Linux Security

Introduction to Securing SSH with FIDO2 and Physical Security Keys

Securing SSH connections is crucial for preventing unauthorized access to Linux systems. Recently, there has been an increase in attacks targeting SSH, including CVE-2022-42010, which allows attackers to bypass authentication using a malicious SSH server. To mitigate such risks, using FIDO2 and physical security keys can significantly enhance the security of SSH connections. In this blog post, we will explore how to secure SSH with FIDO2 and physical security keys on Fedora.

Penetration testing (pentesting) is an essential process for identifying and addressing vulnerabilities within web applications. It involves simulating cyberattacks to assess the security of systems, networks, and applications, ultimately revealing areas of weakness that could be exploited by malicious actors. Web applications, being a major point of interaction for many businesses, are a prime target for cyberattacks. Therefore, ensuring that these applications are robust against common threats is critical.

There are a variety of tools available to pentesters to help automate and streamline the process of identifying vulnerabilities in web applications. These tools range from scanning platforms that automatically detect common flaws like SQL injection or cross-site scripting (XSS), to more advanced options that provide in-depth testing capabilities. This post will explore some of the most widely used pentesting tools for web applications, offering a detailed look at how each tool works, their key features, and how they assist in identifying potential vulnerabilities.

Kali Linux is a specialized Linux distribution designed for penetration testing, security research, computer forensics, and reverse engineering. Developed and maintained by Offensive Security, Kali Linux has become a go-to platform for ethical hackers and security professionals worldwide. It comes preloaded with a vast array of tools tailored to meet the diverse needs of the cybersecurity domain.

Features and Highlights

Kali Linux stands out from other distributions due to its unique features:

Wireshark is a powerful open-source network protocol analyzer widely used for network troubleshooting, analysis, software development, and education. As one of the most trusted tools in the networking world, Wireshark provides unparalleled visibility into live and recorded network traffic, making it a cornerstone for IT professionals and cybersecurity experts.

Key Features of Wireshark

Deep Packet Inspection

Wireshark captures and inspects packets in real time, offering detailed insights into network traffic. With support for hundreds of protocols, it decodes and displays protocol-specific data in an easy-to-read format.

In the world of network security, firewalls play a critical role in protecting systems from unauthorized access and malicious traffic. They are a fundamental component of any secure network infrastructure. However, not all firewalls are created equal, and understanding the differences between application-level firewalls and IP-level firewalls is crucial for building an effective defense strategy.

In this post, we’ll explore the key distinctions between these two types of firewalls, with a particular focus on the advantages of application-level firewalls. Let’s break down the basic concepts first.

AppArmor (Application Armor) is a Linux Security Module (LSM) that provides a practical, easy-to-use Mandatory Access Control (MAC) framework for restricting the capabilities of applications. Unlike SELinux, which relies on complex policies, AppArmor simplifies security by using profile-based access control.

Key Features

• Profile-Based Access Control: AppArmor restricts application behavior based on predefined profiles.
• Path-Based Security Policies: Unlike SELinux, which uses labels, AppArmor policies are based on file paths.
• Learning Mode: Allows administrators to create security profiles by observing application behavior.
• Fine-Grained Access Control: Provides detailed permission controls over file access, network connections, and capabilities.
• User-Friendly Management: Easier to configure and deploy compared to SELinux.

How AppArmor Works

AppArmor uses security profiles that define which files, capabilities, and network accesses an application is allowed. These profiles are enforced at the kernel level, restricting an application’s ability to perform unauthorized actions.

Landlock is a Linux Security Module (LSM) that provides a flexible, unprivileged sandboxing mechanism for applications. Unlike traditional LSMs such as SELinux and AppArmor, which enforce mandatory access control policies set by system administrators, Landlock allows applications to define their own security restrictions. This makes it a powerful tool for developers seeking to add additional security layers without requiring elevated privileges.

Key Features

• Unprivileged Sandboxing: Landlock enables applications to apply security restrictions without requiring root access or administrative intervention.
• Filesystem Access Control: Developers can define which files and directories an application can access.
• Incremental Restrictions: A process can only tighten its access permissions over time, preventing privilege escalation.
• Composability: Can be used in combination with other LSMs such as SELinux and AppArmor for enhanced security.
• User-Space Control: Allows developers to enforce security policies dynamically within their applications.

How Landlock Works

Landlock uses a set of security rules that define what resources an application can access. These rules are enforced at the kernel level and prevent applications from performing unauthorized actions. Unlike traditional access control mechanisms, Landlock works on a per-process basis, meaning individual applications can define and enforce their own security policies without affecting the rest of the system.

WordPress is the backbone of nearly half the websites on the internet, making it a high-value target for attackers. WPScan is a specialized tool designed to help secure WordPress installations by identifying vulnerabilities, misconfigurations, and weak points in their setup. Developed for ethical hackers, administrators, and security professionals, WPScan is an essential tool for maintaining a secure WordPress environment.

Learn more about WPScan on its official website, including its latest features and comprehensive documentation.

Linux Security Modules (LSM)

Linux Security Modules (LSM) is a framework that allows different security models to be implemented as kernel modules. It provides the necessary hooks within the Linux kernel for implementing access control mechanisms beyond the traditional Unix permissions model. Several LSMs are available, each with different use cases and security policies.

SELinux

Security-Enhanced Linux (SELinux) is one of the most well-known Linux Security Modules. Developed by the NSA, SELinux enforces Mandatory Access Control (MAC) policies, restricting processes and users based on predefined security policies.

Exim is a powerful and flexible Mail Transfer Agent (MTA) used for handling email traffic on Unix-like systems, including Linux. Originally developed at the University of Cambridge, Exim is designed to be highly configurable while maintaining strong security features. It is commonly used as an alternative to Postfix and Sendmail, offering more advanced routing and filtering capabilities.

Key Features

1. Flexible Configuration

Exim allows for highly customizable mail routing and filtering. Administrators can define complex mail-handling rules, making it ideal for specialized email requirements.