Table of Contents for
Mastering Linux Security and Hardening

Version ebook / Retour

Cover image for bash Cookbook, 2nd Edition Mastering Linux Security and Hardening by Donald A. Tevault Published by Packt Publishing, 2018
  1. Mastering Linux Security and Hardening
  2. Title Page
  3. Copyright and Credits
  4. Mastering Linux Security and Hardening
  5. Packt Upsell
  6. Why subscribe?
  7. PacktPub.com
  8. Contributors
  9. About the author
  10. About the reviewer
  11. Packt is searching for authors like you
  12. Table of Contents
  13. Preface
  14. Who this book is for
  15. What this book covers
  16. To get the most out of this book
  17. Download the color images
  18. Conventions used
  19. Get in touch
  20. Reviews
  21. Running Linux in a Virtual Environment
  22. The threat landscape
  23. So, how does this happen?
  24. Keeping up with security news
  25. Introduction to VirtualBox and Cygwin
  26. Installing a virtual machine in VirtualBox
  27. The EPEL repository on the CentOS virtual machine
  28. Configuring a network for VirtualBox virtual machines
  29. Creating a virtual machine snapshot with VirtualBox
  30. Using Cygwin to connect to your virtual machines
  31. Installing Cygwin on your Windows host
  32. Summary
  33. Securing User Accounts
  34. The dangers of logging in as the root user
  35. The advantages of using sudo
  36. Setting up sudo privileges for full administrative users
  37. Method 1 – adding users to a predefined admin group
  38. Method 2 – creating an entry in the sudo policy file
  39. Setting up sudo for users with only certain delegated privileges
  40. Hands-on lab for assigning limited sudo privileges
  41. Advanced tips and tricks for using sudo
  42. The sudo timer
  43. Hands-on lab for disabling the sudo timer
  44. Preventing users from having root shell access
  45. Preventing users from using shell escapes
  46. Preventing users from using other dangerous programs
  47. Limiting the user's actions with commands
  48. Letting users run as other users
  49. Locking down users' home directories the Red Hat or CentOS way
  50. Locking down users' home directories the Debian/Ubuntu way
  51. useradd on Debian/Ubuntu
  52. adduser on Debian/Ubuntu
  53. Hands-on lab for configuring adduser
  54. Enforcing strong password criteria
  55. Installing and configuring pwquality
  56. Hands-on lab for setting password complexity criteria
  57. Setting and enforcing password and account expiration
  58. Configuring default expiry data for useradd – for Red Hat or CentOS only
  59. Setting expiry data on a per-account basis, with useradd and usermod
  60. Setting expiry data on a per-account basis, with chage
  61. Hands-on lab for setting account and password expiry data
  62. Preventing brute-force password attacks
  63. Configuring the pam_tally2 PAM module
  64. Hands-on lab for configuring pam_tally2
  65. Locking user accounts
  66. Using usermod to lock a user account
  67. Using passwd to lock user accounts
  68. Locking the root user account
  69. Setting up security banners
  70. Using the motd file
  71. Using the issue file
  72. Using the issue.net file
  73. Summary
  74. Securing Your Server with a Firewall
  75. An overview of iptables
  76. Basic usage of iptables
  77. Hands-on lab for basic iptables usage
  78. Uncomplicated Firewall for Ubuntu systems
  79. Basic usage of ufw
  80. Hands-on lab for basic ufw usage
  81. firewalld for Red Hat systems
  82. Verifying the status of firewalld
  83. firewalld zones
  84. firewalld services
  85. Adding ports to a firewalld zone
  86. firewalld rich language rules
  87. Hands-on lab for firewalld commands
  88. nftables – a more universal type of firewall system
  89. nftables tables and chains
  90. Getting started with nftables
  91. Using nft commands
  92. Hands-on lab for nftables on Ubuntu
  93. Summary
  94. Encrypting and SSH Hardening
  95. GNU Privacy Guard
  96. Creating your GPG keys
  97. Symmetrically encrypting your own files
  98. Hands-on lab – combining gpg and tar for encrypted backups
  99. Using private and public keys for asymmetric encryption and signing
  100. Signing a file without encryption
  101. Encrypting partitions with Linux Unified Key Setup – LUKS
  102. Disk encryption during operating system installation
  103. Adding an encrypted partition with LUKS
  104. Configuring the LUKS partition to mount automatically
  105. Encrypting directories with eCryptfs
  106. Home directory and disk encryption during Ubuntu installation
  107. Encrypting a home directory for a new user account
  108. Creating a private directory within an existing home directory
  109. Encrypting other directories with eCryptfs
  110. Encrypting the swap partition with eCryptfs
  111. Using VeraCrypt for cross-platform sharing of encrypted containers
  112. Getting and installing VeraCrypt
  113. Creating and mounting a VeraCrypt volume in console mode
  114. Using VeraCrypt in GUI mode
  115. Ensuring that SSH protocol 1 is disabled
  116. Creating and managing keys for password-less logins
  117. Creating a user's SSH key set
  118. Transferring the public key to the remote server
  119. Disabling root user login
  120. Disabling username/password logins
  121. Setting up a chroot environment for SFTP users
  122. Creating a group and configuring the sshd_config file
