OS Security

SSH is the primary remote administration protocol on Linux. Default configurations are permissive And must be hardened.

Key-based authentication:

ssh-keygen -t ed25519 -C "admin@server" -f ~/.ssh/id_ed25519
ssh-copy-id -i ~/.ssh/id_ed25519.pub user@server

Ed25519 is preferred over RSA and ECDSA. It is faster, more secure, and has smaller keys. RSA keys Should be at least 4096 bits if used.

sshd_config hardening:

PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes
AuthorizedKeysFile .ssh/authorized_keys
PermitEmptyPasswords no
ChallengeResponseAuthentication no
UsePAM yes
X11Forwarding no
MaxAuthTries 3
ClientAliveInterval 300
ClientAliveCountMax 2
AllowUsers admin deploy
Protocol 2
LogLevel VERBOSE

Key directives:

• PermitRootLogin no: Prevent direct root login over SSH. Administrators should log in as an unprivileged user and escalate with sudo.
• PasswordAuthentication no: Disable password-based authentication. Require key-based authentication. This eliminates brute-force attacks against passwords.
• MaxAuthTries 3: Limit authentication attempts. Combined with fail2ban, this provides effective brute-force mitigation.
• AllowUsers: Restrict login to specific users. All other users are denied, even if they have valid keys.
• ClientAliveInterval 300 / ClientAliveCountMax 2: Terminate idle sessions after 600 seconds (300 x 2). This prevents abandoned sessions from being hijacked.

Fail2ban monitors log files for repeated authentication failures and temporarily bans the offending IP addresses using firewall rules (iptables, nftables, or firewalld).

[sshd]
enabled = true
port = ssh
filter = sshd
logpath = /var/log/auth.log
maxretry = 3
findtime = 600
bantime = 3600

• maxretry: Number of failures before banning (3).
• findtime: Time window in seconds (600 = 10 minutes).
• bantime: Duration of the ban in seconds (3600 = 1 hour).

For production servers, consider more aggressive settings: maxretry = 2``bantime = 86400.

Linux file permissions control access to files and directories. Every file has three permission Classes: owner (u), group (g), and others (o). Each class has three permissions: read (r), write (w), and execute (x).

Common permissions:

• 644: Owner rw, group r, others r (typical for files)
• 755: Owner rwx, group rx, others rx (typical for directories and executables)
• 600: Owner rw, group nothing, others nothing (SSH keys, sensitive config)
• 700: Owner rwx, group nothing, others nothing (private directories)

chmod 600 /etc/ssh/sshd_config
chown root:root /etc/ssh/sshd_config
umask 027

umask sets the default permissions for newly created files. The umask value is subtracted from the Maximum permissions (666 for files, 777 for directories).

With umask 027:

• New file: $666 - 027 = 640$ (owner rw, group r, others nothing)
• New directory: $777 - 027 = 750$ (owner rwx, group rx, others nothing)

SUID (Set User ID): When set on an executable file, the process runs with the permissions of the File”s owner, not the user who executed it. This is how passwd can modify /etc/shadow — the passwd binary has SUID root.

chmod u+s /path/to/binary
chmod 4755 /path/to/binary

SUID binaries are a common privilege escalation vector. Every SUID binary on the system should be Audited:

find / -perm -4000 -type f 2>/dev/null

SGID (Set Group ID): When set on a directory, new files inherit the directory’s group rather Than the creator’s primary group. This is used for shared directories.

chmod g+s /path/to/shared-directory

Sticky bit: When set on a directory, only the file owner, directory owner, or root can delete or Rename files within it. This is used for world-writable directories like /tmp.

chmod +t /tmp
chmod 1777 /tmp

root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
admin:x:1000:1000:Admin User:/home/admin:/bin/bash

Fields: username:x:UID:GID:comment:home_dir:shell

The x in the password field means the password hash is stored in /etc/shadow. If the password Field contains anything other than xThe account has a password stored directly in /etc/passwd Which is a security issue (passwd is world-readable).

