Linux Essentials for Cybersecurity

William “Bo” Rothwell At the impressionable age of 14, William “Bo” Rothwell crossed paths with a TRS-80 Micro Computer System (affectionately known as a “Trash 80”). Soon after the adults responsible for Bo made the mistake of leaving him alone with the TRS-80, he immediately dismantled it and held his first computer class, showing his friends what made this “computer thing” work.Since this experience, Bo’s passion for understanding how computers work and sharing this knowledge with others has resulted in a rewarding career in IT training. His experience includes Linux, Unix, and programming languages such as Perl, Python, Tcl, and BASH. He is the founder and president of One Course Source, an IT training organization.Denise Kinsey, Ph.D, CISSP, CISCO Dr. Denise Kinsey served as a Unix administrator (HP-UX) in the late 1990s and realized the power and flexibility of the operating system. This appreciation led to her home installation of different flavors of Linux and creation of several academic courses in Linux. With a strong background in cybersecurity, she works to share and implement best practices with her customers and students. Dr. Kinsey is an assistant professor at the University of Houston.

• Introduction xxixPart I: Introducing Linux 2Chapter 1 Distributions and Key Components 4Introducing Linux 4Linux Distributions 5Shells 6GUI Software 7Installing Linux 7Which Distro? 8Native or Virtual Machine? 9Installing a Distro 10Summary 12Key Terms 12Review Questions 12Chapter 2 Working on the Command Line 14File Management 14The Linux Filesystem 14Command Execution 16The pwd Command 16The cd Command 16The ls Command 17File Globbing 18The file Command 19The less Command 19The head Command 19The tail Command 20The mdkir Command 20The cp Command 20The mv Command 21The rm Command 21The rmdir Command 22The touch Command 22Shell Features 22Shell Variables 22Initialization Files 27Alias 28Command History 29Redirecting Input and Output 30Advanced Commands 33The find Command 33Regular Expressions 35The grep Command 36The sed Command 37Compression Commands 38Summary 40Key Terms 40Review Questions 41Chapter 3 Getting Help 42Man Pages 42Man Page Components 42Man Page Sections 43Man Page Locations 46Command Help Options 46The help Command 46The info Command 47The /usr/share/doc Directory 48Internet Resources 49Summary 50Key terms 50Review Questions 51Chapter 4 Editing Files 52The vi Editor 52What Is vim? 53Essential vi Commands 54Use Basic vi Modes 54Entering the Insert Mode 55Movement Commands 56Repeater Modifiers 57Undoing 57Copying, Deleting, and Pasting 58Finding Text 59Find and Replace 60Saving and Quitting 61Expand Your vi Knowledge 62Additional Editors 63Emacs 63gedit and kwrite 65nano and joe 65lime and bluefish 65Summary 66Key Terms 66Review Questions 66Chapter 5 When Things Go Wrong 68The Science of Troubleshooting 68Step 1: Gathering Information 69Step 2: Determine the Likely Cause 70Step 3: Document Your Plan of Attack (POA) 71Step 4: Perform the Actions 71Steps 5 and 6: Is the Problem Solved? 71Step 7: Are There Other Problems? 71Step 8: Store the Documentation 72Step 9: Prevent Future Problems 72Notifying Users 72Pre- and Post-login Messages 72Broadcasting Messages 77Summary 79Review Questions 79Part II: User and Group Accounts 80Chapter 6 Managing Group Accounts 82What Are Groups Used For? 82Primary versus Secondary Groups 82The /etc/group File 84Special Groups 85User Private Groups 86The /etc/gshadow File 88Managing Groups 90Creating Groups 90Modifying Groups 91Deleting Groups 91Adding Users to Groups 92Group Administrators 93Summary 93Key Terms 93Review Questions 94Chapter 7 Managing User Accounts 96The Importance of User Accounts 96User Account Information 96The /etc/passwd File 97Special Users 98The /etc/shadow File 99Managing Users 102Creating Users 102Modifying Users 105Managing GECOS 105Deleting Users 107Restricted Shell Accounts 107Network-Based User Accounts 108Using su and sudo 108Restricting User Accounts 111Summary 116Key Terms 116Review Questions 117Chapter 8 Develop an Account Security Policy 118Introducing Kali Linux 118Security Principles 119Creating a Security Policy 120Securing Accounts 120Physical Security 120Educating Users 121Account Security 121Security Tools 124The john and Johnny Tools 124The hydra tool 125Summary 126Review Questions 126Part III File and Data Storage 128Chapter 9 File Permissions 130Standard Permissions 130Viewing Permissions 130Files Versus Directories 131Changing Permissions 131Default Permissions 132Special Permissions 134SUID 134SGID 136Sticky Bit 138Access Control Lists (ACLs) 139The mask Value 141Default ACLs 141Changing Ownership 143chown 143chgrp 144File Attributes 145Introduction to SELinux 146Users Create Security Holes 146Daemon Processes Create Security Holes 146SELinux Essentials 147Summary 149Key Terms 150Review Questions 150Chapter 10 Manage Local Storage: Essentials 152Filesystem Essentials 152Partitions 152Filesystems 153Why So Many Partitions/Filesystems? 