IT302
7/9/2012
Research
Linux Security Basics Linux, being one of the most secure operating systems in the world, has many features and services that enhance security to the maximum. Linux isn’t completely secure, like some people like to claim, but many distributions strive to make security a key feature. One of the greatest reasons Linux is more secure, is the simple fact of having a smaller user base than other operating systems; this means that Linux is a smaller target for most malicious intents. That doesn’t mean that distributions rely on this to secure their OS. There are many great and complex security features and services that come with Linux. One of the most complicated security features, I believe, is SELinux. Security Enhanced Linux is a security model developed by the NSA and provides a fine grained permissions system for files, users, groups, sockets, ports, and processes. SELinux was conceived because the current user level security system that Linux, and other operating systems, offer is insufficient for. To ensure a maximum security environment, SELinux uses the MAC security model. This means that an object only has the minimal set of permissions it requires to operate. SELinux uses sets of policies to handle permissions providing the system with a great level of security. These policies can be assigned as roles to users enabling specific rules and regulations for specific individuals. SELinux may be a powerful security feature, but it can also be a pain to work with. Even though SELinux is a great and powerful tool, it can be a great hindrance to installing and using software. Security can be pictured as a sliding bar; one side security, the other usability. It isn’t uncommon for home users of Fedora to disable this feature completely to make the OS more user friendly. This, and the fact that policies can be very difficult to create and maintain, are a few reasons SELinux can be bypassed or breached. If the proper permissions are not configured then security means little to those who have the knowledge to exploit it. Another feature that helps secure Linux systems and servers, is the chroot jail. It was developed in early UNIX 7 systems in 1972, and is included in almost all distributions to date. This feature allows an administrator to set up a new root directory from the perspective of the process or user. The process or user would only see their root directory and below. This allows for isolated process and users with access to only what they need. They can’t see, interact, or modify anything above their root directory. Using this technique, an admin may run virtual servers on one system by creating many jails. This is commonly used when testing software or running content servers. However, there are limitations to using this and it’s not meant to replace full virtualization software. When using this feature, you use the same kernel and share many other resources with the main system and other jails. Also, because processes can’t see the main system, they must have all the necessary binaries, libraries, and files required to perform their tasks. This includes system utilities such as the shell, ls, grep, chmod, and others. None of this will be in the new jail by default and must be installed one way or another. Another drawback is that the administrator of a jail has limited access to many resources. Using sysctl, mounting devices, configuring the network, and changing firewall settings are a few of the tasks that cannot be done inside a jail; these settings are forced by the parent system and cannot be changed. Jail security is very important for any system utilizing this feature. Usually, an attacker “breaks out of jail” because it was improperly configured allowing access to the kernel or other processes. Also, just like any software, there are security holes. These are fixed with security updates to the chroot and Linux system. It is important to keep your system fully updated and properly configured. The chroot jail can be difficult to set up but, if done properly, it can save time, money, and resources. Any time you are connected to the internet, there are processes sending and receiving information at all times. People and software with malicious intent may try to access your system in various methods. There may also be administration reason for limiting access to the network. In both cases, configuring IPtables and TCP wrappers is a must. IPtables was developed alongside Netfilter by Rusty Russell. It was meant to replace the outdated IPchains technology that was currently in use. IPtables is the “firewall” that Linux uses to determine the access rules for the network. These rules are stored in the /etc/sysconfig/iptables and can be modified with the system-config-firewall utility. They can be used to limit access to the network, specific devices, and permit or deny internet connections to various ports and services. The other feature that is used to selectively allow or deny services based on specific criteria, is TCP wrappers. The tcpd or xinitd daemons, depending on your version of Linux, use /etc/hosts.deny and /etc/hosts.allow to control access. These are text files that can be modified by an administrator to customize access to connections and services such as rlogin, ssh, rsh, telnet and others. Log files are provided as a useful tool in discovering incoming attacks or previous attacks. Narrowing down the point of entry and resolving the issue promptly is a must when confidential data is at risk. This may all sound complicated and it is. Securing your system with IPtables or TCP wrappers can take an excessive amount of planning to decide where and how these rules should be implemented. These concepts are some of the most difficult for some to understand and should be handled with care. These are just a few of the more important security features of Linux based systems. These are powerful pieces of security software and they can affect a systems performance. SElinux itself, when fully configured, is said to have a 7% performance hit on a system. An immense amount of planning and thought goes into setting up and maintaining a secure system. However once properly configured, every security feature should work together in harmony; thus creating something of a secure system. Unfortunately, if someone wants into a system there is always a way in. No security measure is perfect and we must be ever vigilant in our quest for greater security. We can do this by monitoring logs, watching network traffic, and “always” installing security updates for our system and services.

References
Farrokhi, Babak. ( © 2008). Network administration with freebsd 7: building, securing, and maintaining networks with the freebsd operating system. [Books24x7 version] Available from http://common.books24x7.com.proxy.itt-tech.edu/toc.aspx?bookid=30152.
Frields P. Radvan S. Wade K. (© 2010). Fedora Documentation: SELinux FAQ. Available from http://docs.fedoraproject.org/en-US/Fedora/13/html/SELinux_FAQ/index.html#id3715409
Negus, Christopher & Foster-Johnson, Eric. ( © 2011). Fedora bible 2011 edition: featuring fedora linux 14. [Books24x7 version] Available from http://common.books24x7.com.proxy.itt-tech.edu/toc.aspx?bookid=40654.