- security scanning - exterior `nmap` to scan for open ports - interior nessus vuln scan - secure boot - UEFI feature that checks digitally signed FW and kernel - only microsoft signs for secure boot purposes - microsoft has a special third-party key that it signs linux kernels with in a shim file - prevent access to GRUB - `grub-mkpasswd-pbkdf2` - block root access - replace root `bin/bash` login shell with `/usr/sbin/nologin`![[images/Pasted image 20250802195228.png]] - create empty `/etc/securetty` file - disables root to login form any physical tty console - system logging configs - able to log to a centralized server - check for SUID and SGID - to disable SUID on a partition remove SUID or default from fourth field of `/etc/fstab` entries - to disable execution of binaries and scripts remove exec or default from fourth field of `/etc/fstab` entries - setting default `umask` - `umask` sets the default set of permissions for files+folders either for system wide or on a per-user basis - part of PAM - `umask` shows current value in octal notation - subtracts umask value from 666 for files - subtracts umask value from 777 for directories - `umask -S` shows current value in symbolic notation - disabling/removing insecure/unused services - ftp, telnet - reduce attack vectors to the extent practical - enforcing password strength - complexity, length, min/max age, history, etc. - edit `/etc/login.defs` - `/etc/pam.d/common-password` - associated with the `pam_pwquality.so` module - limit password attempts - `pam_tally2.so` - `pam_faillock.so` - `fail2ban` - removing unused packages - reduce attack vectors to the extent practical - tuning kernel parameters - turn off un-needed kernel modules - securing service accounts - limit to associated service only so anyone cannot login as the service account - disable interactive abilities - configuring host FW - `iptables`, `firewalld`, or `ufw` - deny specific hosts - edit `/etc/hosts.deny` - for more control, create `/etc/hosts.allow` - SSH - disable rootlogin - disable password login and require pubkey - set a user's shell to `/bin/false` to disable interactive remote login - `sudo usermod -s /bin/false user_name` - use MFA - use AAA - Kerberos + LDAP (like Active Directory) - RADIUS - TACACS+ - setup SELinux or apparmor - set ACLs on files - `getfacl file_name` shows ACXL for file - `setfacl user:r file_name` to set ACL for file - set attributes on files - `lsattr file_name` to show attributes for file - `chattr file_name` to change attributes for file - restrict apps using `chroot` - use LUKS to encrypt partitions - impose fs quotas - add `usrquota` and `grpquota` to appropriate field in `/etc/fstab` - `quota -u user_name` to create quota files for user - `quotaedit` to edit quota files - `repquota -a` to show all quotas - impose memory constraints with `ulimit` - banners and messages - set `/etc/motd` - set `/etc/login.warn` - limit access to `at` and `cron` - insert users/groups into `/etc/at.allow` and `/etc/at.deny` - insert users/groups into `/etc/cron.allow` and `/etc/cron.deny` - restrict USB access - `echo "blacklist uas" >> /etc/modprobe.d/blacklist.conf && echo "blacklist usb:storage" >> /etc/modprobe.d/blacklist.conf` - enable `auditd` - set security rules to monitor and log - use `auditctl` to define temporary rules - add persistent rules to `/etc/audit/audit.rules`