Unix-like Security

🏰 Unix-like Security: Guarding Your Digital Castle

Imagine your computer is a medieval castle. You’re the ruler, and you need to decide who can enter which rooms, what they can touch, and how to keep invaders out. That’s exactly what Unix-like security does!

🗝️ The Big Picture: Your Three-Layer Shield

graph TD
    A["🏰 Your System"] --> B["🚪 File Permissions"]
    A --> C["🛡️ Security Controls"]
    A --> D["🔒 Hardening"]
    B --> E["Who can read?"]
    B --> F["Who can write?"]
    B --> G["Who can execute?"]

Think of Unix security like a castle with:

• Locked doors (file permissions)
• Guards (security controls)
• Strong walls (hardening)
• Secret tunnels (SSH)

📁 Linux File Permissions: The Three Keys

The Magic Numbers: Read, Write, Execute

Every file in Linux has three types of permission:

The Three Groups: Owner, Group, Others

-rwxr-xr--
 │││ │││ │││
 │││ │││ └── Others (everyone else)
 │││ └────── Group (your team)
 └────────── Owner (you, the king!)

Real Example:

ls -l myfile.txt
-rw-r--r-- 1 alice staff 1024 Jan 1 myfile.txt

This means:

• Owner (alice): Can read and write ✅
• Group (staff): Can only read 👀
• Others: Can only read 👀

Changing Permissions: The chmod Command

Using numbers (easy math!):

chmod 755 script.sh

• 7 = 4+2+1 (read+write+execute) for owner
• 5 = 4+1 (read+execute) for group
• 5 = 4+1 (read+execute) for others

Using letters:

chmod u+x script.sh  # Give owner execute
chmod go-w file.txt  # Remove write from group/others

Special Permissions: The Super Powers

Example: The /tmp folder has sticky bit:

drwxrwxrwt  /tmp

Everyone can write, but only you can delete YOUR files!

🛡️ Linux Security Controls: Your Castle Guards

SELinux: The Strict Librarian

SELinux (Security-Enhanced Linux) is like having a very strict librarian who checks EVERYTHING.

graph TD
    A["Process wants to access file"] --> B{SELinux Check}
    B -->|Allowed| C["✅ Access Granted"]
    B -->|Denied| D["❌ Access Blocked"]
    B -->|Audit| E["📝 Logged for review"]

Three Modes:

• Enforcing: Rules strictly applied 🚨
• Permissive: Only logs violations 📝
• Disabled: No protection ⚠️

Check your mode:

getenforce

AppArmor: The Friendly Bouncer

AppArmor is like a bouncer with a guest list. Simpler than SELinux!

Example Profile:

/usr/bin/firefox {
  /home/*/.mozilla/ rw,
  /tmp/ r,
  deny /etc/passwd r,
}

Firefox can read/write its own folder, but NOT your password file!

Capabilities: Splitting the King’s Power

Instead of giving ALL power (root), give just what’s needed:

Example: Let a web server bind to port 80 without being root:

setcap 'cap_net_bind_service=+ep' /usr/bin/myserver

🔨 Linux Hardening: Building Stronger Walls

Step 1: Remove Unused Services

Every running service is a potential door for attackers!

systemctl list-unit-files --state=enabled
systemctl disable bluetooth.service

Step 2: Firewall Configuration (iptables/nftables)

# Block everything, allow only what you need
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -A INPUT -p tcp --dport 22 -j ACCEPT

Step 3: Kernel Hardening

Add to /etc/sysctl.conf:

# Disable IP forwarding
net.ipv4.ip_forward = 0

# Ignore ICMP broadcasts
net.ipv4.icmp_echo_ignore_broadcasts = 1

# Enable SYN flood protection
net.ipv4.tcp_syncookies = 1

Step 4: User Account Security

# Lock unused accounts
usermod -L olduser

# Set password expiration
chage -M 90 username

# Check for empty passwords
awk -F: '($2 == "") {print}' /etc/shadow

The Hardening Checklist

🔐 SSH Security: The Secret Tunnel

SSH is like a secret, encrypted tunnel into your castle.

Basic Hardening in /etc/ssh/sshd_config

# Disable root login
PermitRootLogin no

# Use SSH keys only (no passwords!)
PasswordAuthentication no

# Change default port (optional)
Port 2222

# Allow only specific users
AllowUsers alice bob

SSH Keys: Your Magic Passport

graph LR
    A["Your Computer"] -->|Private Key 🔑| B["SSH Connection"]
    C["Server"] -->|Public Key 🔓| B
    B --> D["✅ Secure Access!"]

Generate your key pair:

ssh-keygen -t ed25519 -C "your@email.com"

Copy to server:

ssh-copy-id user@server

SSH Config: Making Life Easier

Create ~/.ssh/config:

Host myserver
    HostName 192.168.1.100
    User alice
    Port 2222
    IdentityFile ~/.ssh/mykey

Now just type: ssh myserver 🎉

Fail2Ban: The Automatic Guard

Fail2Ban watches for repeated failed logins and blocks attackers:

# Install
apt install fail2ban

# Check banned IPs
fail2ban-client status sshd

🍎 macOS Security Controls: The Apple Fortress

macOS shares Unix roots but adds its own security layers!

Gatekeeper: The App Bouncer

Gatekeeper checks if apps are from trusted sources.

graph TD
    A["App Download"] --> B{Gatekeeper Check}
    B -->|App Store| C["✅ Trusted"]
    B -->|Signed Developer| D["✅ Verified"]
    B -->|Unknown| E["⚠️ Blocked!"]

Control via Terminal:

# Check status
spctl --status

# Allow app manually
spctl --add /path/to/app

System Integrity Protection (SIP)

SIP protects critical system files—even from root!

Protected areas:

• /System
• /usr (except /usr/local)
• /bin, /sbin

Check SIP status:

csrutil status

FileVault: Full Disk Encryption

FileVault encrypts your entire drive. Even if someone steals your Mac, they can’t read your files!

# Check status
fdesetup status

# Enable (requires restart)
sudo fdesetup enable

macOS Firewall

# Check firewall status
/usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate

# Enable firewall
sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setglobalstate on

TCC: Transparency, Consent, Control

TCC manages app permissions for:

• Camera 📷
• Microphone 🎤
• Location 📍
• Contacts, Calendar, Photos

Apps must ASK before accessing these!

🎯 Quick Reference: Security Commands

🏆 Your Security Superpower Checklist

✅ Understand rwx permissions (4, 2, 1) ✅ Know the three groups: owner, group, others ✅ Use SELinux or AppArmor for extra protection ✅ Harden your system: disable unused services ✅ Secure SSH: keys over passwords, disable root ✅ Enable macOS protections: Gatekeeper, SIP, FileVault

🌟 Remember

“Security is not a product, but a process.” — Bruce Schneier

Your castle needs:

• Strong doors (file permissions)
• Alert guards (security controls)
• Thick walls (hardening)
• Secret passages (secure SSH)

Now you’re ready to defend your digital kingdom! 🏰🛡️