Book Image

Mastering Linux Security and Hardening - Second Edition

By : Donald A. Tevault
Book Image

Mastering Linux Security and Hardening - Second Edition

By: Donald A. Tevault

Overview of this book

From creating networks and servers to automating the entire working environment, Linux has been extremely popular with system administrators for the last couple of decades. However, security has always been a major concern. With limited resources available in the Linux security domain, this book will be an invaluable guide in helping you get your Linux systems properly secured. Complete with in-depth explanations of essential concepts, practical examples, and self-assessment questions, this book begins by helping you set up a practice lab environment and takes you through the core functionalities of securing Linux. You'll practice various Linux hardening techniques and advance to setting up a locked-down Linux server. As you progress, you will also learn how to create user accounts with appropriate privilege levels, protect sensitive data by setting permissions and encryption, and configure a firewall. The book will help you set up mandatory access control, system auditing, security profiles, and kernel hardening, and finally cover best practices and troubleshooting techniques to secure your Linux environment efficiently. By the end of this Linux security book, you will be able to confidently set up a Linux server that will be much harder for malicious actors to compromise.
Table of Contents (20 chapters)
1
Section 1: Setting up a Secure Linux System
8
Section 2: Mastering File and Directory Access Control (DAC)
11
Section 3: Advanced System Hardening Techniques

Introducing VirtualBox and Cygwin

Whenever I write or teach, I try very hard not to provide students with a cure for insomnia. Throughout this book, you'll see a bit of theory whenever it's necessary, but I mainly like to provide good, practical information. There will also be plenty of step-by-step hands-on labs and an occasional bit of humor.

The best way to do the labs is to use Linux virtual machines. Most of what we'll do can apply to any Linux distribution, but we will also do some things that are specific to either Red Hat Enterprise Linux (RHEL) or Ubuntu Linux. (RHEL is the most popular for enterprise use, while Ubuntu is the most popular for cloud deployments.)

Red Hat is a billion-dollar company, so there's no doubt about where they stand in the Linux market. But since Ubuntu Server is free of charge, we can't judge its popularity strictly on the basis of its parent company's worth. The reality is that Ubuntu Server is the most widely used Linux distribution for deploying cloud-based applications.

See here for details: http://www.zdnet.com/article/ubuntu-linux-continues-to-dominate-openstack-and-other-clouds/.

Since Red Hat is a fee-based product, we'll substitute CentOS 7 and CentOS 8, which are built from Red Hat source code and are free of charge. (We're using both CentOS 7 and CentOS 8 because there are some differences between them, and both will be supported for quite some time to come.)

For Ubuntu, we'll concentrate on version 18.04, since it's the newest Long Term Support (LTS) version. A new LTS version of Ubuntu comes out in April of every even-numbered year, and non-LTS versions come out in April of every odd-numbered year, and every October. For production use, you'll mainly want to stick with the LTS versions, because the non-LTS versions can sometimes be a bit problematic.

There are several different virtualization platforms that you can use, but my own preferred choice is VirtualBox.

VirtualBox is available for Windows, Linux, and Mac hosts, and is free of charge for all of them. It has features that you have to pay for on other platforms, such as the ability to create snapshots of virtual machines.

Some of the labs that we'll be doing will require you to simulate creating a connection from your host machine to a remote Linux server. If your host machine is either a Linux or a Mac machine, you'll just be able to open the Terminal and use the built-in Secure Shell (SSH) tools. If your host machine is running Windows, you'll need to install some sort of Bash shell, which you can do by either installing Cygwin or by using the Bash shell that's built into Windows 10 Pro.

Installing a virtual machine in VirtualBox


For those of you who've never used VirtualBox, here's a quick guide to get you going:

