Security

PAM Fundamentals

PAM provides a flexible framework for authentication on Linux. Configuration files live in /etc/pam.d/ (one file per service, e.g., /etc/pam.d/sshd).

Four module types:

• auth — Who are you? (verify identity)
• account — Are you allowed? (account restrictions)
• password — Password change handling
• session — Setup/teardown (mount home, logging)

PAM Control Flags

Control flags determine how module success/failure affects the stack:

• required — Failure counts against final result, but remaining modules still run
• requisite — Failure causes immediate stop, no further modules run
• sufficient — Success causes rest of stack to be skipped (if no prior required failures)
• optional — Result mostly ignored; only matters if it's the only module

Key PAM Modules

• pam_pwquality — Password complexity (min length, complexity rules)
• pam_faillock — Account lockout after N failed attempts
• pam_unix — Standard Unix auth (shadow passwords)
• pam_google_authenticator — TOTP-based MFA
• pam_u2f — Hardware token (YubiKey) auth
• pam_ldap — LDAP authentication
• pam_krb5 — Kerberos authentication

MFA via PAM

TOTP (Time-based One-Time Password) — generates 6-digit codes that expire every 30 seconds.

• Install: pam_google_authenticator module
• Enable MFA for SSH: add to /etc/pam.d/sshd
• Require ChallengeResponseAuthentication yes in sshd_config
• pam_u2f — hardware tokens (YubiKey, FIDO2)
• PAM stack order matters — auth then MFA module

LDAP Fundamentals

LDAP provides centralized user authentication across multiple Linux systems. Instead of local /etc/passwd accounts, users authenticate against a central directory server.

• ldap:// — unencrypted (port 389)
• ldaps:// — encrypted TLS (port 636)
• Config: /etc/ldap.conf or via SSSD
• Stores: users, groups, passwords, attributes

SSSD (System Security Services Daemon)

SSSD is the modern way to connect Linux to LDAP (and Kerberos/AD). It provides caching for offline authentication.

• Config: /etc/sssd/sssd.conf
• Caches credentials for offline use
• Integrates with PAM and NSS
• Verify LDAP user: getent passwd username
• Restart: systemctl restart sssd

Kerberos Concepts

Ticket-based authentication — passwords are never sent over the network after initial login. Uses symmetric key cryptography.

• KDC (Key Distribution Center) — central auth server
• TGT (Ticket Granting Ticket) — obtained at login via kinit
• Service Ticket — obtained by presenting TGT to access a specific service
• Config: /etc/krb5.conf
• Realm: Kerberos domain (usually uppercase, e.g., EXAMPLE.COM)

Kerberos Commands

• kinit username — authenticate and obtain TGT
• klist — display current tickets and expiry times
• kdestroy — remove all tickets (logout)
• klist -l — list credential caches
• kinit -r 7d username — renewable ticket for 7 days

Ticket flow: kinit → KDC issues TGT → present TGT to get service ticket → access service. No password re-entry needed during ticket lifetime.

SELinux Modes

• Enforcing — active; violations are denied AND logged
• Permissive — logs violations but does NOT deny (testing mode)
• Disabled — completely off (not recommended)

Check: getenforce
Temp change: setenforce 0 (permissive) or setenforce 1 (enforcing)
Permanent: edit /etc/selinux/config → SELINUX=enforcing (requires reboot)

SELinux Contexts

Every file, process, and port has a security context label.

• ls -Z /file — show file context
• ps -eZ — show process context
• Format: user:role:type:level
• The type is most important for policy rules
• Example: httpd_sys_content_t for web content

SELinux Context Tools

• chcon -t httpd_sys_content_t /var/www/myapp/ — temporary context change (overridden by relabeling)
• restorecon -Rv /var/www/ — restore to policy default; use after mv/cp
• semanage fcontext -a -t httpd_sys_content_t '/custom(/.*)?' — create permanent policy rule
• After semanage fcontext, always run restorecon to apply

Troubleshooting SELinux

• ausearch -m avc -ts recent — find recent AVC denial messages
• audit2allow -a — analyze audit log and suggest policy rules
• sealert — human-readable explanations of denials
• Log file: /var/log/audit/audit.log
• Look for avc: denied entries to identify blocked actions

AppArmor Profiles

• aa-status — show all loaded profiles and modes
• aa-enforce /path/to/profile — set profile to enforcing mode
• aa-complain /path/to/profile — log-only / permissive mode
• aa-disable profile — disable profile
• Profiles stored in /etc/apparmor.d/
• Reload profiles: apparmor_parser -r /etc/apparmor.d/profile