154Which Partitions/Filesystems Should Be Created? 155Filesystem Types 155Managing Partitions 156Ext-Based Filesystem Tools 161Xfs-Based Filesystem Tools 166Additional Filesystem Tools 170du 170df 170Mounting Filesystems 170The umount Command 171The mount Command 171Mounting Filesystems Manually 173Problems Unmounting Filesystems 174Mounting Filesystems Automatically 175Device Descriptors 176Mount Options 177Mounting Removable Media 179Swap Space 179Creating Swap Devices 180Summary 181Key Terms 181Review Questions 181Chapter 11 Manage Local Storage: Advanced Features 184Encrypted Filesystems 184Managing autofs 186Logical Volume Manager 189Logical Volume Manager Concepts 190LVM Essentials 192Using Logical Volumes and Additional LVM Commands 197Resizing Logical Volumes 201LVM Snapshots 204Disk Quotas 206Setting Up a Disk Quota for a Filesystem 207Editing, Checking, and Generating User Quota Reports 207Hard and Soft Links 210Why Use Links? 211Creating Links 211Displaying Linked Files 212Summary 212Key Terms 212Review Questions 212Chapter 12 Manage Network Storage 214Samba 214SAMBA Configuration 215SAMBA Server 218SAMBA Accounts 220Accessing SAMBA Servers 221Network File System 223Configuring an NFS Server 224Configuring an NFS Client 229iSCSI 230Summary 236Key Terms 236Review Questions 236Chapter 13 Develop a Storage Security Policy 240Developing the Plan 240Backing Up Data 241Creating a Backup Strategy 241Standard Backup Utilities 246Third-party Backup Utilities 250Summary 250Key Terms 251Review Questions 251Part IV: Automation 252Chapter 14 crontab and at 254Using crontab 254Configure User Access to the cron Service 256/etc/crontab 258/etc/anacrontab 260Using at 261atq 261atrm 262Configure User Access to at Services 262Summary 263Key Terms 263Review Questions 263Chapter 15 Scripting 264Linux Programming 264BASH Shell Scripting 265Perl Scripting 265Python Scripting 266Basics of BASH Scripting 268Conditional Expressions 269Flow Control Statements 271The while Loop 272The for Loop 272Loop Control 272The case Statement 272User Interaction 273Using Command Substitution 274Additional Information 274Summary 274Key Terms 274Review Questions 275Chapter 16 Common Automation Tasks 276Exploring Scripts that Already Exist on Your System 276The /etc/cron.* Directories 276Repositories 279Creating Your Own Automation Scripts 280Summary 281Key Terms 281Review Questions 281Chapter 17 Develop an Automation Security Policy 282Securing crontab and at 282Securing BASH Scripts 283Access to Scripts 283Script Contents 284Dealing with Data 284Shell Settings 284Shell Style 285Summary 285Review Questions 285Part V: Networking 286Chapter 18 Networking Basics 288Network Terminology 288IPv4 Versus IPv6 290IPv4 Addresses 292Determining a Network Address from an IP Address and Subnet 293Private IP Addresses 294Common Protocol Suites 294Network Ports 295Summary 297Key Terms 297Review Questions 297Chapter 19 Network Configuration 298Ethernet Network Interfaces 298Displaying Ethernet Port Configurations 299Changing Ethernet Port Settings 300Network Configuration Tools 301The arp Command 302The route Command 303The ip Command 304The hostname Command 305The host Command 305The dig Command 306The netstat Command 307Persistent Network Configurations 307The /etc/hostname File (Universal) 307The /etc/hosts File (Universal) 307The /etc/resolv.conf File (Universal) 308The /etc/nsswitch.conf File (Universal) 308The /etc/sysctl.conf File (Universal) 309The /etc/sysconfig/network File (Red Hat) 310The /etc/sysconfig/network-scripts/ifcfg-interface-name Files (Red Hat) 310The /etc/network/interfaces File (Debian) 311Network Troubleshooting Commands 311The ping Command 311The traceroute Command 312The netcat Command 313Access to Wireless Networks 314The iwconfig Command 314The iwlist Command 315Summary 316Key Terms 316Review Questions 317Chapter 20 Network Service Configuration: Essential Services 318DNS Servers 318Essential Terms 319How Name Resolution Works 320Basic BIND Configuration 322Zone Files 326Zone File Basics 326Zone File Entries in the /etc/named.conf File 327Zone File Syntax 328Zone Record Types 329Putting It All Together 333Slave BIND Servers 335Testing the DNS Server 336The dig Command 