第 2 页
Practical Linux Security Cookbook Secure your Linux machines and keep them secured with the help of exciting recipes Tajinder Kalsi BIRMINGHAM - MUMBAI www.allitebooks.com
资料内容
第 3 页
Practical Linux Security Cookbook Copyright © 2016 Packt Publishing All rights reserved. No part of this book may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, without the prior written permission of the publisher, except in the case of brief quotations embedded in critical articles or reviews. Every effort has been made in the preparation of this book to ensure the accuracy of the information presented. However, the information contained in this book is sold without warranty, either express or implied. Neither the author, nor Packt Publishing, and its dealers and distributors will be held liable for any damages caused or alleged to be caused directly or indirectly by this book. Packt Publishing has endeavored to provide trademark information about all of the companies and products mentioned in this book by the appropriate use of capitals. However, Packt Publishing cannot guarantee the accuracy of this information. First published: April 2016 Production reference: 1260416 Published by Packt Publishing Ltd. Livery Place 35 Livery Street Birmingham B3 2PB, UK. ISBN 978-1-78528-642-1 www.packtpub.com www.allitebooks.com
第 4 页
Credits Author Copy Editors Tajinder Kalsi Sonia Cheema Safis Editing Reviewer Nick Glynn Project Coordinator Shweta H Birwatkar Commissioning Editor Veena Pagare Proofreader Safis Editing Acquisition Editor Divya Poojari Indexer Rekha Nair Content Development Editor Mehvash Fatima Production Coordinator Aparna Bhagat Technical Editors Gebin George Cover Work Anushree Arun Tendulkar Aparna Bhagat www.allitebooks.com
第 5 页
About the Author Tajinder Kalsi is an innovative professional with more than 9 years of progressive experience within the information security industry. He has a good amount of knowledge and experience in web application testing, vulnerability assessment, network penetration testing, and risk assessment. At present, he is working as an independent information security consultant. He started his career with Wipro as a technical associate, and later on he became an ISMS consultant cum technical evangelist. In his free time, he conducts seminars in colleges all across India on various topics, and he has covered more than 125 colleges and spoken to 10,000+ students. In the past, he has reviewed books such as Web Application Penetration Testing with Kali Linux, Mastering Kali Linux for Advanced Penetration Testing, and Advanced Wireless Penetration Testing for Highly-Secured Environments. You can find him on Facebook at www.facebook.com/tajinder.kalsi.tj, or contact him on his website at www.tajinderkalsi.com. www.allitebooks.com
第 6 页
About the Reviewer Nick Glynn is a senior software/API engineer working for freelancer.com, where he provides backend and platform support across the stack using the latest technologies. Drawing on his broad range of experience from Board Bring up, Linux driver development and systems development through to full stack deployments, web app development and security hardening for both the Linux and Android platforms, Nick continues his independent efforts as a training instructor and consultant, delivering courses and expertise on Go, Python, and secure Linux development across the globe through his company Curiola (www.curiola.com). I would like to thank my family for their love and my beautiful daughter, Inara, for always being there to brighten my day. www.allitebooks.com
第 7 页
www.PacktPub.com eBooks, discount offers, and more Did you know that Packt offers eBook versions of every book published, with PDF and ePub files available? You can upgrade to the eBook version at www.PacktPub.com and as a print book customer, you are entitled to a discount on the eBook copy. Get in touch with us at customercare@packtpub.com for more details. At www.PacktPub.com, you can also read a collection of free technical articles, sign up for a range of free newsletters and receive exclusive discounts and offers on Packt books and eBooks. TM https://www2.packtpub.com/books/subscription/packtlib Do you need instant solutions to your IT questions? PacktLib is Packt's online digital book library. Here, you can search, access, and read Packt's entire library of books. Why Subscribe? f Fully searchable across every book published by Packt f Copy and paste, print, and bookmark content f On demand and accessible via a web browser www.allitebooks.com
第 8 页
Table of Contents Preface v Chapter 1: Linux Security Problems 1 Introduction 1 The security policy of Linux 2 Configuring password protection 2 Configuring server security 3 Security controls 5 Conducting integrity checks of the installation medium by using checksum 5 Using the LUKS disk encryption 7 Making use of sudoers – configuring sudo access 9 Scanning hosts with Nmap 12 Gaining a root on a vulnerable Linux system 15 Chapter 2: Configuring a Secure and Optimized Kernel 21 Introduction 21 Requirements for building and using a kernel 22 Creating a USB boot media 22 Retrieving a kernel source 23 Configuring and building a kernel 25 Installing and booting from a kernel 31 Testing and debugging a kernel 34 Configuring a console for debugging using Netconsole 34 Debugging a kernel on boot 41 Chapter 3: Local Filesystem Security 43 Viewing files and directory details using the ls command 43 Changing file permissions using the chmod command 46 Implementing access control list (ACL) 50 i www.allitebooks.com
