Linux Security Foundations A Practical Guide to System Processes, Permissions, and Protection (Mike O’Leary)（Z-Library）
Linux
Whether you're a student stepping into the world of cybersecurity or a self-taught learner eager to build real-world skills, this book is your gateway to understanding and mastering Linux from both offensive and defensive perspectives. Designed for readers with a basic familiarity with Linux, it dives deep into the practical techniques that form the backbone of system security. Through more than 100 hands-on exercises, you'll explore how attackers exploit Linux systems―and how defenders can harden them. Learn to navigate Bash with precision, manage users and authentication, crack password hashes, and uncover hidden processes. You'll gain insight into Systemd’s role in service management and persistence, and develop the skills to configure powerful security frameworks like SELinux and AppArmor. This book doesn’t just teach theory―it builds capability. You’ll learn how Linux handles file permissions and access control, how software is installed and verified, and how to think like both an attacker and a defender. Each chapter is packed with actionable knowledge that prepares you for real-world scenarios and professional challenges. What You’ll Learn: • Create and manage users and authentication systems • Crack password hashes and understand PAM • Control processes and Systemd services • Configure file permissions, ACLs, SELinux, and AppArmor • Build a strong foundation in Linux security through practical exercises Who This Book Is For: Ideal for students in computer science, early-career professionals, and career changers aiming to break into cybersecurity. Whether used as a textbook or a self-study guide, this book equips readers with the hands-on experience needed to thrive in the field.
7
Views
Registered users can read the full content for free
Register as a Gaohf Library member to read the complete e-book online for free and enjoy a better reading experience.
Page
1
Linux Security Foundations A Practical Guide to System Processes, Permissions, and Protection — Mike O’Leary
Page
2
Linux Security Foundations A Practical Guide to System Processes, Permissions, and Protection Mike O’Leary
Page
3
Linux Security Foundations: A Practical Guide to System Processes, Permissions, and Protection ISBN-13 (pbk): 979-8-8688-2663-4 ISBN-13 (electronic): 979-8-8688-2664-1 https://doi.org/10.1007/979-8-8688-2664-1 Copyright © 2026 by Mike O'Leary This work is subject to copyright. All rights are reserved by the Publisher, whether the whole or part of the material is concerned, specifically the rights of translation, reprinting, reuse of illustrations, recitation, broadcasting, reproduction on microfilms or in any other physical way, and transmission or information storage and retrieval, electronic adaptation, computer software, or by similar or dissimilar methodology now known or hereafter developed. Trademarked names, logos, and images may appear in this book. Rather than use a trademark symbol with every occurrence of a trademarked name, logo, or image we use the names, logos, and images only in an editorial fashion and to the benefit of the trademark owner, with no intention of infringement of the trademark. The use in this publication of trade names, trademarks, service marks, and similar terms, even if they are not identified as such, is not to be taken as an expression of opinion as to whether or not they are subject to proprietary rights. While the advice and information in this book are believed to be true and accurate at the date of publication, neither the authors nor the editors nor the publisher can accept any legal responsibility for any errors or omissions that may be made. The publisher makes no warranty, express or implied, with respect to the material contained herein. Managing Director, Apress Media LLC: Welmoed Spahr Acquisitions Editor: Susan McDermott Project Manager: Jessica Vakili Cover image from Pixabay.com Distributed to the book trade worldwide by Springer Science+Business Media New York, 1 New York Plaza, New York, NY 10004. Phone 1-800-SPRINGER, fax (201) 348-4505, e-mail orders-ny@springer-sbm.com, or visit www.springeronline.com. Apress Media, LLC is a Delaware LLC and the sole member (owner) is Springer Science + Business Media Finance Inc (SSBM Finance Inc). SSBM Finance Inc is a Delaware corporation. For information on translations, please e-mail booktranslations@springernature.com; for reprint, paperback, or audio rights, please e-mail bookpermissions@springernature.com. Apress titles may be purchased in bulk for academic, corporate, or promotional use. eBook versions and licenses are also available for most titles. For more information, reference our Print and eBook Bulk Sales web page at http://www.apress.com/bulk-sales. Any source code or other supplementary material referenced by the author in this book is available to readers on GitHub. For more detailed information, please visit https://www.apress. com/gp/services/source-code. If disposing of this product, please recycle the paper Mike O’Leary Department of Mathematics Towson University Towson, MD, USA
Page
4
Dedicated to all the security professionals who volunteer their time to work with students.
