BMV - HOME

https://www.youtube.com/watch?v=heacxYUnFHA

https://www.youtube.com/watch?v=ApYbwdFWytE

[BHISHMA ~]# neofetch
██████████████████  ████████   root@BHISHMA 
██████████████████  ████████   ------------ 
██████████████████  ████████   OS: Manjaro Linux x86_64 
██████████████████  ████████   Host: 80TJ Lenovo ideapad 110-15ACL 
████████            ████████   Kernel: 5.15.55-1-MANJARO 
████████  ████████  ████████   Uptime: 2 hours, 42 mins 
████████  ████████  ████████   Packages: 1089 (pacman) 
████████  ████████  ████████   Shell: bash 5.1.16 
████████  ████████  ████████   Resolution: 1366x768 
████████  ████████  ████████   DE: Xfce4 4.16 
████████  ████████  ████████   WM: Xfwm4 
████████  ████████  ████████   WM Theme: Matcha-sea 
████████  ████████  ████████   Theme: Matcha-sea [GTK2], Adwaita [GTK3] 
████████  ████████  ████████   Icons: Papirus-Maia [GTK2], Adwaita [GTK3] 
                               Terminal: xfce4-terminal 
                               Terminal Font: Monospace 12 
                               CPU: AMD A8-7410 APU with AMD Radeon R5 Graphics (4) @ 2.200GHz 
                               GPU: AMD ATI Radeon R4/R5 Graphics 
                               GPU: AMD ATI Radeon HD 8670A/8670M/8690M / R5 M330 / M430 / Radeon 520 Mobile 
                               Memory: 4109MiB / 6849MiB 

                                                       
                                                       

OS        : Manjaro Linux x86_64
Host        : 80TJ Lenovo ideapad 110-15ACL
Kernel        : 5.15.55-1-MANJARO
Uptime        : 2 hours, 42 mins
Packages    : 1089 (pacman)
Shell        : bash 5.1.16
Resolution    : 1366x768
DE        : Xfce4 4.16
WM        : Xfwm4
WM Theme    : Matcha-sea
Theme        : Matcha-sea [GTK2], Adwaita [GTK3]
Icons        : Papirus-Maia [GTK2], Adwaita [GTK3]
Terminal    : xfce4-terminal
Terminal Font    : Monospace 12
CPU        : AMD A8-7410 APU with AMD Radeon R5 Graphics (4) @ 2.200GHz
GPU        : AMD ATI Radeon R4/R5 Graphics
GPU        : AMD ATI Radeon HD 8670A/8670M/8690M / R5 M330 / M430 / Radeon 520 Mobile
Memory        : 4109MiB / 6849MiB 

[BHISHMA ~]# inxi -Fxz
System:
  Kernel: 5.15.55-1-MANJARO arch: x86_64 bits: 64 compiler: gcc v: 12.1.0
    Desktop: Xfce v: 4.16.0 Distro: Manjaro Linux base: Arch Linux
Machine:
  Type: Laptop System: LENOVO product: 80TJ v: Lenovo ideapad 110-15ACL
    serial: <filter>
  Mobo: LENOVO model: Nano 5A8 v: No DPK serial: <filter>
    UEFI-[Legacy]: Lenovo v: 1QCN32WW date: 08/18/2016
Battery:
  ID-1: BATT charge: 7.0 Wh (100.0%) condition: 7.0/23.8 Wh (29.3%)
    volts: 12.1 min: 10.8 model: LENOVO LCFC status: full
CPU:
  Info: quad core model: AMD A8-7410 APU with AMD Radeon R5 Graphics bits: 64
    type: MCP arch: Puma rev: 1 cache: L1: 256 KiB L2: 2 MiB
  Speed (MHz): avg: 1000 min/max: 1000/2200 boost: enabled cores: 1: 1000
    2: 1000 3: 1000 4: 1000 bogomips: 17573
  Flags: avx ht lm nx pae sse sse2 sse3 sse4_1 sse4_2 sse4a ssse3 svm
Graphics:
  Device-1: AMD Mullins [Radeon R4/R5 Graphics] vendor: Lenovo driver: radeon
    v: kernel arch: GCN 2 bus-ID: 00:01.0
  Device-2: AMD Sun XT [Radeon HD 8670A/8670M/8690M / R5 M330 M430 Radeon
    520 Mobile]
    vendor: Lenovo driver: radeon v: kernel arch: GCN 1 bus-ID: 01:00.0
  Device-3: Acer EasyCamera type: USB driver: uvcvideo bus-ID: 2-1.2:4
  Display: x11 server: X.Org v: 21.1.4 driver: X: loaded: radeon
    unloaded: modesetting gpu: radeon resolution: 1366x768~60Hz
  Message: Unable to show GL data. Required tool glxinfo missing.
Audio:
  Device-1: AMD Kabini HDMI/DP Audio vendor: Lenovo driver: snd_hda_intel
    v: kernel bus-ID: 00:01.1
  Device-2: AMD FCH Azalia vendor: Lenovo driver: snd_hda_intel v: kernel
    bus-ID: 00:14.2
  Sound Server-1: ALSA v: k5.15.55-1-MANJARO running: yes
  Sound Server-2: JACK v: 1.9.21 running: no
  Sound Server-3: PulseAudio v: 16.1 running: yes
Network:
  Device-1: Qualcomm Atheros QCA9377 802.11ac Wireless Network Adapter
    vendor: Lenovo driver: ath10k_pci v: kernel bus-ID: 02:00.0
  IF: wlp2s0 state: up mac: <filter>
  Device-2: Realtek RTL810xE PCI Express Fast Ethernet vendor: Lenovo
    driver: r8169 v: kernel port: 1000 bus-ID: 03:00.0
  IF: enp3s0 state: down mac: <filter>
Bluetooth:
  Device-1: Qualcomm Atheros type: USB driver: btusb v: 0.8 bus-ID: 2-1.1:3
  Report: rfkill ID: hci0 rfk-id: 3 state: down bt-service: disabled
    rfk-block: hardware: no software: no address: see --recommends
Drives:
  Local Storage: total: 1.36 TiB used: 315.2 GiB (22.6%)
  ID-1: /dev/sda vendor: Western Digital model: WD10JPCX-24UE4T0
    size: 931.51 GiB
  ID-2: /dev/sdb type: USB model: Mass Storage Device size: 465.76 GiB
Partition:
  ID-1: / size: 87.54 GiB used: 28.93 GiB (33.0%) fs: ext4 dev: /dev/sda3
  ID-2: /boot size: 487.2 MiB used: 111.1 MiB (22.8%) fs: ext4
    dev: /dev/sda2
Swap:
  ID-1: swap-1 type: partition size: 10 GiB used: 0 KiB (0.0%) dev: /dev/sda1
Sensors:
  System Temperatures: cpu: 46.2 C mobo: N/A
  Fan Speeds (RPM): N/A
  GPU: device: radeon temp: 40.0 C device: radeon temp: 43.0 C
Info:
  Processes: 234 Uptime: 2h 9m Memory: 6.69 GiB used: 3.53 GiB (52.8%)
  Init: systemd Compilers: gcc: 12.1.0 clang: 14.0.6 Packages: 1088
  Shell: Bash v: 5.1.16 inxi: 3.3.19
[BHISHMA ~]# 

 ###################################################

VITAL SIGNS FROM NATURE DISREGARDED 

    Nature(GOD) provides us with vital information in various forms to let us know what lies ahead in our journey of life on this planet in the form of SIGNS, which 99.99% of the time we disregard quoting superstition & other excuses. Below I am giving a glimpse into some of such signs that were provided to me, and I was incapable of translating them into anything meaningful.

