KnowledgeStep: Enterprise Linux Security Administration

Course GL550: Enterprise Linux Security Administration

Return to Linux Security Course List

Start Date End Date Price Location Register
No scheduled dates - call for info $  


















This highly technical course focuses on properly securing machines running the Linux operating systems. A broad range of general security techniques such as packet filtering, password policies, and file integrity checking are covered. Advanced security technologies such as Kerberos and SELinux are taught. Special attention is given to securing commonly deployed network services. At the end of the course, students have an excellent understanding of the potential security vulnerabilities -- know how to audit existing machines, and how to securely deploy new network services.

Prerequisites:

This class covers advanced security topics and is intended for experienced systems administrators. Candidates should have current Linux or UNIX systems administration experience equivalent to the GL120 "Linux Fundamentals"GL250 "Enterprise Linux Systems Administration", and GL275 "Enterprise Linux Network Services"

Supported Distributions:
Red Hat Enterprise Linux 5
Fedora Core 6
SUSE Linux Enterprise Server 10
SUSE Linux 10.1
Recommended Class Length:
5 days
Detailed Course Outline:
  • Security Concepts
    • Basic Security Principles
    • Linux Default Install
    • Installer Firewall Options
    • Post-Install Firewall
    • Minimization - Discovery
    • Service Discovery
    • Hardening
    • Security Concepts
    Lab Tasks
    • Removing Packages Using RPM
    • Firewall Configuration
    • Process Discovery
    • Operation of the setuid() and capset() System Calls
    • Operation of the chroot() System Call
  • Scanning, Probing, and Mapping Vulnerabilities
    • The Security Environment
    • Stealth Reconnaissance
    • The WHOIS database
    • Interrogating DNS
    • Discovering Available Hosts and Apps
    • Reconnaissance with SNMP
    • Discovery of RPC Services
    • Enumerating NFS Shares
    • Nessus Insecurity Scanner
    • Configuring OpenVAS
    Lab Tasks
    • NMAP
    • OpenVAS
    • Advanced NMAP Options
  • Password Security and PAM
    • Unix Passwords
    • Password Aging
    • Auditing Passwords
    • PAM Implementation, Management, and Control Statements
    • PAM Modules
    • pam_unix.so
    • pam_cracklib.so
    • pam_pwcheck.so
    • pam_env.so
    • pam_xauth.so
    • pam_tally.so
    • pam_wheel.so
    • pam_limits.so
    • pam_nologin.so
    • pam_deny.so
    • pam_securetty.so
    • pam_time.so
    • pam_access.so
    • pam_listfile.so
    • pam_lastlog.so
    • pam_warn.so
    • pam_console.so
    • pam_resmgr.so
    • pam_devperm.so
    Lab Tasks
    • John the Ripper
    • Cracklib
    • Using pam_listfile to Implement Arbitrary ACLs
    • Using pam_limits to Restrict Simultaneous Logins
    • Using pam_nologin to Restrict Logins
    • Using pam_access to Restrict Logins
    • su & pam
  • Secure Network Time Protocol (NTP)
    • The Importance of Time
    • Time Measurements
    • Terms and Definitions
    • Synchronization Methods
    • NTP Evolution
    • Time Server Hierarchy
    • Operational Modes
    • NTP Clients
    • Configuring NTP Clients and Servers
    • Securing NTP
    • NTP Packet Integrity
    • Useful NTP Commands
    Lab Tasks
    • Configuring and Securing NTP
    • Peering NTP With Multiple Systems
  • Kerberos Concepts
    • Common Security Problems
    • Account Proliferation
    • The Kerberos Solution
    • Kerberos History, Implementations, and Concepts
    • Kerberos Principals, Safeguards, and Components
    • Authentication Process
    • Identification Types
    • Logging In
    • Gaining and Using Privileges
  • Kerberos Components
    • Kerberos Components
    • KDC
    • Kerberos Principal Review
    • Kerberized Services Review
    • Kerberized Clients
    • KDC Server Daemons
    • Configuration Files
    • Utilities Overview
    • Kerberos SysV Init Scripts
  • Implementing Kerberos
    • Plan Topology
    • Plan Implementation
    • Kerberos 5 Client Software
    • Kerberos 5 Server Software
    • Synchronize Clocks
    • Creating and Configuring the Master KDC
    • KDC Logging
    • Kerberos Realm Defaults
    • Specifying [realms]
    • Specifying [domain_realm]
    • Allow Administrative Access
    • Create KDC Databases and Administrators
    • Install Keys for Services
    • Start Services
    • Add Host Principals
    • Add Common Service Principals
