Linux Security

Linux security is a discipline of subtraction: every running service is an attack surface, every world-writable file a liability, every setuid binary a privilege. This chapter covers the layers — permissions and least privilege, SSH hardening, the firewall, update hygiene, the audit commands that show you your own exposure, and the SELinux/AppArmor machinery underneath.

The foundation — least privilege

# every service runs as its own user — never root
id nginx                    # nginx's uid — not root
ps -eo user,comm | grep -v ' root ' | sort -u   # who runs what

Principles: run daemons as dedicated users, grant only the rights they need, NOPASSWD: only for specific commands, sudo over su, key-only ssh. The model from chapter 12 — owner/group/other — is the wall; this chapter is keeping the wall maintained.

SSH — the exposed door

# /etc/ssh/sshd_config — the three lines that matter
PermitRootLogin no
PasswordAuthentication no
Port 2222                    # obscurity tax, not security — but reduces noise

sshd -t validates before reload. Key-only auth (PasswordAuthentication no) is the single largest hardening win — brute force becomes impossible. fail2ban rate-limits attempts; AllowUsers whitelists.

The firewall — default deny

nft list ruleset                    # the current policy
# the canonical minimal policy:
iptables -P INPUT DROP
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j ACCEPT

Default-deny is the posture; allow what's needed. ss -tlnp tells you what's actually listening — the firewall audit always starts there.

The audit commands — your own exposure

ss -tlnp                     # every listener — attack surface inventory
find / -perm -4000 -type f   # every setuid binary
find / -perm -0002 -type d   # world-writable dirs
find / -nouser -o -nogroup   # orphaned files
ls -la /etc/sudoers.d/       # the delegation surface
cat /etc/passwd | awk -F: '$3==0'   # everyone with uid 0 — only root
last -20                     # login history
grep 'Failed password' /var/log/auth.log | tail   # brute-force traffic

ss -tlnp, the setuid inventory, last, and the auth log — the four commands that see a system's real exposure.

Updates — the unglamorous hardening

apt update && apt upgrade          # Debian
dnf upgrade                        # Fedora
slackpkg update && slackpkg upgrade-all   # Slackware
unattended-upgrades                # auto security updates — Debian
needs-restarting -r                # does it need a reboot?

Most real-world compromises are unpatched software, not clever attacks — the update habit is the highest-value security control.

The kernel-level machinery

• SELinux — mandatory access control — policies that confine processes beyond file permissions (sestatus, setenforce, ausearch) — Fedora's default
• AppArmor — the simpler MAC — profiles per program (aa-status) — Debian/Ubuntu's
• seccomp — syscall filtering — restricts which syscalls a process may make
• capabilities — root unbundled (chapter 12)
• cgroups + namespaces — the isolation primitives containers ride

Crypto at rest — LUKS + the secrets files

cryptsetup luksFormat /dev/sda3    # encrypt the partition
cryptsetup luksOpen /dev/sda3 crypt
mkfs.ext4 /dev/mapper/crypt

Full-disk encryption (LUKS) protects at rest — a stolen disk yields nothing without the passphrase. /etc/shadow's 600 perms, ~/.ssh's 700, private keys' 600 — the permission layer is the crypto's keeper.

The operational hygiene

umask 027                  # default-private for a server
passwd -l dormantacct      # lock unused accounts
chmod 600 ~/.ssh/id_*      # private keys private
sudo -l                    # YOUR sudo rights — know them
find . -name '*.key' -perm -o+r   # world-readable private keys — fix now

Where security goes wrong

Exercises

1. ss -tlnp your box — justify every listener.
2. find / -perm -4000 — inventory setuid; research one you don't recognize.
3. sshd -t a hardened sshd_config — verify before reload.
4. ausearch -m avc or aa-status — see your MAC layer.
5. Write the minimal iptables policy from memory.

See also

• Users and permissions · Networking · Linux · Inside a Linux System