Browse Library
Sign In Start Free Trial
Close icon Search icon
Account
Browse Library Advanced Search Sign In Start Free Trial

Add to playlist

Create a Playlist

Modal Close icon
You need to login to use this feature.
  • Mastering Linux Security and Hardening
  • Toc
  • feedback
Mastering Linux Security and Hardening

Mastering Linux Security and Hardening

By : Donald A. Tevault
3.9 (7)
close
Mastering Linux Security and Hardening

Mastering Linux Security and Hardening

3.9 (7)
By: Donald A. Tevault

Overview of this book

This book has extensive coverage of techniques that will help prevent attackers from breaching your system, by building a much more secure Linux environment. You will learn various security techniques such as SSH hardening, network service detection, setting up firewalls, encrypting file systems, protecting user accounts, authentication processes, and so on. Moving forward, you will also develop hands-on skills with advanced Linux permissions, access control, special modes, and more. Lastly, this book will also cover best practices and troubleshooting techniques to get your work done efficiently. By the end of this book, you will be confident in delivering a system that will be much harder to compromise.
Table of Contents (12 chapters)
close
Preface
Preface
Who this book is for
What this book covers
To get the most out of this book
Get in touch
Free Chapter
1
Running Linux in a Virtual Environment
Running Linux in a Virtual Environment
The threat landscape
Keeping up with security news
Introduction to VirtualBox and Cygwin
Using Cygwin to connect to your virtual machines
Summary
2
Securing User Accounts
Securing User Accounts
The dangers of logging in as the root user
The advantages of using sudo
Setting up sudo privileges for full administrative users
Setting up sudo for users with only certain delegated privileges
Advanced tips and tricks for using sudo
Locking down users' home directories the Red Hat or CentOS way
Locking down users' home directories the Debian/Ubuntu way
Enforcing strong password criteria
Setting and enforcing password and account expiration
Preventing brute-force password attacks
Locking user accounts
Setting up security banners
Summary
3
Securing Your Server with a Firewall
Securing Your Server with a Firewall
An overview of iptables
Uncomplicated Firewall for Ubuntu systems
firewalld for Red Hat systems
nftables – a more universal type of firewall system
Summary
4
Encrypting and SSH Hardening
Encrypting and SSH Hardening
GNU Privacy Guard
Encrypting partitions with Linux Unified Key Setup – LUKS
Encrypting directories with eCryptfs
Using VeraCrypt for cross-platform sharing of encrypted containers
Ensuring that SSH protocol 1 is disabled
Creating and managing keys for password-less logins
Disabling root user login
Disabling username/password logins
Setting up a chroot environment for SFTP users
Summary
5
Mastering Discretionary Access Control
Mastering Discretionary Access Control
Using chown to change ownership of files and directories
Using chmod to set permissions values on files and directories
Using SUID and SGID on regular files
The security implications of the SUID and SGID permissions
Using extended file attributes to protect sensitive files
Summary
6
Access Control Lists and Shared Directory Management
Access Control Lists and Shared Directory Management
Creating an access control list for either a user or a group
Creating an inherited access control list for a directory
Removing a specific permission by using an ACL mask
Using the tar --acls option to prevent the loss of ACLs during a backup
Creating a user group and adding members to it
Creating a shared directory
Setting the SGID bit and the sticky bit on the shared directory
Using ACLs to access files in the shared directory
Summary
7
Implementing Mandatory Access Control with SELinux and AppArmor
Implementing Mandatory Access Control with SELinux and AppArmor
How SELinux can benefit a systems administrator
Setting security contexts for files and directories
Troubleshooting with setroubleshoot
Working with SELinux policies
How AppArmor can benefit a systems administrator
Looking at AppArmor profiles
Working with AppArmor command-line utilities
Troubleshooting AppArmor problems
Summary
8
Scanning, Auditing, and Hardening
chevron up
Scanning, Auditing, and Hardening
Installing and updating ClamAV and maldet
Scanning with ClamAV and maldet
SELinux considerations
Scanning for rootkits with Rootkit Hunter
Controlling the auditd daemon
Creating audit rules
Using ausearch and aureport
Applying OpenSCAP policies with oscap
Using SCAP Workbench
More about OpenSCAP profiles
Applying an OpenSCAP profile during system installation
Summary
9
Vulnerability Scanning and Intrusion Detection
Vulnerability Scanning and Intrusion Detection
Looking at Snort and Security Onion
Scanning and hardening with Lynis
Finding vulnerabilities with OpenVAS
Web server scanning with Nikto
Summary
10
Security Tips and Tricks for the Busy Bee
Security Tips and Tricks for the Busy Bee
Auditing system services
Password-protecting the GRUB 2 bootloader
Securely configuring BIOS/UEFI
Using a security checklist for system setup
Summary
11
Other Books You May Enjoy
Other Books You May Enjoy
Leave a review – let other readers know what you think

Using ausearch and aureport

The auditd daemon logs events to the /var/log/audit/audit.log file. Although you could directly read the file with something like less, you really don't want to. The ausearch and aureport utilities will help you translate the file into a language that makes some sort of sense.

Searching for file change alerts

Let's start by looking at the rule that we created that will alert us whenever a change is made to the /etc/passwd file:

sudo auditctl -w /etc/passwd -p wa -k passwd_changes

Now, let's make a change to the file and look for the alert message. Rather than add another user, since I'm running out of cats whose names I can use, I'll just use the chfn utility to  add contact information to the comment field for Cleopatra's entry:

[donnie@localhost etc]$ sudo chfn cleopatra
Changing finger information for cleopatra.
Name []: Cleopatra Tabby Cat
Office []: Donnie's back yard
Office Phone []: 555-5555
Home Phone []: 555-5556

Finger information changed.
[donnie@localhost...
End of Section 9
Next Section
bookmark search playlist font-size

Change the font size

margin-width

Change margin width

day-mode

Change background colour

Close icon Search
Country selected
Close icon Your notes and bookmarks

Delete Bookmark

Modal Close icon
Are you sure you want to delete it?
Cancel
Yes, Delete