Browse Library
Sign In Start Free Trial
Close icon Search icon
Account
Browse Library Advanced Search Sign In Start Free Trial

Add to playlist

Create a Playlist

Modal Close icon
You need to login to use this feature.
  • Book Overview & Buying Mastering Linux Security and Hardening
  • Table Of Contents Toc
  • Feedback & Rating feedback
Mastering Linux Security and Hardening

Mastering Linux Security and Hardening

By : Donald A. Tevault
3.9 (7)
Buy this Book
close
close
Mastering Linux Security and Hardening

Mastering Linux Security and Hardening

3.9 (7)
By: Donald A. Tevault
Buy this Book

Overview of this book

This book has extensive coverage of techniques that will help prevent attackers from breaching your system, by building a much more secure Linux environment. You will learn various security techniques such as SSH hardening, network service detection, setting up firewalls, encrypting file systems, protecting user accounts, authentication processes, and so on. Moving forward, you will also develop hands-on skills with advanced Linux permissions, access control, special modes, and more. Lastly, this book will also cover best practices and troubleshooting techniques to get your work done efficiently. By the end of this book, you will be confident in delivering a system that will be much harder to compromise.
Table of Contents (12 chapters)
close
close
close
Preface
Icon
Preface
Icon
Who this book is for
Icon
What this book covers
Icon
To get the most out of this book
Icon
Get in touch
Free Chapter
1
Running Linux in a Virtual Environment
Icon
Running Linux in a Virtual Environment
Icon
The threat landscape
Icon
Keeping up with security news
Icon
Introduction to VirtualBox and Cygwin
Icon
Using Cygwin to connect to your virtual machines
Icon
Summary
2
Securing User Accounts
Icon
Securing User Accounts
Icon
The dangers of logging in as the root user
Icon
The advantages of using sudo
Icon
Setting up sudo privileges for full administrative users
Icon
Setting up sudo for users with only certain delegated privileges
Icon
Advanced tips and tricks for using sudo
Icon
Locking down users' home directories the Red Hat or CentOS way
Icon
Locking down users' home directories the Debian/Ubuntu way
Icon
Enforcing strong password criteria
Icon
Setting and enforcing password and account expiration
Icon
Preventing brute-force password attacks
Icon
Locking user accounts
Icon
Setting up security banners
Icon
Summary
3
Securing Your Server with a Firewall
Icon
Securing Your Server with a Firewall
Icon
An overview of iptables
Icon
Uncomplicated Firewall for Ubuntu systems
Icon
firewalld for Red Hat systems
Icon
nftables – a more universal type of firewall system
Icon
Summary
4
Encrypting and SSH Hardening
Icon
Encrypting and SSH Hardening
Icon
GNU Privacy Guard
Icon
Encrypting partitions with Linux Unified Key Setup – LUKS
Icon
Encrypting directories with eCryptfs
Icon
Using VeraCrypt for cross-platform sharing of encrypted containers
Icon
Ensuring that SSH protocol 1 is disabled
Icon
Creating and managing keys for password-less logins
Icon
Disabling root user login
Icon
Disabling username/password logins
Icon
Setting up a chroot environment for SFTP users
Icon
Summary
5
Mastering Discretionary Access Control
Icon
Mastering Discretionary Access Control
Icon
Using chown to change ownership of files and directories
Icon
Using chmod to set permissions values on files and directories
Icon
Using SUID and SGID on regular files
Icon
The security implications of the SUID and SGID permissions
Icon
Using extended file attributes to protect sensitive files
Icon
Summary
6
Access Control Lists and Shared Directory Management
Icon
Access Control Lists and Shared Directory Management
Icon
Creating an access control list for either a user or a group
Icon
Creating an inherited access control list for a directory
Icon
Removing a specific permission by using an ACL mask
Icon
Using the tar --acls option to prevent the loss of ACLs during a backup
Icon
Creating a user group and adding members to it
Icon
Creating a shared directory
Icon
Setting the SGID bit and the sticky bit on the shared directory
Icon
Using ACLs to access files in the shared directory
Icon
Summary
7
Implementing Mandatory Access Control with SELinux and AppArmor
Icon
Implementing Mandatory Access Control with SELinux and AppArmor
Icon
How SELinux can benefit a systems administrator
Icon
Setting security contexts for files and directories
Icon
Troubleshooting with setroubleshoot
Icon
Working with SELinux policies
Icon
How AppArmor can benefit a systems administrator
Icon
Looking at AppArmor profiles
Icon
Working with AppArmor command-line utilities
Icon
Troubleshooting AppArmor problems
Icon
Summary
8
Scanning, Auditing, and Hardening
chevron up
Icon
Scanning, Auditing, and Hardening
Icon
Installing and updating ClamAV and maldet
Icon
Scanning with ClamAV and maldet
Icon
SELinux considerations
Icon
Scanning for rootkits with Rootkit Hunter
Icon
Controlling the auditd daemon
Icon
Creating audit rules
Icon
Using ausearch and aureport
Icon
Applying OpenSCAP policies with oscap
Icon
Using SCAP Workbench
Icon
More about OpenSCAP profiles
Icon
Applying an OpenSCAP profile during system installation
Icon
Summary
9
Vulnerability Scanning and Intrusion Detection
Icon
Vulnerability Scanning and Intrusion Detection
Icon
Looking at Snort and Security Onion
Icon
Scanning and hardening with Lynis
Icon
Finding vulnerabilities with OpenVAS
Icon
Web server scanning with Nikto
Icon
Summary
10
Security Tips and Tricks for the Busy Bee
Icon
Security Tips and Tricks for the Busy Bee
Icon
Auditing system services
Icon
Password-protecting the GRUB 2 bootloader
Icon
Securely configuring BIOS/UEFI
Icon
Using a security checklist for system setup
Icon
Summary
11
Other Books You May Enjoy
Icon
Other Books You May Enjoy
Icon
Leave a review – let other readers know what you think