A baby cobra at my doorstep:

Me and my son had gone to the supermarket to get some groceries on a sunday. As the supermarket was only a 3 minute walk, we took a walk and returned with our purchases. We opened the gate, and my son got inside first, then me and I closed the gate from inside, & I hear a loud cry from my son "Paambuuuu", which means snake. I immediately turn towards him and see the snake is trying to climb up the step to get inside the house; the entrance door was partially closed. But the step was made of smooth granite stone and the snake found it impossible to climp-up the slippery surface.

    My son was barely 3 feet away from the snake and he was standing there almost frozen & the snake was trying to make its way under the staircase just 5 feet away, but I stretched my right hand after which the snake probably got confused & hid its head behind my rubber slippers which was lying right next to the granite steps. 

    The next thing I remember is me jumping on top of the snake landing one hard kick using my right leg right on the head of the snake. This act of mine was probably a split-second subconscious mind's decision as I never had the intention to harm/kill the snake but was done in an act of self-defence as my son was standing barely 3 feet away from the snake almost frozen, & had I allowed the snake to crawl under the stair-case it would have taken the whole day and probably the whole of next day too as I had all kinds of junk items lying under the staircase.

    As it turned out, that one kick was fatal enough for the snake, which gouged out one eye of the snake and instantly it turned its head upside down probably causing brain-death. Its tail was still moving, and I was unwilling to kill it, so decided to pick it up using a stick and threw to an un-occupied and buzy plot diagonally opposite to my house. But before throwing it, I took enough photos using my mobile phone, and to my shock identified that this was indeed a baby cobra based upon its marking. The snake would have been around 2 to 2.5 feet long.

    I have asked for forgiveness for having killed a baby cobra in my mind enough number of times. Having lost my piece of mind over the killing of a baby cobra, I began to think why was the snake trying to enter my house, especially when only my wife and daughter were at home? Questions like these kept my mind distracted and unable to find get any clue, just left the unanswered questions pending in my mind.

A snake touches my wife at lightning speed and dives into stream:

    This incident happened while me, my son, daughter & wife where in kerala at my parents residence and decided to go to a nearby waterfall so that my children could have a good time. So we took out car and reached the waterfall and all of us were having a good time playing under the waterfall. My wife decided to not enter the water and was sitting at the nearby rock with a Nikon camera clicking all the moments. 

    I came out of the water for a minute and was looking at my wife from probably 10 feet away, when I noticed a long snake suddenly appeared from no where from the bushes just behind where my wife was sitting alone. The snake came down the slope in a flash, brushed my wife on her left side and dived in the water right in front of me and disappeared. 

    This scene looked to me as if the snake came out of the bushes to touch my wife and give me some kind of message before diving into the water right in front of my eyes. I must say this snake was so lightning fast that the entire scene was over in less than 7-8 seconds. This day I was on a 41-day vratham and was wearing a mala as is customary before heading to Sabarimala Pilgrimage. I must say that I always retain a photographic memory of events like these and such memories stay permanently with me for life.

    This definitely looked like a very clear sign to me, although I couldn't draw any conclusions, but nevertheless kept the matter pending in my mind.

Completely lost our way back home from a visit to KALAHASTI TEMPLE:

    We(me, son, daughter & wife) had gone to Tirupati for the wedding of my wife's relative. After the wedding we decided to visit the Kalahasti Temple which was around 40 Kms and 1 hour travel. We reached Kalahasti, and spent 1 hour inside the temple, although we did not offer any special pooja. From the beginning, I noticed that my wife was just there at the temple as a tourist without any sort of religious feeling inside. To me this attitude seemed as though she was an atheist and was at the temple just because she had to accompany me without a choice. 

    We bought some laddoos from the temple counter and decided to start our journey back home in Bangalore. This was my second visit to the Kalahasti temple & the route was pretty clear to me as I was here with my mother a year ago. However, to my surprise, I suddenly realised that I had taken the wrong route, and searched in google maps, and took a U-turn coming back to the place where we had lost our way & continued on the right route. However within 30 minutes again realised that we were heading the wrong way and but decided to continue after having enquired few passerby. It was a different route I realised there were no petrol bunks on this route. I was running short of fuel, & wasn't sure how far it could go before I find the next petrol station. 

    All of us were very hungry as it was already close to 3 PM, and there is no sign of any restaurant or even any coffee shops. On the way I found some boys selling petrol in bottles & as my fuel indicator was already in warning decided to buy a bottle just in case we needed it as an emergency. Finally after travelling many kilometres found an Essar Petrol station from where I filled the tank with required fuel & continued our journey home. But there was no sign of any restaurant anywhere and by 6 PM evening we reached Bangalore & had all that we wanted to eat from Ananda Bhavan which was less than 5 Kms from my house in Bangalore.

    This is the same route which I use when going to Chennai from Bangalore, and I had used this route more than 25 times atleast in the past, & Tirupati / Kalahasti is only a deviation that I need to take on this route. Yet, I completely lost my way on this return journey, and I have every reason to believe this was yet another valid SIGN and probably the most important one as this directly points to my family life.

    Nevertheless, fate is something that was decided even before my birth leaving me with the only choice of dealing with it as best as I can. Fatal events tests a persons complete personality and 

LINUX - IS IT SECURE ?

 https://www.linux-magazine.com/Online/News/Linus-Says-No-Backdoor-in-Linux

Brief dust-up in the kernel community leads to an illuminating look at random number generation.

After the Snowden documents revealed that the NSA deliberately incorporates bugs into encryption software and hardware systems, some users and cryptography experts are taking a closer look at algorithms and processor instructions for generating random numbers.
Rdrand is an instruction for Ivy Bridge processors that returns a hardware-generated random value. According to Intel, the random number generator is compliant with the standards NIST SP800-90, FIPS 140-2, and ANSI X9.82 . Some experts speculate that NIST SP800-90 might contain a backdoor. Dual_EC_DRBG, one of the algorithms used by NIST SP800-90, is based on Elliptic Curve Cryptography and is three times slower than other alternative approaches. At the Crypto conference in August 2007, Dan Shumow and Niels Ferguson voiced allegations that the algorithm contains weaknesses that could be described as backdoors.

Kyle Condon from the UK filed a petition with Change.org to remove the support of Rdrand from the kernel. The petition states, "Please remove RdRand from /dev/random, to improve the overall security of the linux kernel."

However, the real story is a bit more complicated. Ted Ts’o announced last week on Google Plus that he was glad not to have given in to pressure from Intel. Intel had requested that the random number generation of /dev/random should rely exclusively on Rdrand, but Ts’o refused. Linus Torvald's answer to the petition follows his characteristic negative tone, stating the random number generation in the kernel does not depend on Rdrand alone:

"Where do I start a petition to raise the IQ and kernel knowledge of people? Guys, go read drivers/char/random.c. Then, learn about cryptography. Finally, come back here and admit to the world that you were wrong. Short answer: we actually know what we are doing. You don't. Long answer: we use Rdrand as _one_ of many inputs into the random pool, and we use it as a way to _improve_ that random pool. So even if Rdrand were to be back-doored by the NSA, our use of Rdrand actually improves the quality of the random numbers you get from /dev/random. Really short answer: you're ignorant."

Linus's caustic posts often have the effect of closing down the debate. In this case even seasoned kernel developers might not be eager to jump into the discussion unless they are experts in cryptography. To be fair, the headline for the petition at the Change.org site was a bit caustic also and probably started the whole thing off on the wrong footing: "Linux: A NSA Approved Partner."

As of now, the petition is closed with only five signatures, but at least one cryptography specialist has taken up the challenge to "go read drivers/char/random.c" and, although agreeing with the basic concept for using Rdrand, has offered a suggestion that might someday lead to improvements in the way Linux handles random number generation. Such is the way of the kernel – after all the politics, the real story comes down to programmers studying source code and looking for improvements.

