Mastering Linux Security and Hardening

Copyright and Credits......Page 3
Packt Upsell......Page 4
Contributors......Page 5
Table of Contents......Page 7
Preface......Page 14
Chapter 1: Running Linux in a Virtual Environment......Page 19
 The threat landscape......Page 20
 Keeping up with security news......Page 21
 Introduction to VirtualBox and Cygwin......Page 22
  Installing a virtual machine in VirtualBox......Page 23
  The EPEL repository on the CentOS virtual machine......Page 27
  Configuring a network for VirtualBox virtual machines......Page 28
  Creating a virtual machine snapshot with VirtualBox......Page 29
  Installing Cygwin on your Windows host......Page 31
 Summary......Page 33
Chapter 2: Securing User Accounts......Page 34
 The dangers of logging in as the root user......Page 35
 The advantages of using sudo......Page 36
  Method 1 – adding users to a predefined admin group......Page 37
  Method 2 – creating an entry in the sudo policy file......Page 39
 Setting up sudo for users with only certain delegated privileges......Page 40
  Hands-on lab for assigning limited sudo privileges......Page 44
  The sudo timer......Page 46
   Hands-on lab for disabling the sudo timer......Page 47
  Preventing users from using shell escapes......Page 48
  Preventing users from using other dangerous programs......Page 49
  Limiting the user\'s actions with commands......Page 50
 Locking down users\' home directories the Red Hat or CentOS way......Page 51
 Locking down users\' home directories the Debian/Ubuntu way......Page 52
  useradd on Debian/Ubuntu......Page 53
  adduser on Debian/Ubuntu......Page 54
   Hands-on lab for configuring adduser......Page 55
 Enforcing strong password criteria......Page 56
  Installing and configuring pwquality......Page 58
   Hands-on lab for setting password complexity criteria......Page 61
 Setting and enforcing password and account expiration......Page 62
  Configuring default expiry data for useradd – for Red Hat or CentOS only......Page 63
  Setting expiry data on a per-account basis, with useradd and usermod......Page 65
  Setting expiry data on a per-account basis, with chage......Page 67
   Hands-on lab for setting account and password expiry data......Page 68
 Preventing brute-force password attacks......Page 69
  Configuring the pam_tally2 PAM module......Page 70
   Hands-on lab for configuring pam_tally2......Page 71
 Locking user accounts......Page 72
  Using usermod to lock a user account......Page 73
  Using passwd to lock user accounts......Page 74
  Locking the root user account......Page 75
  Using the motd file......Page 76
  Using the issue file......Page 77
 Summary......Page 78
Chapter 3: Securing Your Server with a Firewall......Page 79
  Basic usage of iptables......Page 80
   Hands-on lab for basic iptables usage......Page 86
  Basic usage of ufw......Page 88
   Hands-on lab for basic ufw usage......Page 89
 firewalld for Red Hat systems......Page 90
  Verifying the status of firewalld......Page 91
  firewalld zones......Page 92
  firewalld services......Page 96
  Adding ports to a firewalld zone......Page 100
  firewalld rich language rules......Page 101
   Hands-on lab for firewalld commands......Page 103
 nftables – a more universal type of firewall system......Page 104
  Getting started with nftables......Page 105
  Using nft commands......Page 108
   Hands-on lab for nftables on Ubuntu......Page 113
 Summary......Page 114
Chapter 4: Encrypting and SSH Hardening......Page 115
 GNU Privacy Guard......Page 116
  Creating your GPG keys......Page 117
  Symmetrically encrypting your own files......Page 119
   Hands-on lab – combining gpg and tar for encrypted backups......Page 122
  Using private and public keys for asymmetric encryption and signing......Page 123
  Signing a file without encryption......Page 128
 Encrypting partitions with Linux Unified Key Setup – LUKS......Page 129
  Disk encryption during operating system installation......Page 130
  Adding an encrypted partition with LUKS......Page 132
  Configuring the LUKS partition to mount automatically......Page 137
  Home directory and disk encryption during Ubuntu installation......Page 139
  Encrypting a home directory for a new user account......Page 141
  Creating a private directory within an existing home directory......Page 142
  Encrypting other directories with eCryptfs......Page 144
  Encrypting the swap partition with eCryptfs......Page 146
  Getting and installing VeraCrypt......Page 147
  Creating and mounting a VeraCrypt volume in console mode......Page 148
  Using VeraCrypt in GUI mode......Page 151
 Ensuring that SSH protocol 1 is disabled......Page 152
 Creating and managing keys for password-less logins......Page 153
  Creating a user\'s SSH key set......Page 154
  Transferring the public key to the remote server......Page 155
 Disabling root user login......Page 156
 Disabling username/password logins......Page 157
  Creating a group and configuring the sshd_config file......Page 158
   Hands-on lab – setting up a chroot directory for sftpusers group......Page 160
 Summary......Page 161
Chapter 5: Mastering Discretionary Access Control......Page 162
 Using chown to change ownership of files and directories......Page 163
 Using chmod to set permissions values on files and directories......Page 165
  Setting permissions with the numerical method......Page 166
