Linux operating system hardening, this is a lesson about how can you can secure your Linux operating
system?
Well, there are many different ways that you could secure your operating system.
So it is not vulnerable to the viruses or attacks or anything that that could harm your system.
So this is also one of the most important topic.
And Linux and many times the recruiters are hiring.
Manager will ask you this question about how do you secure your Linux system or how do you harden your
operating system?
There are a few, many different ways you could even if you go online, you'll find a lot of different
ways.
But I think the most basic ones that anyone should really know are as follows.
The first one is about the account management.
How do you secure the user accounts, one of the policy standards that you have in place?
Then we will cover about remove unwanted packages, all the packages that you have installed in your
system.
If you don't need them, then why do you keep them to remove them?
Then we have to stop unused services.
If a service is running that is not required in your system, stop it, toss it.
Check on listening ports.
Some of the time you have ports that are listening for traffic, for incoming traffic, but we really
don't need any of those incoming traffic.
So what we do to stop them secure S.H. configuration will cover that later enable firewall IP tables,
which is all the work and firewall in the newer version.
Of course, again, we will cover in detail on how we could enable a firewall in our system to make
our system more secure as Linux a C Linux is a new feature that we will cover also as part of this lesson
changing listing service support numbers.
So for example, if your port is running on, let's say, S.H. 22, you could change it to a different
port.
So the hacker who who knows that, you know, the port at 22 runs for S.H. when they tried, they will
get refused then.
Last but not least, keep your system up to date.
So you should have all the security patches installed.
So let's cover them, all of them.
One by one.
I log into the next system.
So I have here a Linux machine.
I logged in through the console.
So the first thing that we talked about is about user account management.
How can we secure that?
Well, the first thing that I should include in this is about the naming convention.
When you create a user name, for example, Oracle or admin, I recommend everyone to not use those
user names because it's very easy to to predict those those user names.
So instead of Oracle, you pick like Oracle, one, two, three, or one, two, three, Oracle instead
of admin, you pick TI admin or admin.
So how do we get the all the user names so you could see the password file and you'll see the listing
of all the users that we have in our system.
You see here the first one column before the call and we had the user name like Spider-Man Spider,
that's my name and many other like NFL scrawny.
So you could change the user name to a different name.
So it's not easily guessed.
Another way, I would say is by default, when a user is created, when you run the command user ad,
then you create a user.
It automatically assigns user ID, which usually starts with three digits or are four digits was one
thousand so on.
So I would also recommend or as a industry standard that to use anything from 10000 and above.
So this way it's not hard to guess.
Another way is about the password policies.
Now, how often your password changes, how long your password should be.
All that information can be looked at by running the command page, which is change if you do minus
L on the user name, which is myself, you will see right here last password change.
This is the time and I change my password.
Password explorer, never password non-active.
So password expired.
Never.
It's not a good sign since this is a lab environment is for training purposes, I don't really care.
But in corporate environment and production environment, there should be a date to change the password.
Same thing goes for an active.
Password account expires when does it password expires, a number of days of warning before password
expires and so on, all that information can be changed.
You could set your own standard depending on your company's requirement.
You could run H h command with dash dash help to find more information, how you could make those changes
for each user.
Also, if you go to that seashell file, you will see permission denied after Birute.
If you cat out the seashell file, you will see each user has this username.
It's password at the end of the password in this call, and it has these numbers.
These are the same numbers as we have defined and change age.
You could change either with this command, see a change, or you could go directly to the XY Sherifa
and make the change.
See here, the seven refers to this seven.
This nine nine nine refers to this nine nine nine.
The zero refers to this zero.
So you could get more information about how you could change it, but you could do through the etsi
shadow or C h a change h.
I would prefer that you use change anyway moving forward.
Also another another file that you should look at is ATSE Login and deaths.
This is the file that you could also define some of the parameters and those parameters are let's open
the file again and you will see here maximum password, maximum days.
These are the default settings.
You could do it by per user basis.
Or if you want to apply to a default setting, you could use it here.
C password minimum length five.
If you if a user is putting a password for then it's not an acceptance.
It has to be five.
And of course, I would recommend going at least 12 or 13 and change it right here.
You could also disable all password, another file that actually manages user accounts and its security
is ETSI Pandi, the directory and the file system auth.
When you look at this file, it has a lot of other parameters that you could define.
I want you to spend some time here or even look it up online and study every field of this file to understand
exactly how this works.
Next one we have is above remove unwanted packages, right?
So how do we get the listing of all the packages to to get the listing of packages?
I think you should know that if you have forgotten, that's fine.
R.P.M. minus keyway and then you hit enter.
When you hit enter, you get the bunch of list of all the packages.
Hmm.
Now how many packages do I have in my system so that that's just like a quiz for you.
So tell me how many packages were.
Well the command is R.P.M. as Kuai W.S. Munsell and this will count every line output of R.P.M..
