Mastering Linux Security And - DocDroid

Table of ContentsUsing SCAP WorkbenchMore about OpenSCAP profilesApplying an OpenSCAP profile during system installationSummaryChapter 9: Vulnerability Scanning and Intrusion DetectionLooking at Snort and Security OnionObtaining and installing SnortGraphical interfaces for SnortGetting Snort in prebuilt appliancesUsing Security OnionScanning and hardening with LynisInstalling Lynis on Red Hat/CentOSInstalling Lynis on UbuntuScanning with LynisFinding vulnerabilities with OpenVASWeb server scanning with NiktoNikto in Kali LinuxInstalling and updating Nikto on LinuxScanning a web server with NiktoSummaryChapter 10: Security Tips and Tricks for the Busy BeeAuditing system servicesAuditing system services with systemctlAuditing network services with netstatAuditing network services with NmapPort statesScan typesPassword-protecting the GRUB 2 bootloaderResetting the password for Red Hat/CentOSResetting the password for UbuntuPreventing kernel parameter edits on Red Hat/CentOSPreventing kernel parameter edits on UbuntuPassword-protecting boot optionsDisabling the submenu for UbuntuPassword-protecting boot option steps for both Ubuntu and Red HatSecurely configuring BIOS/UEFIUsing a security checklist for system setupSummary[ vi 336337341344346

Table of ContentsAppendix A: Other Books You May EnjoyLeave a review – let other readers know what you thinkIndex347349350[ vii ]

PrefaceIn this book, we'll cover security and hardening techniques that apply to any Linux-basedserver or workstation. Our goal is to make it harder for the bad guys to do nasty things toyour systems.Who this book is forWe're aiming this book at Linux administrators in general, whether or not they specialize inLinux security. The techniques that we present can be used on either Linux servers or onLinux workstations.We assume that our target audience has had some hands-on experience with the Linuxcommand line, and has the basic knowledge of Linux Essentials.What this book coversChapter 1, Running Linux in a Virtual Environment, gives an overview of the IT securitylandscape, and will inform the reader of why learning Linux security would be a goodcareer move. We'll also cover how to set up a lab environment for performing hands-onexercises. We'll also show how to set up a virtualized lab environment for performing thehands-on labs.Chapter 2, Securing User Accounts, covers the dangers of always using the root useraccount, and will introduce the benefits of using sudo, instead. We'll then cover how to lockdown normal user accounts, and ensure that the users use good-quality passwords.Chapter 3, Securing Your Server with a Firewall, involves working with the various types offirewall utilities.Chapter 4, Encrypting and SSH Hardening, makes sure that important information—both atrest and in transit—are safeguarded with proper encryption. For data-in-transit, the defaultSecure Shell configuration is anything but secure, and could lead to a security breach if leftas is. This chapter shows how to fix that.

PrefaceChapter 5, Mastering Discretionary Access Control, covers how to set ownership andpermissions on files and directories. We'll also cover what SUID and SGID can do for us,and the security implications of using them. We'll wrap things up by covering ExtendedFile Attributes.Chapter 6, Access Control Lists and Shared Directory Management, explains that normal Linuxfile and directory permissions settings aren't very granular. With Access Control Lists, wecan allow only a certain person to access a file, or we can allow multiple people to access afile with different permissions for each person. We're also going to put what we've learnedtogether in order to manage a shared directory for a group.Chapter 7, Implementing Mandatory Access Control with SELinux and AppArmor, talks aboutSELinux, which is a Mandatory Access Control technology that is included with Red Hattype Linux distros. We'll give a brief introduction here about how to use SELinux to preventintruders from compromising a system. AppArmor is another Mandatory Access Controltechnology that is included with Ubuntu and Suse-type Linux distros. We'll give a briefintroduction here about how to use AppArmor to prevent intruders from compromising asystem.Chapter 8, Scanning, Auditing, and Hardening, discusses that viruses aren't yet a hugeproblem for Linux users, but they are for Windows users. If your organization hasWindows clients that access Linux fileservers, then this chapter is for you. You can useauditd to audit, which accesses either files, directories, or system calls. It won't preventsecurity breaches, but it will let you know if some unauthorized person is trying to access asensitive resource. SCAP, the Security Content Application Protocol, is a complianceframework that's promulgated by the National Institute of Standards and Technology.OpenSCAP, the open source implementation, can be used to apply a hardening policy to aLinux computer.Chapter 9, Vulnerability Scanning and Intrusion Detection, explains how to scan our systemsto see if we've missed anything since we've already learned how to configure our systemsfor best security. We'll also take a quick look at an intrusion detection system.Chapter 10, Security Tips and Tricks for the Busy Bee, explains that since you're dealing withsecurity, we know that you're a busy bee. So, the chapter introduces you to some quick tipsand tricks to help make the job easier.[2]

