Study notes covering Securing A Linux System.
Author: Dylan Barrett
Date: 03/29/2026
📖 Useful Vocabulary / Acronyms
| Terminology | Definition |
|---|---|
| Confidentiality | Ensures that only the autorized user has access to data. |
| Integrety | Ensures that data has not changed unexpectedly |
| Availability | Ensures that users and services have access to the resources they need when they need them |
| Hardening | A process of making a host or app configuration secure by reducing its attack surface. |
| Principle of Least Privilege | A basic principle of security that something shoudl be allocatedd the minimum necessary rights, privileges, or information to preform its role. |
| Rootkits | Class of malware that modifies system files, often at the kernel level |
| Advanced Intrusion Detection Environment (AIDE) | Monitor file integrity and system settings for unauthorized changes |
| rkhunter | A software tool to scan the system and look for rootkits/backdoors by waatching for suspisious kernel modules and hidden files. |
| fsck | Software that checks and repairs the Linux filesystem |
| auditd | Softwware to monitor file access and modifications, including system, configuration, and application files |
| SELinux | Restricts access to essential system files using mandatory access controls |
| Tripwire | A Software to check for changes in system files |
| Identity and Access Managment (IAM) | A Security process that provides identification, autentication and autorization mechanisms for users, computers, and othere entitites to work with organizationl assets like networks, operating systems, and applications. |
| Single Sign On (SSO) | Autentication technology that enables a user to authenticate once and receive autorizations for multiple services |
Harden A Linux System
CIA Triade
Confidentiality - Ensures that only the autorized user has access to data.
Integrety - Ensures that data has not changed unexpectedly
Availability - Ensures that users and services have access to the resources they need when they need them
Hardening Servers
Hardening Steps
- Integrate strong physical security: Enforce restricted areas, require guest badges, ensure doors lock properly, and monitor physical access.
- Implement security scans: Utilize vulnerability scanners and network tools such as Nmap to automate security auditing and ensure compliance.
- Configure secure boot with UEFI: Use UEFI firmware to ensure only digitally signed software is loaded at boot time.
- Configure system logging: Configure the rsyslog and logrotate services to log significant system and application events. Log system access by the root account. Review the /var/log directory regularly. Use journalctl to review security events.
- Review and audit suspicious activity: Log access by the root user account, and check for potential breaches in authentication logs.
- Set a strong default umask: Configure an appropriate set of default permissions by using umask to enforce the principle of least privilege.
- Manage file access: Carefully configure permissions and access control lists (ACLs) according to the principle of least privilege, and utilize SELinux.
- Configure the host firewall: Configure the firewall to enforce the principle of least privilege on network connectivity.
- Configure secure SSH connectivity: Configure the SSH service to deny root logins through network connections, display warning banners to remote users, disallow blank passwords, and require key-based authentication.
- Detect and avoid service misconfigurations: Misconfigured services represent a severe threat to security. Use automated configuration management tools like Ansible to ensure settings remain correct and do not change unexpectedly.
- Disable and remove insecure services: Carefully audit for running services that become unnecessary as the server's role changes throughout its life cycle. Remove unnecessary services with tools such as the DNF and APT package managers. Mask services with the systemctl command.
- Secure service accounts: Audit service accounts stored in /etc/passwd to ensure they do not have shell privileges that would permit privilege escalation. Block shell access by placing /sbin/nologin in the account's shell field of the /etc/passwd file.
- Enforce strong password requirements: Enforce strong password requirements by using the chage command. Pluggable Authentication Modules (PAM) also help enforce password settings.
- Remove unused software packages: Remove unnecessary software with tools such as the DNF and APT package managers.
- Tune kernel parameters: Tune kernel parameters to match the server's role, installed services, network capabilities, performance requirements, and service levels.
- Automate updates: Automate the application of patches and audit the results to ensure all systems receive the appropriate updates.
- Avoid unsecure access services: Remove services like Telnet, File Transfer Protocol (FTP), and Trivial File Transfer Protocol (TFTP) that do not encrypt name and password information during network communications.
- Backport patches for older applications: Some older applications benefit from newer patches that add updated security options or enable new features. Carefully test and apply these patches to maintain security settings.
Indicators of compromise
- Unusual processor activity
- Unusual inbound and outbound network connections
- Suspicious files and directories
- Unexpexted log file changes
Supply Chain Risk Mitigation
- You can help to control supply chain risk by carefully managing where your software originates and addopting a procedure to help identify threats in third party code/softwware.
Restricted Shells
-
/sbin/nologin - Is great for service/object accounts that do not need interactive shells can be created with useradd -s /sbin/nologin
-
/bin/rbash - Is great for security as it is a restricted shell that is used for limiting user actions and commands
Secuirt Banners
-
Banner message purposes include:
- Legal warnings regarding unauthorized use or access, establishing grounds for prosecution.
- Acceptable use policies to indicate allowed and prohibited use of company resources.
- Regulatory compliance for various industries.
- System identification, including hostname or other user-friendly identifier to help remote users understand what resource they connected to.
- Service status information, including upcoming service windows, scheduled downtime, or other access restrictions.
-
Linux Distros have serveral banner message options
- /etc/issue Displays a message before local login, including the operating system version and kernel version.
- /etc/issue.net Displays a message before remote login using services like SSH. It plays a similar role to the /etc/issue file.
- /etc/motd Displays login messages to users and is an older solution most Linux distributions still provide. The "motd" acronym stands for "message of the day."
Secure File Destruction
# With dd
lsblk # To determine the partition that you would like to overwrite
umount /dev/sdc1 # Unmount the partition
dd if=/dev/urandom of=/dev/sdc1 bs=512 status=progress
# Shred to shred partition
lsblk # To determine the partition that you would like to overwrite
umount /dev/sdc1 # Unmount the partition
shred -v -f -n 3 -z /dev/sdc1
# Shred for a single file
shred -u -v -n 3 -z fileToShred
Plugable Authentication Modules (PAM)
-
Linux stores PAM configurations in the /etc/pam.d direcotry and are formated {module interface} {control flag}
- Module interface: Defines functions of the authentication/authorization process contained within a module.
- Control flags: Indicate what should be done upon the success or failure of the module.
- Module names: Define the module to which the directive applies.
- Module arguments: Additional options you can pass into the module.
-
The four module interfaces are account, auth, password, and session
- account: Checks to see whether a user is allowed access to something.
- auth: Verifies passwords and to set credentials (such as Kerberos tickets) .
- password: Changes passwords.
- session: Used when performing tasks in a user session that are required for access (such as mounting home directories).
-
There are also four control flags
- When the optional flag is set, the module result is ignored.
- The required flag mandates that the module result must be successful to continue the authentication, and the user is notified when all tests in the module interfaces are finished.
- The requisite flag is the same as the required flag except for the requisite flag's directive to notify the user immediately upon failure.
- The sufficient flag states that the module result is ignored upon failure.