Linux Security

In: Computers and Technology

Submitted By bknow55
Words 942
Pages 4
| Linux Security | A review of some current technologies | | | |


In the pre-Internet world you have criminals looking for “hard” assets: money, jewelry and other items that could be easily turned into hard currency. We have always had “white-collar” crime such as embezzlement, fraud and insider trading. With the proliferation of the Internet and our personal and professional lives stored in the cloud; criminals can now take one ubiquitous piece of information and turn themselves into a whole other person. The ease in which such information can be used has turned people who would never think of ever holding up a bank, mugging someone or other physical crime, into criminals. This type crime has spawned a whole new “industry”: cyber security. One of the most important aspects of a network administrator’s job is to secure the system from any person who wishes to do criminal activities. These people are both within and outside the organization. With the Linux system there are three main technologies that are in use today. They are SELinux, chroot jail, and iptables.
The first line of defense in a Linux system is chroot jail. Chroot is a process or application that changes the root directory for a user. To the user it appears that they are in their root directory, but they are actually in a modified root directory. This modified root directory is called jail.
Without a chroot jail, a user with limited file permissions would still be able to navigate to top-level directories. As an example, suppose the user’s directory is /home/user. Without chroot, nothing would prevent the user from navigating up to /home to see other users’ directories or even navigating up to / where they can see /etc, /usr, /var, /lib, and other system-critical directories. Although the user would not have the permissions to edit them, they would be able to see the…...

Similar Documents

Linux Securities

...Security of a system when you are open to the internet is paramount in the world of servers. Linux has many layers of ever evolving security in order to keep up with the would be attackers in cyberspace. This is one of the reasons that Linux is one of the most used servers for internet sites and has few viruses engineered towards it. IP Tables Developed by the Netfilter organization the IP tables package for Linux is an evolution of the IP chains which came from the IPv4 Linux firewall package. Paul Russel was the initial head author of the organization and also behind the IP chains project The Netfilter organization began to come together in 1999 and through collaboration and research recognized the shortcomings of the IP chains package and developed this new product in order to address these concerns and make needed improvements. The improvements added to the new IP tables package helped improve performance and overall security. Better integration with the kernel led to improved speed and reliability but the true value came from the new security features. Stateful packet inspection allows the firewall to keep track of every connection passing through it allowing for better monitoring and can even view certain contents and attempt to anticipate actions of certain protocols. Also the ability to filter packets based on MAC address and TCP header flags helps to prevent attacks using malformed packets. Even a rate limiting feature that is designed to eliminate some......

Words: 1131 - Pages: 5

Linux Securities

...Since its release to the public in 1991, the Linux operating system has become one of the most widely used operating systems in the world. This is largely because of the security features. The most popular of these three technologies are SELinux, chroot jail and iptables. We are going to break down the advantages and benefits of each of these features. The United States National Security Agency (NSA), the original developer of SELinux released the first version of this feature in December of 2000. According to a statement by the NSA "NSA Security-enhanced Linux is a set of patches to the Linux kernel and some utilities to incorporate a strong, flexible mandatory access control (MAC) architecture into the major subsystems of the kernel. It provides an enhanced mechanism to enforce the separation of information based on confidentiality and integrity requirements, which allows threats of tampering and bypassing of application security mechanisms to be addressed and enables the confinement of damage that can be caused by malicious or flawed applications. It includes a set of sample security policy configuration files designed to meet common, general-purpose security goals" It provides the ability to separate information based on confidentiality and integrity requirements. The flexibility allows control over what activities can be done by each daemon, user, or process. Standard Linux access controls are modifiable by the user and the applications which the user runs. SELinux......

