Table Of ContentMastering Linux Security and
Hardening
Third Edition
A practical guide to protecting your Linux system
from cyber attacks
Donald A. Tevault
BIRMINGHAM—MUMBAI
Mastering Linux Security and Hardening
Third Edition
Copyright © 2023 Packt Publishing
All rights reserved. No part of this book may be reproduced, stored in a retrieval system, or transmitted in
any form or by any means, without the prior written permission of the publisher, except in the case of brief
quotations embedded in critical articles or reviews.
Every effort has been made in the preparation of this book to ensure the accuracy of the information
presented. However, the information contained in this book is sold without warranty, either express or
implied. Neither the author, nor Packt Publishing or its dealers and distributors, will be held liable for any
damages caused or alleged to have been caused directly or indirectly by this book.
Packt Publishing has endeavored to provide trademark information about all of the companies and products
mentioned in this book by the appropriate use of capitals. However, Packt Publishing cannot guarantee the
accuracy of this information.
Senior Publishing Product Manager: Aaron Tanna
Acquisition Editor – Peer Reviews: Gaurav Gavas
Project Editor: Rianna Rodrigues
Content Development Editor: Liam Draper
Copy Editor: Safis Editing
Technical Editor: Karan Sonawane
Proofreader: Safis Editing
Indexer: Manju Arasan
Presentation Designer: Ganesh Bhadwalkar
Developer Relations Marketing Executive: Meghal Patel
First published: January 2018
Second edition: February 2020
Third edition: February 2023
Production reference: 1210223
Published by Packt Publishing Ltd.
Livery Place
35 Livery Street
Birmingham
B3 2PB, UK.
ISBN 978-1-83763-051-6
www.packt.com
Contributors
About the author
Donald A. Tevault – you can call him Donnie – got involved with Linux
way back in 2006 and has been working with it ever since. He holds the
Linux Professional Institute Level 3 Security certification and the GIAC
Incident Handler certification. Donnie is a professional Linux trainer,
and thanks to the magic of the Internet, has taught Linux classes all over
the world from the comfort of his living room. He has also been a Linux
security researcher for an IoT security company.
I’d like to thank the good folk at Packt Publishing for making the publishing of this book such a smooth
process. I’d also like to thank my cats for graciously allowing me to use their names in the demos, and Mike,
my intrepid technical reviewer, for his suggestions that made the book better than it would have been.
About the reviewer
Michael Ernstoff is a Unix and Linux infrastructure and security specialist with over 25 years of
experience. An independent consultant for over 20 years, Michael has worked for many well-known
blue-chip companies, mainly in the banking and finance industries.
With extensive knowledge of host-based security, security hardening, and identity and access man-
agement. Michael has developed and implemented solutions for Security and Regulatory Compliance.
He is a keen amateur musician and has four children.
Join our book community
Join our community’s Discord space for discussions with the author and other readers:
https://packt.link/CyberSec
Table of Contents
Preface xxi
Section I: Setting up a Secure Linux System 1
Chapter 1: Running Linux in a Virtual Environment 3
Looking at the threat landscape ................................................................................................ 4
Why do security breaches happen? ........................................................................................... 4
Keeping up with security news .................................................................................................. 5
Differences between physical, virtual, and cloud setups ............................................................. 6
Introducing VirtualBox and Cygwin .......................................................................................... 6
Installing a virtual machine in VirtualBox • 7
Installing the EPEL repository on the CentOS 7 virtual machine • 11
Installing the EPEL repository on the AlmaLinux 8/9 virtual machines • 12
Configuring a network for VirtualBox virtual machines • 13
Creating a virtual machine snapshot with VirtualBox • 14
Using Cygwin to connect to your virtual machines • 14
Installing Cygwin on your Windows host • 14
Using the Windows 10 SSH client to interface with Linux virtual machines • 15
Using the Windows 11 SSH client to interface with Linux virtual machines • 18
Cygwin versus the Windows shell • 18
Keeping the Linux systems updated ........................................................................................ 19
Updating Debian-based systems • 19
Configuring auto updates for Ubuntu • 20
Updating Red Hat 7-based systems • 22
Updating Red Hat 8/9-based systems • 26
Managing updates in an enterprise • 27
Summary ............................................................................................................................... 27
viii Table of Contents
Questions ............................................................................................................................... 28
Further reading ...................................................................................................................... 28
Answers ................................................................................................................................. 29
Chapter 2: Securing Administrative User Accounts 31
The dangers of logging in as the root user ................................................................................ 31
