Please enable JavaScript.
Coggle requires JavaScript to display documents.
🐧 Enterprise Linux Compliance Implementation - Coggle Diagram
🐧 Enterprise Linux Compliance Implementation
1️⃣ Linux Compliance Foundation
📌 Understand Linux Compliance
Linux Compliance means:
Ensuring Linux servers follow:
🔹 Security configuration standards
🔹 Access control policies
🔹 Patch management requirements
🔹 Logging requirements
🔹 Monitoring requirements
🔹 Vulnerability management requirements
🔹 Audit requirements
Enterprise Compliance Goals:
🛡 Reduce attack surface
🔐 Control user privileges
📋 Maintain audit evidence
🚨 Detect security violations
🔄 Maintain continuous compliance
2️⃣ Enterprise Linux Compliance Lifecycle
🔍 Step 1: Discover Assets
Goal:
Know what Linux servers exist
Collect:
Server hostname
IP address
Operating system version
Kernel version
Installed packages
Running services
Users
Network ports
Commands:
Check hostname:
hostnamectl
Check OS:
cat /etc/os-release
Check kernel:
uname -r
Check hardware:
lscpu
free -h
lsblk
Check network:
ip addr
ss -tulpn
📊 Enterprise Tools:
CMDB
ServiceNow Asset Management
Ansible Inventory
Red Hat Satellite
Microsoft SCCM
3️⃣ Linux Security Baseline Implementation
🔐 CIS Benchmark Implementation
CIS Benchmark:
Center for Internet Security recommendation
Contains security rules for Linux
Example:
Disable unused services
Password policy
File permissions
SSH hardening
Kernel security
Tools:
OpenSCAP
Path:
/usr/share/xml/scap/content/
Install:
Ubuntu:
apt install libopenscap8 scap-security-guide
RHEL:
yum install openscap-scanner scap-security-guide
Check profiles:
oscap info benchmark.xml
Run scan:
oscap xccdf eval \
--profile cis \
--results result.xml \
benchmark.xml
CIS-CAT Pro
Enterprise CIS scanning tool
Nessus
Vulnerability compliance scanning
Qualys
Enterprise vulnerability management
4️⃣ Identity and Access Management (IAM)
👤 User Management
Important Files:
User database:
/etc/passwd
Password database:
/etc/shadow
Groups:
/etc/group
Commands:
Create user:
useradd username
Modify user:
usermod
Delete user:
userdel
🔑 Password Policy
Configure:
/etc/security/pwquality.conf
Example:
Minimum password length:
minlen=14
Require uppercase:
ucredit=-1
Require number:
dcredit=-1
🔒 Account Lock Policy
Files:
/etc/login.defs
Settings:
PASS_MAX_DAYS
PASS_MIN_DAYS
PASS_WARN_AGE
🛡 Sudo Access Management
File:
/etc/sudoers
Edit safely:
visudo
Examples:
Full administrator:
user ALL=(ALL) ALL
Specific command:
user ALL=(root) /usr/bin/systemctl
Group access:
%linuxadmins ALL=(ALL) ALL
5️⃣ SSH Security Hardening
Configuration File:
/etc/ssh/sshd_config
Disable root login:
PermitRootLogin no
Disable password login:
PasswordAuthentication no
Allow only approved users:
AllowUsers admin1 admin2
Change SSH port:
Port 2222
Restart SSH:
systemctl restart sshd
Verify:
sshd -t
6️⃣ File System Security
🔐 Linux Permissions
Permission Types:
Owner
Group
Others
Commands:
ls -l
chmod
chown
chgrp
Example:
chmod 750 script.sh
Meaning:
Owner:
read write execute
Group:
read execute
Others:
no access
🔒 Special Permissions
SUID
Allows execution with owner privilege
Find:
find / -perm -4000
SGID
Group inheritance
Example:
chmod 2770 /shared
