Book Image

Mastering Linux Security and Hardening

By : Donald A. Tevault
Book Image

Mastering Linux Security and Hardening

By: Donald A. Tevault

Overview of this book

This book has extensive coverage of techniques that will help prevent attackers from breaching your system, by building a much more secure Linux environment. You will learn various security techniques such as SSH hardening, network service detection, setting up firewalls, encrypting file systems, protecting user accounts, authentication processes, and so on. Moving forward, you will also develop hands-on skills with advanced Linux permissions, access control, special modes, and more. Lastly, this book will also cover best practices and troubleshooting techniques to get your work done efficiently. By the end of this book, you will be confident in delivering a system that will be much harder to compromise.

Related Content you might be interested in

Current Title:

Small book image
Mastering Linux Security and Hardening
Donald A. Tevault
Jan, 2018 | 376 pages
Small book image
Practical Linux Security Cookbook
Tajinder Kalsi
Aug, 2018 | 482 pages
Small book image
Linux Service Management Made Easy with systemd
Donald A Tevault
Feb, 2022 | 420 pages
Small book image
Linux Administration Cookbook
Adam K Dean
Dec, 2018 | 826 pages
Table of Contents (15 chapters)
Title Page
Title Page
Packt Upsell
Packt Upsell
Contributors
Contributors
Preface
Preface
Free Chapter
1
Running Linux in a Virtual Environment
Running Linux in a Virtual Environment
The threat landscape
Keeping up with security news
Introduction to VirtualBox and Cygwin
Using Cygwin to connect to your virtual machines
Summary
2
Securing User Accounts
Securing User Accounts
The dangers of logging in as the root user
The advantages of using sudo
Setting up sudo privileges for full administrative users
Setting up sudo for users with only certain delegated privileges
Advanced tips and tricks for using sudo
Locking down users' home directories the Red Hat or CentOS way
Locking down users' home directories the Debian/Ubuntu way
Enforcing strong password criteria
Setting and enforcing password and account expiration
Preventing brute-force password attacks
Locking user accounts
Setting up security banners
Summary
3
Securing Your Server with a Firewall
Securing Your Server with a Firewall
An overview of iptables
Uncomplicated Firewall for Ubuntu systems
firewalld for Red Hat systems
nftables – a more universal type of firewall system
Summary
4
Encrypting and SSH Hardening
Encrypting and SSH Hardening
GNU Privacy Guard
Encrypting partitions with Linux Unified Key Setup – LUKS
Encrypting directories with eCryptfs
Using VeraCrypt for cross-platform sharing of encrypted containers
Ensuring that SSH protocol 1 is disabled
Creating and managing keys for password-less logins
Disabling root user login
Disabling username/password logins
Setting up a chroot environment for SFTP users
Summary
5
Mastering Discretionary Access Control
Mastering Discretionary Access Control
Using chown to change ownership of files and directories
Using chmod to set permissions values on files and directories
Using SUID and SGID on regular files
The security implications of the SUID and SGID permissions
Using extended file attributes to protect sensitive files
Summary
6
Access Control Lists and Shared Directory Management
Access Control Lists and Shared Directory Management
Creating an access control list for either a user or a group
Creating an inherited access control list for a directory
Removing a specific permission by using an ACL mask
Using the tar --acls option to prevent the loss of ACLs during a backup
Creating a user group and adding members to it
Creating a shared directory
Setting the SGID bit and the sticky bit on the shared directory
Using ACLs to access files in the shared directory
Summary
7
Implementing Mandatory Access Control with SELinux and AppArmor
Implementing Mandatory Access Control with SELinux and AppArmor
How SELinux can benefit a systems administrator
Setting security contexts for files and directories
Troubleshooting with setroubleshoot
Working with SELinux policies
How AppArmor can benefit a systems administrator
Looking at AppArmor profiles
Working with AppArmor command-line utilities
Troubleshooting AppArmor problems
Summary
8
Scanning, Auditing, and Hardening
Scanning, Auditing, and Hardening
Installing and updating ClamAV and maldet
Scanning with ClamAV and maldet
SELinux considerations
Scanning for rootkits with Rootkit Hunter
Controlling the auditd daemon
Creating audit rules
Using ausearch and aureport
Applying OpenSCAP policies with oscap
Using SCAP Workbench
More about OpenSCAP profiles
Applying an OpenSCAP profile during system installation
Summary
9
Vulnerability Scanning and Intrusion Detection
Vulnerability Scanning and Intrusion Detection
Looking at Snort and Security Onion
Scanning and hardening with Lynis
Finding vulnerabilities with OpenVAS
Web server scanning with Nikto
Summary
10
Security Tips and Tricks for the Busy Bee
Security Tips and Tricks for the Busy Bee
Auditing system services
Password-protecting the GRUB 2 bootloader
Securely configuring BIOS/UEFI
Using a security checklist for system setup
Summary
Other Books You May Enjoy
Other Books You May Enjoy
Leave a review – let other readers know what you think

Chapter 7. Implementing Mandatory Access Control with SELinux and AppArmor

As we saw in the previous chapters, Discretionary Access Control allows users to control who can access their own files and directories. But, what if your company needs to have more administrative control over who accesses what? For this, we need some sort of Mandatory Access Control or MAC.

The best way I know to explain the difference between DAC and MAC is to hearken back to my Navy days.  I was riding submarines at the time, and I had to have a Top Secret clearance to do my job. With DAC, I had the physical ability to take one of my Top Secret books to the mess decks, and hand it to a cook who didn't have that level of clearance. With MAC, there were rules that prevented me from doing so. On operating systems, things work pretty much the same way. 

There are several different MAC systems that are available for Linux. The two that we'll cover in this chapter are SELinux and AppArmor.

In this chapter, we'll cover the...

Previous Section
End of Section 1
Next Section