Page
5
v Table of Contents About the Author xi About the Technical Reviewer xiii Acknowledgments xv Introduction xvii Chapter 1: Bash 1 1.1. Command-Line Foundations ..........................................................................1 1.1.1. Terminals and Pseudoterminals ............................................................2 1.1.2. Shells .....................................................................................................5 1.2. Bash Foundations ..........................................................................................8 1.2.1. Bash Arguments ....................................................................................8 1.2.2. Bash Restricted Shells ..........................................................................9 1.2.3. Bash Login Shells ................................................................................11 1.2.4. Starting and Stopping Bash .................................................................11 1.2.5. Bash Commands and Builtins ..............................................................14 1.2.6. Using Bash Remotely ...........................................................................17 1.3. Bash Variables, Shell Options, and Environment Variables ..........................34 1.3.1. Bash Shell Options ..............................................................................34 1.3.2. Bash Variables .....................................................................................38 1.3.3. Environment Variables .........................................................................42 1.4. Bash History .................................................................................................53 1.4.1. Using Bash History ..............................................................................57 1.4.2. Attackers and the History ....................................................................57
Page
6
vi 1.5. Bash Aliases .................................................................................................60 1.6. Job Control ...................................................................................................62 1.7. Key Takeaways .............................................................................................66 Chapter 2: Users and Groups 67 2.1. Fundamentals ..............................................................................................67 2.1.1. The /etc/passwd File ...........................................................................70 2.1.2. The /etc/shadow File ...........................................................................72 2.1.3. The /etc/group and /etc/gshadow Files ...............................................76 2.1.4. User and Group Backup Files ..............................................................78 2.2. Creating and Removing Linux Users and Groups .........................................81 2.2.1. The useradd Command ........................................................................82 2.2.2. The adduser Command ........................................................................86 2.2.3. Removing Users ...................................................................................88 2.2.4. Automating User Creation ....................................................................92 2.2.5. Creating and Deleting Groups ..............................................................98 2.3. Managing Users and Groups ......................................................................100 2.3.1. Adding Secondary Groups for a User .................................................100 2.3.2. Locking and Unlocking a User Account .............................................103 2.3.3. Managing Account and Password Expiration ....................................106 2.3.4. Managing GECOS Data ......................................................................109 2.3.5. Managing Groups ..............................................................................110 2.4. Key Takeaways ...........................................................................................112 Chapter 3: User Authentication and Passwords 113 3.1. Password Hashes .......................................................................................113 3.1.1. Manually Adding a User by Editing /etc/passwd and /etc/shadow ...118 3.1.2. Cracking Linux Password Hashes with John the Ripper ...................121 Table of ConTenTs
Page
7
vii 3.2. Pluggable Authentication Modules .............................................................137 3.2.1. Important PAM Modules ....................................................................141 3.2.2. Example: PAM Modules for sshd on Rocky Linux 9.0 ........................ 151 3.2.3. Modifying the PAM Configuration ......................................................155 3.3. Key Takeaways ...........................................................................................171 Chapter 4: Elevated Privileges and User Activity Logs 173 4.1. Working As a Different User .......................................................................174 4.1.1. The sudo Command ...........................................................................174 4.1.2. The su Command ...............................................................................192 4.1.3. The runuser Command ......................................................................193 4.1.4. Polkit .................................................................................................194 4.2. Determining the Users Logged into the System ........................................204 4.2.1. The utmp, wtmp, and btmp Files .......................................................204 4.2.2. The lastlog Command ........................................................................211 4.2.3. systemd Data .....................................................................................216 4.3. Key Takeaways ...........................................................................................220 Chapter 5: Processes and systemd 223 5.1. Listing the Processes Running on a System ..............................................224 5.1.1. The ps Command ...............................................................................224 5.1.2. The pidof Command...........................................................................232 5.1.3. The pgrep Command .........................................................................233 5.1.4. The pstree Command ........................................................................234 5.1.5. The top Command .............................................................................237 5.2. Signals and Process Management .............................................................241 5.3. The /proc Directory ....................................................................................244 5.3.1. Process Information in /proc .............................................................244 5.3.2. Tainted Kernels ..................................................................................251 Table of ConTenTs
Page
8
