Book Image

Mastering Linux Security and Hardening - Second Edition

By : Donald A. Tevault
Book Image

Mastering Linux Security and Hardening - Second Edition

By: Donald A. Tevault

Overview of this book

From creating networks and servers to automating the entire working environment, Linux has been extremely popular with system administrators for the last couple of decades. However, security has always been a major concern. With limited resources available in the Linux security domain, this book will be an invaluable guide in helping you get your Linux systems properly secured. Complete with in-depth explanations of essential concepts, practical examples, and self-assessment questions, this book begins by helping you set up a practice lab environment and takes you through the core functionalities of securing Linux. You'll practice various Linux hardening techniques and advance to setting up a locked-down Linux server. As you progress, you will also learn how to create user accounts with appropriate privilege levels, protect sensitive data by setting permissions and encryption, and configure a firewall. The book will help you set up mandatory access control, system auditing, security profiles, and kernel hardening, and finally cover best practices and troubleshooting techniques to secure your Linux environment efficiently. By the end of this Linux security book, you will be able to confidently set up a Linux server that will be much harder for malicious actors to compromise.

Related Content you might be interested in

Current Title:

Small book image
Mastering Linux Security and Hardening - Second Edition
Donald A. Tevault
Feb, 2020 | 666 pages
Small book image
Linux Service Management Made Easy with systemd
Donald A Tevault
Feb, 2022 | 420 pages
Small book image
Practical Linux Security Cookbook
Tajinder Kalsi
Aug, 2018 | 482 pages
Small book image
Linux Administration Cookbook
Adam K Dean
Dec, 2018 | 826 pages
Table of Contents (20 chapters)
Preface
Preface
Who this book is for
What this book covers
To get the most out of this book
Get in touch
1
Section 1: Setting up a Secure Linux System
Section 1: Setting up a Secure Linux System
Free Chapter
2
Running Linux in a Virtual Environment
Running Linux in a Virtual Environment
Looking at the threat landscape
Why do security breaches happen?
Keeping up with security news
Differences between physical, virtual, and cloud setups
Introducing VirtualBox and Cygwin
Keeping the Linux systems updated
Summary
Questions
Further reading
3
Securing User Accounts
Securing User Accounts
The dangers of logging in as the root user
The advantages of using sudo
Setting up sudo privileges for full administrative users
Setting up sudo for users with only certain delegated privileges
Advanced tips and tricks for using sudo
Locking down users' home directories the Red Hat or CentOS way
Locking down users' home directories the Debian/Ubuntu way
Enforcing strong password criteria
Setting and enforcing password and account expiration
Configuring default expiry data for useradd for Red Hat or CentOS only
Setting expiry data on a per-account basis with useradd and usermod
Setting expiry data on a per-account basis with chage
Preventing brute-force password attacks
Locking user accounts
Locking the root user account
Setting up security banners
Detecting compromised passwords
Understanding centralized user management
Summary
Questions
Further reading
4
Securing Your Server with a Firewall - Part 1
Securing Your Server with a Firewall - Part 1
Technical requirements
An overview of firewalld
An overview of iptables
Uncomplicated firewall for Ubuntu systems
Summary
Questions
Further reading
5
Securing Your Server with a Firewall - Part 2
Securing Your Server with a Firewall - Part 2
Technical requirements
nftables – a more universal type of firewall system
firewalld for Red Hat systems
Summary
Questions
Further reading
6
Encryption Technologies
Encryption Technologies
GNU Privacy Guard (GPG)
Encrypting partitions with Linux Unified Key Setup (LUKS)
Encrypting directories with eCryptfs
Using VeraCrypt for cross-platform sharing of encrypted containers
OpenSSL and the public key infrastructure
Summary
Questions
Further reading
7
SSH Hardening
SSH Hardening
Ensuring that SSH protocol 1 is disabled
Creating and managing keys for passwordless logins
Disabling root user login
Disabling username/password logins
Configuring Secure Shell with strong encryption algorithms
Setting system-wide encryption policies on RHEL 8/CentOS 8
Configuring more detailed logging
Configuring access control with whitelists and TCP Wrappers
Configuring automatic logouts and security banners
