SEC406: Linux Security for InfoSec Professionals

Overview

In this gentle orientation to Linux you will be introduced to the operating system, kernel, and the terminal. Here we begin by discussing essential skills such as using a terminal to navigate and identify programs. You will learn how to find and execute Linux programs and how to refine the results returned using appropriate options and parameters found in the manual pages. We will cover how to find help when you don’t know how to use a command. We will teach you how history and command completion can level up your terminal skills and speed up your commands. Managing files within Linux is unique and we will cover various tips and tricks to make you an expert at this complicated subject. You will learn to know how and where files exist in the filesystem. This section concludes with a discussion on the Visual Editor which is a crucial skill for security and administration of any Linux system. By the end of this section, you will know how to use the terminal effectively, including understanding basic commands, file system navigation, and program execution. These skills will enable you to locate and launch programs, refine search results, and leverage manual pages.

Exercises

• lab1.1_intro_to_shell
• lab1.2_linux_commands
• lab1.3_tab_complete
• lab1.4_history
• lab1.5_navigating
• lab1.6_file_management
• lab1.7_file_management2
• lab1.8_vi

Topics

• Kernel, Operating System, and Distributions
• Terminals
• Manual pages
• Command History
• Navigation
• File Management
• Visual Editor

Overview

Digging into the terminal commands straight away is the best way to build muscle memory. This section builds off the terminal skills of section one. You will learn how to search for files within the filesystem and the various ways that grep can be used to search for information within files. Operating system functions and user experience are highly configurable, and we will learn how to modify our environment using variables and aliases and how that can be abused by a malicious actor. Every system contains some type of authentication mechanism for accounts and groups. We will explore how to manage accounts, discover and change the groups those accounts belong to, and how to switch between accounts. We will also cover how to manage file ownership. You will gain advanced file management techniques, including creating, copying, moving, and deleting files and directories, as well as using filters and pipes.

Exercises

• lab2.1_finding_files
• lab2.2_grep
• lab2.3_environment_variables
• lab2.4_aliases
• lab2.5_redirection_piping
• lab2.6_user_mgmt
• lab2.7_group_mgmt
• lab2.8 file_ownership

Topics

• Searching the Filesystem
• Various Forms of Grep
• Environment Variables and Aliases
• Account Management
• Switching users
• Group management
• File Ownership

Overview

Section three covers essential user access control concepts, including restricting administrative privileges, permissions, and security. Users interact with the filesystem in various ways with different levels of access. If you come to this class with a networking background, you know this as Authentication, Authorization, and Accounting. If you come into the class with a Windows background, you probably think of this as managing users and groups. We will translate those skills into the Linux world. 

We will learn how to ensure accounts have least-privilege access. Least privilege can be implemented in multiple ways, and we will cover how to do that with file level permissions and ownership. You will learn how to secure and appropriately leverage administrative credentials and closely guard them with Least Required Privilege. You will learn some of the tools available that can verify system settings are applied by auditing your system.

Exercises

• lab3.1_file_permissions
• lab3.2_file_permissions2
• lab3.3_special_permissions
• lab3.4_special_permissions2
• lab3.5_special_permissions3
• lab3.6_permission_practical
• lab3.7_sudoers_config
• lab3.8_sudoers_config2
• lab3.9_system_hardening

Topics

• File permissions
• Special permissions
• Sudoers
• SELinux and AppArmor

Overview

Resource management and system monitoring skills, such as understanding processes, system load, and memory usage, are fundamental to working with servers and cloud-based systems. As you move resources to the cloud and establish micro-services in containers, knowing how to limit the resources consumed is a good security practice and can prevent you from incurring unanticipated costs. Managing system resources is how we can maintain the availability of our servers and prevent you from losing time and money. Since everything in Linux is essentially a file, we can look at running process file information and how to manage the processes running on our distributions. In addition, we will look at what a core dump is and how it can be abused.

You will also learn several essential skills that enable your incident response process and continuous monitoring. Those essential skills will include things like scheduling tasks on Linux, keeping historical record of user activity, centralized logging, log rotation, and how to effectively manage and review those logs.

Exercises

• lab4.1_managing_processes
• lab4.2_jobs_control
• lab4.3_jobs_control2
• lab4.4_managing_crontab
• lab4.5_managing_services
• lab4.6_managing_logrotate
• lab4.7_managing_syslog

Topics

• Resource limits
• Process management and Scheduling
• Services, Systemd, and init
• Logging and Log Rotation
• Auditd

Overview

Section five provides you with the opportunity to delve into package management, remote server management via SSH, networking, and other advanced tips and tricks. Like any operating system, we must keep our distributions up to date or we may need a new tool installed to accomplish a task. Often this is done through a package manager. You will learn how to leverage python virtual environments, configure, and manage the built-in package manager, and compile packages after a code review. You will learn encryption of data (at rest and in transit), and how that provides the necessary confidentiality from prying eyes. We will cover how to properly leverage SSH, SCP, and OpenSSL to secure communications. Linux is the basis for most of the networking gear out there. You can even use it as a router and firewall if you wish. We will cover how to manage networking settings and the host-based firewall.

Exercises

• lab5.1_managing_python
• lab5.2_installing_with_apt
• lab5.3_installing_from_source
• lab5.4_ssh-keys
• lab5.5_ssh-config
• lab5.6_ssh-agent
• lab5.7_ssh-forwarding
• lab5.8_firewalls

Topics

• Python package management
• Installing and Running Open Source Software
• Linux package management
• SSH, Tunneling, and Post-Quantum Cryptography
• Networking and Firewalls