Hardening

Physical access to a Linux machine often guarantees total system compromise if boot configurations remain unhardened. By default, anyone with physical or KVM console access can interrupt the GRUB bootloader, append single, init=/bin/sh, or emergency to the kernel arguments, and bypass authentication into a root shell. Securing the boot process requires hardening three independent layers: Password-protecting the GRUB bootloader Requiring authentication for single-user/emergency mode Disabling interactive startup prompts and console reboot hotkeys 1. Password-Protecting Single-User Mode (sulogin) In legacy SysVinit/Upstart configurations (/etc/sysconfig/init): ...

Unthrottled authentication services are susceptible to online credential brute forcing and password spraying attacks. While tools like fail2ban monitor application logs to block IP addresses at the firewall layer, PAM modules enforce account lockouts at the OS level across all authentication entry points (SSH, TTY consoles, display managers, and su). Historically handled by pam_tally2 (and superseded in RHEL 8+ / Debian 11+ by pam_faillock), this module tracks failed attempts and locks accounts for a specified duration. ...

Weak passwords remain one of the most common vectors for initial access and lateral movement in enterprise Linux environments. By default, many Linux distributions enforce minimal password complexity rules. The pam_cracklib module (and its modern successor pam_pwquality) provides password strength checks by testing proposed passwords against dictionary wordlists, entropy requirements, and complexity rules. Key Configuration Parameters Understanding the parameter syntax: Positive credits (e.g., dcredit=1): Bonus characters that reduce the required total length. Negative credits (e.g., dcredit=-1): Strict minimum requirements (must contain at least that number of characters). Parameter Function Recommended Setting minlen=12 Minimum total characters required 12 or higher dcredit=-1 Minimum number of digits required -1 ucredit=-1 Minimum uppercase characters required -1 lcredit=-1 Minimum lowercase characters required -1 ocredit=-1 Minimum special/punctuation symbols required -1 maxrepeat=2 Maximum consecutive repeated characters 2 reject_username Forbids passwords containing the username Included enforce_for_root Enforces the policy on the root account Crucial dictpath=<path> Custom wordlist path for dictionary checks e.g., /usr/share/dict/words Step 1: Configuring PAM Password Policy In Red Hat, CentOS, and Debian/Ubuntu derivatives, password policies are typically applied in /etc/pam.d/system-auth (RHEL/CentOS) or /etc/pam.d/common-password (Debian/Ubuntu): ...

Linux uses Pluggable Authentication Modules (PAM) to decouple system applications (such as sshd, login, sudo, and su) from underlying authentication mechanisms. Instead of hardcoding authentication logic into each daemon, applications dynamically link against PAM (libpam.so). To verify whether a service supports PAM, check its dynamic libraries with ldd: ldd $(which sshd) | grep pam # libpam.so.0 => /lib64/libpam.so.0 (0x00007f81348fc000) PAM Configuration Structure PAM configuration files reside in /etc/pam.d/. Each service typically has its own configuration file (e.g., /etc/pam.d/sshd, /etc/pam.d/sudo). ...

In Linux, newly created files and directories do not specify arbitrary permissions. Instead, the process creating the object requests a base permission set, which the kernel filters through the process’s umask (User Mask). Understanding how umask operates is essential for preventing accidental disclosure of confidential files (e.g., world-readable configuration files or SSH keys). The Fundamental Rule: Masking, Not Subtraction By default, the Linux operating system assigns base permissions: Default Base for Files: 0666 (rw-rw-rw-) — Files are never created with execute (x) permissions by default for safety. Default Base for Directories: 0777 (rwxrwxrwx) — Directories require execute permissions to allow traversal (cd). The umask acts as a bitmask filter: it specifies which permission bits should be disabled (masked out) when a new file or directory is created. ...