Implementing System Security

1. Configuring Firewall

Command	Description	Example
ufw enable	Enable the Uncomplicated Firewall	`ufw enable`
ufw disable	Disable the Uncomplicated Firewall	`ufw disable`
ufw status	Check the firewall status	`ufw status`
ufw allow [port]	Allow traffic on a specific port	`ufw allow 22`
ufw deny [port]	Deny traffic on a specific port	`ufw deny 80`
ufw delete [rule]	Delete a specific rule	`ufw delete allow 22`

Example: Allow SSH Access

ufw allow 22/tcp

Example: Deny HTTP Access

ufw deny 80/tcp

Note: Ensure that you allow access to SSH (port 22) before disabling the firewall to avoid being locked out.

2. Managing SSH Security

Configuration Option	Description	Default Value	Notes
PermitRootLogin	Allows or denies root login via SSH	`yes`	Set to `no` for enhanced security
PasswordAuthentication	Enables or disables password-based login	`yes`	Disable to enforce key-based authentication
PubkeyAuthentication	Enables or disables public key authentication	`yes`	Recommended to keep enabled for secure login
UsePAM	Enables or disables PAM authentication	`yes`	Should be enabled for proper authentication handling
Port	SSH server listening port	`22`	Change to a non-standard port for additional security
AllowUsers	Lists users allowed to log in via SSH	`none`	Can be used to restrict access to specific users
DenyUsers	Lists users denied access to SSH	`none`	Can be used to block specific users from logging in

Example: SSH Configuration File

# /etc/ssh/sshd_config
PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes
UsePAM yes
Port 2222
AllowUsers alice bob

Note: After modifying the SSH configuration, restart the SSH service to apply changes.

Warning: Changing the SSH port or disabling root login can lock you out if not configured properly.

SSH Security Best Practices

Disable root login via SSH
Use key-based authentication instead of passwords
Change the default SSH port (e.g., to 2222)
Restrict access to specific users using AllowUsers
Regularly update SSH server software to address vulnerabilities

3. Updating System Packages

Command	Description	Notes
apt update	Fetches the latest package lists from repositories	Run before `apt upgrade` to ensure latest versions
apt upgrade	Upgrades all installed packages to latest versions	Does not install new packages or remove old ones
apt full-upgrade	Upgrades packages and handles dependencies	May remove or install new packages to resolve conflicts
apt list --upgradable	Lists packages that can be upgraded	Useful for checking what will change before upgrading
apt install <package>	Installs a specific package	Can also upgrade if newer version exists

Example: Update and upgrade system packages

sudo apt update
sudo apt upgrade

Note: Always run apt update before apt upgrade to ensure you have the latest package information.

Warning: Running apt full-upgrade may remove or install packages that could affect system stability. Review changes before proceeding.

Package Manager	Update Command	Upgrade Command	Notes
apt (Debian/Ubuntu)	`apt update`	`apt upgrade`	Most common for Debian-based systems
yum (CentOS/RHEL)	`yum check-update`	`yum update`	Used in older Red Hat-based systems
dnf (Fedora)	`dnf check-update`	`dnf update`	Modern replacement for yum in Fedora
pacman (Arch)	`pacman -Sy`	`pacman -Su`	Used in Arch-based distributions

4. Implementing Fail2ban

Configuration File	Path	Description
fail2ban.conf	`/etc/fail2ban/fail2ban.conf`	Main configuration file for Fail2ban
jail.conf	`/etc/fail2ban/jail.conf`	Defines jails and their settings

Example: Basic jail configuration

[sshd]
enabled = true
port = ssh
filter = sshd
logpath = /var/log/auth.log
maxretry = 3
bantime = 3600

Example: Custom filter for application logs

[Definition]
failregex = ^<HOST>.*Failed login attempt.*
ignoreregex =

Note: Fail2ban monitors log files and bans IP addresses that show malicious behavior, such as too many failed login attempts.

Warning: Misconfiguring Fail2ban can lead to locking out legitimate users. Always test configurations in a non-production environment.

