Security and File Systems

Mounting CIFS Shares

• The uid option in mount.cifs specifies the user that appears as the local owner of the files of a mounted CIFS share when the server does not provide ownership information.

Private Key Security

• Private keys should not be created on systems where they will be used and should never leave them.
• Private keys should have a sufficient length for the algorithm used for key generation.
• Private keys should not be uploaded to public key servers.
• Private keys should not be included in X509 certificates.
• Private keys should not be stored as plain text files without any encryption.

DNSSEC

• NSEC3 is used to prevent zone enumeration in DNSSEC.
• The purpose of a TLSA record in DANE is to sign a TLS server's public key.
• TSIG authenticates name servers in order to perform secured zone transfers by using a secret key that is shared between the servers.

SELinux

• The newrole command is used to run a new shell for a user changing the SELinux context.
• SELinux permissions are related to standard Linux permissions.

AIDE

• The /etc/aide/aide.conf file is used to configure AIDE.

Behavioral-Based HID

• Anomaly-based detection is an example of a behavioral-based HID technique.

Asymmetric Keys

• An asymmetric key is a key used for both encryption and decryption that is generated in a pair.

Apache HTTPD

• The setfattr command is used to set an extended attribute on a file in Linux.
• The SSLVerifyClient require option makes Apache HTTPD require a client certificate for authentication.
• The SSLStrictSNIVHostCheck option makes the clients connecting to the virtual host provide a client certificate that was issued by the same CA that issued the server’s certificate.

DNS Records

• The CAA record is used to publish X.509 certificate and certificate authority information in DNS.

ulimit

• The ulimit command can be used to control the maximum size of written files, the maximum number of open file descriptors, and the maximum number of user processes.

Root CA

• The certificate of a Root CA is a self-signed certificate.
• The certificate of a Root CA does not include the private key of the CA.
• The certificate of a Root CA must contain an X509v3 Authority extension.

FreeIPA

• FreeIPA includes Kerberos KDC, Public Key Infrastructure, and Directory Server components.

DNSSEC Utilities

• The dnssec-keygen command is used to generate keys for DNSSEC.

eCryptfs

• The ecryptfs-mount-private command makes the contents of the eCryptfs encrypted directory ~/Private available to the user.

HID Tools

• A Security Information and Event Management (SIEM) system is an example of a HID tool.

X509 Certificates

• An X509 certificate contains information such as the X509v3 Basic Constraints, which specifies whether the certificate belongs to a certification authority and whether it may be used to sign certificates of subordinate certification authorities.