PrefaceTo get the most out of this bookTo get the most out of this book, you don't need much. However, the following thingswould be quite helpful:1. A working knowledge of basic Linux commands, and of how to navigate throughthe Linux filesystem.2. A basic knowledge about tools such as less and grep.3. Familiarity with command-line editing tools, such as vim or nano.4. A basic knowledge of how to control systemd services with systemctl commands.For hardware, you don't need anything fancy. All you need is a machine that's capable ofrunning 64-bit virtual machines. So, you can use any host machine that runs with almostany modern CPU from either Intel or AMD. (The exception to this rule is with Intel Core i3and Core i5 CPUs. Even though they're 64-bit CPUs, they lack the hardware accelerationthat's needed to run 64-bit virtual machines. Ironically, Intel Core 2 CPUs and AMDOpteron CPUs that are much older work just fine.) For memory, I'd recommend at least 8Gigabytes.You can run any of the three major operating systems on your host machine, because thevirtualization software that we'll be using comes in flavors for Windows, MacOS, andLinux.Download the color imagesWe also provide a PDF file that has color images of the screenshots/diagrams used in thisbook. You can download it here: http:/ / www. packtpub. com/ sites/ default/ files/downloads/ MasteringLinuxSecurityandHardening ColorImages. pdf.Conventions usedThere are a number of text conventions used throughout this book.CodeInText: Indicates code words in text, database table names, folder names, filenames,file extensions, pathnames, dummy URLs, user input, and Twitter handles. Here is anexample: "let's use getfacl to see if we have any Access Control Lists already set on theacl demo.txt file."[3]

PrefaceA block of code is set as follows:[base]name CentOS- releasever - Basemirrorlist http://mirrorlist.centos.org/?release releasever&arch basearch&repo os&infra infra#baseurl http://mirror.centos.org/centos/ releasever/os/ basearch/gpgcheck 1gpgkey ty 1Any command-line input or output is written as follows:[donnie@localhost ] tar cJvf new perm dir backup.tar.xz new perm dir/ -aclsnew perm dir/new perm dir/new file.txt[donnie@localhost ] Bold: Indicates a new term, an important word, or words that you see onscreen. Forexample, words in menus or dialog boxes appear in the text like this. Here is an example:"Click the Network menu item, and change the Attached to setting from NAT to BridgedAdapter."Warnings or important notes appear like this.Tips and tricks appear like this.Get in touchFeedback from our readers is always welcome.General feedback: Email feedback@packtpub.com and mention the book title in thesubject of your message. If you have questions about any aspect of this book, please emailus at questions@packtpub.com.[4]

PrefaceErrata: Although we have taken every care to ensure the accuracy of our content, mistakesdo happen. If you have found a mistake in this book, we would be grateful if you wouldreport this to us. Please visit www.packtpub.com/submit-errata, selecting your book,clicking on the Errata Submission Form link, and entering the details.Piracy: If you come across any illegal copies of our works in any form on the Internet, wewould be grateful if you would provide us with the location address or website name.Please contact us at copyright@packtpub.com with a link to the material.If you are interested in becoming an author: If there is a topic that you have expertise inand you are interested in either writing or contributing to a book, please visitauthors.packtpub.com.ReviewsPlease leave a review. Once you have read and used this book, why not leave a review onthe site that you purchased it from? Potential readers can then see and use your unbiasedopinion to make purchase decisions, we at Packt can understand what you think about ourproducts, and our authors can see your feedback on their book. Thank you!For more information about Packt, please visit packtpub.com.[5]

