Book Image

Practical Linux Security Cookbook - Second Edition

By : Tajinder Kalsi
Book Image

Practical Linux Security Cookbook - Second Edition

By: Tajinder Kalsi

Overview of this book

Over the last few years, system security has gained a lot of momentum and software professionals are focusing heavily on it. Linux is often treated as a highly secure operating system. However, the reality is that Linux has its share of security ?aws, and these security ?aws allow attackers to get into your system and modify or even destroy your important data. But there’s no need to panic, since there are various mechanisms by which these ?aws can be removed, and this book will help you learn about different types of Linux security to create a more secure Linux system. With a step-by-step recipe approach, the book starts by introducing you to various threats to Linux systems. Then, this book will walk you through customizing the Linux kernel and securing local files. Next, you will move on to managing user authentication both locally and remotely and mitigating network attacks. Later, you will learn about application security and kernel vulnerabilities. You will also learn about patching Bash vulnerability, packet filtering, handling incidents, and monitoring system logs. Finally, you will learn about auditing using system services and performing vulnerability scanning on Linux. By the end of this book, you will be able to secure your Linux systems and create a robust environment.
Table of Contents (20 chapters)
Title Page
Copyright and Credits
Contributors
Packt Upsell
Preface
Index

Security policy – server security


A major reason for malicious attacks on Linux servers has been poorly implemented security or existing vulnerabilities. When configuring a server, the security policies need to be implemented properly and ownership needs to be taken for proper customization of the server.

 

How to do it…

Let's have a look and various security policies

General policy

Let's discuss the various security policies:

  1. The administration of all the internal servers in an organization is the responsibility of a dedicated team that should also keep watch for any kind of compliance issues. If a compliance issues occurs, the team should immediately review and implement an updated security policy.
  2. When configuring internal servers, they must be registered in such a way that the identification of the servers can be done on the basis of the following information:
    • Location of the server
    • Operating system version and hardware configuration
    • Services and applications running on the server
  3. Any kind of information in the organization's management system must always be kept up to date.

Configuration policy

Let's discuss the various security policies:

  1. The operating system on the server should be configured in accordance with the guidelines approved for InfoSec.
  2. Any service or application not being used should be disabled, wherever possible.
  3. Every access to the services and applications on the server should be monitored and logged. It should also be protected through access-control methods. An example of this will be covered in Chapter 3, Local FileSystem Security.
  4. The system should be kept updated and any recent security patches, if available, should be installed as soon as possible
  5. Avoid using the root account as much as possible. It is better to use security principles that require least access to perform a function.
  6. Any kind of privileged access must be performed over a secure channel connection (SSH), wherever possible.
  7. Access to the server should be in a controlled environment.

 

Monitoring policy

Let's discuss the various security policies:

  1. All security-related actions on server systems must be logged and audit reports should be saved as follows:
    • For a period of one month, all the security-related logs should be kept online
    • For a period of one month, the daily backups, as well as the weekly backups, should be retained
    • For a minimum of two years, the monthly full backups should be retained
  2. Any event related to security being compromised should be reported to the InfoSec team. They shall then review the logs and report the incident to the IT department.
  3. Some examples of security related events are as follows:
    • Port-scanning-related attacks
    • Access to privileged accounts without authorization
    • Unusual occurrences due to a particular application on the host

How it works…

Following the policies as given here helps the base configuration of the internal server that is owned or operated by the organization. Implementing the policy effectively will minimize unauthorized access to any sensitive and proprietary information.