Security

SSH is far more than an encrypted remote terminal—it is an extensible transport protocol capable of encapsulating arbitrary TCP traffic across segmented network boundaries, NAT gateways, and restrictive firewalls. Here is how to leverage Dynamic, Local, and Remote Reverse SSH tunnels. 1. Dynamic Port Forwarding (-D): SOCKS Proxy Dynamic port forwarding turns your SSH client into a local SOCKS5 proxy server. Any application configured to use this proxy routes its network requests through the remote SSH host. ...

Unthrottled authentication services are susceptible to online credential brute forcing and password spraying attacks. While tools like fail2ban monitor application logs to block IP addresses at the firewall layer, PAM modules enforce account lockouts at the OS level across all authentication entry points (SSH, TTY consoles, display managers, and su). Historically handled by pam_tally2 (and superseded in RHEL 8+ / Debian 11+ by pam_faillock), this module tracks failed attempts and locks accounts for a specified duration. ...

Weak passwords remain one of the most common vectors for initial access and lateral movement in enterprise Linux environments. By default, many Linux distributions enforce minimal password complexity rules. The pam_cracklib module (and its modern successor pam_pwquality) provides password strength checks by testing proposed passwords against dictionary wordlists, entropy requirements, and complexity rules. Key Configuration Parameters Understanding the parameter syntax: Positive credits (e.g., dcredit=1): Bonus characters that reduce the required total length. Negative credits (e.g., dcredit=-1): Strict minimum requirements (must contain at least that number of characters). Parameter Function Recommended Setting minlen=12 Minimum total characters required 12 or higher dcredit=-1 Minimum number of digits required -1 ucredit=-1 Minimum uppercase characters required -1 lcredit=-1 Minimum lowercase characters required -1 ocredit=-1 Minimum special/punctuation symbols required -1 maxrepeat=2 Maximum consecutive repeated characters 2 reject_username Forbids passwords containing the username Included enforce_for_root Enforces the policy on the root account Crucial dictpath=<path> Custom wordlist path for dictionary checks e.g., /usr/share/dict/words Step 1: Configuring PAM Password Policy In Red Hat, CentOS, and Debian/Ubuntu derivatives, password policies are typically applied in /etc/pam.d/system-auth (RHEL/CentOS) or /etc/pam.d/common-password (Debian/Ubuntu): ...

Linux uses Pluggable Authentication Modules (PAM) to decouple system applications (such as sshd, login, sudo, and su) from underlying authentication mechanisms. Instead of hardcoding authentication logic into each daemon, applications dynamically link against PAM (libpam.so). To verify whether a service supports PAM, check its dynamic libraries with ldd: ldd $(which sshd) | grep pam # libpam.so.0 => /lib64/libpam.so.0 (0x00007f81348fc000) PAM Configuration Structure PAM configuration files reside in /etc/pam.d/. Each service typically has its own configuration file (e.g., /etc/pam.d/sshd, /etc/pam.d/sudo). ...

During digital forensics and incident response investigations, analyzing DHCP leases, ARP caches, firewall events, and syslog entries often requires extracting physical network hardware addresses (MAC addresses). A standard IEEE 802 MAC-48 address consists of six groups of two hexadecimal digits separated by colons (00:1A:2B:3C:4D:5E) or hyphens (00-1A-2B-3C-4D-5E), or three groups of four hexadecimal digits separated by dots (001a.2b3c.4d5e). 1. Extracting MAC Addresses with grep Standard Colon-Separated Format To extract colon-delimited MAC addresses using extended regular expressions (grep -E): ...

In Linux, user identity and permissions are determined strictly by numerical User IDs (UIDs), not usernames. If multiple user accounts share the same UID, they possess identical access rights across the file system. Attackers who compromise a system sometimes create a secondary account (e.g., guest or support) with UID 0 to maintain stealthy root access without alerting administrators reviewing login usernames. Finding Duplicate UIDs To inspect all local and directory accounts (including LDAP/NIS/SSSD if configured), query getent passwd: ...

In Linux, user account definitions reside in /etc/passwd (world-readable), while encrypted password hashes and credential aging rules reside in /etc/shadow (restricted to root with 0640 or 0600 permissions). Understanding /etc/shadow field definitions is essential for system auditing, incident response, and credential analysis. Anatomy of an /etc/shadow Entry Each line consists of 9 colon-separated fields: n1x:$6$UoDmVdoW$tYQQm5uHgOpe...:16631:7:15:2:14:16819: Field # Attribute Name Value in Example Description 1 Username n1x Account login name matching /etc/passwd. 2 Encrypted Password $6$UoDmVdoW$... Cryptographic hash prefixed by algorithm identifier. 3 Last Changed Date 16631 Days since the Unix Epoch (Jan 1, 1970) when password was last updated. 4 Minimum Age 7 Days user must wait before they can change password again. 5 Maximum Age 15 Days before the password expires and must be changed. 6 Warning Period 2 Days prior to expiration that warning prompts begin displaying. 7 Inactivity Period 14 Days after expiration during which user can still change password; past this, account is disabled. 8 Expiration Date 16819 Absolute date (in days since epoch) when account is permanently disabled. 9 Reserved (empty) Flag reserved for future operating system use. Identifying Password Hash Algorithms The second field begins with $id$salt$hash. The ID reveals the cryptographic hashing algorithm used: ...

When an adversary compromises a Linux server, they frequently alter system binaries (installing backdoored binaries like sshd or login), inject malicious cronjobs, modify web directories, or alter file permissions (e.g., granting SUID or world-writable access). AIDE (Advanced Intrusion Detection Environment) is a host-based File Integrity Monitoring (FIM) tool that builds a cryptographic baseline database of file attributes, hashes, permissions, and SELinux labels to detect file tampering. How AIDE Operates AIDE scans the filesystem according to rules defined in /etc/aide.conf, calculates cryptographic checksums (SHA-256, SHA-512) and metadata attributes for each file, and stores them in a baseline database (/var/lib/aide/aide.db.gz). ...

In Linux, newly created files and directories do not specify arbitrary permissions. Instead, the process creating the object requests a base permission set, which the kernel filters through the process’s umask (User Mask). Understanding how umask operates is essential for preventing accidental disclosure of confidential files (e.g., world-readable configuration files or SSH keys). The Fundamental Rule: Masking, Not Subtraction By default, the Linux operating system assigns base permissions: Default Base for Files: 0666 (rw-rw-rw-) — Files are never created with execute (x) permissions by default for safety. Default Base for Directories: 0777 (rwxrwxrwx) — Directories require execute permissions to allow traversal (cd). The umask acts as a bitmask filter: it specifies which permission bits should be disabled (masked out) when a new file or directory is created. ...

When external USB flash drives or external storage media are plugged into desktop Linux distributions, automated desktop daemons (like udisks2 or automount rules) often mount them automatically. If the filesystem is mounted without explicit security constraints, an unprivileged user or malicious physical actor can escalate to root privileges instantly using pre-configured SUID binaries. The Attack Vector: SUID Preservation on Portable Filesystems POSIX filesystems (such as ext4, ext3, xfs) store Unix file permissions—including the SetUID (suid) bit (chmod 4755) and file ownership—directly inside the filesystem’s inode tables. ...