Linux Security for Beginners

Explore x 5.9 certificates and public key infrastructure, including trust chains and certificate transparency, and learn to generate keys, create a certificate authority, and issue certificates on Linux using OpenSSL.

Explore how X.509 certificates document public key ownership, trace their lifecycle from registration to active use, and review issuer, subject, public key fields and extensions.

Explore public key infrastructure, trust chains, and the certificate transparency framework, including root and intermediate certificates, certificate authorities, registration authorities, and end-entity certificates.

Generate and manage public/private keys with openssl using rsa, encrypt the private key with a passphrase, produce 2048-bit pem-formatted private and public keys, and learn their role in certificate authorities.

Learn to create a certificate authority with OpenSSL, generate RSA keys, and sign public keys using a SHA-256 X.509 certificate, enabling secure key signing and certificate issuance.

Generate a new RSA 2048 key, request a certificate, and sign it with your certificate authority to produce a valid X.509 certificate using OpenSSL.

Acquire trusted certificates with Let's Encrypt, ACME, and Certbot by proving domain ownership. Install and automate renewals on Apache servers for production sites.

Learn how cfssl speeds certificate creation, offering a modern alternative to OpenSSL. Use a JSON workflow to define subjects and generate a certificate authority.

Explore the fundamentals of public-private key cryptography and x.509 certificates within a PKI, including certificate authorities, and apply them in Linux with OpenSSL and tools like Let's Encrypt, ACME, CFSSL.

Explore TLS and SSL concepts for encryption, signing, and authentication. Implement https on an Apache server, serve cert chains, enable client authentication, and test configurations with OpenSSL clients.

Explain how ssl creates a secure client–server channel through a handshake and certificates, enabling encrypted communication. Tls offers stronger cipher suites and a more robust handshake.

Learn to configure Apache to serve https with ssl, enable sni, set port 443, supply certificate and key files, and implement hsts for secure, enforced connections.

Enable Apache to serve certificate chains by generating a ca key and x509 cert, creating a csr, signing it, and updating ssl config with the full chain for localhost.

Learn how to configure Apache to serve a certificate chain, restart the service, and verify certificate loading; inspect host and CA certificates to understand X.509 fields and chain validation.

Enable mutual verification in Apache httpd by configuring SSL verify client, SSL verify depth, and a CA certificate file to verify client and server certificates.

Configure OCSP stapling in Apache by defining a stapling cache, enabling SSL stapling, and restarting the Apache process; use a temp directory and consider let's encrypt for practice.

Use OpenSSL s_client to test ssl/tls connections to a server (like apache), verify certificates, inspect certificate data and chain, identify self-signed vs CA-signed certs, and troubleshoot tls handshakes.

Wrap up this section by reviewing tls and ssl functionality, enabling https with Apache, serving certificate chains, enabling client authentication, and testing with OpenSSL, including content security policy stapling.

Explore encrypted file systems by understanding block and file system encryption, using decrypt and encrypt tools to implement LUKS1 and LUKS2. Preview network bound disk encryption with Cleaver.

Block level encryption protects an entire disk in Linux, preventing data access when the drive is stolen. File level encryption protects individual files or directories, keeping data secure at rest.

Discover block level full disk encryption during Ubuntu install, including LVM options, erasing disk, and enabling disk level or partition level encryption with a security key and recovery key.

Unlocks the encrypted block disk at boot with a password to decrypt and boot into the Linux system, then authenticates as a user; examines the disk structure via dev/mapper.

Encrypt a partition with cryptsetup using luks format and access it via the mapper. Explore key slots and passphrases while performing live encryption and noting setup steps.

Learn to use cryptsetup with LUKS2 to back up and restore the disk header, manage key slots, and change or add keys on sda2.

Learn to encrypt specific files and directories on Linux with EncryptFS, using mount and unmount operations. Understand choosing a passphrase and cipher, and the importance of backups before encryption.