viii 5.4. Hiding Process Names and Arguments ......................................................252 5.5. systemd .....................................................................................................255 5.5.1. Configuring a systemd Unit File .........................................................256 5.5.2. Components of a systemd Configuration File ....................................259 5.5.3. Managing systemd Services .............................................................266 5.5.4. Managing systemd Units ...................................................................273 5.5.5. Editing a systemd Unit Configuration File..........................................274 5.5.6. Targets ...............................................................................................279 5.5.7. Managing Remote Systems ...............................................................281 5.5.8. Creating a Custom Unit. Example: socat ............................................282 5.5.9. systemd Interaction with SysV Init and Upstart .................................285 5.5.10. The systemd-logind.service ............................................................287 5.5.11. Creating Per-User systemd Services ...............................................291 5.6. Key Takeaways ...........................................................................................298 Chapter 6: Files 299 6.1. The File System ..........................................................................................299 6.1.1. Block Devices ....................................................................................300 6.1.2. Inodes ................................................................................................312 6.1.3. Hard Links .........................................................................................316 6.1.4. Symbolic Links ..................................................................................320 6.1.5. Deleting Files .....................................................................................322 6.2. Linux Directory Structure ...........................................................................324 6.3. File Permissions and Properties ................................................................328 6.3.1. Basic Permissions on Files ................................................................329 6.3.2. Changing File Permissions and Ownership .......................................331 6.3.3. Umask ...............................................................................................332 6.3.4. Basic Permissions on Directories ......................................................333 Table of ConTenTs
Page
9
ix 6.3.5. Advanced Permissions on Files and Directories ................................336 6.3.6. Extended File Permissions ................................................................343 6.3.7. Access Control Lists ..........................................................................345 6.3.8. File Timestamps ................................................................................350 6.4. Using lsof to View Open Files .....................................................................354 6.5. Mounting File Systems...............................................................................362 6.5.1. Mounting an Optical Disc ..................................................................362 6.5.2. Mounting an .iso Image File ..............................................................365 6.5.3. System Recovery ...............................................................................366 6.6. Key Takeaways ...........................................................................................370 Chapter 7: SELinux and AppArmor 373 7.1. SELinux Fundamentals ...............................................................................373 7.2. SELinux Contexts .......................................................................................376 7.2.1. SELinux User .....................................................................................376 7.2.2. SELinux Role ......................................................................................378 7.2.3. SELinux Type ......................................................................................379 7.2.4. SELinux Level ....................................................................................380 7.3. Managing the SELinux Context of Objects .................................................381 7.3.1. SELinux Context of a User .................................................................382 7.3.2. SELinux Context of a File ...................................................................384 7.3.3. SELinux Context of a Process ............................................................392 7.3.4. SELinux Context of a Network Port ....................................................393 7.4. SELinux Classes .........................................................................................401 7.5. SELinux Rules and Policies ........................................................................402 7.6. SELinux Booleans .......................................................................................404 7.7. SELinux Logs ..............................................................................................406 7.8. AppArmor ...................................................................................................410 Table of ConTenTs
Page
10
x 7.9. AppArmor Profiles ......................................................................................413 7.10. Structure of an AppArmor Profile File ......................................................417 7.11. AppArmor Properties of Running Processes ............................................421 7.12. Adding Custom AppArmor Profiles ...........................................................424 7.13. Key Takeaways .........................................................................................426 Chapter 8: Software Management 429 8.1. The apt Command for Mint and Ubuntu .....................................................429 8.1.1. Adding a New apt Repository ............................................................434 8.2. Snap Packages ..........................................................................................438 8.3. The dnf and yum Commands .....................................................................445 8.3.1. Adding a New dnf Repository ............................................................450 8.4. Flatpak .......................................................................................................454 8.5. The zypper Command ................................................................................458 8.6. Validating Software ....................................................................................460 8.7. Key Takeaways ...........................................................................................463 Index 465 Table of ConTenTs
Page
11
xi About the Author Mike O’Leary is a professor at Towson University and was the founding director of the School of Emerging Technologies. He developed and teaches hands-on capstone courses in computer security for both undergraduate and graduate students. He coached the Towson University Cyber Defense team to the finals of the National Collegiate Cyber Defense Competition in 2010, 2012, and 2014.