root:$6$rounds=656000$salt$hash:19000:0:99999:7:::
admin:$6$rounds=656000$salt$hash:19000:0:99999:7:::
nobody:*:19000:0:99999:7:::

Fields: username:hash:last_change:min:max:warn:inactive:expire

• Hash algorithm: $6$ = SHA-512, $5$ = SHA-256, $1$ = MD5 (insecure), $y$ = yescrypt
• min: Minimum days between password changes
• max: Maximum days before password must be changed
• warn: Days before expiration to warn the user
• inactive: Days after expiration before account is disabled
• expire: Account expiration date (days since epoch)

Only root can read /etc/shadow. Permissions should be 640.

PAM provides a flexible framework for authentication. Configuration files are in /etc/pam.d/.

Key modules:

• pam_unix.so: Standard Unix authentication using /etc/shadow.
• pam_faillock.so: Account lockout after failed authentication attempts.
• pam_faildelay.so: Introduce delay after failed authentication.
• pam_deny.so: Always deny access (used as a fallback).
• pam_permit.so: Always allow access (used for non-authenticated modules).

Account lockout configuration (/etc/security/faillock.conf):

deny = 3
unlock_time = 900
fail_interval = 900
root_unlock_time = 60

Disable unnecessary services to reduce the attack surface:

systemctl disable --now avahi-daemon
systemctl disable --now cups
systemctl disable --now bluetooth
systemctl mask --now rpcbind

systemctl mask prevents the service from being started manually or by another service, even by Root (until unmasked).

Review all enabled services:

systemctl list-unit-files --state=enabled
systemctl list-units --type=service --state=running

Discretionary Access Control (DAC) — standard Linux permissions (chmod, chown) — allows the file Owner to set permissions. MAC overrides DAC with system-wide policies that the user cannot modify.

MAC is enforced by the kernel. Even root is subject to MAC policies (unless the policy specifically Exempts root, which it does not).

SELinux (Security-Enhanced Linux) was developed by the NSA and uses a policy-based MAC system. It Assigns a security context (label) to every process, file, port, and other system object. Access is Granted only if the policy explicitly allows the source context to access the target context’s class With the specified permission.

Security context format: user:role:type:level

Example: system_u:system_r:httpd_t:s0

• user: SELinux user identity (system_u, unconfined_u, staff_u, etc.)
• role: Role (system_r, object_r, staff_r, etc.)
• type: Type (the primary identifier for access decisions)
• level: MLS/MCS level (optional, for multi-level security)

Common types:

• httpd_t: Apache/Nginx process type
• httpd_sys_content_t: Web content files
• sshd_t: SSH daemon process type
• var_log_t: Log files
• user_home_t: User home directory files

Check and set mode:

getenforce
sestatus
setenforce 1
setenforce 0

Permanent setting in /etc/selinux/config:

SELINUX=enforcing
SELINUXTYPE=targeted

When SELinux blocks an action, it generates an AVC (Access Vector Cache) denial:

ausearch -m avc -ts recent
sealert -a /var/log/audit/audit.log

Common remediation strategies:

1. Relabel the file:

   restorecon -v /path/to/file

2. Set the correct context permanently:

   semanage fcontext -a -t httpd_sys_content_t "/var/www/custom(/.*)?"
   restorecon -v /var/www/custom

3. Allow a specific action with a boolean:

   setsebool -P httpd_can_network_connect_db 1

4. Write a custom policy module:

   audit2allow -M my_custom_policy
   semodule -i my_custom_policy.pp

AppArmor is an alternative MAC system used by default on Ubuntu, SUSE, and some other distributions. Unlike SELinux, AppArmor uses path-based policies rather than label-based policies.