Explore network bound disk encryption with Clevis and Tang, a client–server, policy-based approach that binds data to a network server and enables automatic decryption.

Explore the fundamentals of block and file system encryption, including creating encrypted block drives and enabling file system level encryption. Also review Clovis and Tang for network bound disk encryption.

Explore the fundamentals of DNS and DNSSEC, configure BIND on a Linux machine to run a DNS server, and review security records like CAA, DANE, and multicast DNS.

Explore how the DNS maps domain names to IP addresses and how zones, root, TLD, and authoritative name servers work with recursive, iterative, and non recursive queries.

Explore how DNSSEC adds cryptographic signatures to DNS records, enabling verification of R SIGs with DNS key records, DS, and by using ZSK and KSK to prevent tampering.

Learn to set up a DNS server on Ubuntu with bind9, configure forwarders, and create a local zone mapping Scott Local to 127.0.0.1.

Configure your local machine to use 127.0.0.1 as the DNS server for Bind. Test lookups to see the domain resolve to the local IP and understand authoritative vs non-authoritative responses.

Enable dnssec on a bind server by generating a ksk and zone key with dnssec-keygen, then configure key access and inline signing before reloading bind.

Understand how CAA records specify which certificate authorities may issue certificates for a domain and its subdomains. Learn how DANE records use DNSSEC to provide a second source of validation.

Learn TSIG and multicast DNS in Linux security for beginners: see how TSIG signs DNS messages for server-to-server authentication and data integrity, and when multicast DNS is suitable.

Explore how DNS over TLS and DNS over HTTPS encrypt DNS queries to protect privacy, comparing DoT on port 853 with DoH over HTTPS port 443 and their browser adoption.

Multicast DNS resolves hostnames to IP addresses on small subnets without a centralized DNS server by broadcasting queries and sharing responses among devices.

Explore DNS fundamentals and DNS seq concepts, learn how to configure bind to implement a secure DNS server, and review security records and multicast DNS on Linux.

Learn to harden a Linux system by disabling unneeded software, configuring services, and applying ACL concepts, USB guard, SSL certificates, CAA root, and virtualization benefits for security.

Reduce the attack surface by disabling unused services and uninstalling unneeded components, then verify which services run and remove unused packages to prevent re-enabling, while protecting OS dependencies.

Learn to analyze and harden systemd services by running systemd-analyze security, interpret exposure scores, and disable private mounts, devices, and sensitive system calls.

Explore how ASLR randomizes address mappings to hinder library-based exploits, how DEP prevents code execution in non-executable memory, and how Exec Shield adds non-tradable memory protection against buffer overflows.

Install USB Guard, generate a new policy, and configure whitelist or blacklist rules to control which USB devices connect; enable the service and allow or block devices by id.

Generate a secure SSH key pair with ssh-keygen, save it by default, optionally add a passphrase, and configure SSH to use the key, disabling password authentication for stronger access control.

Create a temporary linux environment with chroot to safely test software and configurations without affecting your host. Learn to install bootstrap, set up a directory, and shell into the chroot.

Explore Meltdown and Spectre vulnerabilities on Linux systems, understand kernel mitigations, and evaluate when to enable or disable mitigations based on processor risk and performance.

Explore virtualization and containerization, comparing full operating-system virtualization with containers that share the host kernel. Learn how sandboxing and isolation enhance security on a Linux system.

Learn linux host hardening by disabling software and services, configuring system services, and understanding asla deep shield work, usb guard, ssl certificates, meltdown and Spectre mitigations, virtualization, and containerisation.

Learn host intrusion detection with the Linux audit system to detect unauthorized file use, detect malware with Linux malware detection, verify packages, and explore open A.S.A.P. and CCP.

Configure and use the linux audit system to monitor file access with auditd. Create rules with auditctl to watch reads and writes and inspect /var/log/audit for access events.

Install rkhunter with apt, run with --check to perform rootkit checks, indicators of compromise, and network traffic reviews; update indicators of compromise definitions and review logs to ensure system integrity.

