Linux Overview

Linux is an open-source operating system created in 1991 and maintained by a community of programmers. It is fast, reliable and small, needs very little hardware, and is designed to be connected to the network. Anyone can inspect, modify, re-compile and redistribute the kernel source.

A distribution (distro) is the Linux kernel packaged with customised tools and software from one organisation. Examples are Debian, Red Hat, Ubuntu, CentOS and SUSE. Most are free without support; some charge for business support.

• —Open source: free, and can be modified into a tailor-built analysis OS.
• —Powerful CLI: tasks run at a terminal or remotely.
• —More user control: the root user can change any aspect of the OS.
• —Network control: many network tools exist for Linux only.

The root user is the administrator (superuser) account with absolute power over the computer. It can modify any aspect of the system with a few keystrokes, which is valuable for low-level work such as the network stack. Root is the only user who can override file permissions, so its credentials need a strong password and must not be shared beyond high-level admins.

Security Onion is an open-source suite of network security analysis tools, packaged as a special Linux version. Its analyst console is Sguil. A SOC uses several kinds of tool:

Penetration testing (PenTesting) is looking for vulnerabilities in a network or computer by attacking it. Tools include packet generators, port scanners and proof-of-concept exploits. Kali Linux is a distribution that groups many penetration-testing tools into one distro.

A terminal emulator is a GUI application that gives access to the Linux CLI, which is often hidden because Linux boots to the GUI. Examples are Terminator, eterm, xterm, konsole and gnome-terminal. Shell, console, CLI terminal and terminal window are used interchangeably.

Commands are programs stored on disk. The shell looks for a typed command in the directories listed in the path. A command outside the path needs its location specified, or the shell cannot find it. Users can add directories to the path.

To search the output of a previous command, grep must be piped onto the end of it. With no parameters, ifconfig and iwconfig only display the current configuration.

Command-line text editors let you edit files on a remote computer over an SSH text shell, where there is no graphical interface. nano is keyboard-only: CTRL+O saves, CTRL+W searches and CTRL+G opens help.

In Linux everything is treated as a file: memory, disks, the monitor and directories. Showing output on the display means writing to the display's file. The computer itself is configured through text configuration files. One example is /etc/hosts, which holds static mappings of host IP addresses to names; only the superuser can change it, e.g. sudo nano /etc/hosts.

A server runs software that provides services over the network, such as files, email, web pages, log and memory management, or disk scanning. Each service needs separate server software. A client is the hardware/software combination people use directly; client programs use a well-defined protocol to talk to a specific type of server (a web browser talks HTTP to a web server).

A port is a reserved network resource used by a service. Ports let one computer be the server for many services. A server is listening on a port when it has associated itself with that port. Default ports are the well-known ports, and it is common practice to leave a service on its default.

Port scanners such as Nmap find the open ports on a host.

A service configuration file is a text file a service loads at start-up to set its port, resource location and client authorisation. Changes usually need a service restart and often need superuser rights to edit. There is no fixed format, though option = value is common, and # marks a comment.

Device hardening means implementing proven methods to secure a device and protect its administrative access: maintain passwords, enhance remote login, use SSH, define administrative roles (not all IT staff need the same access), stop legacy services starting at boot, and apply OS updates and patches.

• —Ensure physical security.
• —Minimise installed packages.
• —Disable unused services.
• —Use SSH and disable root login over SSH (SSH instead of Telnet).
• —Keep the system updated.
• —Disable USB auto-detection.
• —Enforce strong passwords, periodic changes and no re-use.

Log files give a clear picture of performance, security status and issues, so problems are caught early. Categories are application, event, service and system logs. A daemon is a background process that needs no user interaction. Most Linux logs live in /var/log.

A journal is a log of pending changes used to restore the file system after a crash or power loss. It is the main feature added in ext3 and minimises the risk of file system corruption. The MBR sits in the first sector, stores how the file system is organised and hands over to the OS loader.

