[No audio]
Linux operating system hardening. This is a lesson about
how can you can secure your Linux operating system.
Well, there are many different ways that you
could secure your operating system so it is
not vulnerable to the viruses or attacks
or anything that could harm your system.
So this is also one of the most important topics in
Linux and many times the recruiters or hiring manager will ask
you this question about how do you secure your Linux system
or how do you harden your operating system?
There are few many different ways.
Even if you go online, you'll
find a lot of different ways.
But I think the most basic ones that
anyone should really know are as follow.
The first one is about the account management.
How do you secure the user account, what are
the policies or standards that you have in place?
Then we will cover about remove un-wanted packages. All
the packages that you have installed in your system.
If you don't need them, then why
do you keep them, so remove them.
Then we have to stop un-used services.
If a service is running that is not
required in your system, stop it, toss it.
Check on listening ports.
Some of the time we have ports that
are listing for incoming traffic, but we really
don't need any of those incoming traffic.
So what do we do? Stop secure SSH configuration.
We'll cover that later.
Enable firewall, iptables which is the older
version, and firewalld in the newer version.
Of course again we will cover in detail
on how we could enable firewall in our
system to make our system more secure.
SELinux, SELinux is a new feature that
we will cover also as part of
this lesson. Changing listing services port numbers.
So for example, if your port is running on let's say
SSH 22, you could change it to a different port.
So the hacker who knows that the port 22 runs
for SSH when they try they will get refused. Then
last but not least, keep your system up to date.
So you should have all the security patches installed.
So let's cover them, all of them, one by one.
Log into the Linux system.
[no audio]
So I have here Linux machine,
I've logged in through the console.
So the first thing that we talked
about is about user account management.
How can we secure that?
Well, the first thing that I should include
in this is about the naming convention.
When you create a username, for example Oracle or
admin, I recommend everyone to not use those standard
usernames because it's very easy to predict those usernames.
So instead of Oracle you pick like Oracle
one two three or one two three oracle.
Instead of admin you pick tadmin, or sadmin.
So how do we get all the usernames?
You go to etc, the passwd file and you'll see the
listing of all the users that we have in our system.
You see here all first one column before the
column we have the username like spiderman, spider, that's
my name, and many others like nfs, chrony.
So you could change the username to
a different name so it's not easily guessed.
Another way I would say is by default when
a user is created when you run the command
useradd, when you create a user, it automatically
assigns a user ID, which usually starts with three
digits or four digits, which is 1000, so on.
So I would also recommend as an industry
standard that to use anything from 10,000 and above.
So this way it's not hard to guess.
Another way is about the password policies.
Now, how often your password changes, how
long your password should be.
All that information can be looked at by
running the command chage, which is change age.
If you do -l on the username, which is
myself, you will see right here last password change.
This is the time when I changed my password.
Password expired never.
Password inactive.
So password expired never is not a good sign.
Since this is a lab environment, it's for
training purposes, I don't really care, but in
corporate environment and production environment there should be
a date to change the password.
Same thing goes for inactive password, account expires,
when does the password expires, a number of days
of warning before password expires, and so on.
All that information can be changed.
You could set your own standard
depending on your company's requirement.
You could run chage command with help
to find more information on how you
could make those changes for each user.
Also, if you go to /etc/shadow file, you will see
Permission denied, I have to be root.
[No audio]
So if you cat out the /etc/shadow file,
you'll see each user has the username and password at the end of
the password in this column it has these numbers.
These are the same numbers as
we have defined in change age.
You could change either with this command see
a change, or you could go directly to
the /etc/shadow file and make the change.
Let's see here. This seven refers to this seven.
This 99999 refers to this 99999.
This 0 refers to this 0.
So you can get more information about how
you could change it, whether you could do
through the /etc/shadow or chage age.
I would prefer that you use change age.
Anyway, moving forward.
Also another file that you should
look at is /etc/login.defs.
This is the file that you could also
define some of the parameters and those parameters
are, let's open the file again and you
will see here maximum password, maximum days.
These are the default settings.
You could do it by per user basis,
or if you want to apply to
the default setting, you could use it
here. See PASS_MIN_LEN five.
If a user is putting a password length four, then it's
not going to accept it, so it has to be five.
But of course I would recommend going at
least twelve or 13 and change it right
here. you could also disable all password.
Another file that actually manages user accounts,
And the security is /etc/pam.d, the
directory and the file is system-auth.
When you look at this file, it has a
lot of other parameters that you could define.
I want you to spend some time here or even
look it up online and study every field of this
file to understand exactly how this file works.
Next one we have is about remove unwanted packages.
Right? So how do we get the listing of all the packages?
To get the listing of packages, I think you
should know that. If you have forgotten that's fine,
rpm -qa, and then you hit enter.
When you hit enter, you get a
bunch of lists of all the packages.
Now, how many packages do I have in my system?
So that's like a quiz for you.
So tell me, how many packages do I have?