The NSA backdoor in "Linux"

https://www.barkdull.org/blog/the-nsa-backdoor-in-linux

Considering that the Linux kernel (the only component Linus has any kind of control over), the software from the GNU Project, and all of the most popular third-party software available for GNU/Linux is all free and open source, it is ridiculous that people can even believe the notion that Linus Torvalds, solely, could put a backdoor in "Linux."

Free and open source software obviously makes a clandestine backdoor very difficult.

There's also the fact that any kind of backdoor in a kernel wouldn't amount to much when most user-space software that initiates kernel actions wouldn't be affected. It's important to remember that Linux can't do most tasks without user-space software, let alone those necessary for a backdoor. For example, the ext4 filesystem libraries and the GNU C Library, as well as the -- often proprietary binary blob -- networking, SATA and video drivers, are all necessary components for a backdoor and would all have to be affected.

Which, again, would not only be a very difficult task, but also one that Torvalds would play a minuscule role in.

I would be more concerned about another possible, more likely, and more viable backdoor vulnerability. That being user-space software. It would be easier to put a backdoor in something like OpenSSL (when it wasn't well maintained), and it would be far more useful to put a backdoor in something like the various filesystem libraries, the GNU C Library, GCC, GIMP, Firefox, or Webkit, as those are used not only on desktop GNU/Linux, but on Android, OS X, BSD, iOS, and Windows as well.

Let's not forget about SELinux, the Linux kernel module developed and maintained by the NSA that sees very wide use across distributions. Since most people already use SELinux, the NSA wouldn't even have to approach Torvalds to get a backdoor into Linux. However, again, SELinux is free and open source, the NSA couldn't put a backdoor in it without people noticing.

All of this is inconsequential, anyway, as Torvalds clarified in September of last year that he was, in fact, joking.

The NSA never actually approached him. Despite what his father says.

Suomynona

7 years ago

They can, they will..
My guess is that it would already be implemented in the hardware, isolated from the applied 'OS'.. So with standard technologies the only way out is through my never used packetsniffer. To bypass that, I guess the rush for global dominion have put extra threads in my ethernetcable where my limited tools and knowledge for DSprocessing fails.
Of course the NSA, SÄPO or whomever could always call me for delicious information about PHP, chocolaterecipies or tuned mopeds ;o)
However, humanity has probably been owned for thousands 'millions?' of years, it is probably not a backdoor in there, it has always been at your frontdoor or lawn.

Since this commentsystem is probably going to be implemented at my latest project, socializing, knowledgebasing and promoting masonists/bricklayers/chimneyconstruction'ers here in Sweden, could we not provide an API for infoleakage so that anyone interested could take part of backstage encrypted posts?
Or better yet, maybe 'they' have API's readily available, so the post-object could store at my server and also push to kgb.com?

So, feature request that is ;o)

../greets from an all open 'but somewhat terrified' heart @snowyLandscapes( 'that-is-awsome' );

LINUX BACKDOOR RELATED LINKS:

https://www.bleepingcomputer.com/news/security/nsa-linked-bvp47-linux-backdoor-widely-undetected-for-10-years/

https://www.reddit.com/r/linux/comments/54in5s/the_nsa_has_tried_to_backdoor_linux_three_times/

• Ever since i heard about Intel Active Management Technology (AMT) and AMD's alternative, i wonder why would NSA even bother with backdoors now. Most of us already have a backdoor up and running.
• Doesn't AMT explicitly have to be enabled in BIOS/firmware? So you would need a CPU that supports it, a motherboard that exposes it, and for it to be enabled. It's not some magic backdoor.
• We need FOSS cpu's for next year. Sick of this shit.
• I think the reason we hear nothing about IME hacks is because the NSA would prefer to keep it that way. The IME potential is way more insidious, and they don't have to show their code to anyone.

• Between that and the hardware blobs, we don't have to worry about Linux bring hacked, but rather our hardware itself.

VOID LINUX COMMANDS

http://tinycorelinux.net/corebook.pdf
 

TAR COMMAND WILL AUTO UNZIP .tar.bz / tar.gzip
# tar xf "*.tar.bz"

FIND LINUX KERNEL VERSION
# uname -r
# cat /proc/version
# dmesg | grep Linux
# hostnamectl | grep Kernel

UPDATE VOID LINUX TO LATEST VERSION
# xbps-install -Su

UPDATE VOID PACKAGE MANAGER
# xbps-install -u xbps
# xbps-install -Su gedit-plugins

# xbps-install -S nftables


NO AUDIO AFTER VOID INSTALL
    http://www.troubleshooters.com/linux/void/voidtips.htm#audio
    ALSA channels have to be unmuted manually.
First install alsa-utils:
= install alsa-tools, alsa-utils, and sox:
# xbps-install -S alsa-utils
# xbps-install -S alsa-tools
# xbps-install -S sox
= Unmute the desired channels with alsamixer:
$ alsamixer

Use the arrow keys to select a channel and the mkey to unmute it. Muted channels are indicated by a MM label & unmuted channels by 00 label.

LIBREWOLF BROWSER INSTALL ON VOID LINUX
https://gitlab.com/librewolf-community/browser/source
https://gitlab.com/librewolf-community/browser/source/-/releases

UNABLE TO MOUNT / READ NTFS VOLUMES
= Install the ntfs-3g package
# xbps-install -S ntfs-3g

CREATE USB BOOTABLE FROM ISO
dd bs=4M if=/run/media/kalki/root/home/kalki/Downloads/software.downloads/linux.os/alpine-standard-3.16.2-x86_64.iso of=/dev/sdc conv=fdatasync status=progress

INSTALL GUI WITH i3 WINDOW MANAGER

https://www.reddit.com/r/voidlinux/comments/c84117/noob_question_installing_i3/ 

https://youtu.be/nSHOb8YU9Gw?t=880

When you are staring at text characters in the terminal after installation and you want to change that into a graphical environment with i3, you need two three things basically:

1. A way to display graphical environments. For that, you use xorg, which is called a "display server".

2. A way to start this graphical environment, and then start your preferred "desktop environment". For that, you can use either startx with the necessary configuration, or a "display manager" which does this automatically for you and that is automatically started when you boot your system. A display manager asks you to provide login credentials and then starts your preferred desktop environment.

3. The desktop environment itself.

If you want to take the easy route, just install full xorg:

sudo xbps-install -S xorg xterm

In addition, you may want to install dedicated video card drivers for hardware acceleration. This makes everything way smoother.

After that, you need to install your desktop environment:

sudo xbps-install -S i3

Now you can take two routes. First, you can configure starting your desktop environment manually:

1. echo "exec i3" >> ~/.xinitrc.

2. Now you can use startx in your terminal to start i3.

Second, use a display manager and add this as a service. After reboot, it automatically starts the graphical environment and lets you start i3:

sudo xbps-install -S lightdm lightdm-gtk3-greeter
ln -s /etc/sv/dbus /var/service/dbus
ln -s /etc/sv/lightdm /var/service/lightdm

Additional notes:

• To communicate between graphical and other apps, and to share hardware resources, software is required to do this. dbus takes care of this, and so does consolekit. You install them as follows:

sudo xbps-install ConsoleKit2 dbus

If you want to start your desktop environment by hand, you have to start i3 differently. Instead of above, put this in ~/.xinitrc:

echo "exec ck-launch-session dbus-launch --sh-syntax --exit-with-x11 i3" >> ~/.xinitrc

All this info can be found here in the wiki:  

https://wiki.voidlinux.org/Post_Installation#Graphical_User_Interface

• 02:00 - Users and Groups  
• 04:01 - Sudoers file  
• 08:36 - DE vs. WM  
• 09:23 - Xorg  
• 10:50 - i3wm  
• 12:25 - Fonts  
• 16:13 - XFCE  
• 17:59 - What to do if you messed up  
• 20:48 - LightDM  
• 22:22 - SystemD  
• 23:20 - Miscellaneous customization.

The i3 Status package is called i3status, not i3-status.