Page
12
xiii About the Technical Reviewer Jarrett Booz is a cybersecurity engineer specializing in secure cloud architecture, infrastructure automation, and applied cybersecurity training. His work focuses on designing resilient cloud environments, implementing infrastructure-as-code and continuous delivery practices, and developing interactive cybersecurity exercises that support workforce development and skills advancement. He has also served as an adjunct instructor, teaching hands-on courses in computer science and host-based forensics at both the undergraduate and graduate levels. Jarrett holds a master’s degree in Information Security from Carnegie Mellon University’s Information Networking Institute and a bachelor’s degree in Computer Science from Towson University.
Page
13
xv Acknowledgments I would like to gratefully acknowledge the help I have received from my students over the years, especially the many that continue to share their knowledge and experience after graduation to help newer students and the community at large. I would especially like to recognize and thank Adedoyin Adegbuyi, Eniola Adenle, Ezekiel Aina, Timi Awani, Tyrique Baker, Ethan Blanton, Connor Braude, Josh Browning, Brian Chen, Hudson Cho, Alexander Cochrane, Tre’Shaun Cottman, Austin Daniels, Zachary Eldridge, John Feser, James Garrison, Ricky Gonce, Garrett Hurley, Kordell Hutchins, (Tobe) Ikechukwu Igboemeka, Josh Jankiewicz, Michael Jarvis, James Knuth, Andrew Lincsott, Sean McGuire, Kayla McVey, Simon Murray, Erik Nilson, Alex Parker, Kaden Pirmohamed, RJ Pisciotta, Josh Robertson, Blake Rodgers, Nathan Russell, Christian Sauls, Mario Scotto, Noah Sheinhorn, Sarah Skordas, Jackson Stockstill, Matt Sternhagen, Zakiya Talley, Ryan Tiffany, Kenny Vu, Zach Wagenman, Gabriel Wheat, Alex Wood, Will Young, and Brady Ziegler. I also thank Blair Taylor, Siddarth Kaza, and the Towson University Center for Interdisciplinary & Innovative Cybersecurity for their support as this book was being developed and written. I also thank the members of the Apress team, especially Susan McDermott, who have been wonderful colleagues in this journey.
Page
14
xvii Introduction “I want to learn more about cybersecurity, but don’t know where to start.” Early career professionals often need help to bridge the gap between academic and theoretical knowledge on one hand and practical, hands-on, actionable skills needed when sitting at the keyboard. The purpose of this book is to lend a helping hand to readers learning cyber operations and developing practical security problem-solving skills. This is the result of 20 years of experience teaching hands-on cybersecurity courses to undergraduate and graduate students, many of whom have provided inspiration and feedback. This book provides a hands-on look at the security features and components of Linux. Readers should be familiar with Linux at a practical operational user level.1 The book assumes that the reader understands the basics of computer networking, including IP, TCP, and UDP. Readers are assumed to be competent programmers in a variety of languages; this is especially important for the discussion and analysis of malware. I have found that American university computer science students in their third or fourth years well understand most of the required background. Readers should have access to Linux systems for testing, experimentation, and to complete the various exercises. One way to build a testing laboratory is with virtualization. This allows users to emulate one 1 Readers that want to review Linux basics may find William Shotts, The Linux Command Line, 2nd edition, No Starch Press, 2019, to be a great starting place. Another good choice is Occupytheweb, Linux Basics for Hackers, No Starch Press, 2019.
