Linux Server Security - Protect system from getting hacked!

This video gives an overview of the entire course.

In this video we will learn about the basics of security.

In this video we will be conducting integrity checks of the installation medium using checksum.

• Change the directory to the folder containing the downloaded ISO file

• Type md5sum command

• Compare the hash calculated

In this video we will learn to use the sudo command, to provide trusted users administrative access to the system without sharing the password.

• Create a normal account and then give it sudo access

• Use the sudo command from the new account

• Execute the administrative commands

Nmap is one of the most popular tools included in Linux that can be used to scan a network. We will use them in this video.

• Find all online hosts within a given IP range

• Optimize the process in order to scan the range faster

• Discover services that are online

The ls command is used to list files in a directory, and it is similar to the dir command in DOS. In this vide we will look how this command can be used with various parameters to give different results.

• Take a look at the simple listing of files in a current directory

• Check out details of files

• Print the file size in readable form

Change Mode or chmod is a Linux command that is used to modify the access permissions of files and directories. In this video we will look at an example of chmod.

• Change a single permission for users

• Separate different permissions using a comma

• Add or remove a permission for all the users

In addition to providing permissions for the owner and group of a particular file, we can set permissions for any user, user group, or group of all the users who are not in a group of a particular user using ACLs.

• Create three users and give them names

• Create a group with any name

• Check the permissions in the accounts directory

In this video we will see how mv or move command is used when we wish to move files from one directory to another.

• Move the testfile1.txt file from the current directory to any other directory

• Move multiple files using a single command

• Rename files and directories

One of the major aspects of user authentication is monitoring the users of the system. There are various ways to keep track of all the successful and failed login attempts made by a user in Linux and we will look at them in this video.

• Check incorrect login attempts for a particular user

• Use dmesg command, to see the log using the terminal

• View 10 most recent logs in a particular log file

Major role of a system administrator is to configure and manage users and groups on a Linux system. In this video we will limit the login capabilities of all users.

• Change login shell of the account to a special value

• Log in to sslh user as root

• Check details in the file again for the user1 account

Acct is an open source application which helps monitor user activity on a Linux system. In this video we will use this acct application to monitor user activity.

• Run script to configure the package

• Run the command make

• Install the package on Linux system

Defining user authorization on a computer mainly deals with deciding the activities that a user may or may not be allowed to do. In this video, we will go through various controls which can be applied on user accounts.

• Edit the sudoers file

• Run the ps command from user2 as user1

• Log in from user1 and try to change the passwords of the user2 and user3 accounts

SSH, or Secure Shell, is a protocol which is used to log on to remote systems securely and is the most commonly used method for accessing remote Linux systems. We will now see how to use SSH.

• Install software to use SSH

• Log in from the client system to the server system

• Configure SSH to it as per requirements

In this video we will learn to disable or enable the root login for SSH as per our requirements to prevent the chances of an attacker getting access to the system.

• Disable SSH root login

• Enable it again

Even though SSH login is protected by using passwords for the user account, we will make it more secure by using key-based authentication into SSH in this video.

• Create a pair of keys— a private key and a public key

• Copy the public key file to the remote SSH server

• Log in to the server again

When computers are connected to each other to form a network and exchange information and resources with each other, managing this network information becomes an important task for a system administrator.

• Check current IP address

• Check the available Ethernet devices on the system

• Disable Network Manager and then set the details of the IP address

One of the essential steps required to secure a Linux system is to set up a good firewall. In this video we ill configure a firewall using Iptables.

• Check whether any rule already exists on the system

• Check which of the modules of Iptables are loaded

• Make sure that any other packet that enters the INPUT chain should be blocked.

IP spoofing is a very common technique used by attackers to send malicious packets to a computer server. In this video we will block such spoofed addresses.

• Create a basic ruleset of iptables

• Restrict all incoming packets

One of the most important tasks for a Linux system administrator is to control access to network services. At times, it may be better to block all incoming traffic on the server and only allow the required services to connect so we will look at it in this video.

• Allow access to localhost data

• Accept all traffic-related to outbound connections

• Add rule to accept ping requests/responses (Echo ICMP) to keep our system's connections alive

sXid is the tool for monitoring SUID/SGID on a regular basis. Using this tool, we can track changes in the SUID/SGID of files and folders.

• Install the sXid package

• Change value for EMAIL to any other email ID

• Define list of directories

As a system administrator, one major concern is to protect the system from network intrusions. 
This is where PortSentry comes into the picture. It has the ability to detect scans on a host system and react to those scans in the way we choose.

• Install the Portsentry package

• Verify TCPand UDP ports

• Configure portsentry by editing the portsentry.conf file

SSL is a protocol used for transmitting sensitive information over the Internet. OpenSSL library provides an implementation of Secure Sockets Layer (SSL) and TLS Transport Layer Security (TLS) protocols.