Could I have a total number of package.
Thirteen hundred and fifty.
So there are so many packages that I really don't need it.
So what do we need it for.
Get rid of them.
So to get rid of a package, the command is R.P.M. minus E and the package name.
So also remember when you are deleting a package, it will assure you that this package has a dependency
on another package.
So be very careful on that.
If you remove the package and it and that package has a dependencies on other package or other packages,
dependencies on this one, you will have some corruption and some programs that won't work properly.
So just be careful then we have the next one is stop on use services.
OK, how do we get what are the listing of all the services that we are running?
If you run system ctrl dash a, this will give you everything active or inactive.
So if there is a service that is active and you really don't need it, you could just simply stop it.
If a system is serving the pages, why do you need an FSA service on it?
Right.
So that's why we stopped the service.
Then the next one we have here is about check on listening points.
Now, how do we check on the listening ports?
Every service that you run has a port associated with it.
So if you run, that's that base Dashty you and.
P. White, why am I picking these Pacific options?
It's just that that I've been used to it.
You could pick different options to check the ports.
So when I enter, you will see all the ports that are open and listening right now.
See, here's the IP address right here.
And this is my local IP.
And again, this is my local IP.
And you'll see everything that after that has of this port one one one 53, 22, six, 31, 25.
Tell me what 53 is for the sequester.
Well, if you don't remember, 53 is for DNS.
And as I said, DNS what it runs on.
Also, one of the important question.
So if you if you if your machine is not serving as a DNS, why do we have 53 port running?
So stopping the next one we have is about securing a configuration.
Now, if you know that when you log into a system remotely, what protocol you use, you use S.H. and
on the Port 22.
So this could be secured as well.
So if you go to seed slash S.H. and then there is a file called SAHD Config, and when you hit enter,
the more on it you will see this file can be modified and a lot of its parameters can be modified to
make SSA more secure.
And what are those things that can be modified?
The two basic ones that I usually make changes to is No.
One is I change the port.
So right now, if you see the port is running on twenty two, I would change it to 10, 22 or whichever
the port that I would like to have.
So in my system is more secure.
Another thing that I like to do whenever I build a system is I go in and I enable this right now.
You see here, this one has hash sign anything that starts with hash.
It's a common.
So I will take out this hash sign and I'll say permit login and I will say no.
Why?
Because if I am logging in or if anybody's logging into the system as rude, it will deny it.
They should log in as themself and this way they can become your route.
The reason behind this is because every time as user logs in, let's say if I log in, my activity will
be logged in at the time and I logging in and what time I became put.
So all that tracking information will be recorded and it will be a lot easier to understand who did
what to the system.
So these are a couple of things I will do with the SSA configuration.
Then we have enabled firewall or no firewall.
As I said, there are older version of firewall that runs in RedHat six and older is called IP tables.
The newer version of firewall at seven and above its firewall d both serves the same function that Piemonte
has a few enhanced functions.
You could look it up again if you want to learn more about firewall now, I could tell you what a firewall
does.
Firewall when you have it enabled in your system, what it does is that you could filter out meaning
if you want to only accept the traffic that coming in one point twenty two, you can tell firewall.
Hey, firewall only accept traffic coming in for twenty two or only accept traffic coming in four or
one.
Twenty three or four to three.
Anything that you wanted to make the changes to firewall.
Anything you want the service to be running.
So firewall is like a watchdog or a defender or a gatekeeper for your system which allows someone or
traffic to come in or and it allows the traffic to leave the commands that you need to know for firewall,
as in GUI, in the newer version of Linux, if you are using Google, you can run firewall, dash config
hit enter and you will see it'll bring up a good this Google will let you enable services, lets you
enable ports at ports, remove protocols or at protocols.
If you see if you want to add a port, let's say if you enable firewall on your system by default,
it would block everything.
So once you enable firewall, it was not going to talk to anybody outside.
It's now going to have anybody talking to you.
So how do you enable the communication?
You add the ports, you click on add, you put the port.
No, let's say I want everyone to talk to me and I'm a DNS server, so talk to me.
Three, I'm allowing it.
That's good.
Click OK and good, perfect.
So that's how the firewall or IP deal works in a newer system and that has cool.
What if I do not have a code?
OK, for that.
There's another command for a text based or command line command which is firewall that which is for
command.
And then you do help, you'll get a lot of information.
How do you find or how do you query or how you remove a port and all the words and we have the command
IP tables, so and you hit it tables.
You could just to help and you will see all the information that you have right now.
If you enable the IP services and then you run IP tables to actually list, it will list all the services
anyway.
The configuration file for IP tables, the older version is etsi this config.
IP and six config to compare the file is IP tables confect, and this is a file that you could go in
and modify if you don't want to modify to the command line, you can modify through the file and then
restart the services.
