Operating System Security

-rwxr-xr--  1  alice  devs  4096  Jan 15  script.sh
│││││││││└─ other: read
││││││└──── other: no write
│││││└───── other: no execute
││││└────── group: read
│││└─────── group: no write
││└──────── group: execute
│└───────── owner: read
│────────── owner: write
└────────── owner: execute
│
└─ file type: - = file, d = dir, l = symlink

# Octal notation
chmod 755 script.sh    # rwxr-xr-x
chmod 644 config.txt   # rw-r--r--
chmod 600 private.key  # rw------- (private key!)
chmod 700 ~/.ssh       # rwx------

# Symbolic notation
chmod u+x script.sh    # add execute for owner
chmod g-w file.txt     # remove write for group
chmod o=r file.txt     # set other to read-only

# Change owner
chown alice:devs file.txt
chown -R www-data:www-data /var/www/html

# Find world-writable files (dangerous)
find / -perm -o+w -not -path "/proc/*" 2>/dev/null

# Find SUID files (privilege escalation risk)
find / -perm -4000 -type f 2>/dev/null

# SUID (Set User ID): file runs as owner, not caller
# Example: /usr/bin/passwd is SUID root — lets any user change their password
ls -la /usr/bin/passwd
# -rwsr-xr-x  root  root  passwd
#    ^── 's' = SUID bit

# SGID (Set Group ID): file runs as group
# Dangerous SUID binaries (check GTFOBins):
find / -perm -4000 2>/dev/null | grep -v "^/proc"

# Remove SUID from unnecessary binaries
chmod u-s /usr/bin/find   # if not needed

# Create user with no shell (service account)
useradd -r -s /usr/sbin/nologin -d /var/lib/myapp myapp

# Lock an account
usermod -L username          # lock (prepend ! to password hash)
passwd -l username           # alternative

# Sudo configuration (/etc/sudoers via visudo)
# Allow alice to run only nginx commands as root:
alice ALL=(root) /bin/systemctl restart nginx, /bin/systemctl status nginx

# Allow user to run specific script without password:
deploy ALL=(root) NOPASSWD: /opt/deploy.sh

# Dangerous sudo misconfigurations to audit:
# ANY command with NOPASSWD
# sudo -l to see what current user can run
sudo -l

# 1. SUID binary abuse
find / -perm -4000 2>/dev/null
# GTFOBins: many binaries (find, vim, python) can be exploited when SUID
# Defense: remove SUID from all non-essential binaries

# 2. Sudo misconfig
sudo -l  # check what you can run as root
# sudo find . -exec /bin/sh \; -quit   (if find is in sudoers)
# Defense: never allow sudo on editors/find/python without specific args

# 3. Writable PATH
echo $PATH
# If /tmp is in PATH, malicious binary named 'ls' gets executed
# Defense: strict PATH, never include writable dirs

# 4. Cron jobs running as root
cat /etc/cron* /var/spool/cron/* 2>/dev/null
# If cron script is world-writable → inject commands
# Defense: cron scripts owned by root, not world-writable

# 5. Writable /etc/passwd (rare)
# Can add root-privileged user directly
# Defense: immutable flag: chattr +i /etc/passwd

# LinPEAS / LinEnum: automated PrivEsc enumeration
curl -L https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh | sh

# /etc/sysctl.d/99-hardening.conf

# Prevent ICMP redirects (MITM prevention)
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.all.send_redirects = 0

# Enable SYN cookies (SYN flood protection)
net.ipv4.tcp_syncookies = 1

# Disable IP source routing
net.ipv4.conf.all.accept_source_route = 0

# Hide kernel pointers in /proc (KASLR support)
kernel.kptr_restrict = 2

# Restrict dmesg to root
kernel.dmesg_restrict = 1

# Restrict ptrace (prevent process injection)
kernel.yama.ptrace_scope = 1

# Apply:
sysctl -p /etc/sysctl.d/99-hardening.conf

# Check status
aa-status

# Profiles in /etc/apparmor.d/
# Example: restrict nginx to only read /var/www
/usr/sbin/nginx {
  capability net_bind_service,
  /var/www/** r,
  /var/log/nginx/** w,
  /run/nginx.pid rw,
}

# Enforce a profile
aa-enforce /etc/apparmor.d/usr.sbin.nginx

# Complain mode (log only, don't block)
aa-complain /etc/apparmor.d/usr.sbin.nginx

# Generate profile for a binary
aa-genprof /usr/bin/myapp

# Install
apt install auditd

# Add rules (/etc/audit/rules.d/audit.rules)
# Monitor /etc/passwd changes
-w /etc/passwd -p wa -k passwd_changes

# Monitor sudo usage
-w /usr/bin/sudo -p x -k sudo_use

# Monitor SSH logins
-w /var/log/auth.log -p r -k auth_log

# Monitor /tmp execution (malware indicator)
-a always,exit -F dir=/tmp -F perm=x -k tmp_exec

# Search audit log
ausearch -k passwd_changes
ausearch -k sudo_use --start today
aureport --logins

# /etc/ssh/sshd_config
PermitRootLogin          no          # never allow root SSH
PasswordAuthentication   no          # keys only
PubkeyAuthentication     yes
AllowUsers               alice bob   # whitelist
MaxAuthTries             3
ClientAliveInterval      300
ClientAliveCountMax      2
X11Forwarding            no
AllowTcpForwarding       no          # prevents SSH tunneling
Protocol                 2           # SSHv1 is broken

# Restart after changes
systemctl restart sshd
# ALWAYS test in a new terminal before closing current session!