Toggle Side Panel
Lesson 1, Topic 1
In Progress

Manage Security

1. Firewalld and firewall-cmd

Firewalld is a dynamic firewall manager which uses firewall-cmd as the command-line client to interact and configure firewall settings.

a. Configuring Firewall Settings

Adjusting and defining rules to allow or block specific traffic.

Example:

# Add http service to the public zone permanently
firewall-cmd --zone=public --add-service=http --permanent

# Reload firewall for changes to take effect
firewall-cmd --reload


2. File Permissions Management

a. Default File Permissions

The standard permissions assigned to a file or directory upon creation, influenced by the umask setting.

Example:

# View current umask value
umask

# Set umask to 027
umask 027


3. SSH Key-based Authentication

a. Generating and Using SSH Key Pairs

A method to authenticate to SSH servers without a password.

Example:

# Generate an RSA key pair
ssh-keygen -t rsa

# Copy the public key to the remote server
ssh-copy-id user@remote_server


4. SELinux Modes

a. Enforcing vs. Permissive Modes

  • Enforcing: SELinux policy is enforced and logs violations.
  • Permissive: SELinux doesn’t enforce the policy but logs violations.

Example:

# Set SELinux to permissive mode
setenforce 0

# Set SELinux to enforcing mode
setenforce 1


5. SELinux Contexts

a. File and Process Context

Every file, process, and port has an associated SELinux context, which is a label that dictates its policy.

Example:

# View the context of a file
ls -Z /path/to/file

# View the context of a process
ps -eZ | grep process_name

b. Restoring Default File Contexts

Returning the SELinux context of a file or directory to its default.

Example:

# Restore context for a file or directory
restorecon -v /path/to/file

c. Managing SELinux Port Labels

Example:

# Add a new port type
semanage port -a -t http_port_t -p tcp 8080

d. Booleans in SELinux

On/off settings in SELinux that modify system behavior.

Example:

# Toggle a boolean to allow HTTPD scripts and modules to connect to the network
setsebool -P httpd_can_network_connect 1


6. Addressing SELinux Policy Violations

a. Diagnosing Violations

Example:

# Check SELinux denials
ausearch -m avc -ts recent


Practical Exercise

  1. Set up an SSH server and authenticate using key pairs.
  2. Modify your firewall to allow SSH traffic.
  3. Create a new file and examine its SELinux context.
  4. Cause an SELinux violation and diagnose it using the tools provided.

Summary

Security on Linux, particularly Red Hat, is multi-layered, with SELinux and firewalld serving as crucial components. Properly managing these elements ensures system protection without hindering usability.

Key Points

  1. Firewalld provides dynamic firewall management.
  2. SSH key pairs enhance authentication security.
  3. SELinux offers fine-grained control over system processes and files.
  4. Recognizing and resolving SELinux policy violations is vital for system health.