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

https://opensource.com/article/19/9/linux-commands-hardware-information

[BHISHMA ~]# neofetch

LINUX COMMANDS - III

DISPLAYING DATE IN VARIOUS FORMATS
date +%a,%_2d-%b-%4Y,%_H:%M%_P
Tue, 7-Dec-2021, 1:41-AM
date +%a,%_2d-%b-%Y,%_H:%M%_p 

date +%a," "%d" "%b" "%Y" - "%r
Wed, 19 Jan 2022 - 05:36:48 PM IST

COPY COMMANDS
cp -a //run/media/bhishma/WD-II/IP-1/. /mnt/data/win1/
cp -a -v //run/media/bhishma/WD-II/IP-2/. /mnt/data/win2/
cp -a -v //mnt/data/win1/. /run/media/bhishma/WD-II/IP-1/
/usr/bin/rsync -vuza /mnt/data/win1/. /run/media/bhishma/WD-II/IP-1/
/usr/bin/rsync -vuza /mnt/data/win2/. /run/media/bhishma/WD-II/IP-2/
/usr/bin/rsync -vuza /mnt/data/kdebkp/. /run/media/bhishma/kdebkp/

IPTABLE COMMANDS
iptables -p icmp -h ### IPTABLES COMMAND COMPLETE OPTIONS
systemctl enable iptables ### sets iptables to start on boot
systemctl disable iptables ### stops iptables from start on boot
systemctl start iptables.service
systemctl start ip6tables.service
systemctl stop iptables.service
systemctl --type=service
iptables --list-rules
ip6tables --list-rules
iptables -F ### delete all rules
iptables -X ### DELETE A USER DEFINED CHAIN
iptables -E LOGGING LOGS ### RENAME chain named LOGGING TO LOGS
iptables-save -f /etc/iptables/iptables.rules
iptables-save -f /etc/iptables/ip6tables.rules
journalctl -k | grep "IN=.*OUT=.*" ### LIST LOGS FOR IPTABLES

iptables -P INPUT ACCEPT
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT
iptables -L -n -v --line-numbers ### List ruleset, numeric format, verbose, display rule line numbers
iptables -F ### delete all rules
iptables -D OUTPUT 2 ### delete input rule number 5
iptables -L INPUT -n --line-numbers
iptables -I INPUT 1 -s ipaddress -j DROP ### inserts new INPUT rule 5
iptables -A INPUT -j DROP ### DROP ALL INCOMING PACKETS
iptables -A OUTPUT -j DROP ### DROP ALL OUTGOING PACKETS

MOVE NON WORKING IPTABLES APP TO TEMP DIR &
COPY WORKING LEGACY APP TO DEFAULT FOLDER
sudo touch /run/xtables.lock
sudo chmod a+r /run/xtables.lock

#!/bin/bash
mv /usr/sbin/iptables /usr/sbin/iptables-broken
cp /usr/sbin/iptables-legacy /usr/sbin/iptables
mv /usr/sbin/iptables-restore /usr/sbin/iptables-restore-broken
mv /usr/sbin/ip6tables-restore /usr/sbin/ip6tables-restore-broken
mv /usr/sbin/iptables-save /usr/sbin/iptables-save-broken
mv /usr/sbin/ip6tables-save /usr/sbin/ip6tables-save-broken
cp /usr/sbin/iptables-legacy-restore /usr/sbin/iptables-restore
cp /usr/sbin/ip6tables-legacy-restore /usr/sbin/ip6tables-restore
cp /usr/sbin/iptables-legacy-save /usr/sbin/iptables-save
cp /usr/sbin/ip6tables-legacy-save /usr/sbin/ip6tables-save

IPTABLES RULE TO LOG BOTH INCOMING & OUTGOING PACKETS
iptables -N LOGS1
iptables -I INPUT 4 -j LOGS1
iptables -I OUTPUT 4 -j LOGS1
iptables -A LOGS1 -m limit --limit 2/min -j LOG --log-prefix "IPTbmv-Dropped1: " --log-level 4
iptables -A LOGS1 -j DROP

DROP OR ACCEPT TRAFFIC FROM MAC ADDRESS EXAMPLE
iptables -A INPUT -m mac --mac-source 00:0F:EA:91:04:08 -j DROP
iptables -A INPUT -p tcp --destination-port 22 -m mac --mac-source 00:0F:EA:91:04:07 -j ACCEPT ### ACCEPT TCP PORT 8080 FROM MAC source

NETWORK COMMANDS
ip address show
which tcpdump ### FIND IF TCPDUMP IS INSTALLED IN SYSTEM
pacman -S tcpdump ### INSTALL TCPDUMP
tcpdump -D ### PRINT LIST OF NETWORK INTERFACES THAT TCPDUMP CAN USE
ss -lntu ### LIST OPEN TCP & UDP NETWORK PORTS
ip neigh ### LIST NEIGHBOUR DEVICES AND ITS MAC ADDRESSES
pacman -S net-tools ### INSTALLS NETSTAT & OTHER COMMANDS
pacman -Sy dnsutils ### INSTALLS NSLOOKUP & DIG & OTHER COMMANDS
ip -4 addr show eth0 | grep -oP '(?<=inet\s)\d+(\.\d+){3}'
ip -4 addr show dev wlp2s0 | grep -oP '(?<=inet\s)\d+(\.\d+){3}'
ip -4 addr show | grep -v '127.0.0.1'
ip -4 addr show | grep -oP '(?<=inet\s)\d+(\.\d+){3}' | grep -v '127.0.0.1'
ip addr show | grep -oP '(?<=inet\s)\d+(\.\d+){3}' | grep -v '127.0.0.1'
ip addr show | grep -oP 'inet \K[^/]+' | grep -v '127.0.0.1' ### BEST COMMAND SHOWS IP ONLY
ip route get 8.8.8.8 | grep -oP 'src \K[^ ]+'
ip route | grep -oP 'src \K[^ ]+'
ip route get 8.8.8.8 | grep -oP 'dev \K[^ ]+'
ip addr | grep "scope global" | sed 's:^[^0-9]*::' | sed 's:/.*$::'
ip addr | grep "scope global" | grep -oP 'inet \K[^/]+'
ip a | grep "scope global" | grep -Po '(?<=inet )[\d.]+'
ip address show $(ip route | grep "^default " | head -n1 | grep -Po "(?<=dev )[^ ]+") | grep -Po "(?<=inet )[^ /]+"
nmcli device show | awk '/4.A/ {print $2}' | grep -v '127.*' | cut -d / -f1

DISK | DIRECTORY | FILE COMMANDS
blkid ### lists UUID of all disk resources
ls -al /dev/disk/by-uuid/ ### lists UUID of all disk resources
find . -type f -name "*dillo*" ### FIND FILE WITH NAME dillo (START FROM \ DIRECTORY)
rm -rf folder-name ### deletes all subfolders & files recursively
find . -type f -name pycharm.svg -exec rm {} \; ### FIND & DELETE ALL FILES WITH NAME "pycharm.svg"
df -h
df -hT
fdisk -l
parted -l
findmnt ### POWERFUL TOOL TO FIND MOUNTED FILESYSTEMS.
chown bhishma:bhishma . ### CHANGE OWNERSHIP FROM ROOT TO BHISHMA FOR CURRENT DIRECTORY
chown owner_name file_name
chown -c master file1.txt ### CHANGES OWNER TO MASTER | -C: REPORTS AFTER OWNER CHANGE IS DONE.
chown :group1 file1.txt ### TO CHANGE OWNERSHIP OF A GROUP
chmod +rwx . ### CHANGE PERMISSIONS OF CURRENT DIRECTORY
chmod [class][operator][permission] file_name
chmod [ugoa][+or-][rwx] file_name
ls -al /dev/disk/by-uuid/ ### lists UUID of all disk resources
UUID=6cce8255-bf46-4b4a-a071-019472c7cc75 /mnt/data ext4 defaults 0 2 ### EDIT /etc/fstab FILE TO AUTO MOUNT DISK AT BOOT
sudo dd bs=4M if=/mnt/data/downloads/archbang-autumn-0412-x86_64.iso of=/dev/sdb conv=fdatasync status=progress ### CREATE USB BOOTABLE FROM ISO
dd bs=4M if=/mnt/data/downloads/iso/manjaro-xfce-21.1.6-minimal-211017-linux513.iso of=/dev/sdb conv=fdatasync status=progress

