Linux Security and Hardening, The Practical Security Guide.

Explore why linux is considered relatively secure, the superuser concept, and how open source software shapes security; examine user and admin roles and the principle of least privilege.

Explore how Linux security relies on trade-offs between convenience and protection, and why a system's security depends on users and admins; learn to mitigate risks with disciplined hardening and vigilance.

Linux secures multi-user systems with separate accounts, file permissions, and a root user who can access all processes. Open source software and package managers enable centralized updates and rapid patching.

Apply security guidelines such as minimizing installed software, separating services, encrypting data in transit and at rest, using least privilege, multi-factor authentication, and dedicated accounts to improve Linux hardening.

Explore the ongoing security lifecycle of Linux, from account management and log monitoring to encryption, least privilege, multi-factor authentication, and firewall capabilities, highlighting open source advantages.

Explore Linux security and hardening basics, including protecting physical security, evaluating third-party hosting and cloud implications, and implementing data encryption on new and existing Linux systems.

Shows how bootloaders can bypass single-user mode with init=/bin/bash and outlines hardening steps, including bootloader passwords, superusers, encrypted GRUB passwords, and data encryption against physical access.

Encrypt your disk with dm-crypt and LUKS to protect data on block devices; use strong passphrases or key files, understand memory handling, and enjoy transparent encryption via /dev/mapper during boot.

Back up the existing /home partition, overwrite with shred, format and create a new file system, mount, restore the backup, then configure fstab and crypttab to finish encryption.

Mask the control-alt-delete target on systemd to ignore reboot requests and reload the daemon; on older style systems, remove the line from startup configuration and reload.

Identify physical security threats to Linux systems. Reduce unauthorized access by preventing boot-time breaches, including attackers entering single user mode, password-protecting the bootloader, and disabling reboots when ctrl-alt-del is pressed.

Explore linux account types and password security, including shadow passwords and account expiration, then monitor logs, deploy intrusion detection systems, lock or unlock accounts, and implement multifactor authentication.

Explore how PAM on Linux governs authentication to protect accounts from privilege escalation, using login and sshd configurations in /etc/pam.d and module interfaces.

Identify linux account types and root's uid 0, then summarize password security with pam_pwquality, shadow passwords, and expiry controls via chage and pam_pw_history.

Secure Linux by managing account types, restricting root logins, and using sudo for privileged tasks, while configuring service accounts and removing unused accounts.

Shows how root logins are controlled by the secure ttyl file and switching between virtual consoles with ctrl+alt+f. Demonstrates creating an empty secure ttyl file to prevent directory logins.

The lecture demonstrates configuring sudo access for Bob, showing syntax checks in the sudo configuration, and using editors, whoami, and sudo -u to run commands as different users.

Explore techniques to secure network services, configure the Linux firewall, prevent information leakage, test open ports and perform port scans, and secure SSH and xinetd.

Hardening Linux network services begins with running daemons under dedicated users and binding them to needed interfaces. Use firewalls and tcp wrappers to restrict access and keep services updated.

Identify information leakage risks by auditing running services with systemctl, stopping and disabling unused services, and verifying listening ports with netstat, nmap, lsof, telnet, and nc.

Learn to secure sshd with key-based authentication, configure password and root login controls, and port forward with -L, -R, and -D for encrypted tunnels.

Master Linux firewall fundamentals by using netfilter and iptables to build chains (input, output, forward) and rules across filter, nat, mangle, raw, and security tables.

Configure IPv4 and IPv6 firewall rules with iptables and ip6tables, list chains with -L and -T, and set default policies for Linux security and hardening.

Demonstrates configuring a Linux firewall with iptables to allow http on port 80 and ssh from a private 10.0.0.0/24 network, then uses drop and reject rules, logging, and persistence.

Configure tcp wrappers to allow ssh and services by matching client ip/netmask patterns, listing allowed clients in hosts.allow, using except and severity controls, and denying all others by default.

Explore how Linux file and directory permissions work and apply proper permissions for files and directories, including secure sharing with groups and multiple users, append-only modes, and ACLs.

Explore how Linux file and directory permissions function and how improper or overly broad settings create security risks, with a practical refresher for seasoned users.

Learn to set file and directory permissions with groups and chgrp, and how umask masks like 022 and 002 determine 755/644 defaults for directories and files.

Explore extended attributes in Linux file systems, including immutable i and append-only a attributes. Learn to set, clear, and verify attributes with chattr and lsattr for log integrity.

Demonstrate protecting the hosts file by setting the immutable i attribute with lsattr verification, preventing edits or deletions and illustrating how append attributes affect log files.

Learn how access control lists extend Unix and Linux file permissions with access and default ACLs, using setfacl and getfacl to grant, modify, and view granular file and directory permissions.

Demonstrates configuring access control lists with setfacl and getfacl to grant project x group and individual users read and write rights, set default ACLs, and apply changes recursively.

Rootkits enable unauthorized root access and hide themselves, operating in user space or kernel space; detect with chk rootkit and rk hunter, then reinstall the OS or restore from backups.

This lecture demonstrates installing rk hunter on a linux system, updating rootkit rules, running checks, reviewing the log for warnings, and configuring email alerts and a cron job for monitoring.