  123. Hands-on lab – setting up a chroot directory for sftpusers group
  124. Summary
  125. Mastering Discretionary Access Control
  126. Using chown to change ownership of files and directories
  127. Using chmod to set permissions values on files and directories
  128. Setting permissions with the symbolic method
  129. Setting permissions with the numerical method
  130. Using SUID and SGID on regular files
  131. The security implications of the SUID and SGID permissions
  132. Finding spurious SUID or SGID files
  133. Hands-on lab – searching for SUID and SGID files
  134. Preventing SUID and SGID usage on a partition
  135. Using extended file attributes to protect sensitive files
  136. Setting the a attribute
  137. Setting the i attribute
  138. Hands-on lab – setting security-related extended file attributes
  139. Summary
  140. Access Control Lists and Shared Directory Management
  141. Creating an access control list for either a user or a group
  142. Creating an inherited access control list for a directory
  143. Removing a specific permission by using an ACL mask
  144. Using the tar --acls option to prevent the loss of ACLs during a backup
  145. Creating a user group and adding members to it
  146. Adding members as we create their user accounts
  147. Using usermod to add an existing user to a group
  148. Adding users to a group by editing the /etc/group file
  149. Creating a shared directory
  150. Setting the SGID bit and the sticky bit on the shared directory
  151. Using ACLs to access files in the shared directory
  152. Setting the permissions and creating the ACL
  153. Charlie tries to access Vicky's file with an ACL set for Cleopatra
  154. Hands-on lab – creating a shared group directory
  155. Summary
  156. Implementing Mandatory Access Control with SELinux and AppArmor
  157. How SELinux can benefit a systems administrator
  158. Setting security contexts for files and directories
  159. Installing the SELinux tools
  160. Creating web content files with SELinux enabled
  161. Fixing an incorrect SELinux context
  162. Using chcon
  163. Using restorecon
  164. Using semanage
  165. Hands-on lab – SELinux type enforcement
  166. Troubleshooting with setroubleshoot
  167. Viewing setroubleshoot messages
  168. Using the graphical setroubleshoot utility
  169. Troubleshooting in permissive mode
  170. Working with SELinux policies
  171. Viewing the Booleans
  172. Configuring the Booleans
  173. Protecting your web server
  174. Protecting network ports
  175. Creating custom policy modules
  176. Hands-on lab – SELinux Booleans and ports
  177. How AppArmor can benefit a systems administrator
  178. Looking at AppArmor profiles
  179. Working with AppArmor command-line utilities
  180. Troubleshooting AppArmor problems
  181. Summary
  182. Scanning, Auditing, and Hardening
  183. Installing and updating ClamAV and maldet
  184. Installing ClamAV and maldet
  185. Configuring maldet
  186. Updating ClamAV and maldet
  187. Scanning with ClamAV and maldet
  188. SELinux considerations
  189. Scanning for rootkits with Rootkit Hunter
  190. Installing and updating Rootkit Hunter
  191. Scanning for rootkits
  192. Controlling the auditd daemon
  193. Creating audit rules
  194. Auditing a file for changes
  195. Auditing a directory
  196. Auditing system calls
  197. Using ausearch and aureport
  198. Searching for file change alerts
  199. Searching for directory access rule violations
  200. Searching for system call rule violations
  201. Generating authentication reports
  202. Using predefined rules sets
  203. Applying OpenSCAP policies with oscap
  204. Installing OpenSCAP
  205. Viewing the profile files
  206. Scanning the system
  207. Remediating the system
  208. Using SCAP Workbench
  209. More about OpenSCAP profiles
  210. Applying an OpenSCAP profile during system installation
  211. Summary
  212. Vulnerability Scanning and Intrusion Detection
  213. Looking at Snort and Security Onion
  214. Obtaining and installing Snort
  215. Graphical interfaces for Snort
  216. Getting Snort in prebuilt appliances
  217. Using Security Onion
  218. Scanning and hardening with Lynis
  219. Installing Lynis on Red Hat/CentOS
  220. Installing Lynis on Ubuntu
  221. Scanning with Lynis
  222. Finding vulnerabilities with OpenVAS
  223. Web server scanning with Nikto
  224. Nikto in Kali Linux
  225. Installing and updating Nikto on Linux
  226. Scanning a web server with Nikto
  227. Summary
  228. Security Tips and Tricks for the Busy Bee
  229. Auditing system services
  230. Auditing system services with systemctl
  231. Auditing network services with netstat
  232. Auditing network services with Nmap
  233. Port states
  234. Scan types
  235. Password-protecting the GRUB 2 bootloader
  236. Resetting the password for Red Hat/CentOS
  237. Resetting the password for Ubuntu
  238. Preventing kernel parameter edits on Red Hat/CentOS
  239. Preventing kernel parameter edits on Ubuntu
  240. Password-protecting boot options
  241. Disabling the submenu for Ubuntu
  242. Password-protecting boot option steps for both Ubuntu and Red Hat
  243. Securely configuring BIOS/UEFI
  244. Using a security checklist for system setup
  245. Summary
  246. Other Books You May Enjoy
  247. Leave a review – let other readers know what you think