Well, the command is rpm -qa | wc -l, and this
will count every line output of rpm -qa.
I have a total number of package 1350.
So there are so many package
that I really don't need it.
So what do we need it for?
Well, get rid of them.
So, to get rid of a package, the command
is rpm -e, and the package name.
So also remember, when you are deleting a
package, it will ask you that this package
has a dependency on another package.
So be very careful on that.
If you remove the package, and that package has
dependencies on another package, or other package has dependencies
on this one, you will have some corruption and
some programs that won't work properly.
So just be careful.
Then we have the next one iss top unused services.
Okay, how do we get, what are the listing
of all the services that we are running?
If you run systemctl -a, this will
give you everything active or inactive.
So if there is a service that is active and you
really don't need it, you could just simply stop it.
If a system is serving webpages, why
do you need NFS service on it,
right? So that's where we stop the services.
Then the next one we have here
is about check on listening ports.
Now how do we check on the listening ports?
Every service that you run has
a port associated with it.
If you run netstat -tunlp, why
am I picking these specific options?
It's just that that I've been used to it.
You could pick different options to check the ports.
When I hit enter, you will see all the
ports that are open and listening right now.
See here's the IP address right here,
and this is my local IP.
And again, this is my local IP.
And you'll see everything that after
that has of these port.
111, 53, 22, 631, 25.
Tell me what 53 is for?
That's a quiz.
Well, if you don't remember, 53 is for DNS, and
as I said, DNS what port it runs on,
also one of the important questions. So if
your machine is not serving as a DNS,
why do we have a 53 port running?
So stop it.
The next one we have
is about securing SSH configuration.
Now, if you know that when you log
into system remotely, what protocol you use, you
use SSH and on the port 22.
So this could be secured as well.
So if you go to cd /etc/ssh, and then there is a file
called sshd.config, and when you hit enter or do more on it,
you will see this file can be modified and a lot of
its parameters can be modified to make SSH more secure.
And what are those things that can be modified?
The two basic ones that I usually make changes
to is number one is I change the port.
So right now, if you see the port is running on 22,
I will change it to 1022 or whichever the port that I
would like to have, so my system is more secure.
Another thing that I like to do whenever I build
a system is I go in and I enable this.
Right now you see here, this one has hash sign.
Anything that starts with hash, it's a comment.
So I will take out this hash sign and I'll
say PermitRootLogin and I will say no. Why?
Because if I'm logging in or if anybody's logging
into the system as root, they will deny it.
They should log in as themselves and
this way they could become root.
The reason behind this is because every time a user
logs in, let's say if I log in, my activity
will be logged in, at the time when I log
in and what time I became root.
So all that tracking information will be recorded
and it will be a lot easier to
understand who did what to the system.
So these are a couple of things
I will do with the SSH configuration.
Then we have enable firewall.
Now, firewall, as I said, there are older
version of firewall that runs in Redhat
6 and older, it is called iptables.
The newer version of firewall with
seven and above is firewalld.
Both serves the same function.
The firewalld has a few enhanced functions.
You could look it up again if
you want to learn more about firewall.
Now, I could tell you what firewall does.
firewall, when you have it enabled in your system,
what it does is, you could filter out.
Meaning if you want to only accept the traffic that's
coming in on port 22, you can tell firewall hey
firewall, only accept traffic coming in for port 22 or
only accept traffic coming in for port 123 or 53.
Anything that you wanted to make the changes to
firewall, anything you want the service to be running.
So firewall is like a watchdog, it's a defender or a
gatekeeper for your system which allows someone or traffic to come
in or it allows the traffic to leave. The commands that
you need to know for firewall is in GUI,
in the newer version of Linux. If you are using
GUI, you could run firewall-config, hit Enter and you
will see it will bring up a GUI.
This GUI will let you enable services, let you enable
ports, add ports, remove protocols or add protocols. If you
see, if you want to add a port.
Let's say if you enable firewall on your
system, by default it will block everything.
So once you enable firewall, it's not
going to talk anybody outside, it's not
going to have anybody talking to you.
So how do you enable the communication?
You add the port, you click on
Add, you put the port number.
Let's say I want everyone to talk to me, and
I'm a DNS server, so talk to me with 53.
I'm allowing it. That's good.
Click OK and good. Perfect.
So that's how the firewall or iptable works,
in a newer system, and that has GUI.
What if I do not have a GUI?
Okay, for that there's another command for
text based or command line command which
is firewall-cmd which is for command.
And when you do help, you'll get a lot of information.
How do you find or how do you
query or how you remove a port?
In older version we have the command iptables.
So when you hit iptables, you could just do help,
and you'll see all the information that you have right now.
If you enable the IP services and then you run
iptable -list, it will list all the services. Anyway,
the configuration file for iptables, the older version is /etc/sysconfig,
[No audio]
ip, and in sysconfig the file is iptables,
config, and this
is the file where you could go in and modify.
