Linux for Networking Professionals: Securely configure and operate Linux network services for the enterprise

Cover
Copyright
Contributors
Table of Contents
Preface
Section 1: Linux Basics
Chapter 1: Welcome to the Linux Family
	Why Linux is a good fit for a networking team
		Why is Linux important?
		The history of Linux
	Mainstream data center Linux
		Red Hat
		Oracle/Scientific Linux
		SUSE
		Ubuntu
		BSD/FreeBSD/OpenBSD
	Specialty Linux distributions
		Open source firewalls
		Kali Linux
		SIFT
		Security Onion
	Virtualization
		Linux and cloud computing
	Picking a Linux distribution for your organization
	Summary
	Further reading
Chapter 2: Basic Linux Network Configuration and Operations – Working with Local Interfaces
	Technical requirements
	Working with your network settings – two sets of commands
	Displaying interface IP information
		Displaying routing information
	IPv4 addresses and subnet masks
		Special-purpose addresses
		Private addresses – RFC 1918
	Assigning an IP address to an interface
		Adding a route
		Adding a route using legacy approaches
		Disabling and enabling an interface
		Setting the MTU on an interface
		More on the nmcli command
	Summary
	Questions
	Further reading
Section 2: Linux as a Network Node and Troubleshooting Platform
Chapter 3: Using Linux and Linux Tools for Network Diagnostics
	Technical requirements
	Network basics – the OSI model
	Layer 2 – relating IP and MAC addresses using ARP
		MAC address OUI values
	Layer 4 – how TCP and UDP ports work
		Layer 4 – TCP and the three-way handshake
	Local port enumeration – what am I connected to?  What am I listening for?
	Remote port enumeration using native tools
	Remote port and service enumeration – nmap
		NMAP scripts
		Are there limits to Nmap?
	Wireless diagnostic operations
	Summary
	Questions
	Further reading
Chapter 4: The Linux Firewall
	Technical requirements
	Configuring iptables
		iptables from a high level
		The NAT table
		The mangle table
		Order of operations in iptables
	Configuring nftables
		nftables basic configuration
		Using include files
	Summary
	Questions
	Further reading
Chapter 5: Linux Security Standards with Real-Life Examples
	Technical requirements
	Why do I need to secure my Linux hosts?
	Cloud-specific security considerations
	Commonly encountered industry-specific security standards
	The Center for Internet Security critical controls
		Getting a start on CIS critical security controls 1 and 2
		OSQuery – critical controls 1 and 2, adding in controls 10 and 17
	The Center for Internet Security benchmarks
		Applying a CIS benchmark – securing SSH on Linux
	SELinux and AppArmor
	Summary
	Questions
	Further reading
Section 3: Linux Network Services
Chapter 6: DNS Services on Linux
	Technical requirements
	What is DNS?
	Two main DNS server implementations
		An organization\'s \"internal\" DNS server (and a DNS overview)
		An internet-facing DNS server
	Common DNS implementations
		Basic installation: BIND for internal use
		BIND: Internet-facing implementation specifics
	DNS troubleshooting and reconnaissance
	DoH
	DoT
		knot-dnsutils
		Implementing DoT in Nmap
		DNSSEC
	Summary
	Questions
	Further reading
Chapter 7: DHCP Services on Linux
	How does DHCP work?
		Basic DHCP operation
		DHCP requests from other subnets (forwarders, relays, or helpers)
		DHCP options
	Securing your DHCP services
		Rogue DHCP server
		Rogue DHCP client
	Installing and configuring a DHCP server
		Basic configuration
		Static reservations
		Simple DHCP logging and troubleshooting in everyday use
	Summary
	Questions
	Further reading
Chapter 8: Certificate Services on Linux
	Technical requirements
	What are certificates?
	Acquiring a certificate
	Using a certificate – web server example
	Building a private Certificate Authority
		Building a CA with OpenSSL
		Requesting and signing a CSR
	Securing your Certificate Authority infrastructure
		Legacy tried-and-true advice
		Modern advice
		CA-specific risks in modern infrastructures
	Certificate Transparency
		Using Certificate Authority for inventory or reconnaissance
	Certificate automation and the ACME protocol
	OpenSSL cheat sheet
	Summary
	Questions
	Further reading
Chapter 9: RADIUS Services for Linux
	Technical requirements
	RADIUS basics – what is RADIUS and how does it work?
