1. IS3440 Linux Security Unit 2 Securing a Linux Platform―Core Components

2. Class Agenda 3/23/16 Covers Chapter 2 and 3 Learning Objectives
Lesson Presentation and Discussions.
Discussion on Assignments.
Discussion on Lab Activities.
Lab will be perform in class.
Break Times as per School Regulations.
Quiz 3.1 will be held in the next class. It will cover chapter 1 to 3

3. Learning Objective
Configure the basic settings to secure a Linux platform.

4. Key Concepts Secure boot loaders
Security considerations while using kernel and user space components
Discretionary access control (DAC) and access control lists (ACLs)
Mandatory access control (MAC) with Security Enhanced Linux (SELinux)
Concepts of a packet filtering firewall

5. Linux Kernel more robust-Monolithic and modular.
Open source-source code available
Developers are mostly volunteers.
The Kernel can be customized-recompiled
Is Multi-User Operating System
Can be configured as a Domain Controller for Windows

6. Full function Linux can be booted from CD or a USB
Security challenges
Full function Linux can be booted from CD or a USB
Linux can be booted with admin privilege without a password
Security issued of booting from CDs or USB. Students should explore.
The GUI pose security risk
Many distribution with variety of desktop.

7. Common Boot Loaders Grand Unified Bootloader (GRUB)
Linux Loader (LILO)
Loadlin
Universal Bootloader (U-Boot)

9. GRUB need to be hardened.

10. GRUB Configuration Options
Comments
default=0
This option is for default kernel to boot. When multiple kernels are listed, the first one in the list will start at zero.
timeout=0
This option sets the time out to zero.
color green/blue
This option specifies the color for the GRUB screen. In this case, green is the foreground color and blue is the background color.
password – md5 <encrypted password>
This option is for the encrypted password.
splashimage=(hd0,0)/grub/splash.xpm.gz
This option is for “splash” image that shows when you access the GRUB menu.

11. Enable firewall

12. The Linux Firewall Location of netfilter Location of iptables User
Kernel Space
User Space
Hardware
User

13. Sudo Access

14. Access control mechanisms
Layered Security
Physical security
Firewall
Access control mechanisms
Encryption
Monitoring
Backups

15. SELinux

16. Common Linux Access Controls
MAC allows the file sharing service to interact with the shared filesystem.
DAC provides the required permissions to access files.
The firewall allows user access based on the file service port and user’s Internet Protocol address.

17. Immutable permission

18. Special Permission

19. Access Control Mechanisms
11/27/2018
Access Control Mechanisms
DAC
Defines the access control for objects in the filesystem
ACLs
Grants “special” permissions to users or groups for an object in the filesystem that are not specified in the DAC permissions
MAC
Adds additional categories to objects in the filesystem
DAC: For example, user Joe owns the file “readme.txt” and gives read access permission to everyone but only Joe has the write permissions.
MAC: Any user or process accessing the object must have proper access before interacting with it.
(c) ITT Educational Services, Inc.

20. Kernel Space
Kernel Space has access and can control all aspects of a Linux system.
Loadable kernel modules (LKMs) are a common avenue for rootkits.

21. User Space
User space is the most likely avenue that black-hat hackers attempt to exploit the Linux system.
It is common for black-hat hackers to gain unauthorized access simply by guessing an easy password from a user account.

22. Importance of a Firewall
Firewall on each host server provides an additional layer of security:
If the network perimeter firewall allows unauthorized traffic into the network, firewall protects servers from the unauthorized traffic.
Firewall provides additional protection to host servers if a rogue program infects the local area network (LAN).

23. Importance of Securing Core Components
Default settings, improper file permissions, and insecure user accounts are common methods used by black-hat hackers to gain unauthorized access.
Best practices and compliance standards require basic security and can result in hefty fines, if not followed.

24. Summary In this presentation, the following concepts were covered:
Common boot loaders
The process of Linux access control
Access control mechanisms such as DAC, ACL, and MAC
Considerations for using kernel space and user space
Importance of firewall and securing core components

25. Discussion 2.1 Identifying Layers of Access Control in Linux
Discussions and Lab
Discussion 2.1 Identifying Layers of Access Control in Linux
Lab 2.2 Configure Basic Security Controls on a Fedora Linux Server