Install rkhunter and run its checks on Linux to detect rootkits and indicators of compromise, update to fetch new indicators, and review the log while scheduling daily scans with cron.

Install and use the Linux malware detection tool to scan for malware, download with curl, extract the tarball, and configure email or Slack alerts and cron scans.

Learn to schedule daily host scans with cron via crontab -e, running malware and rootkit detections at 1 a.m. to minimize impact when no one is on the device.

Verify installed packages' integrity by checking their hashes against the package database, using md5 checks, and interpret results such as permissions issues and configuration file scopes.

Learn how the aid utility verifies file integrity by hashing system files and comparing them to a stored database, then initialize and run checks to detect changes.

Explore how OpenSCAP and the Security Content Automation Protocol automate Linux security compliance testing using policy-driven configuration and vulnerability scans. Reduce manual effort with automation.

Learn host intrusion detection using the Linux audit system, detect unauthorized file use, identify rootkits with chkrootkit and rkhunter, and verify packages as part of Linux malware detection.

Learn Linux resource control to limit resource use for individuals, users, or groups. Define and use cgroups, set limits, and manage process consumption with systemd slices.

Learn how ulimits prevent resource overconsumption and denial of service on Linux systems by setting limits on core dumps and processes.

Explore how seed groups (control groups) allocate resources across cpu, io, memory, net, and processes, using cpu set, memory limits, io restrictions, and device and net controls.

Explore systemd units and slices to manage resources in linux, compare system and user space, and configure cpu, memory, and i/o accounting for balanced allocations.

Configure per-process resource limits with system ctrl to allocate cpu shares and memory limits, balancing system and user space while preventing resource hogging.

Learn to enforce resource limits with ulimits, manage subgroups, and separate system and user resources while controlling individual process consumption. Examine access control for files and directories.

Learn discretionary access control, how to set file ownerships, configure uid and permissions bits, and manage and view access control lists for resources.

Explore discretionary access control, where the resource owner sets read, write, and execute permissions, and assess its ease for trusted users against risks of overly broad access.

Master Linux file ownership and discretionary access control by understanding owner, group, and others permissions (rwx), how to view them, and how superuser changes affect access.

Learn how setuid and setgid bits cause programs to run as the owner or a group, enabling access to restricted resources. See how chmod implements these permissions.

Explore access control lists to view and assign granular file permissions using getfacl and setfacl, including user, group, and other permissions and discretionary access control on files.

Review discretionary access control fundamentals, set file ownership, configure setuid bits, and manage access control lists. Explore mandatory access control to compare approaches for system resource access.

Explore mandatory access control concepts, including type enforcement and role-based access control, and learn to configure SELinux and AppArmor for users, processes, and applications.

Explore type enforcement and mandatory access control, with data classified by confidentiality and clearance levels, and role-based access control to assign permissions through centralized roles in Linux.

Explore SELinux basics by activating Linux, using policy core utils and Linux utils, configuring permissive, enforcing, or disabled modes, and introducing role-based access control; logs at /var/log/audit/audit.log inform policy decisions.

Explore SELinux policies and role-based access control, mapping users to roles and managing access to files, ports, and processes, with modules that enable or disable features to reduce attack surface.

Learn to view and manage linux selinux booleans to enable or disable daemon capabilities. Use setsebool to toggle booleans, noting most defaults are off to improve security.

Learn to manage Linux users and ports with the SC Linux management tool, adding and modifying users, refreshing accounts, and configuring port access under mandatory access control.

Learn how AppArmor provides mandatory access control to limit program resource access, generate basic policies, and test them against sample programs for secure confinement.

Learn how to configure AppArmor rules to grant only the resources an application needs, using aa-logprof to generate rules from denied access and reduce the attack surface.

Master type enforcement and access control models, configuring SELinux and AppArmor for access control of users, processes, and resources. Next, examine network-scoped ideas to secure networks around applications and servers.