Words: 600 - Pages: 3

Linux Security

...programs and libraries need to be copied or linked to the appropriate locations in the new directory tree.” (Haas) The term sandbox is a metaphor for the type of security that chroot jail uses. Once you put a program or utility into the jail, it only knows of what is contained in the cell, the rest of your system becomes invisible to it. It does this by changing the apparent root directory for the current running process and its children. A program that is run in a modified environment cannot name files outside the designated directory tree. For example if you place Apache into a chroot jail and somebody would hack into your system, the only thing that they would be able to see and access would be Apache and the files needed to run it, the rest of your system does not even exist according to chroot jail. Chroot makes it more difficult for attacks to take place in your environment. To set up a useful chroot jail, first determine which utilities and or programs the users of the chroot jail will need. Then you must copy the appropriate binaries and their libraries into the jail. II. SELinux SELinux was developed by The U.S. National Security Agency(NSA). “SELinux was released under the NSA under the GNU GPL open source license. SELinux is essentially a Linux kernel with a number of utilities that provide enhanced security functionality. But the critical component of SELinux is how it implements and handles mandatory access controls. SELinux is important because......

Words: 1582 - Pages: 7

Linux Security

...The Linux security technologies I researched are SELinux, chroot jail and iptables. SELinux (Security-Enhanced Linux) is a Linux feature that provides the mechanism for supporting access control security policies, including United States Department of Defense-style mandatory access controls, through the use of Linux Security Modules (LSM) in the Linux kernel. It is not a Linux distribution, but rather a set of kernel modifications and user-space tools that can be added to various Linux distributions. Its architecture strives to separate enforcement of security decisions from the security policy itself and streamlines the volume of software charged with security policy enforcement. The key concepts underlying SELinux can be traced to several earlier projects by the United States National Security Agency. The United States National Security Agency (NSA), the original primary developer of SELinux, released the first version to the open source development community under the GNU GPL on December 22, 2000. The software merged into the mainline Linux kernel 2.6.0-test3, released on 8 August 2003. Other significant contributors include Network Associates, Red Hat, Secure Computing Corporation, Tresys Technology, and Trusted Computer Solutions. Experimental ports of the FLASK/TE implementation have been made available via the TrustedBSD Project for the FreeBSD and Darwin operating systems. It provides an enhanced mechanism to enforce the separation of information based on......

Words: 1300 - Pages: 6

Linux Security

...APPLY HARDENED SECURITY FOR CONTROLLING ACCESS 1. Suppose the domain is denied for all services in the hosts.deny and the host.allow file has the rule ALL:ALL. Will TCPWrappers allow access? ALL:ALL, TCPWrappers will not allow access. 2. How do you enable SELinux? Configure /etc/selinux/config file from permissive to enforcing to enable SELinux. 3. What are three modes of SELinux? Explain their basic functionality. SELinux modes are enforcing, permissive, and disabled. Enforcing is when SELinux security policy is enforced. Permissive is when SELinux prints warnings instead of enforcing, and disabled is when SELinux is fully disabled. 4. Consider the following firewall rule, and describe what this permits or denies. 5. What command would you use to allow all the traffic from the loopback? -A INPUT –I lo –j ACCEPT 6. What command would you use to view the network port configuration for the iptables? Iptables –L 7. If a service is to allow in one place and to deny in another, what is the outcome? The outcome would be to allow because access rules in hosts.allow are applied first and take precedence over rules specified in hosts.deny. 8. Is the order of the rules important? If you deny something within the IP network layer, but permit something within the TCP transport layer that uses the IP network layer that you just denied, will your TCP traffic be permitted? The order of the rules are......

