Hello, and welcome to this Pluralsight presentation.
My name is Andrew Mallet.
And in this module,
we're going to be working through hardening your Linux systems.
Now I'm going to be your instructor as I help guide you through this module,
a module where we're going to be taking a look at
what do we mean by hardening Linux.
Some of it is going to be looking at the services that we have
installed and removing services that we don't need.
Taking a look at removing insecure services. Maybe on a lot of modern systems,
we don't have some of our older services such as Telnet,
but we certainly need to be aware of what our system is
running and deciding if there are better,
more secure services that we could use to replace those.
Making sure that we have got our mandatory‑access control lists enabled.
So many systems like Ubuntu come with AppArmor already set up,
and when we're working with our Red Hat‑based systems such as Alma Linux,
we would normally expect to find SELinux enabled.
Well, let's make sure they are still enabled.
We'll look at the ways that we can create security
and tune our kernel with sysctl.
We'll be listing unused user accounts,
user accounts that perhaps haven't logged in for a while checking for when
the password was last changed on some of our user accounts,
and perhaps locking user accounts on password failure.
Now we're using Ubuntu 20.04 for these demonstrations.
It's all based around Vagrant virtual machines,
but we're using a brand new Vagrant system.
This is very easily set up with Vagrant.
We can go through and destroy the current Ubuntu system, bring it back up again.
This is cloning than the Vagrant box and creating a new instance of it.
And then, of course, SSHing back into our box.
But it becomes a very easy way when using these lab systems to be able to
return to a clean system without anything from previous labs.
The security as a Linux administrator, certainly is
going to be your responsibility.
I always think that if something is left just to the defaults,
it really does show a lack of thought,
and a lack of thought is those golden opportunities for those
people that want to break into your system because,
of course,
they're going to be aware of all of the defaults and they're
going to be making use of those defaults.
So we need to go through and start checking what services were
enabled and do we actually need those services?
Are there any insecure services that we have running?
Out of the box, very often, more services will be enabled than we actually need,
so let's go through and double check that the services we
have running are the services that we need.
Understanding some of the tools that you have available to investigate your
system can really uncover a lot of valuable information,
so we'll be taking a look at grep and awk and how we can use these
to discover more information about our system.
Now when we look at security, it's really like an onion.
It shouldn't be just one level, security is implemented in many layers.
And, of course, if you get it wrong, you're going to cry.
Now when we start talking about insecure services,
we can go through and take a look at something like Telnet.
We have SSH, so we don't really need Telnet,
but you might think, well, don't worry, Telnet is blocked through my firewall,
so it doesn't really matter if I'm running it or not.
Well, okay, what if your firewall fails or it is compromised?
What if somebody has gained access to your internal network,
and can you really trust all of your internal users?
Really?
Always assume the worst and work with this in mind,
and this is why security has got to be multilayered.
Sure, we're going to block Telnet at our firewall,
but we can also firewall our own server and ensure that Telnet isn't running,
as well as blocking it through our firewalls.
When we take a look at listing our services,
we no longer have the netstat command,
so we've got to get used to the ss command.
And if we just use those switches that we're used to with our netstat command,
then, of course, we're not going to see any advantage.
But some of the things that we can then go through and look at is our
listening ports and then start filtering on which ports we want.
The more investigation that we provide to these listening ports,
then the better we're going to understand.
Taking a look at ssh, well, that is a secure service,
so we shouldn't be too concerned about that.
But if it's listening on every interface,
do we need it listening on every interface?
Using systemctl and status, we're going to be able to see all of our services,
so without including any arguments after status, we can easily then
run down this list and determine whether or not we need those
services to be enabled or even installed.
And don't forget to check our mandatory‑access control lists.
If we're using Ubuntu, such as we will be,
we can go through and check our AppArmor status to
ensure that AppArmor is enabled.
If we were running on our Red‑Hat system or Alma Linux,
we can go through and use the getenforce command.
But let's check that it is loaded as we think it is.
Now we've seen a lot of slides,
but we really now need to go through and investigate the default install of Ubuntu that we have in our Vagrant box.