Security
The security domain focuses on hardening a Linux system against unauthorized access and privilege abuse. Topics span file permissions, mandatory access control, firewalls, and secure remote access. Defense in depth combines many small controls into a resilient whole.
Permissions and Ownership
Standard permissions are managed with 'chmod', 'chown', and 'chgrp', expressed in symbolic or octal notation. The 'umask' value determines default permissions on newly created files. Special bits add behavior: SUID runs a program as its owner, SGID inherits group or runs as the group, and the sticky bit restricts deletion in shared directories like /tmp. Auditing these bits helps catch privilege-escalation risks.
Mandatory Access Control
SELinux and AppArmor confine processes beyond traditional permissions. SELinux uses labels and policies, with 'getenforce' and 'setenforce' controlling Enforcing versus Permissive modes and 'ausearch'/'audit2allow' helping diagnose denials. AppArmor uses path-based profiles managed with 'aa-status' and 'aa-enforce'. These systems limit the damage a compromised process can do.
Firewalls
Modern distributions filter traffic with nftables, often fronted by firewalld or ufw for easier management. 'firewall-cmd' adds services or ports to zones, using --permanent plus --reload to persist changes. Legacy iptables rules may still appear on older systems. Default-deny inbound policies with explicit allows are the safest baseline.
Securing SSH
OpenSSH is hardened through /etc/ssh/sshd_config. Disable root login with 'PermitRootLogin no', prefer key-based authentication over passwords, and consider changing defaults or adding rate limiting. Key pairs are generated with 'ssh-keygen' and distributed with 'ssh-copy-id'. These steps sharply reduce exposure to brute-force attacks.
Encryption and Integrity
Data at rest can be protected with LUKS full-disk encryption managed by cryptsetup. File integrity and authenticity rely on hashing and GPG signatures verified during package installation. Certificates and TLS secure services in transit. Combining encryption with access control and monitoring provides layered protection.