第 9 页
Table of Contents File handling using the mv command (moving and renaming) 54 Install and configure a basic LDAP server on Ubuntu 60 Chapter 4: Local Authentication in Linux 71 User authentication and logging 71 Limiting the login capabilities of users 75 Monitoring user activity using acct 78 Login authentication using a USB device and PAM 82 Defining user authorization controls 87 Chapter 5: Remote Authentication 91 Remote server/host access using SSH 91 Disabling or enabling SSH root login 95 Restricting remote access with key-based login into SSH 99 Copying files remotely 102 Setting up a Kerberos server with Ubuntu 107 Chapter 6: Network Security 117 Managing the TCP/IP network 117 Using Iptables to configure a firewall 121 Blocking spoofed addresses 127 Blocking incoming traffic 130 Configuring and using the TCP Wrapper 135 Chapter 7: Security Tools 141 Linux sXID 141 Portsentry 144 Using Squid proxy 150 OpenSSL Server 154 Tripwire 160 Shorewall 167 Chapter 8: Linux Security Distros 173 Kali Linux 173 pfSense 179 DEFT – Digital Evidence and Forensic Toolkit 185 NST – Network Security Toolkit 192 Helix 196 Chapter 9: Patching a Bash Vulnerability 203 Understanding the bash vulnerability through Shellshock 203 Shellshock's security issues 207 The patch management system 212 Applying patches on the Linux systems 218 ii www.allitebooks.com
第 10 页
Table of Contents Chapter 10: Security Monitoring and Logging 223 Viewing and managing log files using Logcheck 223 Monitoring a network using Nmap 227 Using glances for system monitoring 231 Monitoring Logs using MultiTail 234 Using system tools – Whowatch 237 Using system tools – stat 241 Using system tools – lsof 244 Using system tools – strace 247 Using Lynis 251 Index 255 iii www.allitebooks.com
第 12 页
Preface When setting up a Linux system, security is supposed to be an important part of all stages. A good knowledge of the fundamentals of Linux is essential to implementing a good security policy on the machine. Linux, as it ships, is not completely secure, and it is the responsibility of the administrator to configure the machine in a way such that it becomes more secure. Practical Linux Security Cookbook will work as a practical guide for administrators and help them configure a more secure machine. If you want to learn about Kernel configuration, filesystem security, secure authentication, network security, and various security tools for Linux, this book is for you. Linux security is a massive subject and not everything can be covered in just one book. Still, Practical Linux Security Cookbook will give you a lot of recipes for securing your machine. What this book covers Chapter 1, Linux Security Problems, covers various vulnerabilities and exploits in relation to Linux. It also discusses the kinds of security that can be implemented for these exploits. Topics include preparing security policies and security controls for password protection and server security and performing vulnerability assessments of the Linux system. It also covers the configuration of sudo access. Chapter 2, Configuring a Secure and Optimized Kernel, focuses on the process of configuring and building the Linux kernel and its testing. Topics covered include requirements for building a kernel, configuring a kernel, kernel installation, customization, and kernel debugging. The chapter also discusses configuring a console using Netconsole. Chapter 3, Local Filesystem Security, looks at Linux file structures and permissions. It covers topics such as viewing file and directory details, handling files and file permissions using chmod, and the implementation of an access control list. The chapter also gives readers an introduction to the configuration of LDAP. v
第 13 页
Preface Chapter 4, Local Authentication in Linux, explores user authentication on a local system while maintaining security. Topics covered in this chapter include user authentication logging, limiting user login capabilities, monitoring user activity, authentication control definition, and also how to use PAM. Chapter 5, Remote Authentication, talks about authenticating users remotely on a Linux system. The topics included in this chapter are remote server access using SSH, disabling and enabling root login, restricting remote access when using SSH, copying files remotely over SSH, and setting up Kerberos. Chapter 6, Network Security, provides information about network attacks and security. It covers managing the TCP/IP network, configuring a firewall using Iptables, blocking spoofed addresses, and unwanted incoming traffic. The chapter also gives readers an introduction to configuring and using TCP Wrapper. Chapter 7, Security Tools, targets various security tools or software that can be used for security on a Linux system. Tools covered in this chapter include sXID, PortSentry, Squid proxy, OpenSSL server, Tripwire, and Shorewall. Chapter 8, Linux Security Distros, introduces the readers to some of the famous distributions of Linux/Unix that have been developed in relation to security and penetration testing. The distros covered in this chapter include Kali Linux, pfSense, DEFT, NST, and Helix. Chapter 9, Patching a Bash Vulnerability, explores the most famous vulnerability of Bash shell, which is known as Shellshock. It gives readers an understanding of Shellshock vulnerability and the security issues that can arise with its presence. The chapter also tells the reader how to use the Linux Patch Management system to secure their machine and also gives them