Command	Description	Usage
fail2ban-client status	Shows current status of Fail2ban	`fail2ban-client status`
fail2ban-client status sshd	Shows status of specific jail (e.g., sshd)	`fail2ban-client status sshd`
fail2ban-client set sshd unbanip <IP>	Unbans an IP address from a specific jail	`fail2ban-client set sshd unbanip 192.168.1.100`

5. Auditing System with Lynis

Feature	Description	Command	Status
System Hardening	Checks for system hardening configurations	`lynis audit system`	NEW
Vulnerability Scanning	Scans for known vulnerabilities in the system	`lynis audit --cron`	DEPRECATED
Security Compliance	Verifies compliance with security benchmarks	`lynis audit --benchmark`	NEW

Example: Running Lynis Audit

sudo lynis audit system

Note: Lynis is an open-source security auditing tool for Linux systems. It helps identify vulnerabilities and misconfigurations in the system.

Warning: Ensure Lynis is updated to the latest version to avoid missing critical security checks.

Key Features of Lynis

System hardening checks
Vulnerability scanning
Compliance verification
Security best practices recommendations

6. Scanning for Rootkits

Tool	Description	Features	Notes
chkrootkit	Rootkit scanner for Linux systems	Checks for common rootkits, backdoors, and suspicious files	Can detect known rootkit signatures and file modifications
rkhunter	Rootkit hunter for Linux systems	Scans for rootkits, backdoors, and local exploits	Includes checks for file integrity and system configuration
clamav	Anti-virus scanner for Linux systems	Detects rootkits and malicious software	Can be used in conjunction with other tools for deeper analysis

Example: Using chkrootkit

# Run chkrootkit on the system
sudo chkrootkit

# Output example:
ROOTKIT_CHECKS="chkrootkit"
CHKROOTKIT_VERSION="0.52"

Checking for rootkits...

Example: Using rkhunter

# Run rkhunter on the system
sudo rkhunter --check

# Output example:
[ OK ] The rootkit tests have been completed.

Note: Rootkit scanning tools should be run regularly to detect any potential threats on the system.

Warning: Some rootkits can evade detection by these tools. It's recommended to use multiple tools and manual checks for comprehensive security.

7. Setting Password Policies

Policy	Description	Configuration
PASS_MAX_DAYS	Maximum number of days a password is valid	`chage -M 90 username`
PASS_MIN_DAYS	Minimum number of days between password changes	`chage -m 7 username`
PASS_WARN_AGE	Days before password expiry to warn user	`chage -W 7 username`
PASS_MIN_LEN	Minimum password length	`passwd -l username`
PASS_MAX_LEN	Maximum password length (default 255)	Enforced via PAM modules
PASSWORD_QUALITY	Enforces complexity requirements	`pam_pwquality.so`

Example: Enforcing password complexity

password < 8 characters
repeated character sequences (e.g., "aaa")
sequential characters (e.g., "abc")
common dictionary words

Note: Password policies are enforced via /etc/pam.d/common-password or similar PAM configuration files.

Warning: Setting PASS_MAX_DAYS too low may cause users to change passwords too frequently, leading to weak passwords or user frustration.

8. Enforcing Password Complexity

Property	Value	Description
PASS_MAX_DAYS	`90`	Maximum number of days a password may be used before it must be changed
PASS_MIN_DAYS	`1`	Minimum number of days between password changes
PASS_WARN_AGE	`7`	Number of days before password expiry to warn user
PASS_MIN_LEN	`12`	Minimum length of password
PASS_COMPLEXITY	`required`	Enforce complexity rules (uppercase, lowercase, digits, special chars)

Example: Setting Password Policy

# Edit /etc/login.defs
PASS_MAX_DAYS   90
PASS_MIN_DAYS   1
PASS_WARN_AGE   7
PASS_MIN_LEN    12
PASS_COMPLEXITY required

# Apply to existing users
chage -M 90 -m 1 -W 7 user1

Note: Password complexity rules are enforced via pam_pwquality module in PAM configuration.

Warning: Setting PASS_MIN_LEN too low may compromise security. A minimum of 12 characters is recommended.