Mounting assigns a directory (the mounting point) to a partition so its file system is accessible, similar to a Windows drive letter. mount with no options lists the mounted file systems. The root file system is /; in the module's example it is ext4 on /dev/sda1.

Every file carries permissions defining what the owner (user), the group and others may do. The rights are read (r), write (w) and execute (x). They are always displayed in User, Group, Other order. ls -l shows them with extra detail.

[analyst@secOps ~]$ ls -l space.txt
-rwxrw-r-- 1 analyst staff 253 May 20 12:49 space.txt

• —First character: - is a file, d is a directory.
• —rwx (user, analyst): read, write and execute.
• —rw- (group, staff): read and write.
• —r-- (other): read only.

Permissions cannot be broken: a user has only the rights the permissions allow. The only user who can override them is root, who can write to any file, so root access should be carefully controlled.

A hard link is another file name that points to the same location (the inode) as the original. Create one with ln (existing file first, new file second); the link count in ls -l then shows 2. Changing either name changes the data, and deleting one name leaves the other intact.

ln space.txt space.hard.txt
rm space.hard.txt
more space.txt        # still works

A symbolic link (symlink, soft link) points to a path. Create one with ln -s. Changes through it also change the original, but if the original is deleted the symlink is left pointing at nothing.

ln -s test.txt mytest.txt
rm test.txt
more mytest.txt
ls -l mytest.txt
lrwxrwxrwx 1 analyst analyst 8 May  7 20:17 mytest.txt -> test.txt

The X Window System (X or X11) is the windowing framework behind most Linux GUIs. It draws windows and handles the mouse and keyboard. It works as a server: the application can run remotely while its window displays locally. X does not define the look of the interface; window managers do, defining buttons, fonts, icons, borders and colours. Gnome and KDE are examples, and they are why the Linux GUI varies so much between distributions.

Ubuntu's default GUI is Gnome 3, with the Apps Menu, Ubuntu Dock, Top Bar, Activities and Status Menu.

Ubuntu Dock

App launcher and switcher on the left

Activities

Search apps and files, switch workspaces

Status Menu

Network, user settings, lock and shutdown

A package is a program plus its supporting files; a package manager installs it into the right places. pacman serves Arch Linux; dpkg and apt serve Debian and Ubuntu.

Keep the OS updated because patches fix known vulnerabilities, and unscheduled updates follow major discoveries.

A process is a running instance of a program. Forking is how the kernel lets a process create a copy of itself, and it is the only way to create new processes in Linux. The caller becomes the parent and the new process its child; they have different PIDs but run the same code. Apache forks to serve many requests with fewer resources.

• —ps lists processes once, when invoked. Listing needs no root, but killing or modifying other users' processes does.
• —top keeps displaying processes dynamically; press q to exit.
• —kill modifies a process (remove, restart, pause). Run ps or top first to find the PID.

Linux is not immune to malware. It is better protected by design, through file system structure, permissions and user restrictions, and open source means patches often appear within hours. Still, server and kernel vulnerabilities get exploited. The common attack vector is a vulnerable service or process, such as an outdated Apache web server: attackers probe open ports for the server version and type, then research known issues for that version. Reduce the opportunity by keeping the computer updated and closing unused services and ports.

A rootkit is malware that raises an unauthorised user's privileges or grants access to protected parts of the system, often to secure a backdoor. It changes kernel code and modules, hides the intrusion and tampers with diagnostic tools so their output hides it. Most need root or admin access to install.

• —Detect by booting trusted media (such as a live CD), mounting the compromised drive and inspecting it with trusted tools.
• —Inspection methods: behavioural, signature scanning, difference scanning and memory dump analysis.
• —Removal usually means reinstalling the OS; firmware rootkits usually need hardware replacement.

chkrootkit is a shell script that checks for known rootkits by comparing signatures of core programs, using common tools such as strings and grep. It also compares /proc contents with the output of ps. It is not 100% reliable.

Piping chains commands with | so one command's output becomes the next one's input.

ls -l | grep host