In this lesson,
we're going to discuss the cybersecurity best practices
that you need to implement within Linux.
Now, Linux is the operating system that is used
on the most network devices
and security appliances out there.
This includes things like routers, firewalls,
next-generation firewall devices,
unified threat management gateways,
virtual private network concentrators,
intrusion detection systems, intrusion protection systems,
security information and event management appliances,
wireless access point devices, and many others.
Therefore, it's important to understand
how all of this security-related data
can be collected from these devices,
because it's going to give you a lot of areas
that you can look at
when you're trying to secure your network.
Additionally, you also need to understand
what kind of security hardening you can do
on your Linux servers and devices,
because as more and more companies
are moving their data into the cloud,
it's being put onto Linux servers,
and so you have to understand the extent
to which that data could be compromised
if you don't properly secure your network.
So what can you do to protect your server
and increase your Linux security?
Well, this is what we're going to be talking about
in this lesson.
And we're going to talk about all the different techniques
you can do to bolster the security of your Linux systems,
and therefore minimize the risk of your organization
falling victim to a data breach or other attack.
Now, there are lots of best practices that you should follow
to secure your Linux operating systems,
and we're going to cover those as we go through
these cybersecurity best practices in this lesson.
Now, when I talk about the terms cybersecurity
and cybersecurity best practices,
I'm really talking about the ways that you can protect
your computer systems and digital information
against unauthorized access, attack, theft, or data damage.
These days, cybersecurity is truly
an important and necessary thing
for organizations of all shapes and sizes.
It's an essential practice
that individuals also need to have,
because your individual identity
is not separated from the digital space.
These things are all interwoven these days.
So in our world that is highly connected
across the internet,
we really have to be cybersecurity minded,
both at work and at home.
Now, cybersecurity seeks to address
three specific principles.
These are confidentiality, integrity, and availability,
which we refer to as the CIA triad.
Now, if one of these principles is compromised,
the security of the organization
as a whole can be threatened.
Confidentiality is the principle that talks
about keeping information and communications
private and protected from unauthorized access.
Confidential information includes things like trade secrets,
personnel records, health records, tax records,
military secrets, and more.
When you're dealing with confidentiality,
you try to control that data by using encryption
and access controls to protect it from being exposed.
The second principle we have is integrity,
and integrity is the fundamental principle
of keeping the organization's information accurate,
error-free, and without unauthorized modifications.
For example, if I was able to break into a school's system
and go ahead and change the test scores
for a particular student,
that would actually be an integrity violation,
because the integrity of that grade information
was compromised when I changed it from one score to another,
and that was unauthorized in its modification.
Now, typically, to control integrity,
you want to use things like hashing, digital signatures,
certificates, and change control processes.
Now, the third principle we have is known as availability,
and availability refers to the fundamental principle
of ensuring that computer systems operate continuously
and that the authorized people
can access their data whenever they need it.
This is typically controlled by using redundant systems,
installing fault tolerance,
and then doing software patching and updates
to ensure your systems remain online all the time.
Now, a prominent component of cybersecurity
comes down to authentication.
Authentication enables the organization to trust
that the users are who they claim to be.
Now, there are various ways to authenticate a user
when they try to log onto a system.
You can do this using pins, passwords,
and passphrases, for example.
All of these are basically strings of text
that you're going to input along with your username
in order to sign into a system.
Depending on the system,
you may be constrained by the type of characters you use,
the length, either the minimum
or maximum number of characters you can use,
and other things like that.
Now, in addition to using a knowledge factor,
like pins, passwords, or passphrases,
you can also use a possession factor,
something like a token.
Now, a token is any unique object,
whether physical or digital, that you possess,
and then present to verify your identity.
These tokens are usually going to be used
to generate one-time passwords, and these are called OTPs,
and those passwords or pin numbers would then expire
after a certain amount of time, normally 30 to 60 seconds.
These tokens can also be leveraged in digital certificates
as part of their authentication information,
depending on how you configure them.
Another type of authentication we can use
is what we call an inheritance factor,
and this includes things like biometrics.
Now, biometrics is an authentication scheme
that verifies a user's identity
based on their physical characteristics,
like their fingerprint, their iris,
their hand size, or things like that.
We can go ahead and get this information from our users
by using things like fingerprint scanners, iris scanners,
hand geometry scanners, voice recognition devices,
and facial recognition software.
And there's lots of different ways to use biometrics.
Now, this makes it a little bit harder
to compromise than a normal password,
because if you had to present my fingerprint,
that's a lot harder than getting my password,
and so it is considered a higher level of security.
