Ch 19 : Linux Security Basics

In this chapter, we’ll explore Linux security basics, including securing remote access, configuring firewalls, encrypting data, and implementing network security measures. By the end of this chapter, I hope you will have a solid foundation for keeping your Linux system secure.

Summary

Linux security basics, including SSH configuration, ufw, gpg, and tools like fail2ban, protect Debian 12 systems from threats. These practices ensure secure access, data protection, and network safety for beginners.

Why Learn Linux Security?

Security is a critical aspect of system administration and development. Whether you’re managing a personal machine or a production server, understanding Linux security tools and practices will help you protect your system from unauthorized access, data breaches, and network-based attacks. Linux security encompasses both local system security and network security, as the two are deeply interconnected.

---

Linux security basics are essential for safeguarding Debian 12 systems, whether for personal use or small office servers. This chapter introduces tools like ssh, ufw, and gpg to protect against unauthorized access, secure data, and monitor threats, empowering beginners to build a secure environment.

Learning Objectives: By the end of this chapter, you’ll be able to configure secure remote access with SSH, set up firewalls, encrypt files, and apply basic network security measures to protect your system from common threats.

Why Learn Linux Security Basics?

Security is critical to protect data, ensure privacy, and maintain system integrity. Linux security basics help beginners prevent unauthorized access, mitigate network attacks, and secure sensitive information, forming the foundation for robust system administration.

Securing Remote Access with SSH

ssh ensures encrypted remote access, protecting against eavesdropping.

Generating SSH Keys

Keys are more secure than passwords.

• RSA key:

  $ ssh-keygen -t rsa -b 4096 -C "your_email@example.com"

• Ed25519 key:

  $ ssh-keygen -t ed25519 -C "your_email@example.com"

• Copy key:

  $ ssh-copy-id user@remote_host

SSH Configuration

Customize ~/.ssh/config:

Host myserver
    HostName 192.168.1.100
    User amar
    IdentityFile ~/.ssh/id_ed25519

Connect:

$ ssh myserver

Securing sshd_config

Edit /etc/ssh/sshd_config:

PermitRootLogin no
PasswordAuthentication no
Port 2222
AllowUsers amar

Restart:

$ sudo systemctl restart ssh

Configuring Firewalls

Firewalls block unauthorized network traffic.

ufw: Simple Firewall

User-friendly firewall management.

• Enable:

  $ sudo ufw enable

• Allow SSH:

  $ sudo ufw allow ssh

• Allow port:

  $ sudo ufw allow 8080/tcp

• Status:

  $ sudo ufw status

iptables: Advanced Firewall

Granular traffic control.

• Allow SSH:

  $ sudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT

• Allow HTTP/HTTPS:

  $ sudo iptables -A INPUT -p tcp --dport 80 -j ACCEPT
  $ sudo iptables -A INPUT -p tcp --dport 443 -j ACCEPT

• Drop default:

  $ sudo iptables -P INPUT DROP

• Save:

  $ sudo iptables-save > /etc/iptables/rules.v4

Encrypting Data

gpg secures sensitive files.

• Encrypt:

  $ gpg -c file.txt

• Decrypt:

  $ gpg -d file.txt.gpg > file.txt

• Generate key:

  $ gpg --full-generate-key

• List keys:

  $ gpg --list-keys

Network Security Basics

Protects against network threats.

Key Measures

• Updates:

  $ sudo apt update && sudo apt upgrade

• Secure protocols: Use SSH, HTTPS, SFTP.
• Concepts: Ensure confidentiality, integrity, availability.

Advanced Security Tools

fail2ban: Intrusion Prevention

Blocks brute-force attacks.

$ sudo apt install fail2ban
$ sudo systemctl enable fail2ban

apparmor: Access Control

Restricts program permissions.

$ sudo apt install apparmor

lynis: Security Auditing

Identifies system vulnerabilities.

$ sudo apt install lynis
$ sudo lynis audit system

chkrootkit: Rootkit Detection

Scans for malicious software.

$ sudo apt install chkrootkit
$ sudo chkrootkit

clamav: Antivirus

Detects malware in files.

$ sudo apt install clamav
$ sudo clamscan /path/

auditd: Event Logging

Tracks security events.

$ sudo apt install auditd
$ sudo auditctl -e 1

Comparing Security Tools

Tool	Purpose	Ease	Best For
ufw	Simple firewall	Easy	Beginners
iptables	Advanced firewall	Hard	Complex setups
fail2ban	Blocks brute-force	Moderate	Service protection

Novice Tip: Start with ufw, then add fail2ban.

Practical Examples

SSH setup:

$ ssh-keygen -t ed25519
$ ssh-copy-id amar@192.168.1.100
$ ssh amar@192.168.1.100

Firewall:

$ sudo ufw allow ssh
$ sudo ufw enable

Encrypt file:

$ gpg -c secret.txt

Practice Time!

1. Generate an SSH key and connect to a server.
2. Configure ufw to allow SSH and HTTP.
3. Encrypt and decrypt a file with gpg.
4. Install fail2ban and enable SSH protection.
5. Run a lynis audit.

Try This: Run ufw status and share the output on X with #LinuxCommandLine!

Glossary of Commands, Tools, and Shortcuts

Reference: Linux Manpages, Debian APT.

Command/Tool	Description
ssh	Secure remote access
ssh-keygen	Generates SSH keys
ufw	Simple firewall
iptables	Advanced firewall
gpg	Encrypts files
fail2ban	Blocks brute-force attacks
apparmor	Restricts program access
lynis	Audits system security
chkrootkit	Detects rootkits
clamav	Antivirus scanner
auditd	Logs security events

---

That’s it for chapter 19 ! You’ve now learned how to secure your Linux system using SSH, firewalls, encryption, and advanced configurations like iptables and /etc/ssh/sshd_config. In the next chapter, we’ll dive into performance monitoring—how to monitor system resources using tools like htop, btop, and vmstat. Until then, practice these security techniques to keep your system safe.

Previous : Chapter 18 | Next: Chapter 20