Instructor: Linux operating system hardening.
This is a lesson about how you can secure
your Linux operating system.
Well, there are many different ways
that you could secure your operating system
so it is not vulnerable to the viruses or attacks
or anything that could harm your system.
So, this is also one of the most important topic in Linux,
and many times the recruiters or hiring manager
will ask you this question
about how do you secure your Linux system?
Or how do you harden your operating system?
There are a few many different ways you could,
even if you go online,
you'll find a lot of different ways.
But I think the most basic ones
that anyone should really know are as follow.
The first one is about the account management.
How do you secure the user accounts?
What are the policies or standards that you have in place?
Then we will cover about remove unwanted packages.
All the packages that you have installed in your system.
If you don't need them, then why do you keep them?
So, remove them.
Then we have to stop unused services.
If a service is running that is not required in your system,
stop it, toss it.
Check on listening ports.
Some of the time we have ports
that are listening for traffic, for incoming traffic,
but we really don't need any of those incoming traffic.
So, what do we do? Stop 'em.
Secure SSH configuration.
We'll cover that later.
Enable firewall, iptables, which is the older version,
and firewalld in the newer version.
Of course, again, we'll cover in detail
on how we could enable a firewall in our system
to make our system more secure.
SELinux.
SELinux is a newer feature
that we will cover also as part of this lesson.
Changing listening services port numbers.
So, for example, if your port is running
on let's say SSH 22,
you could change it to a different port
so the hacker who knows that, you know,
the port at 22 runs for SSH,
when they try it, they'll get refused.
Then last but not the least, keep your system up to date.
So, you should have all the security patches installed.
So, let's cover them, all of them one by one.
Log into the Linux system.
So, I have here my Linux machine.
I'm logged in through the console.
So, the first thing that we talked about
is about user account management.
How can we secure that?
Well, the first thing that I should include in this
is about the naming convention.
When you create a username, for example, Oracle or admin,
I recommend everyone to not use those standard usernames
because it's very easy to to predict those usernames.
So, instead of Oracle, you pick like Oracle123 or 123Oracle.
Instead of admin, you pick tadmin or sadmin.
So, how do we get all the usernames?
So, you go to /etc/ the password file,
and you will see the listing of all the users
that we have in our system.
You'll see here all the first one column before the colon
we have the username like spiderman, spider, that's my name,
and many other like nfs, chrony.
So, you could change the username to a different name
so it's not easily guessed.
Another way I would say is by default
when a user is created,
when you run the command user add
when you create a user, it automatically assigns a user id
which usually starts with three digits or four digits,
which 1000 so on.
So, I would also recommend or as a industry standard
that to use anything from 10,000 above.
So, this way it's not hard to guess.
Another way is about the password policies.
Now, how often your password changes.
How long your password should be.
All that information can be looked at by running
the command chage, which is change age.
If you do - L on the username,
which is myself
you'll see right here last password change.
This is the time when I changed my password.
Password expired never.
Password inactive.
So, password expired never is not a good sign.
Since this is a lab environment.
It's for training purposes.
I don't really care.
But in corporate environment, in production environment,
there should be a date to change the password.
Same thing goes for inactive password, account expires.
When does the password expires
and number of days of warning before password expires
and so on.
All that information can be changed.
You could set your own standard
depending on your company's requirement.
You could run chage command
with --help to find more information
how you could make those changes for each user.
Also, if you go to /etc/shadow file, you'll see...
Permission denied I have to be root.
So, if you cat out the /etc/shadow file,
you'll see each user has
this username, it's password.
At the end of the password, in this column
it has these numbers.
These are the same numbers
as we have defined in change age.
You could change either with this command c age change
or you could go directly
to the /etc/shadow file and make the change.
You'll see here this seven refers to this seven.
This 999 refers to this 999.
This zero refers to this zero.
So, you could get more information
about how you could change it,
whether you could do through the /etc/shadow
or chage change age.
I would prefer that you use change age.
Anyway, moving forward.
Also another file that you should look at
is /etc/login defs.
This is the file
that you could also define some of the parameters.
And those parameters are...
Let's open the file again
and you will see here maximum password, maximum days.
These are the default settings.
You could do it by per user basis
or if you wanna apply it to a default setting,
you could use it here.
See password, minimum length five.
If you, if a user is putting a password length four
then it's not gonna accept it,
so it has to be five.
But of course I would recommend go at least 12 or 13
and change it right here.
You could also disable all password.
Another file that actually manages user accounts
and its security is /etc/pam.d, the directory
and the file is system auth.
And you look at this file,
it has a lot of other parameters that you could define.
I want you to spend some time here
or even look it up online
and study every field of this file
to understand exactly how this file works.
Next one we have is about remove unwanted packages, right?
So, how do we get the listing of all the packages?
To get the listing of packages,
I think you should know that.
If you have forgot, that's fine.
rpm -qa and then you hit enter.
When you hit enter,
you get the bunch of lists of all the packages.
Hmm.
Now how many packages do I have in my system?
So, that it's, that's like a quiz for you.
So, tell me, how many packages do I have?
