Regardless of where you are in the cybersecurity world, network administrator, security analyst or hacker/penetration tester, learning how to make linux more secure is fundamental to your professional life, be it making systems safer or learning how to circumvent security measures.
How to Make Linux More Secure
Just because you are using Linux, doesn’t mean you are secure as security is an ongoing process. In this series of 5 articles, Secur covers a range of topics essential to learning how to make Linux more secure, including:
- Part 1: General security concepts, principles, and best practice guidelines.
- Part 2: Physical security.
- Part 3: Linux user account security.
- Part 4: Network security.
- Part 5: File system security.
Part 1: Understanding Linux Security Concepts
Before diving into specific security procedures for Linux, let’s review some general security concepts, principles, and best practice guidelines for the Linux operating system. This includes:
- Linux security features.
- The superuser.
- Why Linux is avoided by many attackers.
- Open source and security.
- Software management.
- User and administrator roles and
responsibilities in security. - Security Principles
- The security of software and services
- Encryption
- Accounts
- Multi-factor authentication
Is Linux Secure?
- This is the big question
- Nothing is perfectly secure.
- Security is a series of trade-offs.
- Most are trade off between convenience vs security
- No passwords to log on = easy to use, not secure.
- System powered off = secure, not usable.
Risk Assessment
You will always be making trade offs based on the severity of the risk. Below are some of the basic questions you need to ask and answer during the course of your risk assessment:
- What is the probability of the risk occurring?
- What is the potential damage associated if the risk materializes?
- What is the cost to mitigate the risk?
- In terms of performance and dollars
- What is the effectiveness of the
countermeasure?
Linux Security Risk Factors
- Linux can be configured to be less secure than it should be.
- Users may employ lax file permissions.
- System administration mistakes.
- Users could use easy to guess passwords.
- Data transmitted in the clear.
- Encryption should be used when possible.
- Malicious software installed on the system.
- Lack of training or security awareness.
What Makes Linux Secure?
Multiuser System
- Linux is a multiuser system.
- Having separate accounts allows for a separation of roles and permissions.
- The administrator/superuser is the root account.
root is all powerful- Owns that system
- Can’t have files hidden on them
- Root privileges are required to install system-wide software/ configure networking/manager users
- Keep the root account secure. Even administrators should have normal accounts for day to day activities.
- All other user accounts are “normal” accounts.
- Each user should have own account.
- Applications have their own accounts as well.
Benefits of a Multiuser System.
- File permissions.
- Can be customized on a per user basis
- Every file has an owner.
- The root user owns the files associated with the operating system
- A file’s creator owns individual files. These files usually live in the creator’s home directory.
- Permissions can be granted to other accounts and users as needed.
- Without the proper permissions, users cannot see, use or modify files that they do not own.
- An attacker only has the privileges of the account they exploited.
- This is why you do not run applications as root.
- Breaking into one account does not necessarily compromise the entire system.
- This is due to the way in which Linux permissions files.
- You cannot modify/use programs that an account does not have permissions for.
- Each process is run by an account.
- Every process has an owner.
- Each account can manage their processes.
- The exception is that * root can do anything.
Attackers Are Lazy
Linux isnt the most attractive target to hackers for a number of reasons:
- First off, there are fewer Linux systems than Windows.
- Linux user base is technical.
- Have higher security awareness.
Linux is Open Source
- You don’t have to trust one company.
- Practically impossible to sneak malicious code
into the Linux Kernel without people knowing it. - Open source increases the speed of discovery of
security holes. - Windows is a black box. You do not know what is going on under hood
Centralized Software Management
Centralized software management decreases the security risk for a number of reasons:
- Packages are managed by package managers.
- Packages are collections of files that make up an application
- Linux distributions provide package repositories.
- Centralization allow for the installation of software from a cryptologically trusted provider.
- Packages are signed by the developer with a cryptographic key so you can be sure who developed it and has not changed since the signature was applied.
- Prevents installation of maliciously altered software
- Most Linux OS software is open source.
- Anyone can read the source code for flows
- As flaws are addressed, packages are updated
- Easy to keep up with security updates. When updating the operating system, you can update all of the services being used.
- Linux vs Windows Software Installation
- Linux: Search the repository and install with the package manager.
- Windows: Search the Internet and install from a third party website.
- untested software. Microsoft has not vetted it.
- Closed source.
- You may not know what you’re going to get. Unwanted software is often bundled with it.
Linux Security Guidelines
Some of this guidelines can be generalized to situations involving any software/computing environment, not just Linux
Minimize Software and Services
Don’t install more software than you need. The more software you install and the more services you have running increase the size of the attack vector.
- If you don’t need a piece of software, don’t install it.
- If you don’t need a service, don’t start it
- If you no longer need the software or service,
stop and uninstall it.
Run Services on Separate Systems
If possible run each service on a separate system
Minimizes the risk of one compromised service leading to other compromised services.
If you run a file sharing service on a web server, someone who compromises the web server could gain access to the file server.
Encrypt Data Transmissions
- Protect against eavesdropping and man-in- the middle attacks.
- Always encrypt authentication credentials.
- Do not use unsecured protocols like:
Avoid Shared Accounts
There is a lack of accountability with shared accounts.
- Each person should have their own account.
- Each service should have its own account.
- Shared accounts make security auditing
difficult because you cannot tell who was logged in at the time. - People are more lax with shared accounts
Avoid Direct root Logins
- Do not allow direct login of shared accounts.
- Force users to login to their personal accounts.
and then switch to the shared account.- This creates a log record
- Control and monitor access with sudo command.
- sudo allows for temporary escalation of privileges .
- Do this rather than switching to the root account as it creates a log record.
Maintaining Accounts
- Enforce strong passwords
- Remove/lock unused accounts
- Create and use a process for removing access.
- Role changes
- Employee departure
Use Multi Factor Authentication
Multi factor authentication involves:
- Something you know, something you have or something you are (biometrics):
- Account password + phone to receive a one time code
- Account password + fingerprint
The Principle of Least Privilege
- Grant the least amount of user privilege in order to accomplish a task:
- Only use root privileges when required.
- Do not run services as the root user.
- Allow people and services just enough access to do their jobs, but no more.
Monitor System Activity
- Routinely review logs.
- Send logs to a central logging system. in real time.
- Even if an attacker modifies the local logs, the central ones will be intact.
Use a Firewall
- Linux has a built-in firewall.
- Netfilters: packet filtering framework built into Linux.
- iptables: Create firewall rules
- Only allow network connections from desired sources.
Encrypt Your Data
● Encrypt data while it is at rest.