• Install OpenSSL package on the first system

• Enable SSL support

• Create a self-signed certificate using OpenSSL

Tripwire is a host-based Intrusion Detection System (IDS), which can be used to monitor different filesystem data points and then alert us if any file gets modified or changed.

• Install Tripwire package

• Initialize Tripwire database

• Run the Tripwire interactive command to test it

Kali is a Debian-based Linux distribution developed for the purpose of security testing. With hundreds of penetration testing tools preinstalled, Kali is a ready to use OS. In this video we will install kali linux

• Learn the installation procedure

While performing computer forensics, it is important that the software being used is able to ensure the integrity of file structures. DEFT is designed for forensics and is based on Lubuntu, which is itself based on Ubuntu.

• Understand the different tools available in DEFT

Shellshock, or Bashdoor, is a vulnerability that's used in most versions of the Linux and Unix operating systems. In this video, we will take a look at how to set up our system to understand the internal details of the Shellshock vulnerability.

• Check the version of bash on the Linux system

• Check whether the vulnerability actually exists or not

• Define a function and export it in order to make it available in the child shell

Whenever a security vulnerability is found in any software, a security patch is released for the software so that the bug can be fixed. For such situations. We will be creating a sample program in C to understand the process of creating a patch file.

• Create a patch for a program using the diff command

• Apply the patch using the patch command

Logcheck is a good tool to help administrators analyze and scan log files. In this video, we will use the logcheck function to view and manage the log files.

• Install the Logcheck package and edit its configuration

• Change the format of the date/time stamp for

• Define the logs to be monitored

For any network that is either big or small, network monitoring and security is a very essential Task. In this video, we will take a look at how to use Nmap to perform different types of scans.

• Perform a simple scan using Nmap

• Scan more than one system

• Scan target system

For an administrator, system monitoring is also about monitoring the performance of the system by checking the processes and services running on it. Glances can highlight programs that use the maximum amount of system resources. We will now learn to use it in this video.

• Modify the threshold value for the color codes

• Modify the refresh time interval

• Enable the client/server mode of Glances

While working on Linux, the most commonly used command is ls, which gives a listing of the files in the directory we specified. However, it shows only a little information about the files. Instead, if we use the stat command, we can get more information about the files/ directories when compared to using ls.

• Use ls – l command to perform a long-listing of the file

• Use the stat command to check the details of the directories

• Use the -f option with the stat command

When running any command or program on our Linux machine, you might wonder what the background working of it is. For this, we have a very useful tool in Linux called strace. In this video, let's see how strace can be used in various ways to trace the execution of any program from start to end.

• Use the –c option to have a statistical summary of the strace command

• Use –e option to show only a specific call

• Use the –o option to save the output of the strace command in a file

Monitoring log files on Linux manually is a very tedious task. To make it easy, we can use auditing tools on our Linux system. Lynis is easy to use and we can get a security report in a faster duration of time. This is helpful when scanning Linux systems for vulnerabilities and malwares.

• Scan the complete system

• Find all the lines in the report that contain the word Warning

• Find all the lists of all the Suggestion given by Lynis

This video gives an overview of the entire course.

Most people have no idea how hackers actually gain access to a server. This section teaches how. So “Know thy enemy”. Understanding your enemy means learning how to protect against them. Additionally we will use what we learn here for the last section. Port Scanning in the first step when attacking.

• The attack’s problem: what can he actually attack

• Port Scanning shows which services are available to attack

• Even software versions can be identified, and it is very easy

By Port Scanning an attacker knows what applications are running on a server. So now an attacker tries to gain access to the server by missing security patches or misconfigurations in an application.

• Vulnerability scanners can help to show vulnerable services

• Setup of OpenVAS

• Vulnerabilities found on a test server by OpenVAS

Also passwords are a common way an attacker gains access to a system. Weak passwords on accounts or application default accounts can be identified automated and easily.

• How do hackers find weak accounts and what services can be used to guess passwords

• Using a tool to guess passwords via SSH

• The tool hydra finds weak passwords via SSH

Alternatively instead of attacking a server directly, if an attacker can compromise an administrator he can steal SSH keys and keylog his passwords to gain access to the servers.

• If a server or network is too secure, it might be easier for a hacker to try to comprise the administrator

• Compromising the administrator can be done by sending malware by email or to bait an admin to click on a malware link

• Hacker send dedicated handcrafted phishing email

Now that the three most common ways have been shown how hackers obtain unauthorized access to servers, the viewer should use this information to assess his own situation. This is called attack surface analysis.