The advantages of using sudo .................................................................................................. 32
Setting up sudo privileges for full administrative users ............................................................ 33
Adding users to a predefined admin group • 33
Creating an entry in the sudo policy file • 35
Setting up sudo for users with only certain delegated privileges ............................................... 36
Hands-on lab for assigning limited sudo privileges • 39
Advanced tips and tricks for using sudo ................................................................................... 41
The sudo timer • 41
View your sudo privileges • 41
Hands-on lab for disabling the sudo timer • 42
Preventing users from having root shell access • 43
Preventing users from using shell escapes • 43
Preventing users from using other dangerous programs • 46
Limiting the user’s actions with commands • 47
Letting users run as other users • 47
Preventing abuse via a user’s shell scripts • 48
Detecting and deleting default user accounts • 50
New sudo features .................................................................................................................. 51
Special sudo considerations for SUSE and OpenSUSE ............................................................... 51
Summary ............................................................................................................................... 53
Questions ............................................................................................................................... 54
Further reading ...................................................................................................................... 55
Answers ................................................................................................................................. 55
Chapter 3: Securing Normal User Accounts 57
Locking down users’ home directories the Red Hat way ........................................................... 57
Locking down users’ home directories the Debian/Ubuntu way ................................................ 58
useradd on Debian/Ubuntu • 59
adduser on Debian/Ubuntu • 60
Hands-on lab for creating an encrypted home directory with adduser • 61
Enforcing strong password criteria ......................................................................................... 62
Table of Contents ix
Installing and configuring pwquality • 63
Hands-on lab for setting password complexity criteria • 65
Setting and enforcing password and account expiration .......................................................... 66
Configuring default expiry data for useradd for Red Hat-type systems only ............................... 67
Setting expiry data on a per-account basis with useradd and usermod ...................................... 69
Setting expiry data on a per-account basis with chage .............................................................. 70
Hands-on lab for setting account and password expiry data • 72
Preventing brute-force password attacks ................................................................................. 73
Configuring the pam_tally2 PAM module on CentOS 7 • 73
Hands-on lab for configuring pam_tally2 on CentOS 7 • 74
Configuring pam_faillock on AlmaLinux 8/9 • 75
Hands-on lab for configuring pam_faillock on AlmaLinux 8 or AlmaLinux 9 • 75
Configuring pam_faillock on Ubuntu 20.04 and Ubuntu 22.04 • 77
Hands-on lab for configuring pam_faillock on Ubuntu 20.04 and Ubuntu 22.04 • 77
Locking user accounts ............................................................................................................ 78
Using usermod to lock a user account • 78
Using passwd to lock user accounts • 79
Locking the root user account ................................................................................................. 80
Setting up security banners .................................................................................................... 80
Using the motd file • 81
Using the issue file • 82
Using the issue.net file • 83
Detecting compromised passwords ......................................................................................... 83
Hands-on lab for detecting compromised passwords • 86
Understanding centralized user management .......................................................................... 87
Microsoft Active Directory • 87
Samba on Linux ..................................................................................................................... 87
FreeIPA/Identity Management on RHEL-type distros • 88
Summary ............................................................................................................................... 90
Questions ............................................................................................................................... 90
Further reading ...................................................................................................................... 91
Answers ................................................................................................................................. 91
Chapter 4: Securing Your Server with a Firewall – Part 1 93
Technical requirements .......................................................................................................... 93
An overview of the Linux firewall ............................................................................................ 94
An overview of iptables ........................................................................................................... 95