  1. Download and install VirtualBox and the VirtualBox Extension Pack. You can get them from https://www.virtualbox.org/.
  2. Download the installation .iso files for Ubuntu Server 18.04, CentOS 7, and CentOS 8. You can get them from https://ubuntu.com/download/alternative-downloads#alternate-ubuntu-server-installer and https://www.centos.org/. (Note that for Ubuntu 18.04, you'll need to use this alternate installer. The default installer that you get from the main Download page lacks some of the features that you'll need to complete the exercises.)
  3. Start VirtualBox and click the New icon at the top of the screen. Fill out the information where requested. Increase the virtual drive size to 20 GB, but leave everything else as the default settings, as shown in the following screenshot:
  1. Start the new virtual machine. Click on the folder icon at the bottom-left corner of the dialog box and navigate to the directory where you stored the .iso files that you downloaded. Choose either the Ubuntu ISO file or the CentOS ISO file, as shown in the following screenshot:
  1. Click the Start button on the dialog box to start installing the operating system. Note that, for Ubuntu Server, you won't be installing a desktop interface. For the CentOS 7 virtual machine, choose either the KDE desktop or the GNOME desktop, as you desire. For CentOS 8, your only desktop choice is GNOME. (We'll go through at least one exercise that will require a desktop interface for the CentOS machine.)
  2. When installing Ubuntu, choose Install Ubuntu Server when you get to the following screen:
  1. Repeat the procedure for the other Linux distributions.
  2. Update the Ubuntu virtual machine by entering the following commands:
sudo apt update
sudo apt dist-upgrade
  1. Hold off on updating the CentOS virtual machine because we'll do that in the next exercise.
  2. For Ubuntu, choose No automatic updates on the Configuring tasks screen, and choose to install the OpenSSH Server on the Software selection screen.
When installing Ubuntu, you'll be asked to create a normal user account and password for yourself. It won't ask you to create a root user password, but will instead automatically add you to the sudo group so that you'll have admin privileges.

When you get to the user account creation screen of the CentOS installer, be sure to check the Make this user administrator box for your own user account, since it isn't checked by default. It will offer you the chance to create a password for the root user, but that's entirely optional—in fact, I never do.

The user account creation screen of the RHEL 8 installer—which looks the same as the one on CentOS 7 and CentOS 8—is shown here:

For Ubuntu 18.04, you'll go through several self-explanatory screens to set up your real name, a username, and a password. The Ubuntu installer will automatically add your user account to the sudo group, which will give you full administrator privileges.

Here's the user account creation screen for Ubuntu 18.04:

So, now, let's change gears and move on to CentOS 7.

Installing the EPEL repository on the CentOS 7 virtual machine

While the Ubuntu package repositories have pretty much everything that you need for this course, the CentOS package repositories are—shall we say—lacking. To have the packages that you'll need for the CentOS hands-on labs, you'll need to install the EPEL repository. (The EPEL project is run by the Fedora team.) When you install third-party repositories on Red Hat and CentOS systems, you'll also need to install a priorities package and edit the .repo files to set the proper priorities for each repository. This will prevent packages from the third-party repository from overwriting official Red Hat and CentOS packages if they just happen to have the same name. The following steps will help you install the required packages and edit the .repo files:

  1. The two packages that you'll need to install EPEL are in the normal CentOS 7 repositories. Run the following command:
sudo yum install yum-plugin-priorities epel-release
  1. When the installation completes, navigate to the /etc/yum.repos.d directory, and open the CentOS-Base.repo file in your favorite text editor. After the last line of the base, updates, and extras sections, add the line priority=1. After the last line of the centosplus section, add the line priority=2. Save the file and close the editor. Each of the sections that you've edited should look something like this (except with the appropriate name and priority number):
 [base]
name=CentOS-$releasever - Base
mirrorlist=http://mirrorlist.centos.org/?
release=$releasever&arch=$basearch&repo=os&infra=$infra
#baseurl=http://mirror.centos.org/centos/
$releasever/os/$basearch/
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-7
priority=1
  1. Open the epel.repo file for editing. After the last line of the epel section, add the line priority=10. After the last line of each remaining section, add the line priority=11.
  2. Update the system and then create a list of the installed and available packages by running the following commands:
sudo yum upgrade
sudo yum list > yum_list.txt

Now, let's move on to CentOS 8.

Installing the EPEL repository on the CentOS 8 virtual machine

To install the EPEL repository on CentOS 8, all you have to do is run the following command:

sudo dnf install epel-release

There's no priorities package as there is on CentOS 7 and earlier, so we won't have to worry about configuring the repository priorities.

When the package installation is complete, create a list of available software packages with the following commands:

sudo dnf upgrade
sudo dnf list > dnf_list.txt

Next, let's configure our network.

