Mastering Linux Security and Hardening, Second Edition by Donald A. Tevault -- Read -- Imperial Library of Trantor

Index

Title Page Copyright and Credits

Mastering Linux Security and Hardening Second Edition

About Packt

Why subscribe?

Contributors

About the author About the reviewers Packt is searching for authors like you

Preface

Who this book is for What this book covers To get the most out of this book

Download the example code files Download the color images Conventions used

Get in touch

Reviews

Section 1: Setting up a Secure Linux System Running Linux in a Virtual Environment

Looking at the threat landscape Why do security breaches happen? Keeping up with security news Differences between physical, virtual, and cloud setups Introducing VirtualBox and Cygwin

Installing a virtual machine in VirtualBox Installing the EPEL repository on the CentOS 7 virtual machine Installing the EPEL repository on the CentOS 8 virtual machine Configuring a network for VirtualBox virtual machines Creating a virtual machine snapshot with VirtualBox Using Cygwin to connect to your virtual machines

Installing Cygwin on your Windows host

Using Windows 10 Pro Bash shell to interface with Linux virtual machines

Cygwin versus Windows Bash shell

Keeping the Linux systems updated

Updating Debian-based systems

Configuring auto updates for Ubuntu

Updating Red Hat 7-based systems Updating Red Hat 8-based systems Managing updates in an enterprise

Summary Questions Further reading

Securing User Accounts

The dangers of logging in as the root user The advantages of using sudo Setting up sudo privileges for full administrative users

Adding users to a predefined admin group Creating an entry in the sudo policy file

Setting up sudo for users with only certain delegated privileges

Hands-on lab for assigning limited sudo privileges

Advanced tips and tricks for using sudo

The sudo timer View your sudo privileges

Hands-on lab for disabling the sudo timer

Preventing users from having root shell access Preventing users from using shell escapes Preventing users from using other dangerous programs Limiting the user's actions with commands Letting users run as other users Preventing abuse via user's shell scripts Detecting and deleting default user accounts

Locking down users' home directories the Red Hat or CentOS way Locking down users' home directories the Debian/Ubuntu way

useradd on Debian/Ubuntu adduser on Debian/Ubuntu

Hands-on lab for configuring adduser

Enforcing strong password criteria

Installing and configuring pwquality

Hands-on lab for setting password complexity criteria

Setting and enforcing password and account expiration Configuring default expiry data for useradd for Red Hat or CentOS only Setting expiry data on a per-account basis with useradd and usermod Setting expiry data on a per-account basis with chage

Hands-on lab for setting account and password expiry data

Preventing brute-force password attacks

Configuring the pam_tally2 PAM

Hands-on lab for configuring pam_tally2

Locking user accounts

Using usermod to lock a user account Using passwd to lock user accounts

Locking the root user account Setting up security banners

Using the motd file Using the issue file Using the issue.net file

Detecting compromised passwords

Hands-on lab for detecting compromised passwords

Understanding centralized user management

Microsoft Active Directory Samba on Linux FreeIPA/Identity Management on RHEL/CentOS

Summary Questions Further reading

Securing Your Server with a Firewall - Part 1

Technical requirements An overview of firewalld An overview of iptables

Mastering the basics of iptables Blocking ICMP with iptables Blocking everything that isn't allowed with iptables Hands-on lab for basic iptables usage Blocking invalid packets with iptables

Restoring the deleted rules Hands-on lab for blocking invalid IPv4 packets

Protecting IPv6

Hands-on lab for ip6tables

Uncomplicated firewall for Ubuntu systems

Configuring ufw Working with the ufw configuration files

Hands-on lab for basic ufw usage

Summary Questions Further reading

Securing Your Server with a Firewall - Part 2

Technical requirements nftables – a more universal type of firewall system

Learning about nftables tables and chains Getting started with nftables

Configuring nftables on Ubuntu 16.04 Configuring nftables on Ubuntu 18.04

Using nft commands Hands-on lab for nftables on Ubuntu

firewalld for Red Hat systems

Verifying the status of firewalld Working with firewalld zones Adding services to a firewalld zone Adding ports to a firewalld zone Blocking ICMP Using panic mode Logging dropped packets Using firewalld rich language rules Looking at iptables rules in RHEL/CentOS 7 firewalld Creating direct rules in RHEL/CentOS 7 firewalld Looking at nftables rules in RHEL/CentOS 8 firewalld Creating direct rules in RHEL/CentOS 8 firewalld Hands-on lab for firewalld commands

Summary Questions Further reading

Encryption Technologies

GNU Privacy Guard (GPG)

Hands-on lab – creating your GPG keys Hands-on lab – symmetrically encrypting your own files Hands-on lab – encrypting files with public keys Hands-on lab – signing a file without encryption

Encrypting partitions with Linux Unified Key Setup (LUKS)

Disk encryption during operating system installation Hands-on lab – adding an encrypted partition with LUKS Configuring the LUKS partition to mount automatically