Words: 291 - Pages: 2

Apply Hardening Security for Linux

...configuring services, what Linux directory typically contains server configuration files? cn=config is the is the subtree location where the default configuration is stored as a series of LDAP entries. 2. What command disables remote access to the MySQL Database? Is this a security hardening best practice? Remote access is disabled by default. Hardening security is recommended by installing the whole security package: Antivirus and Antispam, Firewall, and all of the security packages recommended by your operating system. 3. What is a Linux runlevel for a specific service or application? What command allows you to define the runlevel for a service or application? Runlevel 0 = halt Runlevel 1 = Single user mode Runlevel 2 = Basic multi-user mode (without networking)/User defineable Runlevel 3 = Full (text based) multi-user mode/Mulit-user mode Runlevel 4 = Not used Runlevel 5 = Full (GUI based) multi-user mode/Full multi-user mode Runlevel 6 = reboot /etc/rc.d 4. What is the Apache Web Server? Review the /etc/httpd/conf/httpd.conf configuration file, and point out a setting that could enhance security. The worlds most popular Web server. mod_reqtimeout.c = Set timeout and minimum data rate for receiving requests/set this to RequestReadTimeout header=10 body=30 (Allow 10 seconds to receive the request including the headers and 30 seconds for receiving the request body) 5. OpenSSH is the de facto method to remotely access Linux systems. Explain why the......

Words: 393 - Pages: 2

Linux Security

...Securing Linux Platforms and Applications Project Project Part 1 Task 1: Outline Security Policy This security policy is essential to the First World Bank Savings and Loan. It is used to break up the security plan not measurable, specific, and testable goals and objectives. This security policy would be used to provide all current and prospective customers online banking services while keeping the First World Saing bank competitive in the financial marketplace. This solution is also an imperative due to an estimated revenue of $100,0000,000 flowing in by virtue of online credit card transactions specific to banking and loan application based services. This security policy will go on to outline the specific regulations and legislation that are in agreement with the statutory compliance criteria. Below is a recommended view of the characteristics and components of the recommended security based policy. Taking up the stake of the performance, cost, and security of maintaining the Linux, and open source infrastructure will be within the premise of the defined roles and responsibilities. Annual cost savings are estimated to amount to $4,000,000 (approx) by virtue of implementation of this solution. The ‘C’-‘I’-‘A’ triad will be a crucial requirement fo the First World Savings Bank and translates to Confidentiality, Integrity and Availability respectively. Confidentiality aspect with reference to First World Savings Bank – Confidentiality refers to the principle that......

Words: 3404 - Pages: 14

Linux Security

...Linux Security Mr. Rehman 02 Feb 2015 Week 2 Lab 1 Please note that the parameters in this configuration file control the # behavior of the tools from the shadow-utils component. None of these # tools uses the PAM mechanism, and the utilities that use PAM (such as the # passwd command) should therefore be configured elsewhere. Refer to # /etc/pam.d/system-auth for more information. # # *REQUIRED* # Directory where mailboxes reside, _or_ name of file, relative to the # home directory. If you _do_ define both, MAIL_DIR takes precedence. # QMAIL_DIR is for Qmail # #QMAIL_DIR Maildir MAIL_DIR /var/spool/mail #MAIL_FILE .mail # Password aging controls: # # PASS_MAX_DAYS 60 Maximum number of days a password may be used. # PASS_MIN_DAYS 0 Minimum number of days allowed between password changes. # PASS_MIN_LEN 8 Minimum acceptable password length. # PASS_WARN_AGE 14 Number of days warning given before a password expires. -- INSERT [student@centos ~]$ su-c 'vi /etc/login.defs' bash: su-c: command not found [student@centos ~]$ su -c 'vi/etc/login.defs' Password: bash: vi/etc/login.defs: No such file or directory [student@centos ~]$ su -c 'vi /etc/login.defs' Password: [student@centos ~]$ su -c '/usr/sbin/useradd dbadmin1' Password: [student@centos ~]$ su -c '/usr/sbin/useradd dbadmin2 > su -c...