1Running Linux in a VirtualEnvironmentSo, you may be asking yourself, "Why do I need to study Linux security? Isn't Linux alreadysecure? After all, it's not Windows." But, the fact is, there are many reasons.It's true that Linux has certain advantages over Windows when it comes to security. Theseinclude:Unlike Windows, Linux was designed from the ground up as a multiuseroperating system. So, user security tends to be a bit better on a Linux system.Linux offers a better separation between administrative users and unprivilegedusers. This makes it a bit harder for intruders, and it also makes it a bit harder fora user to accidentally infect a Linux machine with something nasty.Linux is much more resistant to virus and malware infections than Windows is.Certain Linux distributions come with built-in mechanisms, such as SELinux inRed Hat and CentOS and AppArmor in Ubuntu, which prevents intruders fromtaking control of a system.Linux is a free and open source software. This allows anyone who has the skill toaudit Linux code to hunt for bugs or backdoors.But, even with those advantages, Linux is just like everything else that's been created bymankind. That is, it isn't perfect.

Running Linux in a Virtual EnvironmentChapter 1Here are the topics that we'll cover in this chapter:Why every Linux administrator needs to learn about Linux securityA bit about the threat landscape, with some examples of how attackers have, attimes, been able to breach Linux systemsResources for keeping up with IT security newsHow to set up Ubuntu Server and CentOS virtual machines with VirtualBox, andhow to install the EPEL repository in the CentOS virtual machineHow to create virtual machine snapshotsHow to install Cygwin on a Windows host so that Windows users can connect toa virtual machine from their Windows hostsThe threat landscapeIf you've kept up with IT technology news over the past few years, you'll likely have seen atleast a few articles about how attackers have compromised Linux servers. For example,while it's true that Linux isn't really susceptible to virus infections, there have been severalcases where attackers have planted other types of malware on Linux servers. These caseshave included:Botnet malware: It causes a server to join a botnet that is controlled by a remoteattacker. One of the more famous cases involved joining Linux servers to a botnetthat launched denial-of-service attacks against other networks.Ransomware: It is designed to encrypt user data until the server owner pays aransom fee. But, even after paying the fee, there's no guarantee that the data canbe recovered.Cryptocoin mining software: It causes the CPUs of the server on which it'splanted to work extra hard and consume more energy. Cryptocoins that getmined go to the accounts of the attackers who planted the software.And, of course, there have been plenty of breaches that don't involve malware, such aswhere attackers have found a way to steal user credentials, credit card data, or othersensitive information.Some security breaches come about because of plain carelessness. Here'san example of where a careless Adobe administrator placed the company'sprivate security key on a public security blog: https:/ / www. theinquirer.net/ inquirer/ news/ 3018010/ adobe- stupidly- posts- private- pgp- keyon- its- security- blog.[7]

Running Linux in a Virtual EnvironmentChapter 1So, how does this happen?Regardless of whether you're running Linux, Windows, or whatever else, the reasons forsecurity breaches are usually the same. They could be security bugs in the operating system,or security bugs in an application that's running on that operating system. Often, a bugrelated security breach could have been prevented had the administrators applied securityupdates in a timely manner.Another big issue is poorly-configured servers. A standard, out-of-the-box configuration ofa Linux server is actually quite insecure and can cause a whole ton of problems. One causeof poorly-configured servers is simply the lack of properly-trained personnel to securelyadminister Linux servers. (Of course, that's great news for the readers of this book, because,trust me, there's no lack of well-paying, IT security jobs.)As we journey through this book, we'll see how to do business the right way, to make ourservers as secure as possible.Keeping up with security newsIf you're in the IT business, even if you're not a security administrator, you want to keep upwith the latest security news. In the age of the internet, that's easy to do.First, there are quite a few websites that specialize in network security news. Examplesinclude Packet Storm Security and The Hacker News. Regular tech news sites and Linux newswebsites, such as The INQUIRER, The Register, ZDNet, and LXer also carry reports aboutnetwork security breaches. And, if you'd rather watch videos than read, you'll find plentyof good YouTube channels, such as BeginLinux Guru.Finally, regardless of which Linux distribution you're using, be sure to keep up with thenews and current documentation for your Linux distribution. Distribution maintainersshould have a way of letting you know if a security problem crops up in their products.[8]

