Browse Library
Sign In Start Free Trial
Close icon Search icon
Account
Browse Library Advanced Search Sign In Start Free Trial

Add to playlist

Create a Playlist

Modal Close icon
You need to login to use this feature.
  • Mastering Linux Security and Hardening
  • Toc
  • feedback
Mastering Linux Security and Hardening

Mastering Linux Security and Hardening

By : Donald A. Tevault
3.9 (7)
close
Mastering Linux Security and Hardening

Mastering Linux Security and Hardening

3.9 (7)
By: Donald A. Tevault

Overview of this book

This book has extensive coverage of techniques that will help prevent attackers from breaching your system, by building a much more secure Linux environment. You will learn various security techniques such as SSH hardening, network service detection, setting up firewalls, encrypting file systems, protecting user accounts, authentication processes, and so on. Moving forward, you will also develop hands-on skills with advanced Linux permissions, access control, special modes, and more. Lastly, this book will also cover best practices and troubleshooting techniques to get your work done efficiently. By the end of this book, you will be confident in delivering a system that will be much harder to compromise.
Table of Contents (12 chapters)
close
Preface
Preface
Who this book is for
What this book covers
To get the most out of this book
Get in touch
Free Chapter
1
Running Linux in a Virtual Environment
Running Linux in a Virtual Environment
The threat landscape
Keeping up with security news
Introduction to VirtualBox and Cygwin
Using Cygwin to connect to your virtual machines
Summary
2
Securing User Accounts
Securing User Accounts
The dangers of logging in as the root user
The advantages of using sudo
Setting up sudo privileges for full administrative users
Setting up sudo for users with only certain delegated privileges
Advanced tips and tricks for using sudo
Locking down users' home directories the Red Hat or CentOS way
Locking down users' home directories the Debian/Ubuntu way
Enforcing strong password criteria
Setting and enforcing password and account expiration
Preventing brute-force password attacks
Locking user accounts
Setting up security banners
Summary
3
Securing Your Server with a Firewall
Securing Your Server with a Firewall
An overview of iptables
Uncomplicated Firewall for Ubuntu systems
firewalld for Red Hat systems
nftables – a more universal type of firewall system
Summary
4
Encrypting and SSH Hardening
Encrypting and SSH Hardening
GNU Privacy Guard
Encrypting partitions with Linux Unified Key Setup – LUKS
Encrypting directories with eCryptfs
Using VeraCrypt for cross-platform sharing of encrypted containers
Ensuring that SSH protocol 1 is disabled
Creating and managing keys for password-less logins
Disabling root user login
Disabling username/password logins
Setting up a chroot environment for SFTP users
Summary
5
Mastering Discretionary Access Control
Mastering Discretionary Access Control
Using chown to change ownership of files and directories
Using chmod to set permissions values on files and directories
Using SUID and SGID on regular files
The security implications of the SUID and SGID permissions
Using extended file attributes to protect sensitive files
Summary
6
Access Control Lists and Shared Directory Management
Access Control Lists and Shared Directory Management
Creating an access control list for either a user or a group
Creating an inherited access control list for a directory
Removing a specific permission by using an ACL mask
Using the tar --acls option to prevent the loss of ACLs during a backup
Creating a user group and adding members to it
Creating a shared directory
Setting the SGID bit and the sticky bit on the shared directory
Using ACLs to access files in the shared directory
Summary
7
Implementing Mandatory Access Control with SELinux and AppArmor
chevron up
Implementing Mandatory Access Control with SELinux and AppArmor
How SELinux can benefit a systems administrator
Setting security contexts for files and directories
Troubleshooting with setroubleshoot
Working with SELinux policies
How AppArmor can benefit a systems administrator
Looking at AppArmor profiles
Working with AppArmor command-line utilities
Troubleshooting AppArmor problems
Summary
8
Scanning, Auditing, and Hardening
Scanning, Auditing, and Hardening
Installing and updating ClamAV and maldet
Scanning with ClamAV and maldet
SELinux considerations
Scanning for rootkits with Rootkit Hunter
Controlling the auditd daemon
Creating audit rules
Using ausearch and aureport
Applying OpenSCAP policies with oscap
Using SCAP Workbench
More about OpenSCAP profiles
Applying an OpenSCAP profile during system installation
Summary
9
Vulnerability Scanning and Intrusion Detection
Vulnerability Scanning and Intrusion Detection
Looking at Snort and Security Onion
Scanning and hardening with Lynis
Finding vulnerabilities with OpenVAS
Web server scanning with Nikto
Summary
10
Security Tips and Tricks for the Busy Bee
Security Tips and Tricks for the Busy Bee
Auditing system services
Password-protecting the GRUB 2 bootloader
Securely configuring BIOS/UEFI
Using a security checklist for system setup
Summary
11
Other Books You May Enjoy
Other Books You May Enjoy
Leave a review – let other readers know what you think

Looking at AppArmor profiles

In the /etc/apparmor.d directory, you'll see the AppArmor profiles for your system.  (The SELinux folk say policies, but the AppArmor folk say profiles.):

donnie@ubuntu3:/etc/apparmor.d$ ls -l
total 72
drwxr-xr-x 5 root root  4096 Oct 29 15:21 abstractions
drwxr-xr-x 2 root root  4096 Nov 15 09:34 cache
drwxr-xr-x 2 root root  4096 Oct 29 14:43 disable
drwxr-xr-x 2 root root  4096 Apr  5  2016 force-complain
drwxr-xr-x 2 root root  4096 Oct 29 15:21 local
drwxr-xr-x 2 root root  4096 Oct 29 15:02 lxc
-rw-r--r-- 1 root root   198 Jun 14 16:15 lxc-containers
-rw-r--r-- 1 root root  3310 Apr 12  2016 sbin.dhclient
drwxr-xr-x 5 root root  4096 Oct 29 15:21 tunables
-rw-r--r-- 1 root root   125 Jun 14 16:15 usr.bin.lxc-start
-rw-r--r-- 1 root root   281 May 23  2017 usr.lib.lxd.lxd-bridge-proxy
-rw-r--r-- 1 root root 17667 Oct 18 05:04 usr.lib.snapd.snap-confine.real
-rw-r--r-- 1 root root  1527 Jan  5  2016 usr.sbin.rsyslogd
-rw-r--r-- 1 root root  1469 Sep  8 15...
End of Section 9
Next Section
bookmark search playlist font-size

Change the font size

margin-width

Change margin width

day-mode

Change background colour

Close icon Search
Country selected
Close icon Your notes and bookmarks

Delete Bookmark

Modal Close icon
Are you sure you want to delete it?
Cancel
Yes, Delete