Profile example (/etc/apparmor.d/usr.sbin.nginx):

#include <tunables/global>

/usr/sbin/nginx {
  #include <abstractions/base>
  #include <abstractions/nameservice>

  capability dac_override,
  capability setuid,
  capability setgid,

  /etc/nginx/** r,
  /usr/share/nginx/** r,
  /var/log/nginx/** rw,
  /var/www/** r,

  network inet tcp,
}

Commands:

aa-status
aa-enforce /etc/apparmor.d/usr.sbin.nginx
aa-complain /etc/apparmor.d/usr.sbin.nginx
aa-logprof
apparmor_parser -r /etc/apparmor.d/usr.sbin.nginx

Kernel modules extend kernel functionality at runtime. They run in kernel mode with full privileges. Unauthorized or malicious kernel modules can completely compromise the system.

Hardening:

echo "install usb-storage /bin/true" >> /etc/modprobe.d/disable-usb.conf
echo "install cramfs /bin/true" >> /etc/modprobe.d/disable-filesystems.conf
lsmod
echo "blacklist floppy" >> /etc/modprobe.d/blacklist.conf

Sysctl configures kernel parameters at runtime. Security-relevant parameters:

net.ipv4.ip_forward = 0
net.ipv4.tcp_syncookies = 1
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv6.conf.all.accept_redirects = 0
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1
kernel.dmesg_restrict = 1
kernel.kptr_restrict = 2
fs.suid_dumpable = 0
kernel.unprivileged_bpf_disabled = 1
kernel.perf_event_paranoid = 3

Persistent configuration in /etc/sysctl.d/99-security.conf:

net.ipv4.ip_forward = 0
net.ipv4.tcp_syncookies = 1
kernel.dmesg_restrict = 1
kernel.kptr_restrict = 2
kernel.unprivileged_bpf_disabled = 1

Apply with sysctl --system.

Add to /etc/default/grub (GRUB_CMDLINE_LINUX_DEFAULT):

slab_nomerge
init_on_alloc=1
init_on_free=1
page_poison=1
page_alloc.shuffle=1
nosmt

Update GRUB after modification:

grub-mkconfig -o /boot/grub/grub.cfg

Understanding privilege escalation techniques is essential for both attackers and defenders. This Section covers common techniques and their defenses.

If a SUID root binary has a known vulnerability or can be manipulated, an unprivileged user can gain Root access.

Enumeration:

find / -perm -4000 -type f 2>/dev/null

Classic examples:

• find: find . -exec /bin/sh -p \; (if find is SUID root)
• vim: :!/bin/sh (if vim is SUID root)
• nmap: nmap --interactive then !sh (older versions with SUID)
• less/more: !/bin/sh (if less is SUID root)

Defense: Audit all SUID binaries. Remove SUID from binaries that do not require it. Use chmod u-s to remove the SUID bit. Replace SUID binaries with capabilities where possible (e.g., setcap cap_net_raw+ep /usr/bin/ping instead of SUID root on ping).

Sudo allows users to run commands as root (or another user). Misconfigured sudoers rules are a Common escalation path.

sudo -l

Dangerous misconfigurations:

• sudo vim /etc/shadow — The user can run :!/bin/sh from vim to get a root shell.
• sudo less /var/log/auth.log — The user can run !/bin/sh from less.
• sudo awk '{print $1}' /etc/shadow — Directly reads the shadow file.
• sudo env followed by manipulation of PATH or LD_PRELOAD.
• sudo (root) NOPASSWD: /usr/bin/find — Can execute arbitrary commands via find’s -exec.
• sudo (root) NOPASSWD: ALL — Full root access.

Defense:

• Grant specific commands, not editors or interpreters.
• Use sudoedit instead of sudo vim for editing files.
• Disable command escaping in editors: Defaults use_pty.
• Remove NOPASSWD from all rules unless operationally required.
• Regularly audit sudoers: visudo -c and review the output.

Cron jobs run on a schedule with the privileges of the owning user. If a cron job executes a script That an unprivileged user can modify, the user can inject arbitrary commands that run with the cron Job’s privileges.