Now, what is more secure, though,
is when you start combining these different things.
For example, if I combine a password with a token,
that now has something I know and something I have,
and putting these two factors together
gives me multifactor authentication,
which is much more secure than any single factor.
The next thing we're going to cover is RADIUS.
Now, RADIUS is the Remote Authentication
Dial-In User Service,
and this is an internet standard protocol
that provides authentication, authorization, and accounting,
which we call AAA, as part of our services.
Now, in addition to RADIUS, we can also use TACACS.
Now, TACACS+ is the Terminal Access Controller
Access-Control System,
and it's actually more secure and more scalable than RADIUS,
but it only works on Cisco devices, and for this reason,
you're going to see a lot of people
still using RADIUS instead of TACACS+.
Now, another thing we have to cover is the idea of LDAP.
LDAP is the Lightweight Directory Access Protocol,
and it's a directory service protocol
that runs over a TCP/IP network.
LDAP allows your clients to authenticate to the LDAP service
and the service's schema then defines the tasks
that that particular client can and cannot perform
once they're accessing a directory database.
Now, in addition to LDAP on Windows systems,
we use something known as Kerberos.
Now, Kerberos is an authentication service
that's based on a time-sensitive ticket-granting system.
It's also used a lot when we use single sign-on
or SSO methods for users to access
different sites and different services.
Now, SSO is a method where the user
can enter their access credentials one time
and they're being passed to the authentication server,
and then, based on that, they get a ticket,
and they can then log into other services
across the network or across the internet.
This gives you a list of what is allowed
and what is not allowed
based on those particular access credentials.
Now, Linux does have an implementation of Kerberos as well,
and there's a few commands that you should know,
including kinit, which is the initialization command
that's used to authenticate Kerberos,
and thereby grant the user a ticket,
granting a ticket if successful;
kpassword, which is a command that's used
to change the user's Kerberos password;
klist, which is a command used
to list the user's ticket cache;
and kdestroy, which is used to clear
the user's ticket cache.
For example, if I issue the command
kinit user@diontraining.com,
this will prompt for the user's password
that's being stored in the directory server's database.
If they enter the correct password,
this user will obtain a ticket from the Kerberos server.
That user can then issue klist -v
to verify that the ticket they've received
was valid and was properly obtained.
Now, the next thing we need to talk about
in terms of cybersecurity
is what's known as privilege escalation.
Now, privilege escalation occurs
when a user's able to obtain access
to additional resources or functionality
that they're normally not allowed access to.
One of the most common scenarios is when a normal user
is able to exploit some kind of vulnerability
in the system or its software
to gain root-level permissions.
One pitfall of this is that that person
now has the ability to run things as root.
And generally, this happens
because of poorly-configured SUID and SGID permissions.
When you change the permissions of a file
to use either SUID or SGID,
always use the lowest level of permissions
needed to accomplish that task.
This means you're adhering
to the principle of least privilege.
Also, you want to make sure
you're looking at your software programs
and ensure you're only installing things that you trust,
because some software programs
can have a backdoor installed into them,
and that can enable an attacker
to get a remote shell into your system.
Now, to help prevent this,
there is something known as chroot jail.
This is spelled C-H-R-O-O-T.
Now, a chroot jail is a way to isolate a process
and its children from the rest of the system.
For chroot jail to work,
you need to make sure it's only used on processes
that don't need to be run as root,
because a root user can easily break out of the jail.
Now, when you're using chroot jail,
it's really a good thing to do, because it separates out
privileged access on the file system
so that a malicious or rogue process
can't cause damage outside of its jailed environment.
The whole idea here is that you can create a directory tree
where you copy or link in all the system files that you need
for that process to run.
For example, if I use the command
chroot /home/user /usr/bin/bash,
this will create a new root directory using the bash shell
as the process inside of this jail.
The chroot command can be run by typing chroot,
the options, the new root directory you're creating,
in my case, it was /home/user,
and then the command you want to link into it.
Now, another thing you need to be aware of
in terms of security is encryption.
Encryption is a cryptographic technique that converts data
from plaintext into coded or encoded ciphertext.
Now, if you want to read that data again
from its ciphertext form,
you need to do the reverse process,
which is known as decryption.
This is the companion technique
that converts your ciphertext back into plaintext.
Now, an algorithm is known as a cipher,
and this is responsible for this whole conversion
of encrypting and decrypting process.
When a message is encrypted, only authorized parties
with the necessary decryption information,
such as the private key, can decode and read that data.
