View source for Linux security

This page contains some basic security measures specifically for people getting started with linux. Knowing your way around a bit on the [[kinky linux command-line]] is required for easily doing these steps. If you run into trouble, find us on IRC.

[[File:Sparta.jpg|400px|thumb|right|Internet Security is based on a slew of old myths, which reach their most ‘refined’ form in RandomSource, which in turn of course derived from the original Rule of Least Power episode "Planet of Wobbly Rocks where the Security Guard Got Shot".]]

== Setting up root mail ==

Debian with MATE comes with the <code>exim</code> mailserver installed. If you don't like <code>exim</code>, install <code>postfix</code> (if you install the one, the other is uninstalled). 

* Exim uses the Sendmail design model where a single binary controls all the facilities of the MTA. This monolithic design is inherently less secure due to the lack of binary separation between the individual components of the system. Exim separates processes and has well-defined stages where it gains or loses privileges.
* Postfix has a modular design to improve security over Qmail. A master daemon (a background process) launches other smaller processes with limited privileges that do specific tasks related to the various stages of mail delivery. The modular approach limits the effects of attacks.
* Sendmail is the default MTA shipped with many Linux distribution sets and is the most well-known. It is easy to configure but had the most security loopholes, partly because it was designed long before hackers started attacking email systems. Developers fix most security issues quickly, but because it has the most number of users, it is still the biggest target for hackers.

To install postfix:

 $ sudo apt-get install postfix

Next is setting up an account in a mail client.

The wizard of Icedove (Thunderbird) does not allow directly for setting up local mail adresses. Choose "I think I'll configure my account later.":

[[File:Localmail1.png|640px|thumb|center]]

Make the menu appear, and choose the big Movemail link (all the way to the right of the blue email):

[[File:Localmail2.png|640px|thumb|center]]

Fill in "Identity" data like so:

[[File:Localmail3.png|640px|thumb|center]]

Outgoing Server Information like so (will be revisited):

[[File:Localmail4.png|640px|thumb|center]]

Your "Account Name":

[[File:Localmail5.png|640px|thumb|center]]

If all went well the account has appeared. Revisit SMTP settings: Edit > Account Settings -> Outgoing Server (SMTP) -> Edit

[[File:Localmail7.png|640px|thumb|center]]

Set Port 25:

[[File:Localmail6.png|640px|thumb|center]]

You may already have messages for user. Maybe not for root yet.

Open <code>/etc/aliases</code> with your favourite editor (vi, vim, nano, geany):

 $ sudo geany /etc/aliases

And make sure there is a <code>root: username</code>, username being *your* username of course, and a <code>postmaster: root</code> line in the file.

[[File:Localmail8.png|640px|thumb|center]]

== Installing intrusion detection ==
You can use a firewall, keep your system softwares up to date, stop all unrequired services, use long and difficult passwords and password managers, and more (see below), there is still a chance that some intruder might get into your system.

When intruders penetrate your system there is a great chance that they will want to make their presence as quiet as possible. To do so, they are most likely to replace some common binaries such as <code>ls</code>, <code>netstat</code> or <code>ps</code> with versions that will not make their presence visible. For example, <code>ls</code> can be replaced with an <code>ls</code> version that won't show the files they created, <code>netstat</code> will not show connections that are used by the intruder, and <code>ps</code> will hide processes the intruder runs. To detect changes like that in your system, you can set up intrusion detection with for example <code>aide</code> or <code>tripwire</code>. 

''Aide'' and ''tripwire'' are both File Integrity Agents (FIAs). A FIA monitors the integrity and state of the files and objects on your machine. If it detects changes to those files, then it alerts the administrator that an unauthorised access or change has taken place. FIAs usually take a hash of all files to be monitored using an algorithm like MD5. The snapshot is periodically checked against the current hash of the file and any variations alerted on.

For some "''aide'' vs ''tripwire''" notes, see [[Linux applications#Intrusion detection|Linux applications: Intrusion detection]], and for an example install of tripwire on a server, see [[Linux server security#Installing intrusion detection|Linux server security: Installing intrusion detection]]. On a home system, aide.

To install ''aide'' on a debian based system:

 $ sudo apt-get install aide

Open up <code>/etc/default/aide</code> with your favourite editor to change who to send its reports to: 

 $ sudo geany /etc/default/aide

[[File:Aide1.png|640px|thumb|center]]

Initialise (this can take some time):

 $ sudo aideinit

Most of ''aide'' configuration can be found in <code>/etc/aide/aide.conf</code>. This file is pretty well documented and default rules are quite decent. Aide aims at reporting files that changed since the last snapshot (stored in <code>/var/lib/aide/aide.db</code>). In hostile environments, a good security measure is to keep the database file on a floppy disk, cdrom or external disk. If you have such a device, you can copy the current snapshot to it and use the snapshot from that device during later runs of aide.