AUTO MOUNT A DATA DISK
blkid ### lists UUID of all disk resources
ls -al /dev/disk/by-uuid/ ### lists UUID of all disk resources
mkdir /mnt/data ### CREATE NEW MOUNT POINT FOLDER
groupadd grpdata ### CREATE NEW GROUP
usermod -aG grpdata kalki (KALKI IS NAME OF USER TO BE ADDED) ### ADD USER KALKI TO GROUP grpdata
chown -R :grpdata data ### CHANGE OWNERSHIP OF MOUNT POINT
vi /etc/fstab ### OPEN FSTAB CONFIG FILE
UUID=6cce8255-bf46-4b4a-a071-019472c7cc75 /mnt/data ext4 defaults 0 2 ### ADD LINE TO FSTAB FILE END
findmnt --verify ### TEST THE FSTAB BEFORE REBOOTING

PACMAN INSTALL/UNINSTALL COMMANDS
pacman -Syyu ### DOWNLOAD & INSTALL SYSTEM UPDATE FOR ARCH LINUX
pacman -S epiphany ### DOWNLOADS & INSTALLS OTTER BROWSER & DEPENDENT PACKAGES
pacman -Rns dillo ### UNINSTALL DILLO WEB BROWSER WITH INSTALLED PACKAGES

SYSTEM CONFIG COMMANDS
systemctl --type=service
systemctl --type=service --state=running
sudo -i
systemctl daemon-reload
lsblk -a ### LISTS ALL STORAGE DEVICES ON SYSTEM
lsusb ### LISTS ALL USB DEVICES
dmidecode -t bios ### LIST BIOS INFORMATION
pacman -Syu ### UPDATES ALL INSTALLED PACKAGES
pacman -S opera ### INSTALL OPERA BROWSER
dmidecode -t memory ### MEMORY HARDWARE INFORMATION
dmidecode -t memory | grep -i size ### MEMORY HARDWARE INFORMATION - SIZE
dd if=/dev/zero of=1G.test bs=1 count=0 seek=1G ### CREATE 1GB FILE FOR TESTING
rm ./path/to/the/file/file_1.txt ### DELETE A FILE
rm -d directory ### DELETE A DIRECTORY
ps aux | grep midori
ps aux | grep firefox
ps aux --sort -pcpu | grep firefox
ps aux --sort -pmem | head -n 16 ### DISPLAY TOP 16 MEMORY CONSUMING PROCESSES
ps aux --sort -pcpu | head -n 10 ### DISPLAY TOP 10 CPU CONSUMING PROCESSES
ps auxk -pcpu | head -n 10 ### DISPLAY TOP 10 CPU CONSUMING PROCESSES
ps -eo user,pid,%cpu,%mem,command --sort -pcpu | grep midori | head -20 ### SORTS OUTPUT DESCENDING
ps -eo user,pid,%cpu,%mem,command --sort=%mem ### SORTS OUTPUT ASCENDING
ps aux --sort -pcpu | grep webkitwebprocess | head -n 10
ps aux --sort -pcpu | grep webkit2gtk | head -n 10
kill [SIGNAL name/number] [PID/process name]
kill -9 3124
killall -9 firefox


BASH SCRIPTING COMMANDS
chmod u+x deploy.sh to make BASH script executable
echo -e "--------------CPU/Memory Usage----------------"
echo -e "Memory Usage:\t"`free | awk '/Mem/{printf("%.2f%"), $3/$2*100}'`
echo -e "Swap Usage:\t"`free | awk '/Swap/{printf("%.2f%"), $3/$2*100}'`
echo -e "CPU Usage:\t"`cat /proc/stat | awk '/cpu/{printf("%.2f%\n"), ($2+$4)*100/($2+$4+$5)}' | awk '{print $0}' | head -1`
echo ""

AWK SCRIPTING COMMANDS
awk -F':' '{printf "%s%s", $2, (/^Grade/)?"\n":"\t|"}' input.txt ### converts rows to columns
pacman -Qi | grep -E -w -i "name|description|licenses|depends|reason|date"
pacman -Qi | grep -E -w -i "name|description|URL|licenses|Depends|Required|Replaces|Reason" | awk '{ print $1, $2, $3, $4, $5, $6, $7,
$8 }' | awk -F':' '{printf "%-s %s", $2, (/^Install Reason/)?"\n":"\t|"}' | head -n 10
pacman -Qi | grep -E -w -i "name|description|URL|licenses" | awk '{ print $1, $2, $3, $4 }' | awk -F':' '{printf "%-s %s", $2, (/^Licenses/)?"\n":"\t|"}' | head -n 10

CRON JOBS IN LINUX
journalctl -xb -u cronie
systemctl list-timers --all

BASH SCRIPTING - VARIABLES IN LINUX
myname='Terry Clark'
echo $myname
unset myname
export myname=Terry ### CREATES GLOBAL VARIABLES AVAILABLE ACROSS SCRIPTS

TERMINAL CONSOLE KEYBOARD SHORTCUTS
Ctrl + A Go to the beginning of the line you are currently typing on
Ctrl + E Go to the end of the line you are currently typing on
Ctrl + L Clears the Screen, similar to the clear command
Ctrl + U Clears the line before the cursor position. If you are at the end of the line, clears the entire line.
Ctrl + H Same as backspace
Ctrl + R Lets you search through previously used commands
Ctrl + C Kill whatever you are running or start a new prompt
Ctrl + D Exit the current shell
Ctrl + Z Puts whatever you are running into a suspended background process. fg restores it.
Ctrl + W Delete the word before the cursor
Ctrl + K Clear the line after the cursor
Ctrl + T Swap the last two characters before the cursor
Esc + T Swap the last two words before the cursor
Alt + F Move cursor forward one word on the current line
Alt + B Move cursor backward one word on the current line
Tab Auto-complete files and folder names

MAC ADDRESS
wlp2s0 cc:b0:da:a7:39:2f LAPTOP WIFI
enp3s0 c8:5b:76:68:de:25 LAPTOP LAN
redmi 4a:0b:1d:eb:8f:74 REDMI PHONE


systemd is the newest Linux service manager(System V & Upstart are older ones)
mount command mounts a storage device or filesystem
/usr/local/SOFTNAME = software you compile from source (.tar.gz)
/usr/bin/ = Usually programs get installed to
/opt = can be used for trying software install which can be later removed

Windows Server Hardening

Windows Server Hardening Checklist

Sourced from : https://www.netwrix.com/windows_server_hardening_checklist.html

Deploying servers in their default state is the quickest way to get the job done. But the server will almost certainly be optimized for ease of use, often at the expense of cyber security.  By investing a little time in WindowsServer hardening — identifying and remediating security vulnerabilities that threat actors could exploit — you can dramatically reduce your risk of costly breaches and business disruptions from attacks, malware (including ransomware), and other cyber threats. 

This guide provides a comprehensive checklist of Windows Server hardening best practices for strengthening your security and compliance posture and protecting your vital systems and data. Your goal should be to establish security baselines tailored for your environment that reduce your attack surface and improve information security. You can get additional guidance from the Center for Internet Security (CIS) and the US Department of Defense Security Technical Implementation Guide (STIG).