If you don't want to modify it through
the command line, you can modify through the
file and then restart the services.
In the newer version, the file name is /etc/firewall.
I'm sorry, /etc/firewalld is the directory,
and the file is firewalld.conf.
This is the one that you can modify.
Then we'll move on to the next one
about securing our system, which is enable SELinux.
Now, what is SELinux?
Now, let me read you something really off
the Internet or standard definition of SELinux.
SELinux stands for Security Enhanced
Linux. It is a security architecture integrated into
the 2.6x kernel using the
Linux Security module, also known as LSM.
It is a project of the United States National
Security Agency which stands for NSA, which is abbreviated
as NSA and the SELinux Community.
SELinux integration into Redhat Linux Enterprise Voice was a
joint effort between the NSA and the Redhat.
SELinux defines the access and transition rights of every
user, every application process and the file the system on.
So if you know, every operating system has
an application, it has a process, it has
a file, it has a user, right?
So we have talked about the user
permissions and how do we change it?
We change it to the change mod right?
Now how do we change the permission of a process?
How do we change the
permission of an application, right?
Well that's not possible with the operating system.
So what we did, we have this SELinux which
controls the permission access of process and application, and
it goes deep, deep down in the detail and
control every access of the file, the configuration file.
If you want to make SELinux enable, the
first thing you have to do is run sestatus to
make sure if it's running or not.
And if you do sestatus, you see
in my system SELinux status is enabled.
Now, a lot of companies that I have worked in
the past and a lot of people that I've talked
to, they usually keep SELinux disabled, which I understand
because many times their computers or their environment running in
a private network so they really don't need it.
Plus SELinux is a very newer technology and it
is a bit complicated when implemented into your system.
So you have to have a very
detailed and better understanding for SELinux.
So if you want to disable it, all you have to
do is go to /etc/sysconfig and you do vi.
I'm just doing more for now.
And you will see right here, let me clear the screen
so there won't be any confusion when you look at it.
So you see right here anything that
has hash signs of course is comment.
So you see right here it says SELINUX equal enforcing.
It means it is enforced and it's enabled.
And there are three modes of SELinux.
One is enforcing which means the
SELinux Security policy is enforced. Right?
Then the second is Permissive which is
telling that SELinux system prints warning
but does not enforce policies.
So if someone is making any changes, it will print hey,
something was going on, but it's not going to stop it.
Then there's another one.
The last one of course is the
disabled, of course, which disables the SELinux.
So you could change it here and once you have
it, it is recommended that you reboot your system.
So to check the parameters of a file, for example,
let's say if I go to my home directory and
these are the files and directories I have.
So if I just do status, sorry, just stat and I
do let's say I have this file called lalaland.
You will see right here it tells me
everything about the file name, the size, the
block, the IO block and right here it
says Access which is read, write, execute, right?
We already covered that and if not, then you already
know that it could be defined by change mod command.
Now if you notice right here,
this is a new thing, Context.
This specific file is defined by
the object is user home.
So that's how the SELinux keep track of
which directory belongs to which user or which
file and it also gives you Access, Modify,
Birth, Change, and all that different information.
We could change only the
read, write, and execute, right?
But all that additional stuff if you want to
have it, that could be done with SELinux.
Anyway, there are other commands that I want you
to look into it which I will not cover
here, which is because SELinux is a huge topic.
Just for your knowledge or to have you have
somewhat exposure, you should know what SELinux is.
So anyway, some of the command of SELinux is
chcon which change file, SELinux security context, then we
have checkpolicy which is SELinux policy compiler, and
the other ones are new rule, setsebool,
sebool, fixfiles, semanage, and so many
other commands that I will not cover here.
Also I have attached some
documentation which you could read.
So this is about SELinux.
Now, the second to the last part that I wanted
to cover is about change listing service port numbers.
Now, also I covered that a little bit
on the SSH configuration where you could change
from port 22 to a different port.
You could also make that same change to other services.
For example, DNS by default run on 53, right?
You could make that changes as well
to make your system more secure.
And the last one is about keep
your operating system up to date.
Now, it doesn't mean you just go online and
do yum update all and just update everything, all
the packages that you have. You don't have to
do or you don't have to update every package,
but you do have to make sure especially anything
that is related to security, you have to update.
And how do we keep on up to date with the security?
Well, one thing is you keep
on running this yum update, right?
But is it the right way to do it?
Well, what I do I could tell you is I keep
myself up to date with all the alerts that I get
from Redhat or CentOS or even Windows.
Every time there is an issue or there's a new
patch that comes out, I get notified, I have an
email, so I would recommend you to do the same.
Go ahead and sign up on redhat.com on centos.org.
As soon as you get any of those updates, go and apply.
That's how you keep your system secure.
Anyway, this is about how you could do your system
secure or OS hardening if you cover everything here in detail
and if someone is asking you questions, trust me, you're going
to ace it if you go over this.
All right, good luck.
[No audio]