Sticky Bit
Protect shared folders
Example:
chmod 1777 /tmp
7️⃣ SELinux Enterprise Security
Purpose:
Mandatory Access Control
Controls:
Who can access what
Check status:
sestatus
Modes:
Enforcing
Permissive
Disabled
Configuration:
/etc/selinux/config
Context Management:
ls -Z
Restore labels:
restorecon -Rv /directory
Policy Management:
semanage
audit2allow
8️⃣ Linux Firewall Compliance
Tools:
firewalld
nftables
iptables
Check firewall:
firewall-cmd --state
View rules:
firewall-cmd --list-all
Allow service:
firewall-cmd \
--add-service=https \
--permanent
Reload:
firewall-cmd --reload
9️⃣ Patch Management
Purpose:
Remove vulnerabilities
Check updates:
Ubuntu:
apt update
RHEL:
yum check-update
Install patches:
Ubuntu:
apt upgrade
RHEL:
yum update
Enterprise Tools:
Red Hat Satellite
WSUS
Ansible Tower
Landscape
🔟 Logging and Auditing
Linux Logs:
/var/log/
Important files:
/var/log/messages
/var/log/auth.log
/var/log/secure
/var/log/audit/audit.log
Systemd Journal:
journalctl
Audit Framework:
Package:
auditd
Configuration:
/etc/audit/audit.rules
Check:
auditctl -l
Example rule:
Monitor passwd file
auditctl -w /etc/passwd -p wa
1️⃣1️⃣ File Integrity Monitoring
Purpose:
Detect unauthorized changes
Tools:
AIDE
OSSEC
Wazuh
AIDE:
Install:
apt install aide
Initialize:
aide --init
Check:
aide --check
1️⃣2️⃣ Vulnerability Management
Process:
Discover
Scan
Analyze
Remediate
Verify
Tools:
Nessus
Qualys
OpenVAS
Rapid7 InsightVM
Linux checks:
Installed packages:
rpm -qa
dpkg -l
Vulnerable packages:
yum updateinfo
apt list --upgradable
1️⃣3️⃣ Malware and Rootkit Detection
Tools:
rkhunter
chkrootkit
Commands:
rkhunter --check
chkrootkit
1️⃣4️⃣ Network Security Compliance
Check ports:
ss -tulpn
Disable unused services:
systemctl disable service
Check listening services:
netstat -tulpn
1️⃣5️⃣ Backup and Recovery Compliance
Requirements:
Backup configuration
Backup data
Test restore
Linux backup tools:
rsync
tar
Bacula
Veeam
1️⃣6️⃣ Configuration Management
Enterprise Automation:
Ansible
Inventory:
/etc/ansible/hosts
Example:
Install package:
ansible all -m yum -a "name=httpd state=present"
Apply security baseline:
ansible-playbook hardening.yml
1️⃣7️⃣ Compliance Monitoring
Continuous Checking:
Daily:
Logs
Failed login
Vulnerability
Weekly:
Compliance scans
Monthly:
Patch cycle
Quarterly:
Audit review
Enterprise Platforms:
Splunk
Elastic SIEM
IBM QRadar
Microsoft Sentinel
1️⃣8️⃣ Compliance Reporting
Evidence Collection:
Generate:
CIS scan report
Patch report
User access report
Firewall report
Audit logs
Documentation:
Security baseline document
Exception document
Risk acceptance document
1️⃣9️⃣ Enterprise Linux Compliance Architecture
Linux Servers
|
↓
Configuration Management
|
Ansible
|
↓
Security Baseline
|
CIS Benchmark
|
↓
Compliance Scanner
|
OpenSCAP
Nessus
|
↓
SIEM Monitoring
|
Splunk
Elastic
QRadar
|
↓
Security Operations Center
|
Incident Response
2️⃣0️⃣ Practical Learning Lab Project
Build Lab:
VM1:
Ubuntu Server
CIS Hardening
VM2:
RHEL Clone
SELinux
VM3:
Security Scanner
OpenSCAP
VM4:
SIEM
Elastic Stack
Practice:
✔ Apply CIS Benchmark
✔ Scan compliance
✔ Fix failures
✔ Generate report
✔ Monitor logs
✔ Automate with Ansible
✔ Repeat continuously