Advanced Linux Security: A Complete Guide to Protecting Your System

Security is a crucial aspect of Linux administration. In this complete guide, we will explore advanced hardening techniques to protect your Linux infrastructure.

1. Firewall Configuration

Configuring UFW (Uncomplicated Firewall)

# Enable the firewall
sudo ufw enable

# Configure the basic rules
sudo ufw default deny incoming
sudo ufw default allow outgoing

# Allow specific services
sudo ufw allow ssh
sudo ufw allow http
sudo ufw allow https

# Check the rules
sudo ufw status verbose

Configuring iptables

# Back up the current rules
sudo iptables-save > /etc/iptables.rules

# Basic rules
sudo iptables -P INPUT DROP
sudo iptables -P FORWARD DROP
sudo iptables -P OUTPUT ACCEPT

# Allow local traffic
sudo iptables -A INPUT -i lo -j ACCEPT

# Allow established connections
sudo iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

2. Securing SSH

Configuring sshd

# Edit the configuration file
sudo nano /etc/ssh/sshd_config

# Recommended configuration
PermitRootLogin no
PasswordAuthentication no
X11Forwarding no
MaxAuthTries 3
LoginGraceTime 60
AllowUsers utilisateur1 utilisateur2

SSH Keys

# Generate a key
ssh-keygen -t ed25519 -C "votre@email.com"

# Copy the public key
ssh-copy-id utilisateur@serveur

# Configure the client
nano ~/.ssh/config

# Recommended content
Host serveur
    HostName serveur.com
    User utilisateur
    IdentityFile ~/.ssh/id_ed25519
    ServerAliveInterval 60

3. User and Permission Management

Password Policy

# Install PAM
sudo apt install libpam-pwquality

# Configuration
sudo nano /etc/security/pwquality.conf

# Recommended settings
minlen = 12
dcredit = -1
ucredit = -1
ocredit = -1
lcredit = -1

Auditing Permissions

# Find SUID files
find / -type f -perm -4000 -ls

# Find SGID files
find / -type f -perm -2000 -ls

# Check permissions
ls -la /etc/passwd /etc/shadow

4. Monitoring and Intrusion Detection

Installing Fail2ban

# Installation
sudo apt install fail2ban

# Configuration
sudo nano /etc/fail2ban/jail.local

# Recommended configuration
[DEFAULT]
bantime = 3600
findtime = 600
maxretry = 3

[sshd]
enabled = true
port = ssh
filter = sshd
logpath = /var/log/auth.log

Configuring Logwatch

# Installation
sudo apt install logwatch

# Configuration
sudo nano /etc/logwatch/conf/logwatch.conf

# Recommended settings
Output = mail
Format = html
MailTo = admin@example.com

5. Securing Services

Configuring SELinux

# Installation
sudo apt install selinux-basics selinux-policy-default

# Activation
sudo selinux-activate

# Mode configuration
sudo nano /etc/selinux/config

# Recommended mode
SELINUX=enforcing
SELINUXTYPE=default

AppArmor

# Installation
sudo apt install apparmor apparmor-utils

# Activation
sudo systemctl enable apparmor
sudo systemctl start apparmor

# Profile configuration
sudo aa-status

6. Securing the File System

Secure Mounting

# Edit the fstab file
sudo nano /etc/fstab

# Recommended options
/dev/sda1 / ext4 defaults,noexec,nodev,nosuid 0 1
/dev/sda2 /home ext4 defaults,nodev,nosuid 0 2

Configuring Quotas

# Installation
sudo apt install quota

# Configuration
sudo quotacheck -cugm /
sudo quotaon -v /

# Edit quotas
sudo edquota -u utilisateur

7. Backup and Recovery

Configuring Backups

# Backup script
#!/bin/bash
BACKUP_DIR="/backup"
DATE=$(date +%Y%m%d)
tar -czf $BACKUP_DIR/backup_$DATE.tar.gz /etc /home /var/www

Scheduling Backups

# Edit crontab
sudo crontab -e

# Daily task
0 2 * * * /usr/local/bin/backup.sh

8. Security Auditing

Auditing Tools

# Install Lynis
sudo apt install lynis

# Run the audit
sudo lynis audit system

# Install rkhunter
sudo apt install rkhunter

# Configuration and scan
sudo rkhunter --update
sudo rkhunter --check

Log Monitoring

# Install logwatch
sudo apt install logwatch

# Configuration
sudo nano /etc/logwatch/conf/logwatch.conf

# Schedule reports
sudo crontab -e
0 7 * * * /usr/sbin/logwatch --mailto admin@example.com --output mail --format html

9. Network Security

Configuring TCP Wrappers

# Edit the configuration files
sudo nano /etc/hosts.allow
sudo nano /etc/hosts.deny

# Recommended rules
# /etc/hosts.deny
ALL: ALL

# /etc/hosts.allow
sshd: 192.168.1.0/24

Configuring SSL/TLS

# Install Certbot
sudo apt install certbot python3-certbot-nginx

# Obtain a certificate
sudo certbot --nginx -d example.com

Conclusion

Linux security is an ongoing process that requires:

• Constant monitoring
• Regular updates
• Proper configuration
• Detailed documentation

Remember that security is a layered approach. Combine these techniques to build a robust defense against threats.