Words: 488 - Pages: 2

Linux Security

...Linux Security Project Part 1 Instructor Sandro Tuccinardi Student Brian Dupee Security Policy Outline First World bank wants to provide banking services online to its customers. The institution estimates over $100,000,000 a year in online credit card transactions for loan applications and other banking services. According to a team that was formed using a Linux an open source infrastructure would roughly as estimated give an annual cost savings in licensing fees alone can be as much as $4,000,000. The assets while using Linux open source infrastructure goal would be maintaining (CIA) triad confidentiality, integrity, and availability in the infrastructure. There is legislation, regulations, federal and state laws governing online banking. Compliance regulations such as Sarbanes–Oxley Act of 2002, Gramm–Leach–Bliley Act (GLBA), Payment Card Industry Data Security Standard (PCI DSS), Federal Information Security Management Act of 2002, Control Objectives for Information and Related Technology (COBIT). Many or part of these and more must be taken into consideration while putting this project in play. There are a couple of documents: ISO\IEC 17799 and ISO\IEC 27001. The ISO\IEC 17799 IT security technique is the policy for information security management, guidelines, principles for implementing and improving security. • security policy; • organization of information security; • asset management; • human resources security; • physical and......

Words: 448 - Pages: 2

Linux Security

... The Federal Deposit Insurance Corporation (FDIC) is an insurance that guarantees the money is a customer’s account up to $250,000 per depositor. A depositor is any one on the account that has provide their Social Security Number. Member banks are required to place a sign at their place of business stating that the deposits are backed by the full faith and credit of the United State Government. The First World Bank by complying with the different regulations help the bank provides confidentiality side of the CIA triangle. Customers will feel confident with the First World Bank handling their money and most important their information. Yes open source Linux can handle the security demands that the legislation and regulation require. Linux is running some of the world’s top secure networks the U.S. department of Defense, U.S. Navy Submarine Fleet, the City of Munich, Germany, French Parliament, State-Owned Industrial and Commercial Bank of China, Novell, Google, IBM, Cisco, Amazon, New York Stock Exchange just to name a few. Linux is secure as any properly setup operating system. If the world powers listed above trust and use Linux to protect their top secret information they Linux can protect the customers data at the First World Bank. With open source Linux patches are put out quicker and once an issue is found the open source world is immediately working on it and put out the fix as soon as it is done, unlike Microsoft that put out an update when they feel like it. ...

Words: 1405 - Pages: 6

It 302 Linux Security

...Linux Security Craig Van Doeselaar ITT Technical Institute IT 302 – Linux Matthew Gort April 4, 2012 Linux handles security through three basic concepts, SELinux, chroot jail and iptables. Each concept is designed to target a specific need in the security spectrum. SELinux works at the kernel level and enforces mandatory access control, chroot jail works within the file system and iptables handles routing of data. In the following paragraphs I will discuss some details of each discipline. SELinux can be traced back to the National Security Agency (NSA) when they got involved in trying to create a secure architecture. They released there research to the open source community which picked it up and continues to make improvements to its basic architecture. SELinux is designed to work at the kernel level of an operating system to enforce mandatory access control policies that confine users and servers to the minimum amount of privilege they require to do their job. The concept was to lock everything down by default and selectively allow access to applications as needed. This prevented security loop holes from remaining open because the average user wouldn’t know what to have running and what to have shut down. This way as users attempt to use an application SELinux will deny the attempt unless you can authorize its use. This gave administrators better security on their workstations from inadvertent malicious use or outright......

Words: 769 - Pages: 4

Linux Security

...Robert Hoffman Linux Research 2.1 Security for computers is one of the most important aspects of a system that has to be in place. For this paper I will be writing about four security features that Linux systems use; these are SELinux, chroot jail, openSSH, and iptables. I will briefly describe what they do to provide security. SELinux (security enhanced Linux) was developed by the NSA, who chose Linux as its operating system to create a more secure operating system. Since the development of SELinux by the NSA most Linux distributions now implement SELinux as a standard. Traditional Linux systems use a security called (DAC) discretionary access control. With this approach users and their objects, i.e., files or processes run by the user have the same access as the user. So if an attacker got hold of an admin account they would have complete control over any files or services that account runs or has access to. SELinux uses (MAC) mandatory access control. With this, services and files are controlled by policies saying what may or may not be done. MAC enforces these security policies that limit what users and programs can do. Security threats coming from user errors, attackers, or software problems are limited by MAC. SELinux has three modes that it can function in: Enforcing- This is the default state where SELinux security policy is enforced, anything not permitted by the security policy can not be......