In the newer version, the file name is ETSI Firewall, the site that C or D is the dirty and the firewall
is firewall dot com.
This is the one that you can modify.
Then we'll move on to the next one about securing our system, which is change.
Sorry, enable s e Linux.
Now what is C Linux.
Now let me read you something really off the Internet are standard definition of SC Linux, SC Linux
stands for security and has Linux is a security architecture integrated into the two to six X kernel
using the Linux security module, also known as LSM.
It is a project of the United States National Security Agency, which is stands for NSA or which is
abbreviated as NSA and the SLA community.
Exelis integration into Readhead Linux enterprise voice was a joint effort between the NSA and the redhead.
Asulin defines the access and transmission rights of every user, every application process and of the
system.
So we have a F, you know, every operating system has an application, it has a process, it has a
phylis as a user.
Right.
So we have talked about the user permissions and how do we change it?
We change it to the change mod right now.
How do we change the permission of a process?
How do we change the permission of an application?
Right.
Well, that's not possible with the operating system.
So what we did, we have this SC Linux, which controls the access, the the permission access of process
and application.
And it goes deep, deep down in the detailed and control every access of the file, the configuration
file.
If you wanted to make sorry, if you wanted to make SC Linux enable, the first thing you have to do
is run Passi status to make sure if it's running or not.
And if you do se that as you see in my system, as Linux status is enabled.
Now, a lot of companies that have worked in the past and a lot of people that I've talked to, they
usually keep SC Linux disabled, which I understand because many times the computers are there.
And why am I running in a pro bono work so that they really don't need it?
Plus, SLN is a very newer technology and it's it is a bit complicated when implemented into your system.
So you have to have a very detailed and better understanding for SC Linux.
So if you want to disable it, you all you have to do is go to ATSE, says config and you do V.I. I'm
just doing more for now and you will see right here.
Let me clean the screen so there won't be any confusion when you look at it.
So you see right here, anything that has hash signs is of course, is common.
So you see right here, I see Linux equal enforcing.
It means it is force and it's enabled.
And there are three modes of SC Linux.
One is enforcing, which means the SC Linux security policies enforced.
Right then the second is permissive, which is telling that asylum system print's warning but does not
enforce policies.
So if someone is making any changes, it will print, hey, something was going on, but it's not going
to stop it.
Then there's another one.
The last one is, of course, is the disable, of course, which disables the SC Linux.
So you could change it here.
And once you have it, it is recommended that you reboot your system.
So to check the parameters of a file, for example, let's say if I go to my home directly and these
are the file and directories I have.
So if I just do status or just sorry, just that and I do let's say I have this file called Lala Land.
You will see right here.
And it tells me everything about that.
While the files name the size to block the IO block and right here says Access, which is read, write,
execute, write, we already covered that.
And if not, then you already know that it is like a it could be defined with change mod.
Corkman Now, if you notice right here, this is a new thing, context to this specific file is defined
where the object is use your home.
So that's how the ceiling is, keep track of which directly belongs to which user or which file.
And it also gives you access, modifier, board change and all that different information.
We could change only the read, write and execute.
Right.
But all that additional stuff, if you wanted to have it, that could be done at Selznick's anyway.
There are other commands that I want you to look into it, which I will not cover here, which is because
Selznick's is a huge topic just for your knowledge or to have you have it somewhat exposure that you
should know what Sillen is.
So anyway, some of the command Linux is S.H. Con, which change file in a security context.
Then we have Czech policy, which is Celldex policy compiler and the other ones are new role.
Set C.
Bool set C.
Bool fixed files semantic and so many of the commands that will not cover here.
Also I have attached some documentation which you can read.
So this is about Essy Linux.
Now this second to the last part that I wanted to COHRE is about change listing service.
So as port numbers now also I covered that a little bit on the C so Secich configuration where you could
change from Port 22 to a different port.
You could also make this same change to other services, for example, DNS by default on 53.
Right.
You can make that changes as well to make your system more secure.
And the last one is about keep your operating system up to date.
Now, it doesn't mean you just go online and do some update all and just update everything.
All the packages that you have, you don't have to do or you don't have to update every package.
But you do have to make sure especially anything that is related to security, you have to update.
And how do we keep on up to date with the security?
Well, one thing is you keep on running on Abdelal updated.
Right.
But that's is it the right way to do it?
Well, what I do, I could tell you is I keep myself up to date with with all the alerts that I get
from RedHat or S.O.S or even Windows, every time there is an issue or there's a new patch that comes
out, I get notified.
I have an email.
So I would recommend you to do the same.
Go ahead and sign up on Readhead Dotcom, on sento.
As soon as you get any of those updates, go in and apply.
That's how you keep your system secure.
Anyway, this is about how you could do your system secure or always hardening.
If you cover everything here in detail and if someone is asking you questions, trust me, you're going
to ace it if you go with this.
All right.
Good luck.