The truth is…
I am just an idiot who Jess found
on Internet…
Slide 3
Slide 3 text
No content
Slide 4
Slide 4 text
Ubuntu CentOS Fedora
Red Hat Debian
Slide 5
Slide 5 text
Ubuntu
Debian
CentOS
Fedora
Red
Hat
Slide 6
Slide 6 text
Things that annoy developers…
• Security
• Permissions
• ACL
• Process Monitoring
• Log Management
Slide 7
Slide 7 text
USER ACCESS FIREWALL
FAIL2BAN SECURITY UPGRADES
Slide 8
Slide 8 text
USER ACCESS FIREWALL
FAIL2BAN SECURITY UPGRADES
Slide 9
Slide 9 text
$ sudo adduser viraj
Slide 10
Slide 10 text
$ sudo usermod -a -G sudo viraj
• usermod - Command to modify an existing user
• -a - Append the group
• -G sudo - Assign the group “sudo” as a secondary group
• viraj - The user to assign the group
Slide 11
Slide 11 text
$ ssh-keygen –t rsa –b 4096 –f id_peers
• -t rsa - Create an RSA type key pair.
• -b 4096 - Use 4096 bit encryption.
• -f id_peers - The name of the SSH identity files created. The two files
would be id_peers and id_peers.pub
Slide 12
Slide 12 text
Restrict Access
PermitRootLogin no
PasswordAuthentication no
/etc/ssh/sshd_config
Slide 13
Slide 13 text
MySQL Security
CREATE DATABASE my_app
DEFAULT CHARACTER SET utf8mb4
COLLATE utf8mb4_unicode_ci;
CREATE TABLE `users` (
`id` int(10) unsigned NOT NULL AUTO_INCREMENT,
`email` varchar(255) COLLATE utf8_unicode_ci NOT NULL,
PRIMARY KEY (`id`),
UNIQUE KEY `users_email_unique` (`email`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8 COLLATE=utf8_unicode_ci;
Slide 14
Slide 14 text
MySQL Security
CREATE USER 'my_user'@'%' IDENTIFIED BY 'some_secure_password';
Slide 15
Slide 15 text
MySQL Security
CREATE USER 'my_user'@'%' IDENTIFIED BY 'some_secure_password';
GRANT ALL PRIVILEGES on my_app.* TO 'my_user'@'%';
Slide 16
Slide 16 text
MySQL Security
# Hostname
CREATE USER 'my_user'@’peersconf.com' IDENTIFIED BY
'some_secure_password';
Slide 17
Slide 17 text
MySQL Security
# Hostname with wildcard
CREATE USER 'my_user'@'%.peersconf.com' IDENTIFIED BY
'some_secure_password';
Slide 18
Slide 18 text
MySQL Security
# By IP Address
CREATE USER 'my_user'@'12.124.345.67' IDENTIFIED BY
'some_secure_password';
Slide 19
Slide 19 text
MySQL Security
# Subnet 192.168.1.1 through 192.168.1.254
CREATE USER 'my_user'@'192.168.1.%' IDENTIFIED BY
'some_secure_password';
Slide 20
Slide 20 text
MySQL Security
# A read-only user
GRANT CREATE VIEW, SELECT, SHOW VIEW on my_app.* TO 'my_user'@'-
WHATEVER-';
Slide 21
Slide 21 text
MySQL Security
# A 90% use-case user
GRANT ALTER, CREATE, DELETE, DROP, INDEX, INSERT, LOCK TABLES,
SELECT, UPDATE on my_app.* TO 'my_user'@'-WHATEVER-';
Slide 22
Slide 22 text
USER ACCESS FIREWALL
FAIL2BAN SECURITY UPGRADES
Slide 23
Slide 23 text
Default Rules
sudo iptables –L -v
Slide 24
Slide 24 text
Default Rules
sudo iptables –L -v
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
Permissions – Operations
Directories Files
read
`ls` or read contents of a
directory
Read file contents
write
Rename or create a new
file/directory within a directory
or delete a directory
Edit or delete a file
execute `cd` into a directory
Execute a file – such as a bash
command
Slide 40
Slide 40 text
$ -rwxrwxr-x 1 forge forge 604 Mar 1 20:48 bower.json
$ -rwxrwxr-x 1 forge forge 604 Mar 1 20:48 bower.json
Permissions User & Group
Slide 43
Slide 43 text
$ -rwxrwxr-x 1 forge forge 604 Mar 1 20:48 bower.json
Permissions User & Group Size Last Modified
Slide 44
Slide 44 text
$ -rwxrwxr-x 1 forge forge 604 Mar 1 20:48 bower.json
Permissions User & Group Size Last Modified
The preceding “d” denotes this as a directory. Lacking a “d”
means it’s a file
Slide 45
Slide 45 text
$ rwx rwx r-x
User Group Other
Slide 46
Slide 46 text
Changing Permissions
Slide 47
Slide 47 text
$ chmod [-R] guo[+-=]rwx /some/dir
Slide 48
Slide 48 text
$ chmod [-R] guo[+-=]rwx /some/dir
-R = Change permissions recursively (if it is a directory)
Slide 49
Slide 49 text
$ chmod [-R] guo[+-=]rwx /some/dir
• u - perform operation on the user permissions
• g - perform operation on the group permissions
• o - perform operation on the other permissions
Slide 50
Slide 50 text
$ chmod [-R] guo[+-=]rwx /some/dir
• + means add permission
• - means remove permission
• = means set permission explicitly
Slide 51
Slide 51 text
$ chmod [-R] guo[+-=]rwx /some/dir
• r - add or remove read permissions
• w - add or remove write permissions
• x - add or remove execute permissions
$ sudo setfacl -R -m u:peers:rwx /some/dir
• setfacl - Set ACL
• -R - Recursive down into files and directories
• u:peers:rwx - The user peers will get rwx permissions
• /some/dir - Apply to the /some/dir directory and all the sub files/dirs
$ sudo setfacl -R -m g:www-data:rwx /some/dir
• setfacl - Set ACL
• -R - Recursive down into files and directories
• g:www-data:rwx - The group www-data will get rwx permissions
• /some/dir - Apply to the /some/dir directory and all the sub files/dirs