Hands-on lab – configuring the LUKS partition to mount automatically

Encrypting directories with eCryptfs

Home directory and disk encryption during Ubuntu installation Hands-on lab – encrypting a home directory for a new user account Creating a private directory within an existing home directory Hands-on lab – encrypting other directories with eCryptfs Encrypting the swap partition with eCryptfs

Using VeraCrypt for cross-platform sharing of encrypted containers

Hands-on lab – getting and installing VeraCrypt Hands-on lab – creating and mounting a VeraCrypt volume in console mode Using VeraCrypt in GUI mode

OpenSSL and the public key infrastructure

Commercial certificate authorities Creating keys, certificate signing requests, and certificates

Creating a self-signed certificate with an RSA key Creating a self-signed certificate with an Elliptic Curve key Creating an RSA key and a Certificate Signing Request Creating an EC key and a CSR

Creating an on-premises CA

Hands-on lab – setting up a Dogtag CA

Adding a CA to an operating system

Hands-on lab – exporting and importing the Dogtag CA certificate Importing the CA into Windows

OpenSSL and the Apache web server

Hardening Apache SSL/TLS on Ubuntu Hardening Apache SSL/TLS on RHEL 8/CentOS 8 Hardening Apache SSL/TLS on RHEL 7/CentOS 7

Setting up mutual authentication

Summary Questions Further reading

SSH Hardening

Ensuring that SSH protocol 1 is disabled Creating and managing keys for passwordless logins

Creating a user's SSH key set Transferring the public key to the remote server

Hands-on lab – creating and transferring SSH keys

Disabling root user login Disabling username/password logins

Hands-on lab – disabling root login and password authentication

Configuring Secure Shell with strong encryption algorithms

Understanding SSH encryption algorithms Scanning for enabled SSH algorithms

Hands-on lab – installing and using ssh_scan

Disabling weak SSH encryption algorithms

Hands-on lab – disabling weak SSH encryption algorithms – Ubuntu 18.04 Hands-on lab – disabling weak SSH encryption algorithms – CentOS 7

Setting system-wide encryption policies on RHEL 8/CentOS 8

Hands-on lab – setting encryption policies on CentOS 8

Configuring more detailed logging

Hands-on lab – configuring more verbose SSH logging

Configuring access control with whitelists and TCP Wrappers

Configuring whitelists within sshd_config

Hands-on lab – configuring whitelists within sshd_config

Configuring whitelists with TCP Wrappers

Configuring automatic logouts and security banners

Configuring automatic logout for both local and remote users Configuring automatic logout in sshd_config Creating a pre-login security banner

Configuring other miscellaneous security settings

Disabling X11 forwarding Disabling SSH tunneling Changing the default SSH port Managing SSH keys Setting different configurations for different users and groups Creating different configurations for different hosts

Setting up a chroot environment for SFTP users

Creating a group and configuring the sshd_config file

Hands-on lab – setting up a chroot directory for the sftpusers group

Sharing a directory with SSHFS

Hands-on lab – sharing a directory with SSHFS

Remotely connecting from Windows desktops Summary Questions Further reading

Section 2: Mastering File and Directory Access Control (DAC) Mastering Discretionary Access Control

Using chown to change ownership of files and directories Using chmod to set permissions on files and directories

Setting permissions with the symbolic method Setting permissions with the numerical method

Using SUID and SGID on regular files The security implications of the SUID and SGID permissions

Finding spurious SUID or SGID files

Hands-on lab – searching for SUID and SGID files

Preventing SUID and SGID usage on a partition

Using extended file attributes to protect sensitive files

Setting the a attribute Setting the i attribute

Hands-on lab – setting security-related extended file attributes

Securing system configuration files Summary Questions Further reading

Access Control Lists and Shared Directory Management

Creating an ACL for either a user or a group Creating an inherited ACL for a directory Removing a specific permission by using an ACL mask Using the tar --acls option to prevent the loss of ACLs during a backup Creating a user group and adding members to it

Adding members as we create their user accounts Using usermod to add an existing user to a group Adding users to a group by editing the /etc/group file

Creating a shared directory Setting the SGID bit and the sticky bit on the shared directory Using ACLs to access files in the shared directory

Setting the permissions and creating the ACL

Hands-on lab – creating a shared group directory

Summary Questions Further reading

Section 3: Advanced System Hardening Techniques Implementing Mandatory Access Control with SELinux and AppArmor

How SELinux can benefit a systems administrator Setting security contexts for files and directories

Installing the SELinux tools Creating web content files with SELinux enabled Fixing an incorrect SELinux context

Using chcon Using restorecon Using semanage Hands-on lab – SELinux type enforcement

Troubleshooting with setroubleshoot

Viewing setroubleshoot messages Using the graphical setroubleshoot utility Troubleshooting in permissive mode

Working with SELinux policies

Viewing Booleans Configuring the Booleans Protecting your web server Protecting network ports Creating custom policy modules

