Security and Networking Fundamentals¶

📖 Linux Security Guide - Security hardening reference 📖 TCP/IP Guide - Networking reference

Security Fundamentals¶

CIA Triad¶

Authentication vs Authorization¶

Multi-Factor Authentication (MFA)¶

MFA requires two or more different factors (not just two passwords).

Encryption¶

Encryption Types¶

Symmetric Encryption: - Same key for encryption and decryption - Fast, suitable for large data - Challenge: secure key distribution - Algorithms: AES, DES, 3DES, Blowfish - Use case: encrypting data at rest, TLS session data

Asymmetric Encryption (Public Key): - Key pair: public key (encrypt) and private key (decrypt) - Slower than symmetric - Public key can be shared openly - Algorithms: RSA, ECC, DSA - Use case: SSH keys, TLS handshake, digital signatures

Hashing: - One-way function (cannot reverse) - Fixed-length output regardless of input size - Used for integrity verification, not encryption - Algorithms: SHA-256, SHA-512, MD5 (insecure), bcrypt - Use case: password storage, file integrity, checksums

TLS/SSL¶

📖 TLS Overview - TLS reference

• TLS (Transport Layer Security) - Encrypts data in transit
• SSL (Secure Sockets Layer) - Deprecated predecessor to TLS
• HTTPS = HTTP + TLS (port 443)
• Certificate - Proves server identity, issued by Certificate Authority (CA)

TLS Handshake (simplified): 1. Client connects and sends supported cipher suites 2. Server responds with certificate and chosen cipher 3. Client verifies certificate with CA 4. Both sides establish symmetric session key 5. Encrypted communication begins

Certificates¶

Linux Security¶

Firewall Management¶

firewalld (modern):

systemctl enable --now firewalld
firewall-cmd --state                        # check status

# Allow services
firewall-cmd --add-service=http --permanent
firewall-cmd --add-service=https --permanent
firewall-cmd --add-service=ssh --permanent

# Allow ports
firewall-cmd --add-port=8080/tcp --permanent

# Remove rules
firewall-cmd --remove-service=http --permanent

# Apply changes
firewall-cmd --reload

# List current rules
firewall-cmd --list-all

iptables (legacy):

iptables -L                             # list rules
iptables -A INPUT -p tcp --dport 80 -j ACCEPT    # allow HTTP
iptables -A INPUT -p tcp --dport 443 -j ACCEPT   # allow HTTPS
iptables -A INPUT -j DROP                         # drop all other

SSH Security¶

# Generate key pair
ssh-keygen -t ed25519                   # modern, recommended
ssh-keygen -t rsa -b 4096              # RSA alternative

# Copy public key to server
ssh-copy-id user@server

# SSH connection
ssh user@server
ssh -p 2222 user@server                 # custom port

SSH Hardening (/etc/ssh/sshd_config):

PermitRootLogin no                      # disable root SSH login
PasswordAuthentication no               # require keys only
PubkeyAuthentication yes                # enable key authentication
MaxAuthTries 3                          # limit login attempts

File Permissions for Security¶

chmod 600 ~/.ssh/id_ed25519            # private key - owner only
chmod 644 ~/.ssh/id_ed25519.pub        # public key - readable
chmod 700 ~/.ssh                        # .ssh directory - owner only
chmod 600 ~/.ssh/authorized_keys       # authorized keys - owner only

SELinux and AppArmor¶

# SELinux
getenforce                              # check status
setenforce 0                            # set permissive (temporary)
setenforce 1                            # set enforcing

# AppArmor
aa-status                               # check status

Common Security Threats¶

Security Best Practices¶

1. Principle of least privilege - Grant minimum required access
2. Defense in depth - Multiple layers of security
3. Patch regularly - Keep systems and software updated
4. Use MFA - Multi-factor authentication wherever possible
5. Encrypt data - At rest and in transit
6. Monitor and audit - Log and review security events
7. Backup regularly - Protect against data loss and ransomware

Networking Fundamentals¶

OSI Model¶

Memory Aid: Please Do Not Throw Sausage Pizza Away (bottom-up)

TCP/IP Model¶

TCP vs UDP¶

IP Addressing¶

IPv4: - 32-bit address (4 octets): 192.168.1.100 - Total: ~4.3 billion addresses - Private ranges: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 - Loopback: 127.0.0.1

CIDR Notation: | CIDR | Subnet Mask | Hosts | |------|-------------|-------| | /8 | 255.0.0.0 | 16 million | | /16 | 255.255.0.0 | 65,534 | | /24 | 255.255.255.0 | 254 | | /32 | 255.255.255.255 | 1 (single host) |

IPv6: - 128-bit address: 2001:0db8:85a3::8a2e:0370:7334 - Virtually unlimited addresses - No NAT needed - Loopback: ::1

Common Ports¶

DNS (Domain Name System)¶

How DNS Works: 1. User types www.example.com in browser 2. Browser checks local cache 3. Query goes to recursive DNS resolver 4. Resolver queries root nameserver 5. Root directs to .com TLD nameserver 6. TLD directs to authoritative nameserver 7. Authoritative returns IP address 8. Browser connects to IP

DNS Record Types: | Record | Purpose | Example | |--------|---------|---------| | A | IPv4 address | example.com -> 93.184.216.34 | | AAAA | IPv6 address | example.com -> 2606:2800:220:1:... | | CNAME | Alias to another domain | www -> example.com | | MX | Mail server | example.com -> mail.example.com | | NS | Nameserver | example.com -> ns1.example.com | | TXT | Text record | SPF, DKIM verification |

Network Troubleshooting Commands¶

ping host                   # test connectivity (ICMP)
traceroute host             # trace route to destination
dig domain                  # DNS lookup (detailed)
nslookup domain             # DNS lookup (simple)
ss -tunlp                   # listening ports with processes
netstat -tunlp              # legacy alternative to ss
curl -v http://host         # HTTP request with details
ip addr show                # network interface configuration
ip route show               # routing table

Key Facts for the Exam¶

1. CIA triad: Confidentiality, Integrity, Availability
2. Symmetric encryption uses one key; asymmetric uses a key pair
3. TLS encrypts data in transit; HTTPS = HTTP + TLS on port 443
4. SSH uses port 22; always disable root login and use key authentication
5. OSI has 7 layers; TCP/IP has 4 layers
6. TCP is reliable (connection-oriented); UDP is fast (connectionless)
7. /24 subnet = 254 usable hosts; /16 = 65,534 hosts
8. DNS translates domain names to IP addresses using port 53