Enumeration:

crontab -l
cat /etc/crontab
ls -la /etc/cron.d/
ls -la /var/spool/cron/crontabs/

Common issues:

• Writable cron scripts: If /opt/backup.sh is owned by root but group-writable, any group member can modify it and execute code as root.
• Wildcards in cron commands: tar czf /backup/archive.tar.gz * can be exploited with filename trickery (e.g., a file named --checkpoint=1 or --use-compress-program=/bin/sh).
• PATH hijacking: If the cron job does not use absolute paths and the PATH includes a user-writable directory, an attacker can place a malicious binary in that directory.

Defense:

• Set chmod 700 on all cron scripts. Ensure root-owned scripts are not group- or world-writable.
• Use absolute paths for all commands in cron jobs.
• Set PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin in the crontab.
• Avoid wildcards or use -- to terminate option parsing.

Kernel vulnerabilities allow an unprivileged user to escalate to root by exploiting bugs in the Kernel itself. These are the most dangerous escalation vectors because they bypass all application- Level controls.

Common kernel vulnerability classes:

• Use-after-free: A memory page is freed but a pointer to it remains. An attacker can reallocate the page and control its contents.
• Stack overflow: Buffer overflow on the kernel stack. Modern kernels have stack canaries (CONFIG_STACKPROTECTOR), but some paths may be unprotected.
• Race conditions: Exploiting TOCTOU (Time of Check, Time of Use) between two kernel operations.
• Null pointer dereference: Mapping page 0 and exploiting a kernel null pointer dereference.
• Heap overflow: Overflowing kernel heap allocations (slab/SLUB allocator).

Defense:

• Keep the kernel updated. Apply security patches promptly.
• Enable kernel address space layout randomization (KASLR): CONFIG_RANDOMIZE_BASE=y.
• Enable kernel stack protector: CONFIG_STACKPROTECTOR=y.
• Restrict kernel module loading.
• Use kernel.unprivileged_bpf_disabled = 1 to prevent unprivileged eBPF.
• Use kernel.perf_event_paranoid = 3 to restrict perf events.

If a directory in the PATH is writable by the current user, an attacker can place a malicious binary With the same name as a commonly used command in that directory. When the command is executed, the Malicious binary runs instead.

echo $PATH

Defense: Ensure system PATH directories (/usr/bin``/bin``/usr/sbin``/sbin) are owned by Root and not writable by non-root users. Never put . (current directory) in PATH.

The LD_PRELOAD environment variable allows a user to load a shared library before all others. A Malicious library can hook function calls and execute arbitrary code with the privileges of the Target process.

# Attacker creates /tmp/evil.c
#include <stdio.h>
#include <sys/types.h>
#include <stdlib.h>

void _init() {
    if (geteuid() == 0) {
        system("/bin/bash -p");
    }
}

# Compile: gcc -fPIC -shared -o /tmp/evil.so /tmp/evil.c -nostartfiles
# Use: LD_PRELOAD=/tmp/evil.so sudo some_command

This only works if sudo preserves the LD_PRELOAD environment variable (it does not by default in Modern sudo versions).

Defense:

• Ensure env_reset is set in sudoers (default in most distributions).
• Ensure env_keep does not include LD_PRELOAD``LD_LIBRARY_PATHOr similar.
• Use Defaults secure_path in sudoers to set a fixed PATH.

Syslog is the standard logging daemon on Linux. Rsyslog is the default implementation on most modern Distributions. It receives log messages from applications and the kernel and routes them to files, Remote servers, or other destinations.

Configuration in /etc/rsyslog.conf or /etc/rsyslog.d/:

auth,authpriv.*          /var/log/auth.log
kern.*                   /var/log/kern.log
*.emerg                  :omusrmsg:*
*.*;auth,authpriv.none   -/var/log/syslog

Log severity levels (from lowest to highest):

Systemd-journald is the log manager for systemd-based systems. It stores logs in a binary format (journal files) and provides structured log entries with metadata.

journalctl -u ssh              # Logs for sshd service
journalctl -f                  # Follow logs (like tail -f)
journalctl --since "1 hour ago"
journalctl -p err              # Error-level messages only
journalctl --disk-usage        # Show disk usage

Journald can forward to syslog for integration with existing log management infrastructure.

