of admissibility in order to prevent a miscarriage of justice. This preferred treatment is due to the liberty interests at stake.


text:
Canadian Criminal Evidence/Proving Facts

Introduction
There are several ways that facts can be established. The predominant manner of establishing fact is through evidence. In fact, almost all manners of proof require some amount of evidence and the real distinction is the proximity of the evidence to the fact at issue.

Facts are established by:
 * 1) Direct Evidence
 * 2) Circumstantial Evidence (including inferences)
 * 3) Legal Presumptions
 * 4) Judicial Notice
 * 5) Admissions of Fact

Direct Evidence
Direct evidence is evidence that is put forward to directly establish a fact which resolves a matter at issue. No inferences of fact need to be drawn to resolve the matter at issue. A first-hand eyewitness testifying to seeing a criminal offence take place is the most obvious example of direct evidence.

Topics

 * Circumstantial Evidence
 * Inferences
 * Recent Possession
 * Presumptions
 * Judicial Notice
 * Admissions of Fact


text:
Canadian Criminal Evidence/Real Evidence

Introduction
Real evidence consists of all tangible evidence, physical objects such as, tape recordings, computer printouts or photographs. Real evidence, as all other evidence, must first be relevant. Secondly, it must be authentic.

Authentication is often proven by having witnesses identify the object and verify its authenticity. The leading case on authentication of real evidence is in R. v. Parsons. The case hinged on a wiretap whose lawfulness was in question. The issue was handled in a voir dire. However, on appeal the Court said that an issue for the trier of fact to determine not the trial judge. The judge must only determine if the evidence has met the minimum statutory requirement.

There is no fixed formula for submitting real evidence, however, it is recommended that a procedure for submitting evidence be followed such as:
 * 1) call a witness with personal knowledge of the object;
 * 2) ask the witness to describe the object before showing it to the witness;
 * 3) allow the witness to examine and identify it as genuine; and
 * 4) ask that the object be entered as an exhibit, with the appropriate stamp applied by the clerk.

Demonstrative Evidence
Demonstrative evidence includes charts, models, and experiments. They are used as tools to assist the judge in their understanding the of case. They are not "real evidence" is the strictest meaning as they are not objects that form part of the incident.

With demonstrative evidence, there is no need for the formal authentication. Instead, the only standard is that of whether the evidence is relevant and whether it is an accurate representation of what it is supposed to depict. The primary consideration of the court is whether the item can assist the court or whether it warps or distorts the fact-finding process.

Experiments
Experimental evidence is admissible as demonstrative evidence.

Where the experimental evidence is relevant and materials it will tend to be admitted, unless the discretionary exclusion rule is applied.

If the evidence requires inferences using special knowledge, the adducing party will need to admit it as expert evidence.

The courts generally are very cautious about allowing demonstrative evidence in the form of in-court experiments as the environment of a court does not allow for a good duplication of the events at issue. This includes video re-enactment performed by officers.

As a general rule, the relevancy and admissibility will depend on the degree of accuracy the recreation is to the original event.

Experiments in more controlled situations are more likely to be admitted. A ballistics expert who takes a firearm used in an alleged shooting can be permitted to perform tests on the weapon to determine its accuracy.

Anytime that experiments are admitted before a jury, limiting instructions should be given.

Views
A “view” is where the trier-of-fact, be it judge or jury, is permitted to attend the location of the event at issue in trial to better understand the evidence. The view may be requested by either party or on the judge’s motion under s. 652:

The order is made where it “is in the interest of justice”. This requires that the viewing of the location add something to the evidence. While the viewing itself does not amount to evidence, it is intended to be an aid that helps facilitate an understanding of the evidence.

Consequently, the view can be taken even after the close of evidence.

For a detailed review of law, see R. v. Polimac, 2006 CanLII 40110 (ON SC)

Photographs
In order to admit photographic evidence in the Court, the party submitting the evidence must establish that:
 * they accurately and truly represent the facts,
 * are fairly presented and without any intent to mislead and
 * are verified on oath by a person capable of doing so.

The person testifying to the photographs can be:
 * the photographer
 * a person present when the photograph was taken
 * a person qualified to state that the representation is accurate, or
 * an expert witness

The age of a person in a photograph is a question of fact for the trier-of-fact, and does not need an expert.

Police sketches based on eye-witness descriptions will be admissible where the sketch artist is available for cross-examination.

Video
The requirements for admitting video evidence is the same as those of photos. However, in the case of video tape there is the added danger of potential of tape alterations (editing, slow-motion replay, etc.), so the judge must be even more cautious when admitting video evidence.

As long as the video recording is of sufficient quality, the trier-of-fact can identify the accused without corroborating evidence.

The video footage evidence is considered real evidence and so cannot be said to "hearsay".

Video re-enactments
Courts should be cautious when dealing with video reenactments where the accused is not participating. It may have the tenancy to overly influence the jury. Nevertheless, the admissibility turns on whether the prejudicial effect outweighs the probative value.

Audio
Audio recording are to be treated in the same manner as witness testimony, but with the added weight provided that it is a more accurate record of past conversations. The use of private recorded coversations in a criminal trial usually requires a voir dire to be held.

A police officer can give evidence of the accused's natural voice at time arrest to establish voice identification as long as their is no trickery used to induce the accused to speak.


text:
MediaWiki:Licenses

 * subst:nld|I don't know what type of non-free media this is
 * non-free symbol|Coats of arms, crests, flags, seals, and emblems
 * non-free stamp|Postage stamps
 * non-free logo|Company logos, trademarks and press release photos
 * non-free product cover|Covers of products
 * non-free computer icon|Software icons
 * Microsoft screenshot|Screenshots of Microsoft software
 * Adobe screenshot|Screenshots of Adobe software
 * non-free software screenshot|Screenshot of computer or video game software
 * non-free web screenshot|Screenshots of web pages
 * non-free video screenshot|Screenshots of videos
 * non-free video sample|Video samples
 * non-free audio sample|Audio samples
 * non-free art|Sculptures, paintings, illustrations, and other artwork
 * non-free use|Other fair use or fair dealings

title: MediaWiki:Licenses