Encryption is therefore one of the more important
fundamental techniques that we're going to use in cybersecurity
for protecting the confidentiality of data,
because when data is encrypted,
no one can read it except those who have the key.
Encryption can be applied to data as it's going in transit
or passing through a network,
it could be done during data in use,
which is when it's being accessed in memory,
or data at rest,
which is when it's stored on a device or hard drive.
There are several subtypes of data-at-rest encryption,
and two of the most prominent are those known
as disk and drive encryption or file encryption.
Now, when you use full disk encryption, known as FDE,
you're going to encrypt the entire storage drive,
partition, or volume
using either hardware or software utilities,
while file encryption encrypts
only individual files and folders on a given file system
using a particular software utility.
Now, if you're looking for a good platform-independent,
full disk encryption solution, you can look to LUKS,
which is the Linux Unified Key Setup, or L-U-K-S.
The LUKS utility has the ability to encrypt
an entire storage device inside of a Linux environment.
Inside Linux, LUKS will use the dm-crypt subsystem
that was incorporated into the Linux kernel
back in version 2.6.
This subsystem will create a mapping
between an encrypted device and a virtual device name
that the user space software can then work with.
LUKS offers a high degree of compatibility with software
because it standardizes the format of the encrypted devices.
Now, before you encrypt a device,
it's always a good idea to override its contents
with random data or all zeros.
This is known as sanitizing the drive.
This ensures that there's no sensitive data from past use
that is remaining on that drive.
To do this, you can use the shred command.
The shred command is used to securely wipe
a storage device in this manner
by overriding it with a series of random data or zeros.
Another command you're going to come across
is known as cryptsetup.
The cryptsetup command is used as the front-end
to the LUKS and dm-crypt modules.
The LUKS extensions to cryptsetup supports various actions,
including luksFormat,
which is used to format a storage device
using the LUKS encryption standard;
isLuks, which is used to identify
if a given device is a LUKS device;
luksOpen, which is used to open a LUKS storage device
and set it up for mapping,
assuming you have provided the right key;
luksClose, which is used to remove
a LUKS storage device from mapping;
luksAddKey, which is used to associate
a new key material with that LUKS device;
and luksDelKey, which is used to remove
the key material from a LUKS device.
To run cryptsetup, simply type in cryptsetup,
options, action, and the action arguments.
The next thing we're going to talk about is hashing,
and I mentioned earlier that hashing is very important
to the integrity of your data.
Hashing is a process or function that transforms
plaintext input into indecipherable, fixed-length output.
It ensures that this process cannot be easily reversed.
The resulting output of the hashing process
is known as a hash, a hash file, or a message digest.
The input data can vary in length,
but that hash length is always going to be fixed.
Hashing is used in a lot of different
password-authentication schemes,
and hash values can also be embedded
into electronic messages to support data integrity.
Finally, you can hash files and then verify
the integrity of that file after you transfer it
by ensuring that the hash you sent also matched
the hash they calculated when they received the file.
Now, in addition to everything
we've covered up to this point,
we also need to talk about how you can protect your data
as it's going across a network.
So when you're configuring your network configurations,
especially for your web servers,
you always want to enable SSL and TLS.
This guarantees confidentiality and authenticity in the data
as it's being sent and received
from the clients to your servers.
When it comes to all of your different Linux servers,
you do want to configure SSH to disable root access.
This will prevent an authorized user from gaining
complete access over a system from a remote location.
Now, whenever you're doing remote access and receiving
other types of network connections from clients,
you should always configure your system
to deny hosts that it doesn't recognize.
To do this, you'll establish an allow list
of the acceptable hosts
so that all the hosts that are not on that list
are automatically considered untrusted, and blocked.
Finally, you should consider changing
the default port associations for certain services,
like SSH or HTTP or HTTPS,
unless you want those to be easily found.
For example, you might set up your SSH server
to only listen on port 2222 instead of port 22.
This will make it a little bit harder
for attackers to find it,
and it could stop some automated attacks
against well-known ports.
Now realize this is what we call security through obscurity,
and this should not be the only thing
you're doing to secure your systems
by hiding services over different ports,
but it is a little something you can do
to try to make it harder for people
to find out where you're running your services.
Now, if you're running a web server,
you need to understand how to set up SSL and TLS.
If you're running an Apache web server,
which is the most commonly used one on Linux,
you're first going to generate a self-signed certificate
using a tool like OpenSSL,
or you're going to request and obtain a certificate
directly from an external authority,
such as Verisign or Entrust.