Page
15
xviii or more complete systems, called guests, inside another, called the host. Common tools for virtualization are VMWare Workstation, VirtualBox, and Proxmox.2 Windows also supports the Windows Subsystem for Linux, which allows users to create and run Linux systems directly on Windows as applications.3 There are many Linux distributions that are deployed in significant numbers. Rocky Linux is a freely available version of Red Hat Enterprise Linux; it was created in response to the decision of Red Hat (now owned by IBM) to discontinue the development of CentOS, which had been an open source clone of Red Hat Enterprise.4 Current versions of Rocky Linux are available for download from https://rockylinux.org/download, and they make available an archive of older versions at https://dl.rockylinux.org/ vault/rocky/. Ubuntu Linux is developed by Canonical and based on the Debian distribution. It releases versions twice per year, in April and October; the April release in even-numbered years is a long-term release with extended support.5 Ubuntu releases include a desktop version and a server version. Current versions of Ubuntu are available for download at https://ubuntu. com/download/desktop and https://ubuntu.com/download/server. Older versions of Ubuntu are available for download from https://old- releases.ubuntu.com/releases/. Mint is based on Ubuntu with different software choices, including a different desktop. Mint does not use Canonical’s Snap Store, which 2 See https://www.vmware.com/products/desktop-hypervisor/workstation- and- fusion, https://www.virtualbox.org/wiki/Downloads, or https://www. proxmox.com/en/downloads. 3 https://learn.microsoft.com/en-us/windows/wsl/install 4 See https://rockylinux.org/about and https://blog.centos.org/2020/12/ future-is-centos-stream/. 5 https://ubuntu.com/about/release-cycle InTroduCTIon
Page
16
xix has been criticized for a lack of commitment to open source principles.6 The current version of Mint is available for download at https://www. linuxmint.com/download.php. Older but currently supported releases are available from https://www.linuxmint.com/download_all.php. Some of the unsupported releases may still be found on one or more of the Mint mirrors at https://www.linuxmint.com/mirrors.php. OpenSUSE is developed by the OpenSUSE project. Two different versions are made available; Tumbleweed is the rolling release, and Leap is the regular release version. Both can be downloaded from https://get. opensuse.org/. Older versions of Tumbleweed are available at https:// download.opensuse.org/tumbleweed/, while older versions of Leap are available from https://download.opensuse.org/distribution/leap/. Kali is a specialized penetration testing distribution that makes an excellent platform to learn more about offense. Like Ubuntu, it is based on the Debian distribution. Kali is available for download in several formats, including installation media and prebuilt virtual machines. They can be downloaded from https://www.kali.org/get-kali/. This book begins with an introduction to Bash – how it starts, how it is configured, how it can be used by attackers, and how Bash commands can be recorded and logged for defenders. It continues with the fundamentals of local Linux users and groups, with explanations of how users are added, removed, and managed. Password authentication and pluggable authentication modules (PAM) are described; the reader learns how password hashes are created, stored, and cracked with John the Ripper. The reader learns how to find the properties of processes running on the system and how attackers might hide their process names. The methods systemd uses to launch services are examined, and the reader learns how an attacker might create malicious systemd units for persistence. 6 See https://linuxmint-user-guide.readthedocs.io/en/latest/snap.html. InTroduCTIon
Page
17