 Using SUID and SGID on regular files......Page 168
 The security implications of the SUID and SGID permissions......Page 169
  Finding spurious SUID or SGID files......Page 170
   Hands-on lab – searching for SUID and SGID files......Page 171
  Preventing SUID and SGID usage on a partition......Page 172
 Using extended file attributes to protect sensitive files......Page 173
  Setting the a attribute......Page 174
  Setting the i attribute......Page 175
   Hands-on lab – setting security-related extended file attributes......Page 176
 Summary......Page 177
Chapter 6: Access Control Lists and Shared Directory Management......Page 178
 Creating an access control list for either a user or a group......Page 179
 Creating an inherited access control list for a directory......Page 182
 Removing a specific permission by using an ACL mask......Page 183
 Using the tar --acls option to prevent the loss of ACLs during a backup......Page 185
 Creating a user group and adding members to it......Page 187
  Using usermod to add an existing user to a group......Page 188
  Adding users to a group by editing the /etc/group file......Page 189
 Creating a shared directory......Page 190
 Setting the SGID bit and the sticky bit on the shared directory......Page 191
  Setting the permissions and creating the ACL......Page 194
  Charlie tries to access Vicky\'s file with an ACL set for Cleopatra......Page 195
   Hands-on lab – creating a shared group directory......Page 196
 Summary......Page 197
Chapter 7: Implementing Mandatory Access Control with SELinux and AppArmor......Page 198
 How SELinux can benefit a systems administrator......Page 199
 Setting security contexts for files and directories......Page 200
  Creating web content files with SELinux enabled......Page 202
   Using chcon......Page 206
   Using restorecon......Page 207
   Using semanage......Page 208
   Hands-on lab – SELinux type enforcement......Page 210
 Troubleshooting with setroubleshoot......Page 211
  Viewing setroubleshoot messages......Page 212
  Using the graphical setroubleshoot utility......Page 213
  Troubleshooting in permissive mode......Page 215
  Viewing the Booleans......Page 218
  Configuring the Booleans......Page 220
  Protecting your web server......Page 221
  Protecting network ports......Page 222
  Creating custom policy modules......Page 225
   Hands-on lab – SELinux Booleans and ports......Page 228
 How AppArmor can benefit a systems administrator......Page 229
 Looking at AppArmor profiles......Page 230
 Working with AppArmor command-line utilities......Page 233
 Troubleshooting AppArmor problems......Page 236
 Summary......Page 240
Chapter 8: Scanning, Auditing, and Hardening......Page 241
 Installing and updating ClamAV and maldet......Page 242
  Installing ClamAV and maldet......Page 243
  Configuring maldet......Page 244
  Updating ClamAV and maldet......Page 245
 Scanning with ClamAV and maldet......Page 248
 Scanning for rootkits with Rootkit Hunter......Page 249
  Installing and updating Rootkit Hunter......Page 250
  Scanning for rootkits......Page 251
 Controlling the auditd daemon......Page 252
  Auditing a file for changes......Page 253
  Auditing a directory......Page 255
  Auditing system calls......Page 256
 Using ausearch and aureport......Page 257
  Searching for file change alerts......Page 258
  Searching for directory access rule violations......Page 260
  Searching for system call rule violations......Page 265
  Generating authentication reports......Page 268
  Using predefined rules sets......Page 269
  Installing OpenSCAP......Page 271
  Viewing the profile files......Page 272
  Scanning the system......Page 273
  Remediating the system......Page 275
 Using SCAP Workbench......Page 277
 More about OpenSCAP profiles......Page 280
 Applying an OpenSCAP profile during system installation......Page 282
 Summary......Page 284
Chapter 9: Vulnerability Scanning and Intrusion Detection......Page 285
  Obtaining and installing Snort......Page 286
  Graphical interfaces for Snort......Page 289
  Getting Snort in prebuilt appliances......Page 290
  Using Security Onion......Page 294
  Installing Lynis on Red Hat/CentOS......Page 301
  Scanning with Lynis......Page 302
 Finding vulnerabilities with OpenVAS......Page 307
  Nikto in Kali Linux......Page 319
  Installing and updating Nikto on Linux......Page 320
  Scanning a web server with Nikto......Page 321
 Summary......Page 323
 Auditing system services......Page 324
  Auditing system services with systemctl......Page 325
  Auditing network services with netstat......Page 326
  Auditing network services with Nmap......Page 333
   Port states......Page 335
   Scan types......Page 336
 Password-protecting the GRUB 2 bootloader......Page 340
  Resetting the password for Red Hat/CentOS......Page 342
  Resetting the password for Ubuntu......Page 344
  Preventing kernel parameter edits on Red Hat/CentOS......Page 345
  Preventing kernel parameter edits on Ubuntu......Page 346
   Disabling the submenu for Ubuntu......Page 349
   Password-protecting boot option steps for both Ubuntu and Red Hat......Page 350
 Securely configuring BIOS/UEFI......Page 354
 Using a security checklist for system setup......Page 357
 Summary......Page 359
Other Books You May Enjoy......Page 360
 Leave a review – let other readers know what you think......Page 362
Index......Page 363