Keep in mind that although server hardening is vital to cybersecurity, you also need to implement appropriate controls and processes, increase security awareness across the enterprise and follow other critical data security best practices.

Configuration Management 

Before diving into detailed secure configuration guidance, it’s worth reviewing some broader security best practices for developing, documenting and managing your configurations:

• Maintain an inventory record for each server that clearly documents its baseline configuration and records every change to the server.
• Review and minimize the applications installed on each server to reduce risk.
• Thoroughly test and validate every proposed change to server hardware or software before making the change in the production environment.
• Regularly perform a risk assessment. Use the results to update your risk management plan and maintain a prioritized list of all servers to ensure that security vulnerabilities are fixed in a timely manner.
• Keep all servers at the same revision level to simplify configuration management.

Windows Server Preparation 

• Protect new servers from potentially hostile network traffic until the operating system is fully hardened. Harden new servers in a network that is not open to the internet.
• Set a strong BIOS/firmware password to prevent unauthorized changes to the server’s settings.
• Disable automatic administrative logon to the recovery console.
• Configure the device boot order to prevent unauthorized booting from alternate media.

Windows Server Installation 

• Ensure that the system does not shut down during installation.
• Create a system configuration based on the specific role that is needed. You can use the Security Configuration Wizard for this purpose.
• When you install Windows Server, immediately update it with the latest patches using WSUS or SCCM. Security patches resolve known vulnerabilities that attackers could otherwise exploit to compromise a system.
• Enable automatic notification of patch availability and make sure that all appropriate patches, hotfixes and service packs are reviewed, tested and applied in a timely manner.

User Account Security Hardening 

• Disable and rename the guest account on each server.
• Disable and rename the local Administrator account on any machine that is part of a domain where uniquely named domain admin accounts will be used.
• Minimize access to privileged functions. Pay special attention to rights granted to built-in accounts and groups such as:
• Local System (NT AUTHORITY\System)
• Network Service (NT AUTHORITY\NetworkService)
• Administrators group
• Backup Operators group
• Users group
• Everyone group

For example, by default, the ‘Access this computer from the network’ right is granted to the Everyone group, essentially giving all users unrestricted remote access to shared folders.

• Ensure that passwords of system and administrator accounts meet password best practices. In particular, verify that these privileged account passwords are not based on a dictionary word and are at least 15 characters long, with letters, numbers, special characters and invisible (CTRL ˆ ) characters interspersed throughout. Ensure that your strong password policy requires passwords to be changed every 90 days.
• Configure account lockout Group Policy according to account lockout best practices.
• Disallow users from creating and logging in with Microsoft accounts.
• Do not allow “everyone” permissions to apply to anonymous users.
• Disallow anonymous enumeration of SAM accounts and shares.
• Disable anonymous SID/Name translation.
• Promptly disable or delete unused user accounts

Network Security Configuration and Access Management 

• Enable the Windows firewall and make sure the Firewall is enabled for each of the Domain, Private and Public firewall Profiles. Configure the default behaviour of the Firewall for each Profile to block inbound traffic by default.
• Where inbound access is required to a server, restrict it to necessary protocols, ports and IP addresses.
• Perform port blocking at the network setting level. Perform an analysis to determine which network ports need to be open and restrict access to all other ports.
• Allow only Authenticated Users to access any computer from the network.
• Do not grant any users the 'act as part of the operating system' right.
• Deny guest accounts the ability to log on as a service, as a batch job, locally or via RDP.
• If RDP is used, set the RDP connection encryption level to high.
• Remove Enable LMhosts lookup.
• Disable NetBIOS over TCP/IP.
• Remove ncacn_ip_tcp.
• Configure both the Microsoft Network Client and the Microsoft Network Server to always digitally sign communications.
• Disable the sending of unencrypted passwords to third-party Server Message Block (SMB) servers.
• Do not allow any shares to be accessed anonymously.
• Set up the LAN Manager to refuse LM and NTLMv1 authentication.
• Allow Local System to use computer identity for NTLMv2 authentication.
• Disable Local System NULL session fallback.
• Configure allowable encryption types for Kerberos authentication.
• Do not store LAN Manager hash values.
• Remove file and print sharing from network settings. File and print sharing could allow anyone to connect to a server and access critical data without requiring a user ID or password.

Registry Security Configuration 

Ensure that all administrators take the time to thoroughly understand how the registry functions and the purpose of each of its keys. Many of the vulnerabilities in the Windows operating system can be mitigated by changing the following keys: 

• Protect the registry from anonymous access.
• Disallow remote registry access if not required.
• Set MaxCachedSockets (REG_DWORD) to 0.
• Set SmbDeviceEnabled (REG_DWORD) to 0.
• Set AutoShareServer to 0.
• Set AutoShareWks to 0.
• Delete all values in the NullSessionPipes key.
• Delete all values in the NullSessionShares key.

General Security Settings

• Disable any unneeded services included in the default installation to reduce the server’s vulnerability. See the Netwrix Hardened Services guide for specific guidance.
• Remove unnecessary Windows Server roles and features.
• Enable the built-in Encrypting File System (EFS) with NTFS or BitLocker.
• If the server has significant random access memory (RAM), disable the Windows swapfile. This will improve performance and make the machine more secure because no sensitive data can be written to the hard drive.
• Do not use AUTORUN. Otherwise, untrusted code can be run without the direct knowledge of the user; for example, attackers might put a CD into the machine and cause their own script to run.
• Display a legal notice like the following before the user logs in: “Unauthorized use of this computer and networking resources is prohibited…”
• Require Ctrl+Alt+Del for interactive logins,  and configure an inactivity limit to terminate idle interactive sessions.
• Ensure all volumes are using the NTFS file system.
• Configure Local file and folder permissions. By default, Windows does not apply specific restrictions on any local files or folders; the Everyone group is given full permissions to most of the machine. Remove this group and instead grant access to files and folders using role-based groups based on the least-privilege principle. Every attempt should be made to remove Guest, Everyone and ANONYMOUS LOGON from user rights.
• Set the system date/time and configure it to synchronize against domain time servers.
• Configure a timeout that locks the console's screen automatically if it is left unattended.

Audit Policy and Advanced Audit Policy Configuration

• Create an audit policy according to audit policy best practices  to define which events are written to the security logs to gain visibility into critical activity.
• Configure the event log retention method to overwrite as needed and make sure up to 4GB of storage is reserved.
• Configure security log shipping to your security information and event management (SIEM) tool, if you have one, to improve threat detection and response.

Brief Guide to Additional Hardening 

The settings below can be defined locally using the Windows Local Security Policy editor or the Local Group Policy editor. Alternatively, in a domain environment, use the Active Directory GPO (Group Policy Object) Management features on your domain controller to create centralized configuration policies to deploy to all member computers.

• Rigorously enforce the least privilege principle to limit user rights. The User Rights Assignment settings control the permissions and access to privileged functions on a per user and per group basis. Windows has a number of built in user accounts and groups, otherwise known as Special Identities, with relevant privileges aligned to them; they include:
• Local System, or NT AUTHORITY\System
• Network Service, or NT AUTHORITY\NetworkService,
• Administrators
• Backup Operators
• Users
• Everyone

It is vital to minimize the assignment of built-in groups and accounts to these user rights. For example, the ‘Access this computer from the network’ setting is set by default to ‘Administrators, Backup Operators, Everyone, Users’ on Windows 10 — essentially granting unrestricted remote access to shared folders for all users. To reduce this security risk, the recommended setting is to restrict these rights to just the Administrators and Remote Desktop User groups to improve access control.

• Install and enable anti-virus software. Configure it to scan all downloads and attachments and to provide real-time protection. Set to update daily.
• Install and enable anti-spyware software. Configure it to update daily.
• Install and enable data loss prevention (DLP) software.
• Promptly review, test and install recommended updates and patches for all operating system and applications to promptly patch vulnerabilities and improve application security.
• Follow  security best practices, as well as database hardening and application hardening guidance, for all your systems.

