- In this lesson 18.4,
we're gonna talk about Group Policy and SELinux.
In the Windows environment,
we can use Windows Group policy.
Windows Group Policy provides a centralized management
and configuration of our operating systems,
our applications, our user settings,
that are all part of the
Microsoft Windows Active Directory environment.
Now, a GPO or a Group Policy object
is a group of settings.
And GPOs can be associated with a single
or numerous active directory containers
including sites, domains,
and OU's or organizational units.
Now we use the group Policy Management Console, GPMC,
which is a snap-in to provide a single administrative tool
for managing Group Policy across the enterprise.
So we're gonna talk very high level about Group Policy,
specifically what some of the security enhancements are,
because literally we could do 40 hours, 80 hours, 120 hours
just on Windows networking and Group Policy.
So think of this as a really high level survey.
So let's look at some Group Policy Security Enhancements.
Account policies, user rights, audit policies,
our Windows firewall, our software restrictions,
our Windows update, having Command Prompt,
and PowerShell, and disallowing Removable Media.
Our account policies allow us to specify password
account lockout and Kerberos settings.
Our user rights allow us to specify the users
or groups that have rights or privileges on a device.
Our audit policies specify our security settings
that can control the logging of security events
and we know how important logging is.
Our Windows firewall specifies settings and rules
for local Windows stateful firewalls.
Our software restrictions specify settings to identify
and control software installation and execution.
Our Windows update settings control how Windows updates
are going to be installed on a device.
Command and PowerShell options control
how we moderate access to
either a command prompt or to PowerShell.
We can use GPOs to disallow access
to removable media drives,
including DVDs, CDs and well, even floppy drives.
So again, this is just a really, really high level overview.
You know, Microsoft Active directory
and Group Policy have just incredible, incredible myriad
of security options and enhancements.
But all I'm doing here to you today is just introducing you
to the idea of Group Policy and Group Policy objects.
Similarly, at a high level,
let's look at security enhanced Linux or SELinux.
Now SELinux, Security Enhanced Linux
is a Linux kernel access control security module.
Now it was created by the
United States National Security Agency, NSA and Red Hat.
But the security module is available
for most Linux distros or distributions
but it's mainly used on RHEL and Fedora.
Now SELinux operates on the principle of lease privilege.
And by default, everything is denied,
and that a policy is written that gives each element
of the system a process, a user, and so on,
only the permissions that it needs to function.
'Cause remember the idea of least-privilege
which we're only going to give the rights
and the permissions and the privileges necessary
to accomplish a task.
We are not going to give our user
or subject anything more than what they need.
So we have SELinux security policies.
SELinux security policies are a set of rules
that instruct SELinux users who has access
to the system resources.
Now, there are two types of policies.
A targeted policy and a strict policy.
A targeted policy, which is really the most common one
is where only selected processes are protected.
A strict policy is more stringent where
all processes are protected.
Now, SELinux uses what's known
as role-based access control.
Role-based access control is gonna be a way
of grouping privileges and assigning them to users.
So access control is going to be based
on the user-role-type model.
An SELinux user is used in the security context
and the Linux user is gonna be mapped to an SELinux user.
So we'll have your regular Linux user account,
and you'll be mapped to an SELinux user.
Now, the SELinux users are going to be assigned to roles
and those roles determine what the user can do
in the system.
Now, types are associated with processes
and resources like files or devices.
A role can be associated with multiple types,
and these associations will dictate what types
a user's processes can transition to based upon their roles.
Now, there are three SELinux modes,
enforcing, permissive, and disabled.
Enforcing mode is a default in most secure SELinux mode.
In this mode, SELinux enforces the access control policies
and does not allow users to override them.
In permissive mode, the SELinux
does not enforce the policies
but logs events when a user or process attempts to
access a resource that is blocked off by the policies.
And this really allows us to monitor for potential issues.
And then we have disabled mode.
In disabled mode, SELinux does not enforce
the access control policy
and this mode is really more useful for debugging
or when we're just really trying to learn more
about how to set up these configurations.
So just having a basic understanding
of GPO's Group Policy objects
in Microsoft Windows Active directory,
and then SELinux is gonna be important
for your examination.
And that takes us to a three second challenge.
Question one.
Microsoft Windows Active Directory
centralized management approach.
One, two, three.
That's gonna be Group Policy.
Number two.
A collection of Group Policy settings.
One, two, three.
That's gonna be a GPO or a Group Policy Object.
Number three.
The Linux kernel access control
security module that was created by the NSA.
One, two, three.
That's SELinux.
Number four.
The principle of giving subjects
minimal rights and permissions.
One, two, three.
That's gonna be least privilege.
And lastly, number five.
The default and most secure SELinux mode.
One, two, three.
And that's gonna be enforcing mode.
How'd you do?
I hope you did great.
So let's do a security-in-action about Linux Security.
Apply your knowledge.
Your organization recently installed an Apache web
server running a Linux operating system.
Now there is a need for strict access controls
over certain directories,
and you've been asked if this is
an appropriate use of SELinux.
So how do you respond?
So as our recap, right?
You have this Apache Web server
it's running a Linux operating system.
There's a need to have strict access control
over certain directories.
And the question is, does SELinux make sense?
Go ahead and put me on pause.
Think about this for a minute and come on back.
Absolutely.
This would be an appropriate use
of SELinux access control
using a targeted policy in enforcing mode.
Now, the caveat being that SELinux can be
complex to configure and manage,
and the initial implementation mode should probably
be permissive to ensure that it is implemented correctly.
Now, SELinux is just part of a defense in depth strategy.
And should be used right alongside
other security measures.
Doing that, well, you know what it is, right?
It is security in action.
There's your word cloud.
You know what to do.
When you're ready, head on over to our next quiz.