Auditd provides kernel-level auditing for security events. It goes beyond application logging by Intercepting system calls and recording security-relevant events.

Configuration in /etc/audit/audit.rules:

## Audit file access
-w /etc/passwd -p wa -k identity
-w /etc/shadow -p wa -k identity
-w /etc/sudoers -p wa -k identity
-w /etc/ssh/sshd_config -p wa -k ssh_config

## Audit system calls
-a always,exit -F arch=b64 -S execve -F auid>=1000 -F auid!=4294967295 -k exec

## Monitor network configuration changes
-w /etc/network/ -p wa -k network_changes

• -p wa: Watch for writes and attribute changes.
• -k key: Assign a key for filtering.
• -S execve: Watch the execve system call.

View audit logs:

ausearch -k identity
aureport -x
auditctl -l

Unmanaged log files grow without bound and can fill the disk, causing service outages. Logrotate Manages log rotation, compression, and retention.

Configuration in /etc/logrotate.d/:

/var/log/auth.log {
    daily
    missingok
    rotate 90
    compress
    delaycompress
    notifempty
    create 640 root adm
    postrotate
        /usr/lib/rsyslog/rsyslog-rotate
    endscript
}

In production environments, logs should be forwarded to a centralized log management system:

• ELK Stack: Elasticsearch, Logstash, Kibana
• Splunk: Commercial SIEM with log collection
• Graylog: Open-source log management
• Fluentd / Fluent Bit: Log forwarder and processor
• Vector: High-performance log pipeline by Datadog

Centralized logging provides:

1. Correlation of events across multiple systems
2. Longer retention than local storage allows
3. Real-time alerting on security events
4. Protection against log tampering (an attacker who compromises a system cannot erase centralized logs)

# Debian/Ubuntu
apt update && apt upgrade -y
apt install unattended-upgrades
dpkg-reconfigure -plow unattended-upgrades

# RHEL/CentOS
dnf update -y
dnf install dnf-automatic
systemctl enable --now dnf-automatic-install.timer

Unattended-upgrades configuration (/etc/apt/apt.conf.d/50unattended-upgrades):

Unattended-Upgrade::Allowed-Origins {
    "${distro_id}:${distro_codename}-security";
};
Unattended-Upgrade::AutoFixInterruptedDpkg "true";
Unattended-Upgrade::Remove-Unused-Dependencies "true";
Unattended-Upgrade::Automatic-Reboot "false";

Tools that scan systems for known vulnerabilities:

• OpenSCAP: SCAP-based compliance and vulnerability scanning.
• Vuls: Agentless vulnerability scanner for Linux.
• Lynis: Security auditing tool (not a vulnerability scanner per se, but detects misconfigurations).
• Trivy: Container image and filesystem scanner.

AIDE creates a database of file hashes, permissions, and metadata. It periodically compares the Current state against the database and reports changes.

Configuration (/etc/aide/aide.conf):

/var/log       p+im
/etc/passwd    p+im
/etc/shadow    p+im
/etc/ssh/sshd_config p+im
/bin           p+im
/usr/bin       p+im

Flags: p (permissions), i (inode), m (mtime), s (size), sha256 (SHA-256 hash), sha512 (SHA-512 hash).

aideinit                    # Initialize database
aide --update               # Update database
aide --check                # Check for changes
aide --compare              # Compare with last known state

Tripwire is a commercial file integrity monitoring tool with similar functionality to AIDE. It uses Two databases: a baseline database (read-only, ideally stored offline or on immutable storage) and a Current database that is updated on each scan.

OSSEC (now maintained as Wazuh) provides file integrity monitoring alongside log analysis, rootkit Detection, and active response. It is more feature-rich than AIDE alone and includes a centralized Management architecture.