Running Linux in a Virtual EnvironmentChapter 1Links to security news sites are as follows:Packet Storm Security: https:/ / packetstormsecurity. com/ The Hacker News: http:/ / thehackernews. com/ Links to general tech news sites are as follows:The INQUIRER: https:/ / www. theinquirer. net/ The Register: http:/ / www. theregister. co. uk/ ZDNet: http:/ / www. zdnet. com/ You can check out some general Linux learning resources as well. LinuxNews Site:LXer: http:/ / lxer. com/ BeginLinux Guru on YouTube: https:/ / www. youtube. com/channel/ UC88eard 2sz89an6unmlbeA(Full disclosure: I am the BeginLinux Guru.)One thing to always remember as you go through this book is that the only operatingsystem you'll ever see that's totally, 100% secure will be installed on a computer that nevergets turned on.Introduction to VirtualBox and CygwinWhenever I write or teach, I try very hard not to provide students with a cure for insomnia.Throughout this book, you'll see a bit of theory whenever it's necessary, but I mainly like toprovide good, practical information. There will also be plenty of step-by-step hands-on labs.The best way to do the labs is to use Linux virtual machines. Most of what we'll do canapply to any Linux distribution, but we will also do some things that are specific to eitherRed Hat Enterprise Linux or Ubuntu Linux. (Red Hat Enterprise Linux is the most popularfor enterprise use, while Ubuntu is most popular for cloud deployments.)[9]

Running Linux in a Virtual EnvironmentChapter 1Red Hat is a billion-dollar company, so there's no doubt about where theystand in the Linux market. But, since Ubuntu Server is free-of-charge, wecan't judge its popularity strictly on the basis of its parent company'sworth. The reality is that Ubuntu Server is the most widely-used Linuxdistribution for deploying cloud-based applications.See here for details: http:/ / www. zdnet. com/ article/ ubuntu- linuxcontinues- to- dominate- openstack- and- other- clouds/ .Since Red Hat is a fee-based product, we'll substitute CentOS 7, which is built from Red Hatsource code and is free-of-charge. There are several different virtualization platforms thatyou can use, but my own preferred choice is VirtualBox.VirtualBox is available for Windows, Linux, and Mac hosts, and is free of charge for all ofthem. It has features that you have to pay for on other platforms, such as the ability tocreate snapshots of virtual machines.Some of the labs that we'll be doing will require you to simulate creating a connection fromyour host machine to a remote Linux server. If your host machine is either a Linux or a Macmachine, you'll just be able to open the Terminal and use the built-in Secure Shell tools. Ifyour host machine is running Windows, you'll need to install some sort of Bash shell, whichwe'll do by installing Cygwin.Installing a virtual machine in VirtualBoxFor those of you who've never used VirtualBox, here's a quick how-to to get you going:1. Download and install VirtualBox and the VirtualBox Extension Pack. You can getthem from: https:/ / www. virtualbox. org/ .2. Download the installation .iso files for Ubuntu Server and CentOS 7. You

Salman Aftab has 10 years of experience in Linux and 7 years of experience in networks and security. He authored the book Linux Security and Unified Threat Management System. Salman is an owner of the Linux Zero To Hero project, where he teaches Linux from very basic to advanced level free of cost. He is skilled in Linux, AWS, Networks and .