Once you have that,
you're going to download it onto your system.
Then you're going to download and install the mod_ssl package.
Once you've done that,
open up the configuration file for your web server,
which is located at /etc/httpd/conf.d/ssl.conf,
and you can edit that file and be able to uncomment
the document root and server name lines
and replace them with the values necessary
to ensure that the SSL engine is set to on.
Also, you want to make sure you point
your SSLCertificateFile to the path
where you downloaded your certificate on your system.
You'll also point your SSLCertificateKeyFile to the path
where your private key is going to be located,
and then you'll restart Apache and open a web browser
and verify that your site is presenting a valid certificate
using either SSL or TLS.
Now, let's talk about user access,
and how you can manage this using some best practices.
This includes being able to protect
your boot loader configuration with a password
to prevent unauthorized personnel
from tampering with the boot options
and enabling a password within your system's BIOS or UEFI
to prevent unauthorized personnel from installing
or booting into a new operating system.
If you're trying to figure out what USB storage devices
are connected to your system, you can use the lsmod command
to search for USB storage or any dependent modules.
If you see any modules you need to unload,
you can use the modprobe -r command
to unload the relevant modules from the kernel.
Then you can prevent those relevant modules
from being loaded again at boot
by creating a block list file
in the /etc/modprobe.d/ directory.
Another key thing to set up is auditing for your users.
You want to ensure that all of your user IDs
are not being shared, and instead,
each user is uniquely logging in using their own user ID.
This will make sure you can audit
all the actions a user's performing,
and that way you can maintain accountability
for each individual user.
Also, you may want to consider establishing
a public key infrastructure to enforce the use
of public and private keys for authentication,
because this is much more secure
than using usernames and passwords.
Another best practice is to restrict access to cron,
which is the Linux job scheduler.
By doing this, you can prevent unauthorized users
from configuring the system to automatically run
malicious or unwanted tasks at regular intervals,
and this will actually bypass their need
to log in and issue the command manually,
and so you don't want to do that.
Again, you want to make it harder for attackers
to break into your system and do bad things.
Finally, you should disable the use of Ctrl+Alt+Del
to prevent users from rebooting a system
and disrupting service availability if this is a server
that needs to remain up and online at all times.
All right, a couple of more best practices to cover,
and we'll finish up this lesson.
Next, we need to talk about the auditd service.
The auditd service is an audit daemon,
and it enables records to be used
to audit what is being written to storage
and what actions are happening.
Another thing you can do is you can modify
the /etc/issue file to add a banner message
that will display useful information
every time a user logs into the system.
We can also separate out our operating system
and our other data, like application files,
into different partitions,
and this will give us a little more segmentation
and a little bit more security.
Additionally, you want to make sure
you're regularly monitoring for common vulnerabilities
and exposures in the CVE database at cve.mitre.org,
which is the MITRE database called CVE.
This is a website that contains all of the vulnerabilities
for every software application and operating system
that they know about.
And so, if you do that, you'll be able to figure out,
is there anything vulnerable on your system
that you might need to patch and fix.
And finally, you want to make sure
you're hardening your system by disabling or uninstalling
any unused or insecure services.
Remember, services are things that are running
in the background of your Linux system,
and if there's a vulnerability in it,
it means an attacker can attack that
and take control of your system at any time.
There's lots of popular attacks for different services,
like FTP, Telnet, Finger, Sendmail, and Postfix,
just to name a few.
All right, when it comes to implementing
your cybersecurity best practices,
your goal is to protect the confidentiality, integrity,
and availability of the information on your system.
To help with this, you should consider using
advanced authentication mechanisms like LDAP and Kerberos
to centralize your authentication for your users.
Additionally, you might want to consider
using multifactor authentication,
so that way people have to use a username and a password
as well as something like
a biometric fingerprint or a token.
You also want to make sure that you're not granting
more access than is necessary
for any particular file or user.
You can do this by verifying you have the right
SUID and SGID properties set.
You also want to make sure you're placing
any unprivileged processes into chroot jails
to prevent them from accessing
other parts of the file system.
Anytime you're dealing with data,
it's always best to encrypt it,
so you want to encrypt sensitive data
while it's in transit, in use, or at rest,
and you can do this using LUKS
to fully encrypt your storage devices.
When it comes to networking, make sure you're doing things
like limiting root access over SSH,
implement user access best practices
to make sure people aren't sharing IDs,
and implement the best practices like separating
your operating system data and your application data
by placing them on different partitions or volumes.