Before making modifications to the configuration file, make a backup first:

 $ sudo cp /etc/aide/aide.conf /etc/aide/aide.conf.old 

So let say that you have a copy of aide.db on an external disk. To use that snapshot, you can change ''database=file:/var/lib/aide/aide.db'' to ''database=file:/media/user/drive/aide/aide.db'':

[[File:Aide2.png|640px|thumb|center]]

Read through the file to acquaint yourself with aide. By default, changes in ''Binaries'' and ''Libraries'' directories are checked. Those are matched to the ''BinLib'' rule, which basically checks for any changes in permissions, ownership, modification, access and creation date, size change, md5 and sha1 signature, inode, number of links and block count. Then, it also checks for modifications in the log files against the rule ''Logs''. Because log files tend to grow, you cannot use a signature there and you also have to ask aide not to check for size modification (S). 

On debian alikes, aide is run on a daily basis through the script <code>/etc/cron.daily/aide</code>. Default settings in <code>/etc/default/aide</code> tells aide to update it's database. Using <code>database_out</code> value in <code>/etc/aide/aide.conf</code>, aide is going to output a new database any time it runs in /var/lib/aide/aide.db.new if you kept the default settings.

Any time you install new packages or change some configuration settings, run:

 $ sudo /etc/cron.daily/aide

And check in the report that any modifications were only done to files you intended to modify and that added files are only coming from packages you have just installed and copy the new database to whatever place your database points to. Great way to learn about linux and non-intended changes too.

== Managing passwords ==

Using a password manager allows you to load passwords in your clipboard, making it hard to catch it with a keylogger (just in case). And all good password managers allow you to generate passwords, making the passwords independent from your personal preferences and harder to crack. One of the easiest password managers is a GUI tool called keepassx:

 $ sudo apt-get install keepassx

It will appear in your menu. A "first steps" tutorial can be found here http://keepass.info/help/base/firststeps.html

Recommendations:
* Keep the database on a removable medium like an encrypted USB stick.
* Use a second encrypted stick to keep a backup of that database on. 
* For added security, set up the database to use a password as well as a keyfile.
* Try to always close off the application. It uses a lockfile to prevent access by other processes. Quitting the application removes it. If not, and whenever you get a message that you cannot open your database, check on the USB in the directory where the database resides that there isn't a lockfile blocking access. If there is a lockfile while the database is not open for you, just delete the lockfile.
* On rare occasions a database is truly corrupted. That backup on that other stick, phew. :D

If you want to try your hand at cracking your own (current and new) passwords, try one of these http://sectools.org/tag/pass-audit/

== Turning camera off ==

[[File:Yao-ming-meme-turning-on-the-webcam.jpg|420px|thumb|right]]

Intruders can gain access to their victims’ computers with remote-access Trojans (RATs) – malware that gives an intruder administrative control over its targeted computers, including, in this case, the ability to remotely control webcams. It’s an invisibly-installed malware program spread via email attachment or by tricking victims into visiting a booby-trapped site.

Tape the camera. It may even be possible to turn it off in BIOS (depending on your version). 

Better yet, if you know what driver module is controlling the webcam, you can disable the driver with <code>modprobe -r</code>. 

Check with:

 $ lsmod | grep "uvc"

If stuff like this appears, your webcam device uses an uvc driver http://www.ideasonboard.org/uvc/:
<pre>uvcvideo               79005  0 
videobuf2_vmalloc      12816  1 uvcvideo
videobuf2_core         47787  1 uvcvideo
videodev              126451  3 uvcvideo,v4l2_common,videobuf2_core
media                  18305  2 uvcvideo,videodev
usbcore               195340  7 uvcvideo,ums_realtek,usb_storage,ehci_hcd,ehci_pci,usbhid,xhci_hcd</pre>

To disable the cam:

 $ sudo modprobe -r uvcvideo

To enable the cam:

 $ sudo modprobe uvcvideo

If not an uvcvideo driver, try <code>$ sudo lsmod | grep "video"</code> and use the <code>modinfo</code> command to find out more about a particular module:

 $ sudo modinfo [modulename]

Then replace the "uvcvideo" in the above modprobe command with the name of your driver module.

To disable the webcam at boot (if file not exists, create it):

 $ sudo geany /etc/modprobe.d/blacklist.conf

At bottom of the file add this line: <code>blacklist uvcvideo</code> (or the name of your driver instead of "uvcvideo").