Well, the command is rpm -qa | wc -l,
and this will count every line output of rpm -qa.
I have a total number of package 1,350.
So, there are so many packages that I really don't need it.
So, what do we need it for?
Well, get rid of them.
So, to get rid of a package
the command is rpm -e and the package name.
So, also remember when you are deleting a package
it'll ask you
that this package has a dependency on another package.
So, be very careful on that.
If you remove the package and it,
and that package has a dependencies on other package
or other package has dependencies on this one,
you will have some corruption
and some programs that won't work properly.
So, just be careful.
Then we have the next one is stop unused services.
Okay, how do we get...
What are the listing of all the services
that we are running?
If you run systemctl -a,
this will give you everything active or inactive.
So, if there is a service that is active
and you really don't need it, you could just simply stop it.
If a system is serving webpages,
why do you need NFS service on it, right?
So, that's why we stop the services.
Then the next one we have here is
about check on listening ports.
Now how do we check on the listening ports?
Every service that you run has a port associated with it.
So, if you run
netstat -tunlp.
Why am I picking these specific options?
It's just that that I've been used to it.
You could pick different options to check the ports.
So, when I enter, you will see all the ports
that are open and listening right now.
See here's the IP address right here
and this is my local ip and again, this is my local ip
and you'll see everything that after that has these.
Port 111, 53, 22, 631, 25.
Tell me what 53 is for.
That's a quiz.
Well, if you don't remember, 53 is for DNS
and as I said DNS what port it runs on.
Also, one of the important questions.
So, if you, if you,
if your machine is not serving as a DNS,
why do we have a 53 port running?
So, stop it.
The next one we have is about securing SSH configuration.
Now, if you know that when you login to system remotely
what protocol you use?
You use SSH and on the port 22.
So, this could be secured as well.
So, if you go to cd /ssh
and then there is a file called sshd config
and when you hit enter or do more on it,
you will see this file can be modified
and a lot of its parameters can be modified
to make SSH more secure.
And what are those things that can be modified?
The two basic ones that I usually make changes to
is number one is I change the port.
So, right now, if you see the port is running on 22
I'll change it to 1022
or whichever the port that I would like to have.
So, my system is more secure.
Another thing that I like to do
whenever I build a system
is I go in and I enable this.
Right now you see here this one has hash sign.
Anything that starts with hash, it's a comment.
So, I will take out this hash sign
and I'll say permit route login, and I will say no, why?
Because if I'm logging in
or if anybody's logging into the system as root,
it will deny it.
They should log in as themself
and this way they could become your root.
The reason behind this is because every time a user logs in,
let's say if I log in,
my activity will be logged in.
At the time when I logging in and what time I became root.
So, all that tracking information will be recorded
and it will be a lot easier to understand
who did what to the system.
So, these are a couple of things I will do
with the SSH configuration.
Then we have enable firewall.
Well now firewall, as I said
there are older version of firewall
that runs in Red Hat 6 and older is called iptables.
The newer version of firewall with seven and above
it's firewalld.
Both serves the same function.
The firewalld has a few enhanced functions.
You could look it up again
if you wanted to learn more about firewall.
Now I could tell you what firewall does.
Firewall when you have it enabled in your system,
what it does is...
If you could filter out,
meaning if you want to only accept the traffic
that's coming in on port 22,
you can tell firewall,
"Hey firewall, only accept traffic coming in for port 22"
or only accept traffic coming in for port 123 or 53.
Anything that you want to make the changes to firewall.
Anything you want the service to be running.
So, firewall is like a a, a watchdog.
It's a defender or a gatekeeper for your system
which allows someone or traffic to come in or...
And it allows the traffic to leave.
The commands that you need to know for firewall
as in GUI.
In the newer version of Linux
if you are using GUI, you can run firewall -config
hit Enter and you'll see it'll bring up a GUI.
This GUI will let you enable services,
lets you enable ports, add ports,
remove protocols or add protocols.
If you see, if you want to add a port,
let's say if you enable firewall on your system,
by default it will block everything.
So, once you enable firewall,
if it's not gonna talk anybody outside,
it's not gonna talk have anybody talking to you.
So, how do you enable the communication?
You add the ports.
You click on add.
You put the port number.
Let's say I want everyone to talk to me
and I'm a DNS server.
So, talk to me with 53 I I'm allowing it.
That's good.
Click Okay and good. Perfect.
So, that's how the firewall or iptable works
in a newer system and that has GUI.
What if I do not have a GUI?
Okay, for that there's another command.
For a text based or command line command,
which is firewall -cmd
which is for command.
And when you do help, you'll get a lot of information.
How do you find or how do you query
or how do you remove a port?
In older version, we have the command iptables.
So, when you hit iptables, you could just do help
and you'll see all the information that you have right now.
If you enable the IP services
and then you run iptables -list
it will a list all the services.
Anyway, the configuration file for iptables,
the older version, is /etc/sysconfig/ip
and in sysconfig
the file is iptables config
and this is a file where you could go in and modify.
If you don't want it to modify through the command line
you can modify through the file
and then restart the services.