336Securing BIND 337Sending BIND to Jail 337Split BIND Configuration 340Transaction Signatures 341DHCP Server 343DHCP Configuration Basics 344Configuring Static Hosts 346DHCP Log Files 347Email Servers 347SMTP Basics 348Configuring Postfix 349Managing Local Email Delivery 353procmail Basics 354procmail Rules 355procmail Examples 357mbox and Maildir Formats 357Remote Email Delivery 358IMAP and POP Essentials 358The Dovecot Server 359Summary 362Key Terms 362Review Questions 362Chapter 21 Network Service Configuration: Web Services 364Apache Web Server 364Basic Apache Web Server Configuration 365Starting the Apache Web Server 366Apache Web Server Log Files 367Enable Scripting 367Apache Web Server Security 370Essential Settings 370User Authentication 372Virtual Hosts 372Configuring IP-Based Virtual Hosts 373Configuring Name-Based Virtual Hosts 373HTTPS 374SSL Essentials 375SSL Issues 375Self-Signing 376SSL and Apache 376SSL Server Certificate 377Apache SSL Directives 381Proxy Servers 382Tunneling Proxy 383Forward Proxy 383Reverse Proxy 383Squid Basics 384Nginx Configuration 387Client Configuration 389Summary 391Key Terms 391Review Questions 391Chapter 22 Connecting to Remote Systems 394LDAP 394Key LDAP Terms 395The slapd.conf File 397Starting the LDAP Server 399OpenLDAP Objects 401OpenLDAP Schemas 401OpenLDAP Database Changes 402Using the ldapdelete Command 404Using the ldapsearch Command 405Using the ldappasswd Command 407Connecting to an LDAP Server 408FTP Servers 408Configuring vsftpd 409Connecting to an FTP server 412Secure Shell 415Configuring the Secure Shell Server 416Secure Shell Client Commands 418Advanced SSH Features 421Summary 423Key Terms 423Review Questions 423Chapter 23 Develop a Network Security Policy 426Kernel Parameters 426The /etc/sysctl.conf File 426Ignoring ping Requests 427Ignoring Broadcast Requests 428Enabling TCP SYN Protection 428Disabling IP Source Routing 428TCP Wrappers 428Network Time Protocol 430Setting the System Clock Manually 430Setting the System Time Zone Manually 432Setting the System Date Using NTP 434Summary 436Key Terms 436Review Questions 436Part VI: Process and Log Administration 438Chapter 24 Process Control 440Viewing Processes 440The ps Command 440The pgrep Command 442The top Command 442The uptime Command 444The free Command 445Running Processes 445Pausing and Restarting Processes 446Killing Processes 447The kill Command 447The pkill Command 448The killall Command 448The xkill Command 449The nohup Command 450Process Priority 450The nice Command 450The renice Command 450Summary 451Key Terms 451Review Questions 451Chapter 25 System Logging 452Syslog 452The syslogd Daemon 452The /var/log Directory 453The /etc/syslog.conf File 454Creating Your Own /etc/syslog.conf Entry 457The logrotate Command 458The /etc/logrotate.conf File 458The journalctl Command 459The /etc/systemd/journald.conf file 460Summary 461Key Terms 461Review Questions 461Part VII: Software Management 462Chapter 26 Red Hat—Based Software Management 464Red Hat Packages 464How to Obtain Packages 465The /var/lib/rpm Directory 465Using the rpm Command 466Listing rpm Information 466Installing Packages with rpm 472Removing Packages with rpm 474rpm2cpio 475The yum Command 475Repositories 475Using the yum Command 477Additional Tools 484Summary 484Key Terms 485Review Questions 485Chapter 27 Debian-Based Software Management 486Managing Packages with dpkg 486Listing Package Information with dpkg 486Installing Software with dpkg 489Reconfiguring Software with dpkg 490Extracting Files from a Debian Package 490Removing Packages with the dpkg Command 491Managing Packages with APT 492APT Repositories 492Creating a Source Repository 494Listing Package Information with APT Commands 494Installing Packages with APT Commands 496Removing Packages with APT Commands 499Additional APT Features 500Summary 500Key Terms 500Review Questions 500Chapter 28 System Booting 502Phases of the Boot Process 502The BIOS/UEFI Phase 502The Bootloader Phase 503The Kernel Phase 503The Post-Kernel Phase 504GRUB 504Legacy GRUB Configuration 504GRUB 2 Configuration 512Kernel Components 517Kernel Documentation 517Tweaking the Kernel 517Kernel Images 518Kernel Modules 519The /proc/sys Filesystem 526The init Phase 528Configuring Systemd 528Summary 531Key Terms 531Review Questions 532Chapter 29 Develop a Software Management Security Policy 534Ensuring Software Security 534Keep Packages Up to Date 534Consider Removing Unnecessary Packages 535Ensure You Install from Trusted Sources 536CVE 537Distribution-Specific Security Alerts 538xinetd 539Summary 540Key Terms 540Review Questions 541Part VIII: Security