Linux Security Hardening, Audit Framework, and Mandatory Access Control

Hardening Linux infrastructure involves multi-layered defense-in-depth: adhering to CIS benchmarks, configuring the Linux Audit Framework (auditd), securing Pluggable Authentication Modules (PAM), deploying automated intrusion prevention (fail2ban), and enforcing Mandatory Access Control (MAC) using SELinux or AppArmor.

⚡ Quick Dive

Security & Hardening Cheat Sheet

Security Domain Command / Tool Action Example
Audit Log Search ausearch Query auditd events by syscall or file path sudo ausearch -f /etc/shadow -i
Audit Summary aureport Generate summary reports (failed logins, auth) sudo aureport --auth
Audit Rule Add auditctl -w <file> Watch file for modifications/access in kernel sudo auditctl -w /etc/passwd -p wa -k passwd_mods
SELinux Status sestatus Check SELinux mode (Enforcing / Permissive) sestatus
SELinux Context ls -Z <file> Display SELinux security context labels ls -Z /var/www/html
SELinux Restore restorecon -Rv <dir> Restore default file contexts recursively sudo restorecon -Rv /var/www/html
AppArmor Status aa-status Display loaded AppArmor security profiles sudo aa-status
Fail2ban Status fail2ban-client status Check active jail status and banned IP list sudo fail2ban-client status sshd
Unban IP fail2ban-client unban Remove IP address from ban list sudo fail2ban-client set sshd unbanip 1.2.3.4

Security Baseline Checklist

# 1. Audit listening ports and kill unauthorized services
sudo ss -tulpn

# 2. Find all world-writable files on system (security vulnerability)
find / -xdev -type f -perm -0002 -print

# 3. Find all SUID executables (potential privilege escalation targets)
find / -xdev -type f -perm -4000 -print

# 4. Check failed login attempts
sudo lastb | head -n 15

📖 Extended Guide

1. The Linux Audit Framework (auditd)

The Linux Audit subsystem tracks security-relevant events directly inside the kernel (file accesses, privilege changes, syscall execution) and writes to /var/log/audit/audit.log.

Defining Audit Rules (/etc/audit/rules.d/audit.rules):

# Monitor write/attribute changes on /etc/passwd and /etc/shadow
-w /etc/passwd -p wa -k identity_changes
-w /etc/shadow -p wa -k identity_changes

# Monitor execution of user/group modification commands
-w /usr/sbin/useradd -p x -k user_mods
-w /usr/sbin/usermod -p x -k user_mods

# Monitor 64-bit architecture execution of setuid/setgid syscalls
-a always,exit -F arch=b64 -S setuid -S setgid -k priv_escalation

Querying Events: ausearch and aureport

# Reload audit rules
sudo augenrules --load

# Find who modified /etc/passwd and interpret numerical UIDs to names (-i)
sudo ausearch -k identity_changes -i

# Generate authentication audit report
sudo aureport -au

2. Mandatory Access Control (MAC): SELinux & AppArmor

Traditional Linux permissions use Discretionary Access Control (DAC: User, Group, Others). If an attacker compromises a daemon (e.g. Apache running as www-data), DAC allows the attacker to read any file owned by or readable by www-data.

Mandatory Access Control (MAC) confines processes to strict security profiles regardless of user permissions.

SELinux (RHEL, Rocky, CentOS, Fedora)

SELinux attaches a security context label to every process and file: user:role:type:level.

Example Context: unconfined_u:object_r:httpd_sys_content_t:s0
                                       └────────┬────────┘
                                                └─ Type Enforcement Label

# 1. Temporarily switch between Enforcing (1) and Permissive (0)
sudo setenforce 0

# 2. Check why an action was blocked (Audit to AVC log)
sudo ausearch -m AVC,USER_AVC -ts recent

# 3. Set correct context on web directory
sudo semanage fcontext -a -t httpd_sys_content_t "/custom_web(/.*)?"
sudo restorecon -Rv /custom_web

# 4. Toggle SELinux Booleans (e.g., allow web server to make network connections)
sudo setsebool -P httpd_can_network_connect 1

AppArmor (Ubuntu, Debian, SUSE)

AppArmor confines applications using file-path-based profiles stored in /etc/apparmor.d/:

# Check loaded profiles and modes (Enforce vs Complain)
sudo aa-status

# Place profile into complain mode for testing (logs violations without blocking)
sudo aa-complain /etc/apparmor.d/usr.sbin.nginx

# Place profile into enforce mode
sudo aa-enforce /etc/apparmor.d/usr.sbin.nginx

3. Intrusion Prevention with fail2ban

fail2ban scans authentication logs for brute-force attacks and dynamically inserts firewall drop rules.

Jail Configuration (/etc/fail2ban/jail.local):

[DEFAULT]
bantime = 1h
findtime = 10m
maxretry = 5
banaction = ufw

[sshd]
enabled = true
port = ssh
filter = sshd
maxretry = 3

# Restart fail2ban service
sudo systemctl restart fail2ban

# Check banned IP status on sshd jail
sudo fail2ban-client status sshd

4. Pluggable Authentication Modules (PAM)

PAM abstracts authentication mechanisms for Linux services in /etc/pam.d/.

Password Quality Enforcement (/etc/pam.d/common-password):

# Enforce minimum 14 characters with uppercase, lowercase, numbers, and symbols
password requisite pam_pwquality.so retry=3 minlen=14 dcredit=-1 ucredit=-1 lcredit=-1 ocredit=-1

Account Lockout on Failed Attempts (pam_faillock / pam_tally2):

# Lock account for 15 minutes after 5 consecutive failed attempts
auth required pam_faillock.so preauth silent audit deny=5 unlock_time=900
⌂ All Guides