	Implementing RADIUS with local Linux authentication
	RADIUS with LDAP/LDAPS backend authentication
		NTLM authentication (AD) – introducing CHAP
	Unlang – the unlanguage
	RADIUS use-case scenarios
		VPN authentication using user ID and password
		Administrative access to network devices
		RADIUS configuration for EAP-TLS authentication
		Wireless network authentication using 802.1x/EAP-TLS
		Wired network authentication using 802.1x/EAP-TLS
	Using Google Authenticator for MFA with RADIUS
	Summary
	Questions
	Further reading
Chapter 10: Load Balancer Services for Linux
	Technical requirements
	Introduction to load balancing
		Round Robin DNS (RRDNS)
		Inbound proxy – Layer 7 load balancing
		Inbound NAT – Layer 4 load balancing
		DSR load balancing
	Load balancing algorithms
	Server and service health checks
	Data center load balancer design considerations
		Data center network and management considerations
	Building a HAProxy NAT/proxy load balancer
		Before you start configuring – NICs, addressing, and routing
		Before you start configuring – performance tuning
		Load balancing TCP services – web services
		Setting up persistent (sticky) connections
		Implementation note
		HTTPS frontending
	A final note on load balancer security
	Summary
	Questions
	Further reading
Chapter 11: Packet Capture and Analysis in Linux
	Technical requirements
	Introduction to packet capturing – the right places to look
		Capturing from either end
		Switching the monitoring port
		Intermediate in-line host
		Network tap
		Malicious packet capture approaches
	Performance considerations when capturing
	Capturing tools
		tcpdump
		Wireshark
		TShark
		Other PCAP tools
	Filtering captured traffic
		Wireshark capture filters (capturing your home network traffic)
		tcpdump capture filters – VoIP phones and DHCP
		More capture filters – LLDP and CDP
		Collecting files from a packet capture
	Troubleshooting an application – capturing a VoIP telephone call
		Wireshark display filters – separating specific data in a capture
	Summary
	Questions
	Further reading
Chapter 12: Network Monitoring Using Linux
	Technical requirements
	Logging using Syslog
		Log size, rotation, and databases
		Log analysis – finding \"the thing\"
		Alerts on specific events
		Syslog server example – Syslog
	The Dshield project
		Network device management using SNMP
		SNMP NMS deployment example – LibreNMS
		SNMPv3
	Collecting NetFlow data on Linux
		What is NetFlow and its \"cousins\" SFLOW, J-Flow, and IPFIX?
		Flow collection implementation concepts
		Configuring a router or switch for flow collection
		An example NetFlow server using NFDump and NFSen
	Summary
	Questions
	Further reading
		Commonly used SNMP OIDs
Chapter 13: Intrusion Prevention Systems on Linux
	Technical requirements
	What is an IPS?
	Architecture options – where does an IPS fit in your data center?
	IPS evasion techniques
		Detecting a WAF
		Fragmentation and other IPS evasion methods
	Classic/network-based IPS solutions – Snort and Suricata
	Suricata IPS example
	Constructing an IPS rule
	Passive traffic monitoring
		Passive monitoring with P0F – example
	Zeek example – collecting network metadata
	Summary
	Questions
	Further reading
Chapter 14: Honeypot Services on Linux
	Technical requirements
	Honeypot overview – what is a honeypot, and why do I want one?
	Deployment scenarios and architecture – where do I put a honeypot?
	Risks of deploying honeypots
	Example honeypots
		Basic port alerting honeypots – iptables, netcat, and portspoof
		Other common honeypots
	Distributed/community honeypot – the Internet Storm Center\'s DShield Honeypot Project
	Summary
	Questions
	Further reading
Assessments
	Chapter 2 – Basic Linux Network Configuration and Operations – Working with Local Interfaces
	Chapter 3 – Using Linux and Linux Tools for Network Diagnostics
	Chapter 4 – The Linux Firewall
	Chapter 5 – Linux Security Standards with Real-Life Examples
	Chapter 6 – DNS Services on Linux
	Chapter 7 – DHCP Services on Linux
	Chapter 8 – Certificate Services on Linux
	Chapter 9 – RADIUS Services for Linux
	Chapter 10 – Load Balancer Services for Linux
	Chapter 11 – Packet Capture and Analysis in Linux
	Chapter 12 – Network Monitoring Using Linux
	Chapter 13 – Intrusion Prevention Systems on Linux
	Chapter 14 – Honeypot Services on Linux
Other Books You May Enjoy
Index