Rule	Requirement	Enforced By
Uppercase Letters	At least 1	`pam_pwquality`
Lowercase Letters	At least 1	`pam_pwquality`
Digits	At least 1	`pam_pwquality`
Special Characters	At least 1	`pam_pwquality`
No Dictionary Words	Not allowed	`pam_pwquality`

9. Using sudo Securely

Command	Description	Security Considerations
sudo -l	List allowed commands for current user	Shows permissions without executing, useful for auditing
sudo -u username command	Run command as another user	Prevents privilege escalation if misused; ensure target user exists
sudo -S	Read password from stdin	Useful in scripts but can be insecure if not handled properly

Example: Securely running a command as root

sudo -u root /usr/bin/systemctl restart nginx

Note: Always verify the command before running it with sudo. Never run commands from untrusted sources.

Warning: Misconfiguring /etc/sudoers can lead to full system compromise. Use visudo to edit the file safely.

Best Practices for sudo Usage

Limit user permissions to only what is necessary
Avoid using ALL in sudoers rules unless absolutely required
Use Defaults env_reset to prevent environment variable injection
Log all sudo commands for audit purposes

10. Implementing File Integrity Monitoring

Component	Description	Usage
aide	Advanced Intrusion Detection Environment	Monitors file integrity and detects changes to system files
tripwire	File integrity checking tool	Checks for unauthorized changes to files and configurations
ossec	Open Source Host-based Intrusion Detection System	Provides real-time file integrity monitoring and alerting

Example: AIDE Configuration

# /etc/aide.conf
# File integrity rules
/etc/passwd    p+i+n+u+g+s+b+e+m+o+a+q+r+l+P+T
/etc/shadow    p+i+n+u+g+s+b+e+m+o+a+q+r+l+P+T
/var/log       p+i+n+u+g+s+b+e+m+o+a+q+r+l+P+T

Example: AIDE Database Initialization

# Initialize AIDE database
aide --init

# Check for file changes
aide --check

Note: AIDE uses a combination of checksums and metadata to detect file changes. It is highly configurable and supports various hash algorithms like SHA-256, MD5, etc.

Warning: Ensure that the AIDE database is regularly updated to reflect legitimate system changes and avoid false positives.

11. Securing Shared Memory

Parameter	Value	Description
kernel.shmmax	`67108864`	Maximum size of shared memory segment in bytes (64MB)
kernel.shmall	`16777216`	Maximum number of shared memory pages (16GB)
kernel.shm_rmid_forced	`0`	Prevents forced removal of shared memory segments (0 = disabled)

Example: Setting Shared Memory Limits

sudo sysctl -w kernel.shmmax=67108864
sudo sysctl -w kernel.shmall=16777216

Note: Changes made with sysctl are temporary and will be lost after reboot. To make them permanent, add the settings to /etc/sysctl.conf.

Setting	Default Value	Recommended Value	Impact
kernel.shmmax	`67108864`	`134217728`	Increase to allow larger shared memory segments
kernel.shmall	`16777216`	`33554432`	Allow more shared memory pages for large applications

Example: Making Changes Permanent

echo "kernel.shmmax=134217728" | sudo tee -a /etc/sysctl.conf
echo "kernel.shmall=33554432" | sudo tee -a /etc/sysctl.conf

12. Disabling Unnecessary Services

Service	Status	Description	Action
bluetooth	`enabled`	Bluetooth service for wireless device connectivity	`sudo systemctl disable bluetooth`
cups	`enabled`	Common Unix Printing System for printer management	`sudo systemctl disable cups`
avahi-daemon	`enabled`	Service discovery for local network devices	`sudo systemctl disable avahi-daemon`
nfs-server	`enabled`	Network File System server for shared directories	`sudo systemctl disable nfs-server`
rpcbind	`enabled`	RPC port mapping service for NFS	`sudo systemctl disable rpcbind`

Example: Disable a service using systemctl

sudo systemctl disable bluetooth
sudo systemctl status bluetooth

Note: Disabling services reduces the attack surface of your system. Always verify that disabling a service does not impact required functionality.