Complete Linux Security & Hardening with Practical Examples

In this lecture we will cover the concept of Linux security and OS hardening.  What is the difference between security and OS hardening.  Also we will talk about security in general, computer security and Linux security

In this lecture we will cover Linux or Computer security with your home security so it will be easier to understand how security works in IT world

If Linux is connected to Windows or Solaris

We will talk about the importance of security such as:

• Data protection

• Protect system resources (memory, CPU, disk etc.)

• Protect application workflows

• Audit compliance (service organization controls – SOC reports)

• SOC became effective on June 15th, 2011

• Less human errors

• Control management (who gets what, who can access what)

• Peace of mind

There are many way computer security can be implemented and most of them are listed as follow which will be covered in this lecture:

Manual security configuration

• User Accounts

• File Systems

• System access

• System security (system configuration files)

• OS network layer security

Automate through scripts

• Create a script

• Copy over or access over network

• Execute one by one on each server

Deployment tools (Ansible, puppet. Etc.)

3rd part security software (e.g. McAfee) – Not for all security measures

In this lecture we are covering type of computer or linux security breach:

Data

• Steal

• Corrupt

• Remove

Application

• Apache webserver

• Database

• Financial applications

Operating System

• Filesystem corruption

• System failure

• Process management

Hardware

• Attack on CPU, Memory, etc.

This lecture is all about understanding of Oracle VirtualBox and how it allows us to run multiple virtual machines

VirtualBox is a free virtualization tool which allows you to run multiple virtual machines on one host.  In this lecture you will learn how to download, install and configure VirtualBox. 

• Simply to go any search engine and type download Oracle virtualbox

• The very first result should give you the link as "Go to Download" under virtualbox.org

• Click on "Go to Download" link and on the next page click on the download that is appropriate for your host platform. e.g. if you are running Windows on your PC then pick "Windows Host"

• Once clicked on the link it will give you the option to download

• Start the download process and upon completion run the executable which will guide you through the entire installation process

In this lecture we will cover how to create a virtual machine on Oracle virtualbox and use it for Linux CentOS installation

This lecture is all about CentOS download, installation and configuration

https://www.tecmint.com/linux-server-hardening-security-tips/

https://www.tecmint.com/linux-server-hardening-security-tips/

Following are the different ways a user activity can be monitored

• /var/log/messages = All system related messages

• /var/log/secure = user login activity including failures

• last = View history of all logged users

• last <username> = View login history of a certain user

• lastb = View all bad login attempts

• who or w = Who is currently logged in (tty and pts)

  • tty = console

  • pts = xterm, putty, other terminals

• /home/user/.bash_history = User command history

• tcpdump = Server incoming and outgoing traffic

• /etc/rsyslog.conf = Logging configuration

• ps –ef | grep username = Monitor user running processes.

Please download all handouts

In this lecture we will cover different types of Linux files

This lecture is all about the output of ls -l command in Linux

We will learn how to change a file or directory permissions using chmod command

We will learn how to change a file or directory ownership using chown and chgrp commands

In this lecture we are going to cover Access Control List (ACL).  It is used to assign file or directory permission to a specific users and groups

Some of the commands we will cover are as follow:

1) To add permission for user

setfacl -m u:user:rwx /path/to/file

2) To add permissions for a group

setfacl -m g:group:rw /path/to/file

3) To allow all files or directories to inherit ACL entries from the directory it is within

setfacl -dm "entry" /path/to/dir

4) To remove a specific entry

setfacl -x u:user /path/to/file (For a specific user)

5) To remove all entries

setfacl -b path/to/file (For all users)

Please download all handouts

https://www.cyberciti.biz/tips/linux-security.html

The first rule is to keep your server lean and mean. Install only those packages that you really needed. If there are unwanted packages, delete them. The fewer the packages the less chance of unpatched code

Guidelines:

•Do not install packages that you do not need during the initial installation

•Pay close attention to the add-on packages

To get a list of all packages

# rpm –qa (CentOS)

# apt list –installed (Ubuntu)

Remove packages

# rpm –e package_name

# apt-get remove package_name

Orphaned Packages:

The objective is to remove all orphaned packages from CentOS Linux. By orphaned packages we mean all packages which no longer serve a purpose of package dependencies.

For example, package A is depended on package B, thus, in order to install package A the package B must also be installed. Once the package A is removed the package B might still be installed, hence the package B is now orphaned package

•A built-in utility which allows you to check for orphaned packages

yum-utils

•Check if that exist in your system

# rpm –qa | grep yum-utils

•If not then install

# yum install yum-utils

•Get a list of all orphaned packages

# package-cleanup –leaves

•Remove

# yum remove `package-cleanup –leaves`

# apt-get autoremove

• Register to OS providers websites such as Redhat, CentOS, Ubuntu, Debian etc.