Configuring a network for VirtualBox virtual machines

Some of our training scenarios will require you to simulate creating a connection to a remote server. You would do this by using your host machine to connect to a virtual machine. When you first create a virtual machine on VirtualBox, the networking is set to NAT mode. In order to connect to the virtual machine from the host, you'll need to set the virtual machine's network adapter to Bridged Adapter mode. Here's how you can do this:

  1. Shut down any virtual machines that you've already created.
  2. On the VirtualBox Manager screen, open the Settings dialog for a virtual machine.
  3. Click the Network menu item, and change the Attached to setting from NAT to Bridged Adapter, as shown in the following screenshot:
  1. Expand the Advanced item, and change the Promiscuous Mode setting to Allow All, as shown in the following screenshot:
  1. Restart the virtual machine and set it to use a static IP address.
If you assign static IP addresses from the high end of your subnet range, it will be easier to prevent conflicts with low-number IP addresses that get handed out from your internet gateway.

Creating a virtual machine snapshot with VirtualBox

One of the beautiful things about working with virtual machines is that you can create a snapshot and roll back to it if you mess something up. With VirtualBox, that's easy to do, by following these steps:

  1. At the top right-hand corner of the VirtualBox Manager screen, click the Snapshots button.
  1. Further left on the screen, click on the Take icon to bring up the snapshot dialog box. Either fill in the desired Snapshot Name or accept the default name. Optionally, you can create a description, as shown in the following screenshot:
  1. After you've made changes to the virtual machine, you can roll back to the snapshot by shutting down the virtual machine, then highlighting the Snapshot Name, and clicking on the Restore button.

Using Cygwin to connect to your virtual machines

If your host machine is either a Linux or Mac machine, you'll simply open the host's Terminal and use the tools that are already there to connect to the virtual machine. But if you're running a Windows machine, you'll need some sort of Bash shell and its networking tools. Windows 10 Pro now comes with a Bash shell that's been provided by the Ubuntu folk, and you can use that if you desire. But if you don't have Windows 10 Pro, or if you prefer to use something else, you might consider Cygwin.

Cygwin, a project of the Red Hat company, is a free open source Bash shell that's built for Windows. It's free of charge and easy to install.

Installing Cygwin on your Windows host

Here's a quick how-to to get you going with Cygwin:

  1. In your host machine's browser, download the appropriate setup*.exe file for your version of Windows from http://www.cygwin.com/.
  2. Double-click on the setup icon to begin the installation. For the most part, just accept the defaults until you get to the Package selection screen. (The one exception will be the screen where you select a download mirror.)
  3. At the top of the Package selection screen, select Category from the View menu.
  4. Expand the Net category, as shown in the following screenshot:
  1. Scroll down until you see the openssh package. Under the New column, click on Skip (this causes a version number to appear in place of the Skip), as shown in the following screenshot:
  1. After you have selected the proper package, your screen should look like this:
  1. In the bottom right-hand corner, click Next. If a Resolving Dependencies screen pops up, click Next on it as well.
  1. Keep the setup file that you downloaded, because you'll use it later to either install more software packages or to update Cygwin. (When you open Cygwin, any updated packages will show up on the Pending view on the View menu.)
  2. Once you open Cygwin from the Windows Start menu, you can resize it as you desire, and use either the Ctrl + + or Ctrl + - key combinations to resize the font.

Next, we'll look at the Windows 10 Bash shell.

Using Windows 10 Pro Bash shell to interface with Linux virtual machines

If you're using either Windows 10 Pro or Windows 10 Enterprise, you already have an SSH client built into your operating system.

So, let's see how to do this:

  1. To get to it, you can open the traditional Command Prompt from the Windows System menu, like so:
  1. Then, just type in the SSH commands the same as you would from a Mac or Linux machine, like this:
  1. A better option is to use Windows PowerShell instead of the normal Command Prompt. Get to it as you see here:
  1. As before, let's use it to log in to my Orange Pi device, as shown here:

If you have the choice, go with PowerShell instead of Command Prompt. PowerShell is a bit closer to the Linux Bash shell experience, and you'll be much happier with it.

Cygwin versus Windows Bash shell

Both Cygwin and the SSH client that's built into Windows 10 have their pros and cons. In favor of Cygwin, you can install a variety of packages to customize it pretty much any way you want. Also, if you're stuck using Windows 10 Home Edition or—heaven forbid—Windows 7, you can use Cygwin.

In favor of the Windows 10 built-in SSH client, there's the fact that on the Pro and Enterprise editions of Windows 10, it's already there. Also, it's much easier to use if you need to access your normal Windows folders because Cygwin traps you in its own sandboxed directory structure.