an understanding of how patches are applied in a Linux system. Chapter 10, Security Monitoring and Logging, provides information on monitoring logs in Linux, on a local system as well as a network. Topics discussed in this chapter include monitoring logs using Logcheck, using Nmap for network monitoring, system monitoring using Glances, and using MultiTail to monitor logs. A few other tools are also discussed, which include Whowatch, stat, lsof, strace, and Lynis. What you need for this book To get the most out of this book, readers should have a basic understanding of the Linux filesystem and administration. They should be aware of the basic commands of Linux, and knowledge about information security would be an added advantage. This book will include practical examples on Linux security using inbuilt tools of Linux as well as other available open source tools. As per the recipe, readers will have to install these tools if they are not already installed in Linux. vi
第 14 页
Preface Who this book is for Practical Linux Security Cookbook is intended for all those Linux users who already have knowledge of Linux filesystems and administration. You should be familiar with basic Linux commands. Understanding information security and its risks to a Linux system is also helpful in understanding the recipes more easily. However, even if you are unfamiliar with information security, you will be able to easily follow and understand the recipes discussed. Since Practical Linux Security Cookbook follows a practical approach, following the steps is very easy. Sections In this book, you will find several headings that appear frequently (Getting ready, How to do it, How it works, There's more, and See also). To give clear instructions on how to complete a recipe, we use these sections as follows: Getting ready This section tells you what to expect in the recipe and describes how to set up any software or any preliminary settings required for the recipe. How to do it… This section contains the steps required to follow the recipe. How it works… This section usually consists of a detailed explanation of what happened in the previous section. There's more… This section consists of additional information about the recipe in order to make the reader more knowledgeable about the recipe. See also This section provides helpful links to other useful information for the recipe. vii
第 15 页
Preface Conventions In this book, you will find a number of text styles that distinguish between different kinds of information. Here are some examples of these styles and an explanation of their meaning. Code words in text, database table names, folder names, filenames, file extensions, pathnames, dummy URLs, user input, and Twitter handles are shown as follows: "The md5sum command will then print the calculated hash in a single line." Any command-line input or output is written as follows: telinit 1 New terms and important words are shown in bold. Words that you see on the screen, for example, in menus or dialog boxes, appear in the text like this: "Navigate to Main Menu | Backtrack | Exploitation Tools | Network Exploitation Tools | Metasploit Framework | Msfconsole." Warnings or important notes appear in a box like this. Tips and tricks appear like this. Reader feedback Feedback from our readers is always welcome. Let us know what you think about this book—what you liked or disliked. Reader feedback is important for us as it helps us develop titles that you will really get the most out of. To send us general feedback, simply e-mail feedback@packtpub.com, and mention the book's title in the subject of your message. If there is a topic that you have expertise in and you are interested in either writing or contributing to a book, see our author guide at www.packtpub.com/authors. viii
第 16 页
Preface Customer support Now that you are the proud owner of a Packt book, we have a number of things to help you to get the most from your purchase. Downloading the example code You can download the example code files for this book from your account at http:// www.packtpub.com. If you purchased this book elsewhere, you can visit http://www. packtpub.com/support and register to have the files e-mailed directly to you. You can download the code files by following these steps: 1. Log in or register to our website using your e-mail address and password. 2. Hover the mouse pointer on the SUPPORT tab at the top. 3. Click on Code Downloads & Errata. 4. Enter the name of the book in the Search box. 5. Select the book for which you're looking to download the code files. 6. Choose from the drop-down menu where you purchased this book from. 7. Click on Code Download. You can also download the code files by clicking on the Code Files button on the book's webpage at the Packt Publishing website. This page can be accessed by entering the book's name in the Search box. Please note that you need to be logged in to your Packt account. Once the file is downloaded, please make sure that you unzip or extract the folder using the latest version of: f WinRAR / 7-Zip for Windows f Zipeg / iZip / UnRarX for Mac f 7-Zip / PeaZip for Linux Downloading the color images of this book We also provide you with a PDF file that has color images of the screenshots/diagrams used in this book. The color images will help you better understand the changes in the output. You can download this file from http://www.packtpub.com/sites/default/files/ downloads/PracticalLinuxSecurityCookbook_ColoredImages.pdf. ix
第 17 页
