Operating System Security

Linux hardening, Windows security, access controls, and system monitoring.

Overview

OS security protects the foundation of all computing systems.

Key Concepts

• Patch Management — Regular updates
• Access Controls — User permissions
• Service Hardening — Disable unnecessary services
• Audit Logging — System monitoring
• File Permissions — Proper access rights

Linux Security

User Management

# Add user with limited privileges
useradd -m -s /bin/bash username
passwd username

# Add to specific group
usermod -aG sudo username

# List user groups
groups username

# Set password expiration
chage -M 90 username

File Permissions

# Read, Write, Execute permissions
chmod 755 file.txt    # rwxr-xr-x
chmod 644 file.txt    # rw-r--r--
chmod 600 secrets.txt # rw-------

# Change ownership
chown user:group file.txt

# Find SUID files (security risk)
find / -perm -4000 -type f

SSH Hardening

# /etc/ssh/sshd_config
Port 2222
PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes
MaxAuthTries 3
AllowUsers specific_user

Windows Security

Group Policy

Computer Configuration
+-- Windows Settings
|   +-- Security Settings
|   |   +-- Account Policies
|   |   +-- Local Policies
|   |   +-- Windows Defender Firewall
|   +-- Administrative Templates
+-- Software Settings

Windows Firewall

# Block inbound traffic
New-NetFirewallRule -DisplayName "Block Inbound" -Direction Inbound -Action Block

# Allow specific port
New-NetFirewallRule -DisplayName "Allow HTTPS" -Direction Inbound -Protocol TCP -LocalPort 443 -Action Allow

Service Hardening

# Disable unnecessary services
systemctl disable cups
systemctl disable bluetooth
systemctl mask --now debug-shell.socket

# List running services
systemctl list-units --type=service --state=running

# Check listening ports
ss -tuln

Audit Logging

# Enable auditd
sudo systemctl enable auditd
sudo systemctl start auditd

# Add audit rules
auditctl -w /etc/passwd -p wa -k passwd_changes
auditctl -w /etc/shadow -p wa -k shadow_changes

# Search audit logs
ausearch -k passwd_changes

Practice

Harden a Linux server by implementing security best practices.