Save the file and reboot. Your webcam is no longer functioning.

== Turning microphone off ==

Open the alsa control panel for muting the microphone:

 $ sudo alsamixer

You can also use the same <code>modprobe</code> enabling/disabling method as used above for webcam. This page may be helpful for finding your driver module: http://alsa.opensrc.org/ALSA_modules.

== Using a firewall ==
[[File:Gufw-mint.png|320px|thumb|right]]
With a firewall, you can:
* Log hosts scanning services that aren't running
* Limit the services that programs can connect to
* Segregate the local network into trust segments (LAN, DMZ, and Internet)
* Redirect ports to the hosts providing the service (NAT).

If you have a single machine at home, only the first two are of interest. These are also the two that are most likely to cause issues for a beginning user. 

Mint and ubuntu come with a firewall installed, but it is disabled. Usually it's better to turn it on. Especially on mobile devices like laptops, which sometimes connect to other networks than your own. 

The firewall is called <code>ufw</code> ('''u'''ncomplicated '''f'''ire'''w'''all), and can be operated from the terminal (Menu > Accessories > Terminal):

 $ sudo ufw enable

Type your password when prompted for it; this will remain entirely invisible, not even asterisks will show, which is normal. 

Ufw has a sensible set of default settings (profile), which are fine for the vast majority of home users. So unless you have special wishes: you're done!

You can check the status of the firewall with this command:

 $ sudo ufw status verbose

If you wish, you can install a GUI frontend to ufw, called gufw:

 $ sudo apt-get install gufw

And it'll be in your menu items (the icon in mint is a brick wall).

== Safer browsing ==

It is clear that browsing has the most low cost attack vectors for data theft by hackers, tracking by corporations and for governmental spying. Safer browsing is a good investment all around.

=== Choose your browser carefully ===

(also see note about evercookie and Opera)

=== Configuring browsers ===
=== Browser extensions ===

=== Checks and balances ===

== Using removable storage media ==
A simple but straightforward security method is to keep all sensitive information on removable storage media like portable flash memory drives or external hard drives that you only mount the device when you need access to it. You can turn old harddrives into external harddrives by taking them out of an old PC and putting them in a portable HDD USB storage kit (alias harddrive enclosure). These "DIY" kits are available for 2.5 inch and 3.5 inch HDD using either IDE or SATA connections and cost way less than a manufactured USB HDD. 

You may have a permission problem accessing it. If so, change the group of <code>/media/[externaldisk]</code> to storage, change permissions to 775 and add users that need to be able to write to disk to the storage group (re-log required before changes are visible).

As root (or use sudo) do:

 <pre># chgrp storage /media/[externaldisk]
# chmod 775 /media/[externaldisk]
# gpasswd -a [user] storage</pre>

This way everyone will be able to read the disk, but only root and users in storage group will be able to write to it. If you want everyone to be able to read/write, use chmod 777. If the operation isn't permitted while running it as root you probably need to add support for the NTFS file system first:

 <pre># apt-get update
# apt-get install ntfs-3g</pre>

But the most popular forms of security all rely on [[Encrypting_everything|encryption]], the process of encoding information in such a way that only the person (or computer) with the key can decode it. Or maybe others can for some forms of encryption. Or can soon?

== Encryption ==

For an overview of encryption concepts see [[encrypting everything]] and for application of concepts in useful tools [[Object encryption on linux]] and [[Anonymising your traffic with linux]].

== Backups ==

=== Archiving and compressing ===

tar, gzip and bzip2

=== Backup to removable media ===

== Traffic monitoring ==
== Configure sysctl (*) ==

== Audit your setup ==

== Resources ==

=== General ===
* Linux security http://www.linuxsecurity.com/

=== Debian ===

* Security information https://www.debian.org/security/
* Securing Debian Manual https://www.debian.org/doc/manuals/securing-debian-howto/index.en.html

=== Ubuntu ===

* Ubuntu security notices http://www.ubuntu.com/usn/
* Basic Ubuntu Security Guide, Desktop Edition https://wiki.ubuntu.com/BasicSecurity

=== Mint ===

* Forum http://forums.linuxmint.com/viewforum.php?f=143&sid=144ced36d297bed0a2330fda9abc9d40

== Related ==

* [[Installing linux]]
* [[Linux applications]]
* [[Kinky linux command-line]]
* [[Object encryption on linux]]
* [[Anonymising your traffic with linux]]
* [[Clean up all the things]]
* [[Shell scripting]]