I. Chroot jail

“Chroot jail is a UNIX feature that creates a limited sandbox allowing a process to view only a single sub-tree of the file system.” “In order for it to work properly, some common programs and libraries need to be copied or linked to the appropriate locations in the new directory tree.” (Haas)
The term sandbox is a metaphor for the type of security that chroot jail uses. Once you put a program or utility into the jail, it only knows of what is contained in the cell, the rest of your system becomes invisible to it. It does this by changing the apparent root directory for the current running process and its children. A program that is run in a modified environment cannot name files outside the designated directory tree. For example if you place Apache into a chroot jail and somebody would hack into your system, the only thing that they would be able to see and access would be Apache and the files needed to run it, the rest of your system does not even exist according to chroot jail. Chroot makes it more difficult for attacks to take place in your environment.

To set up a useful chroot jail, first determine which utilities and or programs the users of the chroot jail will need. Then you must copy the appropriate binaries and their libraries into the jail.

II. SELinux

SELinux was developed by The U.S. National Security Agency(NSA). “SELinux was released under the NSA under the GNU GPL open source license. SELinux is essentially a Linux kernel with a number of utilities that provide enhanced security functionality. But the critical component of SELinux is how it implements and handles mandatory access controls. SELinux is important because mandatory access controls are essential to limiting access to daemons and users to only what they need. It solves the age old all mighty powerful super user problem in Linux.” (Kerner, 2004)

Regular versions of Linux use Discretionary Access Control (DAC), in this type of access control users can control the access to their own files and other resources. In Mandatory Access Control (MAC) the administrator manages the access controls. The administrator defines the usage and access policy, which cannot be modified or changed by users, and the policy will indicate who has access to which programs and files.
The enforcement of mandatory access control policies that confine user programs and system servers to the minimum amount of privilege they require to do their jobs. When set up this way, the ability of these user programs and system daemons to cause harm when compromised is reduced or eliminated. This confinement operates independently of the regular Linux access control. It has no concept of a "root" super-user.
The security of an unmodified Linux system depends on the correctness of the kernel, all the privileged applications, and each of their configurations. A problem in any one of these areas may allow the compromise of the entire system. In contrast, the security of a modified system based on the Security-enhanced Linux kernel depends primarily on the correctness of the kernel and its security policy configuration. While problems with the correctness or configuration of applications may allow the limited compromise of individual user programs and system daemons, they do not pose a threat to the security of other user programs and system daemons or to the security of the system as a whole.

III. IpTables

Iptables is Linux’s version of a built in firewall. “It is often referred to as a packet filter as it examines each packet transferred in every network connection to, from, and within your computer.” (linux.ie) It makes decisions on what to do with a packet based on rules that are created by the system administrator. Rules are one or more criteria linked together in a chain. A rule will specify the criteria necessary for a packet to match to be allowed.
As a packet enters the system the first rule will be applied and if the packet meets the criteria the next rule will be applied. This process will continue for however many rules are in the chain. If the packet passes the criteria set by the administrator then it is delivered, if it does not match it will be dropped. Some of the criteria that can be set up by the administrator for checking are: ip address, port number, destination address, source address.

Works Cited
Haas, J. (n.d.). About.com. Retrieved 5 1, 2013, from www.about.com
Kerner, S. M. (2004, 2 24). Internet News.com. Retrieved 5 1, 2013, from www.internetnews.com linux.ie. (n.d.). Retrieved 5 1, 2013, from www.linux.ie/articles/tutorials/firewall

I. Chroot jail

“Chroot jail is a UNIX feature that creates a limited sandbox allowing a process to view only a single sub-tree of the file system.” “In order for it to work properly, some common programs and libraries need to be copied or linked to the appropriate locations in the new directory tree.” (Haas)
The term sandbox is a metaphor for the type of security that chroot jail uses. Once you put a program or utility into the jail, it only knows of what is contained in the cell, the rest of your system becomes invisible to it. It does this by changing the apparent root directory for the current running process and its children. A program that is run in a modified environment cannot name files outside the designated directory tree. For example if you place Apache into a chroot jail and somebody would hack into your system, the only thing that they would be able to see and access would be Apache and the files needed to run it, the rest of your system does not even exist according to chroot jail. Chroot makes it more difficult for attacks to take place in your environment.

To set up a useful chroot jail, first determine which utilities and or programs the users of the chroot jail will need. Then you must copy the appropriate binaries and their libraries into the jail.

II. SELinux

SELinux was developed by The U.S. National Security Agency(NSA). “SELinux was released under the NSA under the GNU GPL open source license. SELinux is essentially a Linux kernel with a number of utilities that provide enhanced security functionality. But the critical component of SELinux is how it implements and handles mandatory access controls. SELinux is important because mandatory access controls are essential to limiting access to daemons and users to only what they need. It solves the age old all mighty powerful super user problem in Linux.” (Kerner, 2004)

Regular versions of Linux use Discretionary Access Control (DAC), in this type of access control users can control the access to their own files and other resources. In Mandatory Access Control (MAC) the administrator manages the access controls. The administrator defines the usage and access policy, which cannot be modified or changed by users, and the policy will indicate who has access to which programs and files.
The enforcement of mandatory access control policies that confine user programs and system servers to the minimum amount of privilege they require to do their jobs. When set up this way, the ability of these user programs and system daemons to cause harm when compromised is reduced or eliminated. This confinement operates independently of the regular Linux access control. It has no concept of a "root" super-user.
The security of an unmodified Linux system depends on the correctness of the kernel, all the privileged applications, and each of their configurations. A problem in any one of these areas may allow the compromise of the entire system. In contrast, the security of a modified system based on the Security-enhanced Linux kernel depends primarily on the correctness of the kernel and its security policy configuration. While problems with the correctness or configuration of applications may allow the limited compromise of individual user programs and system daemons, they do not pose a threat to the security of other user programs and system daemons or to the security of the system as a whole.

III. IpTables

Iptables is Linux’s version of a built in firewall. “It is often referred to as a packet filter as it examines each packet transferred in every network connection to, from, and within your computer.” (linux.ie) It makes decisions on what to do with a packet based on rules that are created by the system administrator. Rules are one or more criteria linked together in a chain. A rule will specify the criteria necessary for a packet to match to be allowed.
As a packet enters the system the first rule will be applied and if the packet meets the criteria the next rule will be applied. This process will continue for however many rules are in the chain. If the packet passes the criteria set by the administrator then it is delivered, if it does not match it will be dropped. Some of the criteria that can be set up by the administrator for checking are: ip address, port number, destination address, source address.

Works Cited
Haas, J. (n.d.). About.com. Retrieved 5 1, 2013, from www.about.com
Kerner, S. M. (2004, 2 24). Internet News.com. Retrieved 5 1, 2013, from www.internetnews.com linux.ie. (n.d.). Retrieved 5 1, 2013, from www.linux.ie/articles/tutorials/firewall