Linux

When deploying jump hosts, transparent proxies, or network bridges across multi-homed Linux systems, standard routing tables are often insufficient. Using the Linux Netfilter framework via iptables, you can manipulate packets at both ingress (PREROUTING) and egress (POSTROUTING). Scenario 1: Basic Traffic Forwarding via DNAT and MASQUERADE In this setup, our Linux server acts as an intermediary bridge forwarding traffic from a client to a remote backend service: Client Source IP: 198.51.100.12 Intermediary Gateway (Our Server): 203.0.113.30 Final Backend Destination: 192.0.2.84 Client [198.51.100.12] ──► Gateway [203.0.113.30] ──► Backend [192.0.2.84] Step 1: Destination NAT in PREROUTING Intercept incoming packets destined for our gateway and rewrite the destination IP before routing lookup occurs: ...

Unlike traditional Type-1 and Type-2 hypervisors that virtualize complete hardware stacks and boot independent operating system kernels, containers share the host Linux kernel while isolating processes using kernel Namespaces (PID, NET, IPC, MNT, UTS) and Control Groups (cgroups). Docker packages application dependencies, libraries, and runtime binaries into lightweight, immutable container images. Core Architecture Docker operates under a client-server model: Docker Client (docker): The CLI tool you execute to issue commands. Docker Daemon (dockerd): The background daemon listening for API requests to manage images, containers, networks, and storage volumes. Docker Registry: Public (Docker Hub) or private image repositories. A container lifecycle is tied directly to its primary foreground process (PID 1). When that process exits, the container stops. ...

Relying on standard shell history (~/.bash_history) for security auditing is fundamentally flawed: users can unset HISTFILE, launch sessions inside screen/tmux, prepend commands with spaces, or delete history files before logout. To reliably monitor user commands at the kernel level, Linux provides the pam_tty_audit PAM module. This module enables TTY input logging directly through the Linux Audit daemon (auditd), capturing keystrokes before the shell receives them. Module Parameters pam_tty_audit.so supports three key arguments: ...

Physical access to a Linux machine often guarantees total system compromise if boot configurations remain unhardened. By default, anyone with physical or KVM console access can interrupt the GRUB bootloader, append single, init=/bin/sh, or emergency to the kernel arguments, and bypass authentication into a root shell. Securing the boot process requires hardening three independent layers: Password-protecting the GRUB bootloader Requiring authentication for single-user/emergency mode Disabling interactive startup prompts and console reboot hotkeys 1. Password-Protecting Single-User Mode (sulogin) In legacy SysVinit/Upstart configurations (/etc/sysconfig/init): ...

Unthrottled authentication services are susceptible to online credential brute forcing and password spraying attacks. While tools like fail2ban monitor application logs to block IP addresses at the firewall layer, PAM modules enforce account lockouts at the OS level across all authentication entry points (SSH, TTY consoles, display managers, and su). Historically handled by pam_tally2 (and superseded in RHEL 8+ / Debian 11+ by pam_faillock), this module tracks failed attempts and locks accounts for a specified duration. ...

Weak passwords remain one of the most common vectors for initial access and lateral movement in enterprise Linux environments. By default, many Linux distributions enforce minimal password complexity rules. The pam_cracklib module (and its modern successor pam_pwquality) provides password strength checks by testing proposed passwords against dictionary wordlists, entropy requirements, and complexity rules. Key Configuration Parameters Understanding the parameter syntax: Positive credits (e.g., dcredit=1): Bonus characters that reduce the required total length. Negative credits (e.g., dcredit=-1): Strict minimum requirements (must contain at least that number of characters). Parameter Function Recommended Setting minlen=12 Minimum total characters required 12 or higher dcredit=-1 Minimum number of digits required -1 ucredit=-1 Minimum uppercase characters required -1 lcredit=-1 Minimum lowercase characters required -1 ocredit=-1 Minimum special/punctuation symbols required -1 maxrepeat=2 Maximum consecutive repeated characters 2 reject_username Forbids passwords containing the username Included enforce_for_root Enforces the policy on the root account Crucial dictpath=<path> Custom wordlist path for dictionary checks e.g., /usr/share/dict/words Step 1: Configuring PAM Password Policy In Red Hat, CentOS, and Debian/Ubuntu derivatives, password policies are typically applied in /etc/pam.d/system-auth (RHEL/CentOS) or /etc/pam.d/common-password (Debian/Ubuntu): ...

Linux uses Pluggable Authentication Modules (PAM) to decouple system applications (such as sshd, login, sudo, and su) from underlying authentication mechanisms. Instead of hardcoding authentication logic into each daemon, applications dynamically link against PAM (libpam.so). To verify whether a service supports PAM, check its dynamic libraries with ldd: ldd $(which sshd) | grep pam # libpam.so.0 => /lib64/libpam.so.0 (0x00007f81348fc000) PAM Configuration Structure PAM configuration files reside in /etc/pam.d/. Each service typically has its own configuration file (e.g., /etc/pam.d/sshd, /etc/pam.d/sudo). ...

In Linux, user identity and permissions are determined strictly by numerical User IDs (UIDs), not usernames. If multiple user accounts share the same UID, they possess identical access rights across the file system. Attackers who compromise a system sometimes create a secondary account (e.g., guest or support) with UID 0 to maintain stealthy root access without alerting administrators reviewing login usernames. Finding Duplicate UIDs To inspect all local and directory accounts (including LDAP/NIS/SSSD if configured), query getent passwd: ...

In Linux, user account definitions reside in /etc/passwd (world-readable), while encrypted password hashes and credential aging rules reside in /etc/shadow (restricted to root with 0640 or 0600 permissions). Understanding /etc/shadow field definitions is essential for system auditing, incident response, and credential analysis. Anatomy of an /etc/shadow Entry Each line consists of 9 colon-separated fields: n1x:$6$UoDmVdoW$tYQQm5uHgOpe...:16631:7:15:2:14:16819: Field # Attribute Name Value in Example Description 1 Username n1x Account login name matching /etc/passwd. 2 Encrypted Password $6$UoDmVdoW$... Cryptographic hash prefixed by algorithm identifier. 3 Last Changed Date 16631 Days since the Unix Epoch (Jan 1, 1970) when password was last updated. 4 Minimum Age 7 Days user must wait before they can change password again. 5 Maximum Age 15 Days before the password expires and must be changed. 6 Warning Period 2 Days prior to expiration that warning prompts begin displaying. 7 Inactivity Period 14 Days after expiration during which user can still change password; past this, account is disabled. 8 Expiration Date 16819 Absolute date (in days since epoch) when account is permanently disabled. 9 Reserved (empty) Flag reserved for future operating system use. Identifying Password Hash Algorithms The second field begins with $id$salt$hash. The ID reveals the cryptographic hashing algorithm used: ...

When an adversary compromises a Linux server, they frequently alter system binaries (installing backdoored binaries like sshd or login), inject malicious cronjobs, modify web directories, or alter file permissions (e.g., granting SUID or world-writable access). AIDE (Advanced Intrusion Detection Environment) is a host-based File Integrity Monitoring (FIM) tool that builds a cryptographic baseline database of file attributes, hashes, permissions, and SELinux labels to detect file tampering. How AIDE Operates AIDE scans the filesystem according to rules defined in /etc/aide.conf, calculates cryptographic checksums (SHA-256, SHA-512) and metadata attributes for each file, and stores them in a baseline database (/var/lib/aide/aide.db.gz). ...