Words: 999 - Pages: 4

Linux Security Technology

...|Linux Security Technology | | 1. SELinux SELinux, an implementation of Mandatory Access Control (MAC) in the Linux kernel, adds the ability to administratively define policies on all subjects (processes) and objects (devices, files, and signaled processes). This mechanism is in the Linux kernel, checking for allowed operations after standard Linux Discretionary Access Controls DAC are checked. Security-Enhanced Linux (SELinux) is a Linux feature that provides a mechanism for supporting access control security policies, including United States Department of Defense-style mandatory access controls, through the use of Linux Security Modules (LSM) in the Linux kernel. It is not a Linux distribution, but rather a set of Kernel modifications and user-space tools that can be added to various Linux distributions. Its architecture strives to separate enforcement of security decisions from the security policy itself and streamlines the volume of software charged with security policy enforcement. The key concepts underlying SELinux can be traced to several earlier projects by the United States National Security Agency (NSA), It has been integrated into the mainline Linux kernel since version 2.6. NSA, the original primary developer of SELinux, released the first version to the open source development community under the GNU GPL on December 22, 2000. Security-enhanced......

Words: 1860 - Pages: 8

Linux Security Technologies

...comes in many shapes and sizes which is why operating systems such as Linux develop ways to keep your personal files safe from these unwarranted threats. Some of these measures include, but is not limited to; iptables, SELinux, chroot jail, TCP Wrappers, firewalls, PolicyKit, NX or No eXecute, PIE or Position Independent Executables, Netfilter, and the list goes on (“Fedora Projects” & Vepstas). When a user first approaches Linux it looks similar to what a windows operating system would resemble. With Linux a user has the ability to access every file within the operating system through the use of a terminal or command prompt. Through the use of Linux programming potential threats can gain access to you file system and everything housed within it. Linux is free software that comes with many great security features that any user or administrator greater access and control over the system. The choice can be a bit much for most, but we will discuss a few of these choices here. Security-Enhanced Linux also known as SELinux is a security program that was developed in partner by the National Security Agency or NSA and Red Hat Developers (“Fedora Project”). So what exactly is it that SELinux does? SELinux was designed so that the Administrator could enforce policies that will limit what a user or particular program would be able to access. SELinux is also a MAC or Mandatory Access Control based security that is enabled by default. Some of the policies used by SELinux was......

Words: 1082 - Pages: 5

Security in Linux

...Security in Linux Linux, like any other computing platform, is constantly changing. There are a few major focus points for new and upgraded platforms, one of which is how user friendly it is. User friendliness goes beyond the ability to simply point and click, it also goes behind the lines deep into the inner workings of the system. Security is one of the most important functions of any operating system, very commonly overlooked and taken for granted. A system administrator can configure tables that are provided by the Linux kernel firewall in a program called iptables. Iptables has the ability to redirect, modify or stop packets of data all based on the state of a connection at any given time. There are many different tables that can be defined and each table contains built in chains or user defined chains. Every chain is essentially a list of rules that matches a set of packets and it specifies what to do with a packet that matches the rules. For the casual user it is best to use the predefined rules, they are often more than adequate. In an enterprise situation the administrator would likely want to define additional rules in order to best suit the business needs. Before iptables Linux mainly used ipchains as a firewall package. Iptables is an improvement on ipchains because it monitors the state of connections. Iptables can use the state of the connection as opposed to ipchains using the source destination and content only, to redirect, modify or drop a packet. At least...

Words: 965 - Pages: 4

Baustile | Kuzu no Honkai Note 10 KatzEyes Tout d'abord , je n'ai pas la prétention de pouvoir écrire une critique construite mais plus un re... | Sean Kleier