How Netwrix Can Help

Netwrix Change Tracker simplifies Windows Server hardening and configuration management. It uses system and file integrity monitoring technology to analyze configuration settings and pinpoint vulnerabilities and errors, and provides detailed guidance for establishing a hardened baseline configuration. Then it help you maintain those secure configurations by monitoring and alerting on suspicious changes to:

• Filesystem
• Registry
• Windows Security and Audit policy
• Installed software
• Local user groups and accounts
• Open network ports
• Service states and running processes

Any drift from the hardened configuration can be corrected immediately, while any unexpected change can be promptly investigated to prevent security breaches and downtime. Integration with your overall security system can be provided, either as a component of a 3rd party managed security service or for an in-house approach.

 

Linux Server Hardening and Security Best Practices

Sourced from: https://www.netwrix.com/linux_hardening_security_best_practices.html

Introduction

Implementing secure configurations across your computing environment, including your Unix and Linux systems, is a key security best practice because it reduces your attack surface area and limits the damage that cyberattacks can do. Indeed, system hardening is a core control in many compliance directives.

This guide explains how what configuration hardening is and how to establish hardened build standards for your Linux and Unix systems. 

The Basics of System Hardening

The most secure Linux server or other computer is the one that is powered off and disconnected from the network. But if we want to actually use the machine to provide IT services, we need to maximize its security defenses when it is booted up and attached to the network or even the internet. 

This is where hardening comes into play.  Hardening a system means optimizing its configuration for secure operations and data protection. The range of exploitable vulnerabilities is vast, so there are three main rules to follow:

• Remove functionality that isn’t needed for the role of the computer. For example, operating systems and other applications are typically delivered in a “quick start” state, helpfully pre-loaded with utilities and features that users might want. However, the more functions that are provided, the greater the attack surface presented by the host. Therefore, be sure to disable functions you don’t need and avoid adding unnecessary functions wherever possible.
• Patch and update promptly. Flaws in software design create vulnerabilities that attackers can exploit. Software vendors provide patches or updated versions of the software to remediate these issues, so make sure all software, including operating systems, is fully updated at all times.
• Maintain secure configuration settings. It’s crucial that secure settings be enabled and maintained.

Linux System Hardening

Unsurprisingly, Linux security hardening is a specialized procedure in its own right, given the wide-range of subtly different Linux distributions. While there is no shortage of guides, checklists and tips for best practices in Linux server hardening — including the Center for Internet Security (CIS) benchmarks and the DISA STIGs — this guide will provide the key config options to adopt. 

Important: Make sure you back up your systems before applying hardened settings and test after a restart. It’s easy to get locked out!

Remove Unneeded Functionality 

Start by stripping out any features, utilities and services that are not required for running the server. Uninstall unnecessary software and disable system services that are not needed. Since the hardware in your infrastructure also presents exploitable vulnerabilities, make sure any accessible interfaces, such as USB ports, are disabled or even physically removed from the machine.

The workflow here is to log in and get a report of installed packages and services, and review it to identify any that can be removed or disabled. For the essential items that remain, check for available patches to remediate known vulnerabilities against exploits.

How to List Software on Linux/Unix Systems

System	Commands to Use
Linux (e.g., RedHat or CentOS)	rpm -qa --qf '%{NAME} %{VERSION} %{VENDOR}\n'
Debian Linux (e.g., Ubuntu)	dpkg -l
Fedora Linux	To list software from a terminal or putty session:  service --status-all  chkconfig --list  systemctl -a   To stop a service:  Service <Service-Name> stop Chkconfig <Service-Name> Systemctl stop <Service-Name>   To disable a service: Systemctl disable <Service-Name> Chkconfig <Service-Name> off   Also inspect the /etc/init.d/ path for any service control scripts and run ls /etc/init.d/ to expose all startup scripts; then rename or remove any that are to be disabled.

 

Minimize Open Ports and Other Network Vulnerabilities

Network-based attacks are among the most common threats. To reduce your risk, identify open network-accessible ports and remove any corresponding processes that are not needed. To list open ports on Linux, use the following command: 

ss -tulpn | egrep “LISTEN” | awk ‘{print “IP-Port “ $4 “ PID/Name “ $7}’

In addition:

• Ensure that the TCP Wrappers service is active.
• Define both an etc/hosts.allow whitelist and an etc/hosts.deny blacklist.
• Use the iptables or Firewalld services with a Deny All policy for both IP V4 and V6 traffic, even if you are using on-network third-party WAFs and firewall protection.
• Block ICMP traffic to thwart ping scans used by hacker tools for device discovery.

Review User Accounts and Authentication

Review local user accounts and remove any that are not needed. For local user accounts that remain, a strong password policy should be configured that covers password complexity, length, expiration, re-use and change frequency. Also be sure to use strong hashing algorithms for stored passwords.

User accounts and authentication should be governed using a centralized control system such as Active Directory or, even better, a modern privileged access management (PAM) solution that allows a Zero Standing Privilege strategy, which negates many of the problems with traditional user accounts and permanently assigned privilege. Of course, never use root and always make sure that sudo elevation is used only on an as-needed basis.

How to Configure a Password Policy for Local Accounts 

Locate and edit the following configuration file: /etc/security/pwquality.conf

To enforce a 14-character password: 

minlen = 14

To enforce complexity for all passwords: 

minclass = 4 

OR 

dcredit = -1 

ucredit = -1 

ocredit = -1 

lcredit = -1

To enforce a strong password lockout policy:

Update the /etc/pam.d/system-auth and /etc/pam.d/password-auth files to set the following options: 

auth required pam_faillock.so preauth silent deny=5 unlock_time=900

auth required pam_faillock.so authfail deny=5 unlock_time=900

 

To enforce a password history policy of 5 or more passwords:

Add the remember=5 option to the pam_pwhistory.so and pam_unix.so lines in /etc/pam.d/password-auth:

password requisite pam_pwhistory.so try_first_pass local_users_only enforce-for-root retry=3 remember=5 

password sufficient pam_unix.so sha512 shadow try_first_pass use_authtok remember=5

 

To enforce strong password hashing:

Update the /etc/pam.d/system-auth and /etc/pam.d/password-auth files as follows:

/etc/pam.d/password-auth:

password sufficient pam_unix.so sha512 shadow try_first_pass use_authtok

/etc/pam.d/system-auth:

password sufficient pam_unix.so sha512 shadow try_first_pass use_authtok remember=5

Review Service Accounts

System and service accounts should be reviewed and any that are no longer required should be removed.

Service accounts are “hardened” in that they only support the operation of a locally run process and do not provide a user shell, so these accounts cannot ever be used to access the server by a user logon. However, a core hardening mantra is to minimize functionality, so unused service accounts should still be removed.

SSH Hardening for Linux and Unix

As the primary route for remotely administering your Linux systems, SSH requires particular attention. There are a number of default settings in the /etc/ssh/sshd_config file that need to be enabled in order to harden the SSH server operation. 

SSH is used for all Linux and Unix access, so the following guidelines apply for Unix hardening, too.

Enable v2 of the SSH protocol

For example, the default configuration enables the outdated and less secure version 1 of the SSH protocol. CIS hardening guidance recommends enabling version 2 to enhance security. To do so, simply uncomment the Protocol 2 setting in the configuration file (/etc/ssh/sshd_config) by removing the #, as follows:

Default entry in /etc/ssh/sshd_config:

# The default requires explicit activation of protocol 1

# Protocol 2

A more secure configuration:

# The default requires explicit activation of protocol 1

Protocol 2

Additional hardening

In addition, apply the following recommended CIS hardened settings to the config file: 

LogLevel INFO

IgnoreRhosts yes

…

PermitEmptyPasswords no

…

LoginGraceTime 60

PermitRootLogin no

MaxAuthTries 4

HostbasedAuthentication no

…

X11Forwarding no…

PermitUserEnvironment no

…

ClientAliveInterval 300

ClientAliveCountMax 0

…

Banner /etc/issue.net

 …

AllowUsers <Specify user names, separated by spaces, e.g. user1 user2>

Additional Notes: /etc/issue.net will need to be created/edited to include an appropriate Banner, e.g. Warning! Unauthorized access to this system is forbidden and will be prosecuted by law. By accessing this system, you agree that your actions may be monitored if unauthorized usage is suspected. Together with AllowUsers, AllowGroups is also supported as a config switch/keyword.