In the newer version the file name is /etc/firewalld.
I'm sorry /etc/firewalld is the directory
and the firewall is firewalld.com.
This is the one that you can modify.
Then we'll move on to the next one
about securing our system
which is, sorry, enable SELinux.
Now what is SELinux?
Now let me read you something really off the internet.
Our standard definition of SELinux.
SELinux stands for Security Enhanced Linux
is a security architecture integrated
into the 2.6x kernel using the Linux security module
also known as LSM.
It is a project
of the United States National Security Agency,
which is stands for NSA
or which is abbreviated as NSA,
and the SELinux community.
SELinux integration into Red Hat Linux Enterprise
was a joint effort between the NSA and the Red Hat.
SELinux defines the access and transition rights
of every user, every application process
and on a file, the system it's on.
So, we have a, if..
You know every operating system
has an application, it has a process
it has a file, it has a user, right?
So, we have talked about the user permissions
and how do we change it?
We change it through the change mod, right?
Now, how do we change the permission of a process?
How do we change the permission of an application, right?
Well, that's not possible with the operating system.
So, what we did, we have this SELinux
which controls the access,
the permission access of process and application.
And it goes deep, deep down in the detail
and control every access of a file.
The configuration file,
if you want to make, sorry.
If you want to make SELinux enabled
the first thing you have to do is run sestatus
to make sure if it's running or not.
And if you do sestatus,
you'll see in my system, SELinux status is enabled.
Now, a lot of companies that I have worked in the past
and a lot of people that I've talked to
they usually keep SELinux disabled.
Which I understand because many times their computers
or their environment running in a prior network
so they really don't need it.
Plus, SELinux is a very newer technology
and it is a bit complicated when implemented in your system.
So, you have to have a very detailed
and better understanding for SELinux.
So, if you wanted to disable it,
you all you have to do is go
to /etc/sysconfig and you do vi,
I'm just doing more for now
and you will see right here...
Let me clear the screen
so there won't be any confusion when you look at it.
So, you see right here
anything that has hash signs of course is comment.
So, you see right here it says SELinux equal enforcing.
It means it is enforced and it's enabled.
And there are three modes of SELinux.
One is enforcing,
which means the SELinux security policy is enforced, right?
Then the second is permissive,
which is telling that the SELinux system prints warning
but does not enforce policies.
So, if someone in making any changes, it will print,
"Hey something was going on," but it's not gonna stop it.
Then there's another one is
the last one is of course is the disabled,
of course which disables the SELinux.
So, you could change it here, and once you have it,
it is recommended that you reboot your system.
So, to check the parameters of a file, for example
let's say if I go to my home directory
and these are the file and directories I have.
So, if I just do status or just, sorry, just stat and I do
let's say I have this file called lalaland.
You'll see right here
it tells me everything about that file:
the file name, the size, the block, the IO block.
And right here it says access
which is read, write, execute, right?
We already covered that.
And if not, then you already know
that it is like a it could be defined
with chmod command.
Now, if you notice right here, this is a new thing context.
So, this specific file is defined
with the object as user home.
So, that's how the SELinux
keep track of which directory belongs to,
which user of which file.
And it also gives you access
modify, birth, change, and all that different information.
We could change only the read, write and execute, right?
But all that additional stuff, if you want to have it
that could be done with SELinux.
Anyway, there are other commands
that I want you to look into it
which I will not cover here,
which is because SELinux is a huge topic.
Just for your knowledge
or to have you have a somewhat of exposure
that you should know what SELinux is.
So, anyway, some of the command of SELinux is chcon
which change file SELinux security context.
Then we have checkpolicy
which is SELinux policy compiler,
and the other ones are newrole, setsebool,
setsebool, fixfiles, semanage
and so many other commands that I will not cover here.
Also, I have attached some documentation
which you could read.
So, this is about SELinux.
Now, the second to the last part that I wanted to cover
is about change listing service port.
Service port numbers.
Now also, I covered that a little bit on the SE, sorry,
in SSH configuration where you could change
from port 22 to a different port.
You could also make the same change to other services.
For example, DNS by default run on 53, right?
You could make that changes as well
to make your system more secure.
And the last one is about
keep your operating system up to date.
Now, it doesn't mean you just go online
and do yum update all and just update everything,
all the packages that you have.
You don't have to do...
Or you don't have to update every package
but you do have to make sure,
especially anything that is related to security,
you have to update.
And how do we keep on up to date with the security?
Well, one thing is you keep on running this yum update.
It'll update it, right?
But that's, is it the right way to do it?
Well, what I do, I could tell you is
I keep myself up to date with all the alerts that I get
from Red Hat or CentOS or even Windows.
Every time there is an issue
or there's a new patch that comes out, I get notified.
I have an email.
So, I would recommend you to do the same.
Go ahead and sign up on redhat.com, on centos.org.
As soon as you get any of those updates,
go ahead and apply it.
That's how you keep your system secure.
Anyway, this is about how you could do your system secure
or OS hardening.
If you cover everything here in detail.
And if someone is asking you questions, trust me
you're gonna ace it if you go over this.
All right, good luck.