Hands-on lab – SELinux Booleans and ports

How AppArmor can benefit a systems administrator Looking at AppArmor profiles Working with AppArmor command-line utilities Troubleshooting AppArmor problems

Troubleshooting an AppArmor profile – Ubuntu 16.04 Troubleshooting an AppArmor profile – Ubuntu 18.04

Hands-on lab – Troubleshooting an AppArmor profile

Exploiting a system with an evil Docker container

Hands-on lab – Creating an evil Docker container

Summary Questions Further reading

Kernel Hardening and Process Isolation

Understanding the /proc filesystem

Looking at user-mode processes Looking at kernel information

Setting kernel parameters with sysctl Configuring the sysctl.conf file

Configuring sysctl.conf – Ubuntu Configuring sysctl.conf – CentOS Setting additional kernel-hardening parameters

Hands-on lab – scanning kernel parameters with Lynis

Preventing users from seeing each others' processes

Understanding process isolation

Understanding Control Groups (cgroups) Understanding namespace isolation Understanding kernel capabilities

Hands-on lab – setting a kernel capability

Understanding SECCOMP and system calls Using process isolation with Docker containers Sandboxing with Firejail

Hands-on lab – using Firejail

Sandboxing with Snappy Sandboxing with Flatpak

Summary Questions Answers Further reading

Scanning, Auditing, and Hardening

Technical requirements Installing and updating ClamAV and maldet

Hands-on lab – installing ClamAV and maldet Hands-on lab – configuring maldet Updating ClamAV and maldet

Scanning with ClamAV and maldet

SELinux considerations

Scanning for rootkits with Rootkit Hunter

Hands-on lab – installing and updating Rootkit Hunter Scanning for rootkits

Performing a quick malware analysis with strings and VirusTotal

Analyze a file with strings Scanning the malware with VirusTotal

Understanding the auditd daemon

Creating audit rules Auditing a file for changes Auditing a directory Auditing system calls

Using ausearch and aureport

Searching for file change alerts Searching for directory access rule violations Searching for system call rule violations Generating authentication reports Using predefined rulesets Hands-on lab – using auditd

Applying OpenSCAP policies with oscap

Installing OpenSCAP Viewing the profile files Getting the missing profiles for Ubuntu 18.04 and CentOS 8 Scanning the system Remediating the system Using SCAP Workbench Using the OpenSCAP daemon on Ubuntu 18.04 Choosing an OpenSCAP profile Applying an OpenSCAP profile during system installation

Summary Questions Further reading

Logging and Log Security

Understanding the Linux system log files

The system log and the authentication log The utmp, wtmp, btmp, and lastlog files

Understanding rsyslog

Understanding rsyslog logging rules

Understanding journald Making things easier with Logwatch

Hands-on lab – installing Logwatch

Setting up a remote log server

Hands-on lab – setting up a basic log server Creating an encrypted connection to the log server

Creating a stunnel connection on CentOS 8 – server side Creating an stunnel connection on CentOS 8 – client side Creating a stunnel connection on Ubuntu – server side Creating a stunnel connection on Ubuntu – client side

Separating client messages into their own files

Summary Questions Further reading

Vulnerability Scanning and Intrusion Detection

Introduction to Snort and Security Onion

Obtaining and installing Snort

Hands-on lab – installing Snort on CentOS 7

Graphical interfaces for Snort Using Security Onion

Hands-on lab – installing Security Onion

IPFire and its built-in Intrusion Prevention System (IPS)

Hands-on lab – creating an IPFire virtual machine

Scanning and hardening with Lynis

Installing Lynis on Red Hat/CentOS Installing Lynis on Ubuntu Scanning with Lynis

Finding vulnerabilities with OpenVAS Web server scanning with Nikto

Nikto in Kali Linux Installing and updating Nikto on Linux Scanning a web server with Nikto

Summary Questions Further reading

Security Tips and Tricks for the Busy Bee

Technical requirements Auditing system services

Auditing system services with systemctl Auditing network services with netstat

Hands-on lab – viewing network services with netstat

Auditing network services with Nmap

Port states Scan types Hands-on lab – scanning with Nmap

Password protecting the GRUB 2 bootloader

Hands-on lab – resetting the password for Red Hat/CentOS Hands-on lab – resetting the password for Ubuntu Preventing kernel parameter edits on Red Hat/CentOS Preventing kernel parameter edits on Ubuntu Password protecting boot options

Disabling the submenu for Ubuntu Password protecting boot option steps for both Ubuntu and Red Hat

Securely configuring BIOS/UEFI Using a security checklist for system setup Summary Questions Further reading

Assessments

Chapter 1 Chapter 2 Chapter 3 Chapter 4 Chapter 5 Chapter 6 Chapter 7 Chapter 8 Chapter 9 Chapter 10 Chapter 11 Chapter 12 Chapter 13 Chapter 14

Other Books You May Enjoy

Leave a review – let other readers know what you think

← Prev
Back
Next →

← Prev
Back
Next →