Using ausearch and aureport

The auditd daemon logs events to the /var/log/audit/audit.log file. Although you could directly read the file with something like less, you really don't want to. The ausearch and aureport utilities will help you translate the file into a language that makes some sort of sense.

Searching for file change alerts

Let's start by looking at the rule that we created that will alert us whenever a change is made to the /etc/passwd file:

sudo auditctl -w /etc/passwd -p wa -k passwd_changes

Now, let's make a change to the file and look for the alert message. Rather than add another user, since I'm running out of cats whose names I can use, I'll just use the chfn utility to  add contact information to the comment field for Cleopatra's entry:

[donnie@localhost etc]$ sudo chfn cleopatra
Changing finger information for cleopatra.
Name []: Cleopatra Tabby Cat
Office []: Donnie's back yard
Office Phone []: 555-5555
Home Phone []: 555-5556

Finger information changed.
[donnie@localhost...

Unlock full access

Continue reading for free

A Packt free trial gives you instant online access to our library of over 7000 practical eBooks and videos, constantly updated with the latest in tech
Start a 7-day FREE trial
End of Section 9
Next Section

Create a Note

Modal Close icon
You need to login to use this feature.
notes
bookmark search playlist font-size

Change the font size

margin-width

Change margin width

day-mode

Change background colour

Close icon Search
Country selected
Close icon Your notes and bookmarks

Delete Bookmark

Modal Close icon
Are you sure you want to delete it?
Cancel
Yes, Delete

Delete Note

Modal Close icon
Are you sure you want to delete it?
Cancel
Yes, Delete

Edit Note

Modal Close icon
Write a note (max 255 characters)
Cancel
Update Note

Confirmation

Modal Close icon
claim successful
Order Page Read Now

Buy this book with your credits?

Modal Close icon
Are you sure you want to buy this book with one of your credits?
Close
YES, BUY