• Stay connected with the technical news feeds and OS community

• Run package management software such as Redhat Satellite or Ubuntu Landscape

# yum update or upgrade

# apt-get update

upgrade = will delete obsolete packages

update = will preserve obsolete packages

Before you can decide which services are unnecessary, you need to know which services are running. To find out, run

# netstat –l

# netstat –tulpn

# systemctl

# chkconfig –list (older version of CentOS)

# service --status-all | grep running (CentOS or Ubuntu)

# ps –ef

Disabling through PAM files

•Looking at the files in /etc/pam.d/, you'll probably see configuration files for a number of programs you don't use and maybe even a few you've never heard of. The best way to disable PAM authentication for these programs is to rename these files. Not finding the file named after the service requesting authentication, PAM will fallback to the (hopefully) very secure /etc/pam.d/other

•If you later find that you need one of these programs, you can simply rename the file to its original name and everything will work as it was intended

To stop a service

# chkconfig httpd off

# chkconfig httpd disable

# systemctl stop httpd

# systemctl disable httpd

Example of httpd package and service

# rpm –qa | grep httpd

# yum install httpd

# systemctl start httpd

# ps –ef | grep http

OR

# netstat –tulpn

# systemctl stop httpd

# systemctl disable httpd

• A disk in Linux should be partition into the following mounts

  /

  /boot

  /usr

  /home

  /tmp

  /var

  /opt

  
  

  How disk partitioning can help?

  • Partitioning your drive can also keep your data safer from malware attacks. If ransomware lands on your Linux partition, it would have a lesser chance of locking your personal or critical files on another partition

  • If a partition gets full it can be easily extended using LVM and it won’t impact other partitions

  • Disk partitioning can enhance your system or application performance

  • Utilize other filesystems for each partition (e.g. ext4, XFS etc.).

Here in this lecture we will cover how to disable alt+ctrl+del in Linux

Command to check the status or alt+ctrl+del

# systemctl status ctrl-alt-del.target (CentOS and Ubuntu)

Command to disable alt+ctrl+del

# systemctl disable ctrl-alt-del.target

For earlier version like CentOS/RHEL 6 the file that handles Ctrl-Alt-Del

#/etc/init/control-alt-delete.conf

The above steps will not disable “ctrl+Alt+delete” key combination in GUI mode. To disable it in GUI change keyboard settings

Go to your Linux Console as root --> Navigate to Applications --> System Tools --> Settings --> Devices --> Keyboard --> Keyboard Shortcuts --> System --> Logout --> Enter

Set value of "Logout" as Disabled by hit Backspace à Set

One Network Service Per System or VM Instance

Run different network services on separate servers or VM instance. This limits the number of other services that can be compromised. For example, if an attacker able to successfully exploit a software such as Apache flow, he or she will get an access to entire server including other services such as MySQL/MariaDB/PGSql, e-mail server and so on

In this lecture we will cover how to change console default passwords

To disable USB stick detection

•Create a file /etc/modprobe.d/no-usb and add the following line

•install usb-storage /bin/true

In this lecture we will cover how we can setup network time protocol / chronyd

•Configuration File

/etc/ntp.conf

/etc/chronyd.conf

•Command Syntax

systemctl restart ntpd

systemctl restart chronyd

service ntpd start/restart

•Process or Daemon

ntpq

chronyd

•Status

systemctl status chronyd / ntpd

chronyc sources

ntpq à peers

•Logs

/var/log/messages

/var/log/chrony/...

Change SSH port number 22:

• Open the /etc/ssh/sshd_config file

• replace default Port 22 with different port number say 1110

• save & exit from the file

• service sshd restart

• ssh username@IP -p 1110

What is SELinux?

•Security-Enhanced Linux is a Linux kernel security module that provides a mechanism for supporting access control security policies, including mandatory access controls. (Wikipedia)

•It is a project of the United States National Security Agency (NSA) and the SELinux community

Backup

•A system backup is the process of backing up the operating system, files and system-specific useful/essential data

•It is used in case of hardware, OS, application failures as well as security breach

5 Different Types of Backups

1.System backup

• Physical system (entire image using tools such as acronis, Veeam, Commvault etc.)

• Virtual system (snapshots)

2.Application backup (3rd party application backup solution)

3.Database backup (Oracle dataguard, SQL backup etc.)

4.Filesystem backup (tar, gzip directoris etc.)

5.Disk backup or disk cloning (dd command)