Linux namespaces provide isolation for system resources. Each namespace type isolates a different Aspect:

Namespaces are the fundamental building block of containers. Docker and Kubernetes use namespaces to Provide process isolation.

Control groups (cgroups) limit and account for resource usage (CPU, memory, I/O, network) for a set Of processes. Cgroups v2 is the current standard.

# Create a cgroup and limit memory to 512 MB
mkdir /sys/fs/cgroup/memory/limited
echo 536870912 > /sys/fs/cgroup/memory/limited/memory.max

# Limit CPU to 1 core
echo 100000 > /sys/fs/cgroup/cpu/limited/cpu.max

Seccomp (Secure Computing Mode) restricts the system calls a process can make. There are two modes:

• Strict mode: Allows only read``write``_exitAnd sigreturn. Too restrictive for most applications.
• Filter mode (BPF): Allows specifying a whitelist of permitted system calls using BPF programs.

Docker uses a default seccomp profile that blocks about 44 system calls (out of ~330). Custom Profiles can be created for specific applications.

Containers provide process isolation through namespaces, cgroups, and seccomp. However, they are not A security boundary. The kernel is shared between all containers on a host, and container escape is Possible.

Container isolation vs VM isolation:

UEFI Secure Boot ensures that only cryptographically signed bootloaders and kernels can be executed During the boot process. The firmware verifies the signature of each component before executing it:

1. UEFI firmware verifies the bootloader (e.g., GRUB, shim)
2. The bootloader verifies the kernel
3. The kernel verifies loaded modules (if module signing is enabled)

Keys:

• Platform Key (PK): The top-level key. Replaces all other keys if changed.
• Key Exchange Keys (KEK): Used to update the Signature Database and forbid list.
• Signature Database (db): Contains keys and hashes of trusted bootloaders and applications.
• Forbidden Database (dbx): Contains keys and hashes of revoked bootloaders.

Measured Boot extends Secure Boot by recording (measuring) each component loaded during the boot Process into a Platform Configuration Register (PCR) in the TPM. Unlike Secure Boot, which blocks Unauthorized components, Measured Boot records what was loaded and allows a remote attestation Service to verify that the boot process was clean.

The TPM is a hardware chip on the motherboard that provides:

• Secure key storage: Keys stored in the TPM never leave the chip. Operations are performed inside the TPM.
• Platform measurement: PCR values record the state of the system at boot.
• Remote attestation: A remote party can verify the PCR values to confirm the system is in a known-good state.
• Sealing: Data can be encrypted to a specific PCR state. The data is only decryptable if the system boots with the expected components.

# Check TPM status
tpm2_getcap properties-fixed

# Seal a secret to the current PCR state
echo "my-secret" | tpm2_encryptdecrypt -c key.ctx -o sealed.dat

# Unseal (only works if PCR values match)
tpm2_encryptdecrypt -c key.ctx -i sealed.dat

Group Policy (GPO) is the primary mechanism for managing Windows security settings centrally.

Key security policies:

• Password policy: Minimum length (14+ characters), complexity requirements, maximum age, lockout threshold.
• Account lockout: Lock accounts after 5 failed attempts for 15 minutes.
• User Rights Assignment: Define who can log on locally, who can shut down the system, who can take ownership of files.
• Audit policy: Enable audit for logon events, object access, policy change, privilege use.
• Windows Defender settings: Configure real-time protection, scheduled scans, exclusions.

BitLocker provides full-disk encryption for Windows systems. It encrypts the entire volume and uses The TPM to protect the encryption key.

• TPM-only mode: The key is released automatically if the boot measurements are correct.
• TPM + PIN: Requires a PIN in addition to TPM. Protects against physical attacks on a powered- off system.
• TPM + USB key: Requires a USB flash drive in addition to TPM.