AppArmor vs SELinux

• AppArmor — path-based (controls access by file path). Simpler to configure. Default on Ubuntu and SUSE
• SELinux — label-based (security context on every object). More granular and powerful. Default on RHEL and Fedora
• Both implement MAC (Mandatory Access Control)
• Cannot run both simultaneously on the same system
• Complain mode (AppArmor) = Permissive mode (SELinux)

SSH Hardening

Config file: /etc/ssh/sshd_config

• PermitRootLogin no — block direct root SSH
• PasswordAuthentication no — key-based auth only
• AllowUsers alice bob — whitelist specific users
• Port 2222 — non-default port
• ClientAliveInterval 300 — disconnect idle sessions
• MaxAuthTries 3 — limit auth attempts
• Protocol 2 — SSHv2 only

Apply changes: systemctl reload sshd

sudo Hardening

• NOPASSWD — allow specific commands without password
• Cmnd_Alias — group related commands
• !command — explicitly deny specific command

Example sudoers rule (restrict to one command):

alice ALL=(ALL) /usr/bin/systemctl restart nginx

Edit safely with visudo — validates syntax before saving.

Password Policies (chage)

• chage -M 90 alice — max days before password expires
• chage -m 7 alice — min days before password can change
• chage -W 14 alice — warn days before expiry
• chage -l alice — list current settings

System-wide defaults in /etc/login.defs:
PASS_MAX_DAYS, PASS_MIN_DAYS, PASS_WARN_AGE

Restricted Shells & Service Accounts

• usermod -s /sbin/nologin alice — prevent interactive login; used for service accounts
• usermod -s /bin/false alice — same effect (no shell)
• /etc/shells — lists valid login shells
• Service accounts (e.g., www-data, sshd) should always use nologin
• Unlike locking (passwd -l), nologin still allows PAM/sudo

GPG (GNU Privacy Guard)

• gpg --gen-key — generate key pair
• gpg --export -a "alice" > alice.pub — export public key
• gpg --import alice.pub — import a public key
• gpg --encrypt -r alice file — encrypt for alice
• gpg --decrypt file.gpg — decrypt
• gpg --sign file — sign a file
• gpg --verify file.sig — verify signature
• gpg --list-keys — list keyring

Hashing for Integrity

• sha256sum file — generate SHA-256 hash
• sha256sum -c checksums.txt — verify from checksum file
• md5sum — legacy; avoid for security purposes

File integrity baseline workflow:

sha256sum /bin/bash > hash.txt (save baseline)
sha256sum -c hash.txt (verify later — "OK" = no tampering)

openssl Basics

• openssl genrsa -out key.pem 2048 — generate RSA key
• openssl req -new -key key.pem -out csr.pem — generate CSR
• openssl x509 -req -in csr.pem -signkey key.pem -out cert.pem — self-sign
• openssl s_client -connect host:443 — test TLS connection
• openssl x509 -in cert.pem -text — inspect certificate details

File Encryption

• gpg --symmetric file — symmetric encryption with passphrase → file.gpg
• openssl enc -aes-256-cbc -in file -out file.enc — encrypt with AES-256
• openssl enc -d -aes-256-cbc -in file.enc -out file — decrypt

GPG asymmetric = encrypt with recipient's public key, decrypt with their private key. Symmetric = same passphrase to encrypt and decrypt.

auditd

Linux auditing daemon for tracking system activity and file access.

• Rules in /etc/audit/audit.rules
• auditctl -w /etc/passwd -p wa -k passwd_changes — watch file for write/attribute changes
• -p flags: r=read, w=write, x=execute, a=attribute
• ausearch -k passwd_changes — search logs by key
• aureport --summary — summary report
• Logs: /var/log/audit/audit.log

AIDE (Advanced Intrusion Detection Environment)

File integrity monitoring tool. Detects unauthorized file changes.

• aide --init — create initial database baseline
• aide --check — compare current system to database
• Config: /etc/aide.conf
• Store database on read-only media for tamper resistance
• Schedule via cron for regular checks
• Reports: added, removed, and changed files with attribute details

Vulnerability Scanning & Compliance Tools

• OpenVAS / Greenbone — full network vulnerability scanner
• Lynis — security auditing and hardening tool; lynis audit system
• chkrootkit — rootkit detection
• rkhunter — rootkit hunter; rkhunter --check
• CIS Benchmarks — industry-standard hardening guidelines
• STIG (Security Technical Implementation Guide) — DoD compliance standards