 

Apache Web Server Hardening

Linux is the platform of choice for hosting internet-based web applications, and Apache Tomcat and Apache HTTP Server (often referred to as Apache HTTPD) are two of the most popular options for delivering web content. 

The approach to Apache configuration hardening is the same: minimize functionality and implement secure configuration settings where available.

Verify that only essential Apache modules are enabled:

httpd -M 

For example, mod_dav and  mod_dav_fs should always be disabled, while the  log_config module should always be loaded and enabled.

Confirm the package.access definition only includes the following allowed packages:

package.access = sun.,org.apache.catalina.,org.apache.coyote.,

org.apache.tomcat.,org.apache.jasper.

Configure the server.xml file:

The server.xml file on the CATALINA_HOME/conf path is the core configuration store for the web server. The recommended settings to include in server.xml are as follows:

• Disable the shutdown port:

<Server port="-1" shutdown="SHUTDOWN">

• Remove unused connectors, including the default HTTPConnector and the AJPConnector. To remove the HTTPConnector, delete or comment out this tag:

<Connector className="org.apache.catalina.connector.http.HttpConnector"

...

connectionTimeout="60000"/>

Remove the default presence-advertising settings:

For Tomcat:

Set the xpoweredBy attributes to false:

xpoweredBy="false" />

For HTTP Server:

• Remove the default index.html and comment out the below from the /etc/httpd/conf.d/welcome.conf using a # or ## for each line:

##<LocationMatch "^/+$">

## Options -Indexes

## ErrorDocument 403 /error/noindex.html

##</LocationMatch>

• Comment out the Server-Status section:

##<Location /server-status>

## SetHandler server-status

## Order deny,allow

## Deny from all

## Allow from .example.com

##</Location>

• Comment out the server-info section:

##<Location /server-info>

## SetHandler server-info

## Order deny,allow

## Deny from all

## Allow from .example.com

##</Location>

Disable diagnostic trace facilities: 

Set the allowTrace attribute for each Connector to false

Disable auto deployment of applications, and disable deployment on startup:

autoDeploy="false"

deployOnStartup="false"

Additional hardening:

• Ensure that file and folder permissions are restrictive and that Apache services run using non-shell service accounts (i.e., accounts that cannot be used to log on to the system). Disable Directory Listing and browsing.

$CATALINA_HOME

$CATALINA_BASE

Kernel Hardening for Linux

SELinux modifies the Linux kernel to enforce mandatory access controls, restricting how Linux processes can access files and programs. This additional layer of restriction provides a fundamental protection mechanism against root kit malware. AppArmor provides an equivalent level of MAC for Debian distributions. 

SELinux Settings

Install SELinux on CentOS/RHEL:

dnf install libselinux

Enable SELinux:

By default, SELinux will be disabled. To enable SELinux at boot, edit/etc/default/grub and remove these default settings: 

selinux=0

enforcing=0

Set SELinux config to enforcing

Edit the /etc/selinux/config file to include the following:

SELINUX=enforcing

SELINUXTYPE=default

Check that all services are being run with a security context controlled by SELinux:

The following command will list any services being launched from the init process, which may require a non-default security context assigned to them: 

ps -eZ | egrep "initrc" | egrep -vw "tr|ps|egrep|bash|awk" | tr ':' ' ' | awk '{ print $NF }'

Restart the computer to make sure all settings have been loaded.

AppArmor Settings

Install AppArmor on Ubuntu/Debian:

apt-get install apparmor apparmor-profiles apparmor-utils

Enable AppArmor at boot: 

Edit /etc/default/grub and add the following settings: 

GRUB_CMDLINE_LINUX="apparmor=1 security=apparmor"

Ensure all AppArmor profiles are in enforce mode: 

aa-enforce /etc/apparmor.d/*

Embedded Linux Hardening

Embedded Linux provides a stripped-down operating system for embedded devices or embedded systems, such as smart phones, smart TVs, set-top boxes and broadband internet routers.

A simplified operating system with a reduced footprint is attractive when the full range of function usually provided by server-grade Linux devices is not required and hardware resources such as storage, memory and CPU have been minimized to save manufacturing costs. For example, the open-source Android platform developed by Google is optimized for smart phones and TVs, and the OpenWrt router firmware is used for a wide range of broadband routers.

The functionality included in the operating system varies widely depending upon the intended application. For example, Android includes screen lock, face recognition, PIN entry support and location services; these are not needed in operating systems for home routers, but VPN, guest Wi-Fi and bandwidth throttling features are included. As a result, hardening guidance is specifically linked to the particular device and platform in use.

Android Hardening Highlights

Ensure device firmware is up to date:

Go to Settings | System | System Updates; select Check for Update and install any updates that are available.

Install Google Play and security updates:

Go to Settings | Security:

• Select Google Security Check-Up and apply any updates available.
• Select Google Play system update and apply any updates  available.

Enable general device security: 

1. Go to Settings | Security | Device Security and do the following:

• Set ‘Screen Lock’ to ‘Enabled’.
• Set ‘Pattern Visible’ to ‘Disabled’.
• Set ‘Automatically Lock’ to ‘Immediately’.
• Set ‘Power Button Instantly Locks’ to ‘On’.
• Set Device Admin Apps ‘Find My Device’ to ‘Enabled’.
• Set ‘Allow remote lock and erase’ to ‘Enabled’.

2. Go to Settings | System | Advanced and do the following:

• Set ‘Developer Options’ to ‘Off’.

3. Go to Settings | Apps & Notifications | Advanced | Special App Access and do the following:

• Set ‘Install Unknown Apps’ to ‘Not Allowed’.

4. Launch Play Store | Menu and do the following:

• Select ‘My Apps & Games’ and click ‘Update All’.

OpenWrt Hardening Highlights

• Change the admin password from the default.
• Ensure the firmware is always updated to the latest version.

Kali Linux Hardening

Kali Linux has been optimized to be the pen testers’ platform of choice, so it has a wide range of security auditing and pen testing utilities. 

Since Kali Linux is a Debian-based Linux distribution, you can use the Linux hardening tips above to address the security weaknesses in Kali Linux systems.

Linux Mint Security Hardening

Similarly for Linux Mint, as an Ubuntu-derived Desktop Linux platform, the same hardening procedures used for Debian-Linux should be adopted. Work through the earlier Linux Hardening Checklist steps and apply these to your Linux Mint systems.

Hardening Arch Linux

As an independent Linux distribution not directly derived from Debian or Fedora, Arch Linux is an individual case when it comes to hardening measures, although the concepts of how and what to harden are similar. Arch code is intentionally built as a streamlined ‘no filler’ Linux distribution and as such will require less hardening work when it comes to removing/disabling unnecessary services 

Final Word

Even a hardened system can still be compromised, especially by the following: 

• Zero-day threats — exploits we had no knowledge of and therefore did not protect against
• Ransomware and other malware
• Insider threats, including both hackers using hijacked credentials and users abusing their access

Therefore, in addition to hardening your systems, you need additional defenses. In particular, it’s vital to monitor system and file integrity. Any unexpected change could lead to a breach or other security incident. Netwrix Change Tracker provides real-time alerts on all unplanned changes, and it supports all Linux and Unix platforms.