• Introducing the security process: assessment, diagnosis, planning, implementation, evaluation

• By using a port scanner and a vulnerability the attack surface of the server is assessed

• Open ports are categorized in groups and protections are planned

The no.1 reason why systems are hacked are missing security updates. Configuring automated installation of security updates is an essential step to cope with this risk.

• Installing updates automated is critical for the system security

• What are the required Linux packages per Linux distribution

• How to properly configure the automated update process

Weak passwords are the no.2 reason why systems are broken into. Only allowing strong passwords helps to protect against that. A good alternative is the usage of SSH keys.

• Installing the module for strong password requirements

• How to configure strong password requirements for all Linux distributions

• Alternatively: what are SSH keys and how to use them

Often servers are hacked because attacker could access services that should not have been reachable for them. Firewalling protects against this.

• Analyze which service must be reachable over the network by whom

• Install the firewall scripting module of the Linux distribution

• Configure the firewall rules with the firewall script

The kernel is the heart of the Linux operating system and provides a lot of features that are good and bad for security, so it has to be configured well.

• Choose if you want to configure and compile your own kernel

• Configure the kernel dynamically against exploitation

• Configure the kernel dynamically against network denial-of-service attacks

Network services can be started because the operating system thinks they are necessary – but are not. This makes a system unnecessary vulnerable.

• Identify which network services are running and if they are necessary

• Disable unnecessary services

• Alternatively reconfigure the services so they are not reachable over the Internet

Every network service that is communicating with the Internet has to be hardened against attacks.

• Search the web for hardening guidelines for each service

• Check if how each service is started is hardened

• Configure the service feature securely

Postfix is the best mail service as it very secure and very flexible. Still there are a lot of configuration options necessary to properly secure it.

• Search the web for hardening options for Postfix

• Ensure it is not running as root, and that it is chrooted

• Secure the Postfix features and enable SSL

Apache is the most used web service. There are a lot of configuration options available to provide a good security.

• Search the web for hardening options for Apache

• Ensure it is not running as root

• Secure Apache features and enable SSL

Booting up Linux can be modified by local attacker to gain root access to the system. Grub allows changing the boot options if no authentication is configured, which is the default.

• Choose a secure password for authentication for grub

• Edit the grub custom config file with the password hash and write a new config

• Set Linux kernel dynamic hardening settings in /etc/sysctl.conf

SUID/SGID permission programs are an important mechanism for UNIX/Linux to example allow a user to change his password. However if a security is present in only one of these programs then the system can be compromised.

• Identify which SUID/SGID programs are present on the system

• Change permissions on those programs which are a risk

• Setup a boot script which always performs these permission changes to prevent updates reverting the change

Permissions are the heart of local system security of every operating system. If an attacker can read a sensitive file or write to a config or program, the system might be compromised.

• Understand the different permissions, read/write/execute, and special permissions SUID/SGID/sticky

• Identify dangerous permissions, especially everyone writeable files and directories

• Correct permissions that are at risk, best with a boot-up script

Using telnet, FTP and old SNMP is a high risk, as an attacker can capture login data on the network. It is better to use SSH which fully secures the session.

• Do not use insecure protocols for administration like Telnet

• Configure SSH securely

• Use solely SSH for remote access, even tunnel web management through it

All log messages should be sent to a central and especially secured loghost. For monitoring, SNMPv3 can be used securely to gather system information.

• Setting up syslog on the servers and the loghost

• Configuring SNMPv3 securely

• Think about deploying a full monitoring solution like Nagios

Data needs to be backed up in case of system failure or intrusion. Data can be synced, archived or saved with a full-blown backup software.

• For syncing rsync should be used via SSH

• tar and scp can be used to perform regular automated archiving

• For incremental backups, use a full blown backup software

Two software packages can make your systems more secure: fail2ban and sudo. Fail2ban temporarily blocks attacking hosts with firewall rules, sudo allows fine-grained administrative access for non-admins.

• Configure fail2ban to effectively discourage hackers

• Configure sudo to allow non-admin users to example restart a service

Automation is the key to be a successful administrator. We want to daily port scan our servers and get informed if anything changes.

• Install the packages and download an automation script

• Run the installation for the automation script

• Edit the configuration file

A regular vulnerability assessment scan is essential to ensure the systems are still secure. This video shows how to configure a week scan and email report with OpenVAS.

• Ensure your setup is working and configure a daily update script

• Configure an email alert and a weekly scheduler

• Create a scan task that uses the scheduler and email alert

This was a long and complex training. What did we cover and what should be remembered as key elements.

• Remember to run automatic updates, strong authentication and firewalling

• Use service hardening and kernel sysctl tuning for optimal security

• Good follow up training topics are ethical hacking and Docker