Configuring other miscellaneous security settings
Setting up a chroot environment for SFTP users
Sharing a directory with SSHFS
Remotely connecting from Windows desktops
Summary
Questions
Further reading
8
Section 2: Mastering File and Directory Access Control (DAC)
Section 2: Mastering File and Directory Access Control (DAC)
9
Mastering Discretionary Access Control
Mastering Discretionary Access Control
Using chown to change ownership of files and directories
Using chmod to set permissions on files and directories
Using SUID and SGID on regular files
The security implications of the SUID and SGID permissions
Using extended file attributes to protect sensitive files
Securing system configuration files
Summary
Questions
Further reading
10
Access Control Lists and Shared Directory Management
Access Control Lists and Shared Directory Management
Creating an ACL for either a user or a group
Creating an inherited ACL for a directory
Removing a specific permission by using an ACL mask
Using the tar --acls option to prevent the loss of ACLs during a backup
Creating a user group and adding members to it
Creating a shared directory
Setting the SGID bit and the sticky bit on the shared directory
Using ACLs to access files in the shared directory
Summary
Questions
Further reading
11
Section 3: Advanced System Hardening Techniques
Section 3: Advanced System Hardening Techniques
12
Implementing Mandatory Access Control with SELinux and AppArmor
Implementing Mandatory Access Control with SELinux and AppArmor
How SELinux can benefit a systems administrator
Setting security contexts for files and directories
Troubleshooting with setroubleshoot
Working with SELinux policies
How AppArmor can benefit a systems administrator
Looking at AppArmor profiles
Working with AppArmor command-line utilities
Troubleshooting AppArmor problems
Exploiting a system with an evil Docker container
Summary
Questions
Further reading
13
Kernel Hardening and Process Isolation
Kernel Hardening and Process Isolation
Understanding the /proc filesystem
Setting kernel parameters with sysctl
Configuring the sysctl.conf file
Understanding process isolation
Summary
Questions
Answers
Further reading
14
Scanning, Auditing, and Hardening
Scanning, Auditing, and Hardening
Technical requirements
Installing and updating ClamAV and maldet
Scanning with ClamAV and maldet
Scanning for rootkits with Rootkit Hunter
Performing a quick malware analysis with strings and VirusTotal
Understanding the auditd daemon
Using ausearch and aureport
Applying OpenSCAP policies with oscap
Summary
Questions
Further reading
15
Logging and Log Security
Logging and Log Security
Understanding the Linux system log files
Understanding rsyslog
Understanding journald
Making things easier with Logwatch
Setting up a remote log server
Summary
Questions
Further reading
16
Vulnerability Scanning and Intrusion Detection
Vulnerability Scanning and Intrusion Detection
Introduction to Snort and Security Onion
IPFire and its built-in Intrusion Prevention System (IPS)
Scanning and hardening with Lynis
Finding vulnerabilities with OpenVAS
Web server scanning with Nikto
Summary
Questions
Further reading
17
Security Tips and Tricks for the Busy Bee
Security Tips and Tricks for the Busy Bee
Technical requirements
Auditing system services
Password protecting the GRUB 2 bootloader
Securely configuring BIOS/UEFI
Using a security checklist for system setup
Summary
Questions
Further reading
18
Assessments
Assessments
Chapter 1
Chapter 2
Chapter 3
Chapter 4
Chapter 5
Chapter 6
Chapter 7
Chapter 8
Chapter 9
Chapter 10
Chapter 11
Chapter 12
Chapter 13
Chapter 14
19
Other Books You May Enjoy
Other Books You May Enjoy
Leave a review – let other readers know what you think

Configuring more detailed logging

In its default configuration, SSH already creates log entries whenever someone logs in via SSH, SCP, or SFTP. On Debian/Ubuntu systems, the entry is made in the /var/log/auth.log file. On Red Hat/CentOS systems, the entry is made in the /var/log/secure file. Either way, the log entry looks something like this:

Oct  1 15:03:23 donnie-ca sshd[1141]: Accepted password for donnie from 192.168.0.225 port 54422 ssh2

Oct  1 15:03:24 donnie-ca sshd[1141]: pam_unix(sshd:session): session opened for user donnie by (uid=0)

Open the sshd_config man page and scroll down to the LogLevel item. There, you'll see the various settings that provide different levels of detail for logging SSH messages. The levels are as follows:

  • QUIET
  • FATAL
  • ERROR
  • INFO
  • VERBOSE
  • DEBUG or DEBUG1
  • DEBUG2
  • DEBUG3

Normally, the only two of these we would care about are INFO and VERBOSE...

Previous Section
End of Section 8
Next Section