Linux security basics

Why Linux

Most web servers, cloud machines, network devices and security tools run Linux. As a defender you will log in to Linux servers to read logs, check users and look for signs of attack. You do not need to be an expert admin, but you must be comfortable with the basics.

Users, groups and root

Every person and many services have their own user account. Users can belong to groups, which share permissions. The special user root (user ID 0) can do anything on the system. Because root can do anything, attackers want it, and admins avoid logging in as root directly. Instead, normal users run single commands as root with sudo ("superuser do"), and every sudo use is logged.

$ id
uid=1000(asha) gid=1000(asha) groups=1000(asha),27(sudo)
$ sudo -l
User asha may run the following commands on web01:
    (ALL : ALL) ALL

User accounts are listed in /etc/passwd (readable by everyone, no passwords inside). Password hashes are kept in /etc/shadow, which only root can read.

File permissions

Every file has an owner and a group, and three sets of permissions: for the owner, for the group, and for everyone else (others). Each set has r (read), w (write) and x (execute, or "enter" for a folder).

$ ls -l /etc/passwd /etc/shadow deploy.sh
-rw-r--r-- 1 root root   2981 Mar  2 10:14 /etc/passwd
-rw-r----- 1 root shadow 1630 Mar  2 10:14 /etc/shadow
-rwxr-x--- 1 asha devops  412 Mar  9 18:40 deploy.sh

Permissions are often written as three digits. Each digit adds r = 4, w = 2, x = 1. So rwx = 7, r-x = 5, r-- = 4, --- = 0. The file deploy.sh above is rwxr-x--- = 750.

$ chmod 600 ~/.ssh/id_ed25519
$ find /var/www -perm -0002 -type f
/var/www/html/uploads/config.php

Hardening basics

• Update often: sudo apt update && sudo apt upgrade on Ubuntu/Debian, or sudo dnf upgrade on Red Hat family systems. Most break-ins use known, already-fixed bugs.
• SSH: use key-based login, set PasswordAuthentication no and PermitRootLogin no in /etc/ssh/sshd_config.
• Remove software and services you do not need.
• Give each person their own account; never share root.
• Turn on a host firewall (ufw or firewalld).

Where Linux keeps security logs

On Ubuntu and Debian, logins and sudo use go to /var/log/auth.log. On Red Hat, Rocky and Alma Linux it is /var/log/secure. Systems with systemd also keep a journal you read with journalctl.

$ sudo grep "Failed password" /var/log/auth.log | tail -2
Mar 14 02:11:42 web01 sshd[2231]: Failed password for invalid user admin from 198.51.100.23 port 51514 ssh2
Mar 14 02:11:45 web01 sshd[2233]: Failed password for root from 198.51.100.23 port 51522 ssh2

Common mistakes

• chmod 777 "to make it work". It lets any user, or any hacked web app, change the file. Find the right owner and use the smallest permission.
• Logging in as root over SSH with a password. Use keys and sudo.
• Ignoring updates on "internal" servers. Attackers who get in move to the weakest machine.