Scan types

There are lots of different scanning options, each with its own purpose. The SYN packet scan that we're using here is considered a stealthy type of scan because it generates less network traffic and fewer system log entries than certain other types of scans. With this type of scan, Nmap sends a SYN packet to a port on the target machine, as if it were trying to create a TCP connection to that machine. If the target machine responds with a SYN/ACK packet, it means that the port is in an open state and ready to create the TCP connection. If the target machine responds with an RST packet, it means that the port is in a closed state. If there's no response at all, it means that the port is filtered, blocked by a firewall. As a normal Linux administrator, this is one of the types of scans that you would do most of the time.

The -sS scan shows you the state of TCP ports, but it doesn't show you the state of UDP ports. To see the UDP ports, use the -sU option:

donnie@linux-0ro8:~> sudo nmap -sU 192.168.0.37

Starting Nmap 6.47 ( http://nmap.org ) at 2017-12-28 12:41 EST
Nmap scan report for 192.168.0.37
Host is up (0.00018s latency).
Not shown: 996 closed ports
PORT STATE SERVICE
123/udp open ntp
631/udp open|filtered ipp
3283/udp open|filtered netassistant
5353/udp open zeroconf
MAC Address: 00:0A:95:8B:E0:C0 (Apple)

Nmap done: 1 IP address (1 host up) scanned in 119.91 seconds
donnie@linux-0ro8:~>

Here, you see something a bit different. You see two ports listed as open|filtered. That's because, due to the way that UDP ports respond to Nmap scans, Nmap can't always tell whether a UDP port is open or filtered. In this case, we know that these two ports are probably open because we've already seen that their corresponding TCP ports are open.

ACK packet scans can also be useful, but not to see the state of the target machine's network services. Rather, it's a good option for when you need to see if there might be a firewall blocking the way between you and the target machine. An ACK scan command looks like this:

sudo nmap -sA 192.168.0.37

You're not limited to scanning just a single machine at a time. You can scan either a group of machines or an entire subnet at once:

sudo nmap -sS 192.168.0.1-128
sudo nmap -sS 192.168.0.0/24

The first command scans only the first 128 hosts on this network segment. The second command scans all 254 hosts on a subnet that's using a 24 bit netmask.

A discovery scan is useful for when you need to just see what devices are on the network:

sudo nmap -sn 192.168.0.0/24

With the -sn option, Nmap will first detect whether you're scanning the local subnet or a remote subnet. If the subnet is local, Nmap will send out an Address Resolution Protocol (ARP) broadcast that requests the IPv4 addresses of every device on the subnet. That's a reliable way of discovering devices because ARP isn't something that will ever be blocked by a device's firewall. (I mean, without ARP, the network would cease to function.) However, ARP broadcasts can't go across a router, which means that you can't use ARP to discover hosts on a remote subnet. So, if Nmap detects that you're doing a discovery scan on a remote subnet, it will send out ping packets instead of ARP broadcasts. Using ping packets for discovery isn't as reliable as using ARP because some network devices can be configured to ignore ping packets. Anyway, here's an example from my own home network:

donnie@linux-0ro8:~> sudo nmap -sn 192.168.0.0/24

Starting Nmap 6.47 ( http://nmap.org ) at 2017-12-25 14:48 EST
Nmap scan report for 192.168.0.1
Host is up (0.00043s latency).
MAC Address: 00:18:01:02:3A:57 (Actiontec Electronics)
Nmap scan report for 192.168.0.3
Host is up (0.0044s latency).
MAC Address: 44:E4:D9:34:34:80 (Cisco Systems)
Nmap scan report for 192.168.0.5
Host is up (0.00026s latency).
MAC Address: 1C:1B:0D:0A:2A:76 (Unknown)
Nmap scan report for 192.168.0.6
Host is up (0.00013s latency).
MAC Address: 90:B1:1C:A3:DF:5D (Dell)
. . .
. . .

We see four hosts in this snippet, and there are three lines of output for each host. The first line shows the IP address, the second shows whether the host is up, and the third shows the MAC address of the host's network adapter. The first three pairs of characters in each MAC address denote the manufacturer of that network adapter. (For the record, that unknown network adapter is on a recent model Gigabyte motherboard. I have no idea why it's not in the Nmap database.)