    • Configure Slave KDCs
    • Create Principals for Slaves
    • Define Slaves as KDCs
    • Copy Configuration to Slaves
    • Install Principals on Slaves
    • Synchronization of Database
    • Propagate Data to Slaves
    • Create Stash on Slaves
    • Start Slave Daemons
    • Client Configuration
    • Install krb5.conf on Clients
    • Client PAM Configuration
    • Install Client Host Keys
    Lab Tasks
    • Implementing Kerberos
  • Administrating and Using Kerberos
    • Administrative Tasks
    • Key Tables
    • Managing Keytabs
    • Principals
    • Managing Principals
    • Principal Policy
    • Viewing Principals
    • Managing Policies
    • Overall Goals for Users
    • Signing Into Kerberos
    • Ticket types
    • Viewing Tickets
    • Removing Tickets
    • Passwords
    • Changing Passwords
    • Giving Others Access
    • Using Kerberized Services
    • Kerberized FTP
    • Enabling Kerberized Services
    • OpenSSH and Kerberos
    Lab Tasks
    • Using Kerberized Clients
    • Forwarding Kerberos Tickets
    • OpenSSH with Kerberos
  • Securing The Filesystem
    • Filesystem Mount Options
    • NFS Properties
    • NFS Export Option
    • NFSv4 and GSSAPI Auth
    • Implementing NFSv4
    • File Encryption with GPG and OpenSSL
    • Linux Unified Key Setup (LUKS)
    Lab Tasks
    • Securing Filesystems
    • Securing NFS
    • Implementing NFSv4
    • File Encryption With GPG
    • File Encryption With OpenSSL
    • LUKS-on-disk format Encrypted Filesystem
  • AIDE
    • Host Intrusion Detection
    • Using RPM as an HIDS
    • Introduction to AIDE
    • Concepts of AIDE
    • AIDE Installation
    • AIDE Policies
    • AIDE Usage
    Lab Tasks
    • File Integrity Checking with RPM
    • File Integrity Checking with AIDE
  • Securing APACHE
    • Apache Overview
    • Default Configuration
    • Configuring CGI
    • Turning Off Unneeded modules
    • Configuration Delegation and Scope
    • ACL by IP Address
    • HTTP User Authentication
    • Standard Auth Modules
    • HTTP Digest Authentication
    • Authentication via SQL, LDAP, and Kerberos
    • Scrubbing HTTP Headers
    • Metering HTTP Bandwidth
    Lab Tasks
    • Hardening Apache by Minimizing Loaded Modules
    • Scrubbing Apache & PHP version headers
    • Protecting Web Content
    • Using the suexec mechanism
    • Enabling SSO in Apache with mod_auth_kerb
  • Securing PostgreSQL
    • PostgreSQL Overview and Default Configuration
    • Configuring SSL
    • Client Authentication Basics
    • Authentication Methods
    • Advanced Authentication
    • Ident-based Authentication
    Lab Tasks
    • Configure PostgreSQL
    • PostgreSQL with SSL
    • PostgreSQL with Kerberos Authentication
    • Securing PostgreSQL with Web Based Applications
  • Securing Email Systems
    • SMTP Overview
    • SMTP Implementations
    • Selecting an MTA
    • Security Considerations
    • Postfix Overview
    • Chrooting Postfix
    • Connections and Relays
    • SMTP AUTH & StartTLS/SSL
    • Secure Cyrus IMAP Config
    • Using GSSAPI/Kerberos Auth
    Lab Tasks
    • Configuring Postfix
    • Postfix Network Configuration
    • Postfix In a Chrooted Environment
    • Postfix SMTP AUTH Configuration
    • Postfix STARTTLS Configuration
    • Configuring Cyrus IMAP
    • Kerberos with Postfix and Cyrus
  • SELinux Concepts
    • DAC vs. MAC
    • Shortcomings of Traditional Unix Security
    • SELinux Goals, Evolution, and Modes
    • Gathering Information
    • SELinux Virtual Filesystem
    • SELinux Contexts
    • Managing Contexts
    • SELinux Troubleshooting
    Lab Tasks
    • Exploring SELinux Modes
    • SELinux Contexts in Action
  • SELinux Policy
    • The SELinux Policy
    • Choosing a Policy
    • Policy Layout
    • Tuning and Adapting Policy
    • Booleans
    • Managing Booleans
    • Managing File Contexts
    • Managing Port Contexts
    • Managing SELinux graphically
    • Examining Policy
    Lab Tasks
    • Managing SELinux Booleans [RHEL]
    • Creating Policy with Audit2allow [RHEL]
    • Creating & Compiling Policy from Source [RHEL]
  • Accountability with Kernel auditd
    • Accountability and Auditing
    • Simple Audit Tools
    • Kernel-Level Auditing
    • Configuring the Audit Daemon
    • Controlling Kernel Audit System
    • Creating Audit Rules
    • Searching Audit Logs
    • Generating Audit Log Reports
    • Audit Log Analysis
    Lab Tasks
    • Auditing Login/Logout
    • Auditing File Access
    • Auditing Command Execution