Preface Errata Although we have taken every care to ensure the accuracy of our content, mistakes do happen. If you find a mistake in one of our books - maybe a mistake in the text or the code - we would be grateful if you could report this to us. By doing so, you can save other readers from frustration and help us improve subsequent versions of this book. If you find any errata, please report them by visiting http://www.packtpub.com/submit-errata, selecting your book, clicking on the Errata Submission Form link, and entering the details of your errata. Once your errata are verified, your submission will be accepted and the errata will be uploaded to our website or added to any list of existing errata under the Errata section of that title. To view the previously submitted errata, go to https://www.packtpub.com/books/ content/support and enter the name of the book in the search field. The required information will appear under the Errata section. Piracy Piracy of copyrighted material on the Internet is an ongoing problem across all media. At Packt, we take the protection of our copyright and licenses very seriously. If you come across any illegal copies of our works in any form on the Internet, please provide us with the location address or website name immediately so that we can pursue a remedy. Please contact us at copyright@packtpub.com with a link to the suspected pirated material. We appreciate your help in protecting our authors and our ability to bring you valuable content. Questions If you have a problem with any aspect of this book, you can contact us at questions@packtpub.com, and we will do our best to address the problem. x
第 18 页
1 Linux Security Problems In this chapter, we will discuss the following: f The security policy of Linux f Configuring password protection f Configuring server security f Conducting integrity checks of the installation medium using checksum f Using the LUKS disk encryption f Making use of sudoers – configuring sudo access f Scanning hosts with Nmap f Gaining a root on a vulnerable Linux system Introduction A Linux machine is only as secure as an administrator configures it to be. Once we are done with the installation of the Linux OS and we remove its unnecessary packages after the installation has been completed, we can start working on the security aspect of the software and the services provided by the Linux machine. 1
第 19 页
Linux Security Problems The security policy of Linux A security policy is a definition that outlines the rules and practices to be followed to set up the computer network security in an organization. How the organization should manage, protect, and distribute sensitive data is also defined by the security policy. Developing a security policy When creating a security policy, we should keep in mind that it should be simple and easy for all users. The objective of the policy should be to protect data while keeping the privacy of users intact. It should be developed around these points: f Accessibility to the system f Software installation rights on the system f Data permission f Recovery from failure When developing a security policy, a user should use only those services for which permission has been granted. Anything that is not permitted should be restricted in the policy. Configuring password protection In any system, the password plays a very important role in terms of security. A poor password may lead to an organization's resources being compromised. The password protection policy should be adhered to by everyone in the organization, from users to the administrator level. How to do it… Follow the given rules when selecting or securing your password. For the creation policy, follow these rules: f A user should not use the same password for all the accounts in an organization f All access-related passwords should not be the same f Any system-level account should have a password that's different from any other account held by the same user 2
第 20 页
Chapter 1 For the protection policy, follow these rules: f A password is something that needs to be treated as sensitive and confidential information. Hence, it should not be shared with anyone. f Passwords should not be shared through any electronic communication, such as e-mails. f Never reveal a password on your phone or questionnaire. f Do not use password hints that could provide clues to an attacker. f Never share company passwords with anyone, including administrative staff, managers, colleagues, and even family members. f Don't store passwords in written form anywhere in your office. If you store passwords on a mobile device, always use encryption. f Don't use the Remember Password feature of applications. f In there's any doubt of a password being compromised, report the incident and change the password as soon as possible. For the change policy, follow these rules: f All users and administrators must change their password on a regular basis or at least on a quarterly basis f The security audit team of an organization must conduct random checks to check whether the passwords of any user can be guessed or cracked How it works… With the help of the preceding points, ensure that a password, when created or changed, is not easy enough to be guessed or cracked. Configuring server security A major reason for malicious attacks on Linux servers has been poorly implemented security or existing vulnerabilities. When configuring a server, security policies need to be implemented properly, and ownership needs to be taken in order to properly customize the server. 3
显示前 20 页。下载资料查看完整内容。
评论 (0)
暂无评论。快来抢沙发吧！