The final scan that we'll look at does four things for us:

  • It identifies open, closed, and filtered TCP ports
  • It identifies the versions of the running services
  • It runs a set of vulnerability-scanning scripts that come with Nmap
  • It attempts to identify the operating system of the target host

The scan command that does all of these things looks like this:

sudo nmap -A 192.168.0.37

I guess that you could think of the -A option as the all option, since it really does do it all. (Well, almost all, since it doesn't scan UDP ports.) Here are the results of the scan that I did against my target:

donnie@linux-0ro8:~> sudo nmap -A 192.168.0.37

Starting Nmap 6.47 ( http://nmap.org ) at 2017-12-24 19:33 EST
Nmap scan report for 192.168.0.37
Host is up (0.00016s latency).
Not shown: 996 closed ports
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 5.1 (protocol 1.99)
|_ssh-hostkey: ERROR: Script execution failed (use -d to debug)
|_sshv1: Server supports SSHv1
515/tcp open printer?
631/tcp open ipp CUPS 1.1
| http-methods: Potentially risky methods: PUT
|_See http://nmap.org/nsedoc/scripts/http-methods.html
| http-robots.txt: 1 disallowed entry
|_/
|_http-title: Common UNIX Printing System
5900/tcp open vnc Apple remote desktop vnc
| vnc-info:
| Protocol version: 3.889
| Security types:
|_ Mac OS X security type (30)
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at http://www.insecure.org/cgi-bin/servicefp-submit.cgi :
SF-Port515-TCP:V=6.47%I=7%D=12/24%Time=5A40479E%P=x86_64-suse-linux-gnu%r(
SF:GetRequest,1,"\x01");
MAC Address: 00:0A:95:8B:E0:C0 (Apple)
Device type: general purpose
Running: Apple Mac OS X 10.4.X
OS CPE: cpe:/o:apple:mac_os_x:10.4.10
OS details: Apple Mac OS X 10.4.10 - 10.4.11 (Tiger) (Darwin 8.10.0 - 8.11.1)
Network Distance: 1 hop
Service Info: OS: Mac OS X; CPE: cpe:/o:apple:mac_os_x

TRACEROUTE
HOP RTT ADDRESS
1 0.16 ms 192.168.0.37

OS and Service detection performed. Please report any incorrect results at http://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 213.92 seconds
donnie@linux-0ro8:~>

There are several interesting things here. First, there's the Secure Shell information:

22/tcp open ssh OpenSSH 5.1 (protocol 1.99)
|_ssh-hostkey: ERROR: Script execution failed (use -d to debug)
|_sshv1: Server supports SSHv1

Version 5.1 is a really old version of OpenSSH. (At the time of writing, the current version is version 7.6.) What's worse is that this OpenSSH server supports version 1 of the Secure Shell protocol. Version 1 is seriously flawed and is easily exploitable, so you never want to see this on your network.

Next, we have amplifying information on the print service vulnerability that we found with the OpenVAS scan:

515/tcp  open  printer?
631/tcp open ipp CUPS 1.1
| http-methods: Potentially risky methods: PUT
|_See http://nmap.org/nsedoc/scripts/http-methods.html
| http-robots.txt: 1 disallowed entry
|_/
|_http-title: Common UNIX Printing System

In the 631/tcp line, we see that the associated service is ipp, which stands for Internet Printing Protocol. This protocol is based on the same Hypertext Transfer Protocol (HTTP) that we use to look at web pages. The two methods that HTTP uses to send data from a client to a server are POST and PUT. What we really want is for every HTTP server to use the POST method because the PUT method makes it very easy for someone to compromise a server by manipulating a URL. So, if you scan a server and find that it allows using the PUT method for any kind of HTTP communications, you have a potential problem. In this case, the solution would be to update the operating system and hope that the updates fix the problem. If this were a web server, you'd want to have a chat with the web server administrators to let them know what you found.

Finally, let's see what Nmap found out about the operating system of our target machine:

Running: Apple Mac OS X 10.4.X
OS CPE: cpe:/o:apple:mac_os_x:10.4.10
OS details: Apple Mac OS X 10.4.10 - 10.4.11 (Tiger) (Darwin 8.10.0 - 8.11.1)
Network Distance: 1 hop
Service Info: OS: Mac OS X; CPE: cpe:/o:apple:mac_os_x

Wait, what?  Mac OS X 10.4?  Isn't that really, really ancient? Well yeah, it is. The secret that I've been guarding for the past couple of chapters is that the target machine for my OpenVAS and Nmap scan demos has been my ancient, collectible Apple eMac from the year 2003. I figured that scanning it would give us some interesting results to look at, and it would appear that I was right. (And yes, that is eMac, not iMac.)