Ubuntu Security Components - House of Script

Ubuntu Security Architecture

Ubuntu includes multiple layers of security mechanisms built into the Linux kernel and userspace. Understanding these components is essential for hardening systems and conducting security operations.

AppArmor

Mandatory Access Control (MAC) system using path-based profiles to restrict application capabilities.

UFW

Uncomplicated Firewall - user-friendly frontend for iptables host-based firewall.

auditd

Linux Audit Framework for monitoring security-relevant events and system calls.

PAM

Pluggable Authentication Modules - flexible authentication framework.

sudo

Privilege escalation control with granular command-level permissions.

LUKS

Linux Unified Key Setup - full disk encryption for data-at-rest protection.

Security Layers

Defense in Depth Strategy

Kernel: seccomp, namespaces, cgroups, capabilities
MAC: AppArmor profiles (default in Ubuntu)
Network: UFW/iptables, nftables
Authentication: PAM, sudo, SSH keys
Auditing: auditd, syslog, journald
Encryption: LUKS, eCryptfs, GPG

AppArmor Mandatory Access Control

AppArmor is Ubuntu's default MAC system. Unlike SELinux (used by RHEL/CentOS), AppArmor uses path-based access control rather than labels.

Profile Modes

Enforce: Blocks and logs violations
Complain: Logs violations but allows (audit mode)
Disabled: Profile not loaded

AppArmor Commands

# Check AppArmor status $ sudo aa-status # List all profiles $ sudo apparmor_status # Put profile in complain mode $ sudo aa-complain /etc/apparmor.d/usr.bin.firefox # Put profile in enforce mode $ sudo aa-enforce /etc/apparmor.d/usr.bin.firefox # Reload all profiles $ sudo systemctl reload apparmor

Common Protected Applications

usr.sbin.mysqld - MySQL database
usr.sbin.named - BIND DNS server
usr.bin.firefox - Firefox browser
usr.lib.snapd.snap-confine - Snap packages

UFW (Uncomplicated Firewall)

UFW is Ubuntu's default firewall frontend, making iptables management more accessible.

UFW Commands

# Enable UFW $ sudo ufw enable # Check status with rules $ sudo ufw status verbose # Allow SSH (port 22) $ sudo ufw allow ssh # Allow specific port $ sudo ufw allow 443/tcp # Deny incoming by default $ sudo ufw default deny incoming # Allow from specific IP $ sudo ufw allow from 192.168.1.100 # Delete a rule $ sudo ufw delete allow 8080

Default Policies

Incoming: Default deny (recommended)
Outgoing: Default allow (typical)
Routed: Default deny

iptables (Advanced)

UFW is a frontend for iptables. For complex rules, direct iptables manipulation may be required.

iptables Commands

# List all rules $ sudo iptables -L -v -n # Block specific IP $ sudo iptables -A INPUT -s 10.0.0.5 -j DROP # Save rules (persist after reboot) $ sudo iptables-save > /etc/iptables/rules.v4

Linux Audit Framework (auditd)

The audit daemon monitors and logs security-relevant events including system calls, file access, and authentication.

Auditd Commands

# Install auditd $ sudo apt install auditd audispd-plugins # Check audit status $ sudo auditctl -s # List active rules $ sudo auditctl -l # Watch a file for changes $ sudo auditctl -w /etc/passwd -p wa -k passwd_changes # Watch a directory $ sudo auditctl -w /etc/ssh/ -p wa -k ssh_config # Search audit logs $ sudo ausearch -k passwd_changes # Generate report $ sudo aureport --summary

Common Audit Rules

Security-Relevant Events to Monitor

/etc/passwd, /etc/shadow - User account changes
/etc/sudoers - Privilege escalation configuration
/etc/ssh/sshd_config - SSH configuration changes
/var/log/auth.log - Authentication events
Executable changes in /usr/bin, /usr/sbin

journalctl (systemd Logging)

Modern Ubuntu uses journald for centralized logging alongside traditional syslog.

journalctl Commands

# View all logs $ journalctl # Follow logs in real-time $ journalctl -f # Filter by service $ journalctl -u ssh # Filter by priority (0=emerg to 7=debug) $ journalctl -p err # Logs since boot $ journalctl -b # Authentication logs $ journalctl _COMM=sudo

Knowledge Check

1. Which MAC system is enabled by default in Ubuntu?

SELinux

AppArmor

grsecurity

TOMOYO

2. What command enables the UFW firewall?

ufw start

systemctl start ufw

sudo ufw enable

iptables --enable

3. Which tool monitors security-relevant system calls on Linux?

auditd

syslogd

logrotate

rsyslog

4. What does `aa-complain` do to an AppArmor profile?

Disables the profile entirely

Logs violations but allows them

Strictly enforces the profile

Deletes the profile

5. Which command searches the audit log for a specific key?

auditctl -l

aureport -k

grep audit.log

ausearch -k

Results

0%