Windows Defender is the built-in antivirus and anti-malware solution. Key features:

• Real-time protection: Monitors files, processes, and network activity for malware.
• Attack Surface Reduction (ASR): Blocks behaviors commonly used by malware (executing from email client, creating processes from Office documents, etc.).
• Exploit Protection: Mitigations against memory corruption vulnerabilities (DEP, ASLR, CFG).
• Network protection: Blocks outbound connections to known malicious domains.

UAC prompts for consent when an administrative action is attempted. Even administrators run with Standard user privileges by default. UAC elevates privileges only when explicitly approved.

UAC settings (from most to least secure):

1. Always notify: Prompt for every elevation, including built-in admin accounts.
2. Notify only for app changes: Suppress prompts for Windows operations.
3. Notify only for app changes (secure desktop disabled): Same as above without dimming the screen.
4. Never notify: Effectively disables UAC. Never use this setting.

Many administrators disable SELinux because “it breaks things.” This removes a critical defense Layer. The correct approach is to run SELinux in permissive mode, diagnose the AVC denials, and Write appropriate policy or fix the file contexts. Most issues are resolved with restorecon or a Boolean.

Allowing direct root login over SSH means that if the root password is compromised (brute force, Credential stuffing, password reuse), the attacker has full system access immediately. Always use Key-based authentication with an unprivileged user and sudo.

Logs are useless if nobody reads them. Centralized logging with automated alerting on high-severity Events (failed logins, privilege escalation, file integrity changes) is essential. A breach Discovered months after the fact from forensic analysis is far more costly than one caught in real Time.

Kernel vulnerabilities are among the most severe because they bypass all application-level controls. Automated patching with a reboot window is the minimum. For critical systems, use live patching (e.g., Canonical Livepatch, KernelCare) to apply security fixes without rebooting.

Leaving LD_LIBRARY_PATH or LD_PRELOAD in sudoers env_keep allows privilege escalation through Shared library injection. Modern sudo defaults to env_resetBut always verify.

A file has permissions rwxr-xr--. An administrator runs chmod 750 on the file. What are the new Permissions, and which octal value represents the original permissions?

A system has umask 077. What are the default permissions for:

A) A newly created file b) A newly created directory

An Apache web server returns 403 Forbidden for files in /var/www/html/app/. The file permissions Are correct (644, owned by apache:apache). ls -Z shows:

-rw-r--r--. apache apache unconfined_u:object_r:default_t:s0 index.html

What is the problem, and how do you fix it?

semanage fcontext -a -t httpd_sys_content_t "/var/www/html/app(/.*)?"
restorecon -Rv /var/www/html/app/

-rw-r--r--. apache apache unconfined_u:object_r:httpd_sys_content_t:s0 index.html

setsebool -P httpd_unified on

An attacker has access to a low-privilege shell. They run sudo -l and see:

User deploy may run the following commands on webserver:
    (root) NOPASSWD: /usr/bin/tar

How can the attacker escalate to root?

# Create a malicious file in /tmp
cd /tmp
echo "/bin/bash -p" > shell.sh
chmod +x shell.sh
touch -- "--use-compress-program=shell.sh"
touch archive.tar

# Create a tar archive that triggers the exploit
sudo tar cf archive.tar --use-compress-program=shell.sh *

An auditd rule is configured as:

-a always,exit -F arch=b64 -S open,openat -F dir=/etc -F auid>=1000 -F auid!=4294967295 -k etc_access

What does this rule do? Why is auid!=4294967295 included?

A server has the following sysctl settings:

net.ipv4.ip_forward = 1
net.ipv4.conf.all.accept_redirects = 1
net.ipv4.conf.all.rp_filter = 0
kernel.dmesg_restrict = 0

Identify the security issues and provide the corrected values.

This topic covers the essential concepts and techniques related to os security, including key principles and practical applications.

Key concepts include:

• core concepts and definitions
• key principles and frameworks
• practical applications
• common techniques and methods
• evaluation and critical analysis

A thorough understanding of these concepts, combined with regular practice and review, is essential for mastery of this topic.

Worked examples demonstrating the application of key concepts are covered in the detailed sub-pages linked above.