xx The reader examines the file system, including how to set and manage basic, advanced, and extended file permissions, as well as Linux access control lists. SELinux and AppArmor are important defensive tools for a Linux administrator, and the reader learns how they work and how they can be configured. The text concludes with how software is installed and validated. The text includes more than 200 hands-on exercises at various levels of difficulty that can be used by an instructor using the book as a textbook or by a motivated reader who wants to practice the topics covered in the text. Formatting The text contains code snippets; these are formatted like the following: az-steel\zathras@GLENDALE C:\Users\zathras>systeminfo Host Name: GLENDALE OS Name: Microsoft Windows Server 2019 Standard OS Version: 10.0.17763 N/A Build 17763 OS Manufacturer: Microsoft Corporation OS Configuration: Primary Domain Controller OS Build Type: Multiprocessor Free Registered Owner: Windows User … Output Deleted … Portions written in bold are meant to be entered by the user on their own system. Most output is presented exactly as it appears; deleted material is noted. In some instances, the output of a command or tool is updated to make the result more readable on a printed page with its fixed width. InTroduCTIon
Page
18
xxi Contacting the Author If you find the book helpful, I would love to hear from you, especially if you are a student or faculty member participating in a Collegiate Cyber Defense exercise. If you are a faculty member using this book in a course, I have prepared a Hints and Solutions document that I use in my course, which I would be happy to share. I can be reached on Mastodon at @ MikeOlearyTU@infosec.exchange and https://infosec.exchange/@ MikeOlearyTU. InTroduCTIon
Page
19
1© Mike O’Leary 2026 M. O’Leary, Linux Security Foundations, https://doi.org/10.1007/979-8-8688-2664-1_1 CHAPTER 1 Bash The Linux shell is often the preferred method for a user to manage and configure a Linux system. These are descended from older physical terminals connected to a mainframe. There are several shells available on Linux; one of the most common shells is Bash. Bash accepts several arguments when it is started and can be used to create restricted shells. Users interact with Bash via commands and builtins which behave differently. Bash makes extensive use of shell options, Bash variables, and environment variables. Bash can be configured to record the history of the commands it runs and can also use aliases. These features are commonly used by both defenders managing the system and by attackers. 1.1. Command-Line Foundations Users issue commands to their Linux systems through a command line. A user might be using a graphical interface (like GNOME) or interacting with a web server; however, even in these cases, the user is either issuing commands to Linux or providing input to a program that was started with a Linux command.1 1 For more about the GNOME desktop, see https://www.gnome.org/.
Page
20
2 The most direct way a user can issue commands to their Linux system is through a command line, so this is our starting point for the investigation of the security of Linux systems. 1.1.1. Terminals and Pseudoterminals Users can issue Linux commands through a terminal. Historically, the first terminals were physical teletype devices. Today in Linux, terminals are handled by emulation in the kernel. One kind of terminal is represented in Linux as a TTY, where the acronym TTY comes from the historical word teletypewriter. A user at the physical keyboard of a Linux system that is not using a graphical environment like Gnome or KDE is generally using a TTY. These are represented in Linux as devices with names like /dev/tty1, /dev/tty2, and so on.2 A user on a Linux system can determine the name and the type of the terminal that they are using with the command tty as follows:3 zathras@Ubuntu1804:~$ tty /dev/tty3 Another kind of terminal is called a pseudoterminal.4 These are used by programs like XTerm, Konsole, and GNOME Terminal in graphical 2 For more about the /dev/tty devices, see https://man7.org/linux/man- pages/man4/tty.4.html. For a more complete introduction to terminals and pseudoterminals, see Chapter 62 in Michael Kerrisk, The Linux Programming Interface, No Starch Press, 2010. See also W. Richard Stevens and Stephen Rao, Advanced Programming in the UNIX Environment, 3rd edition, Pearson Education, 2010. 3 For more about the tty command, see https://man7.org/linux/man-pages/ man1/tty.1.html. 4 See Chapter 64 in Michael Kerrisk, The Linux Programming Interface, No Starch Press, 2010. Chapter 1 Bash
The above is a preview of the first 20 pages. Register to read the complete e-book.
AI Reading Assistant
Whole-book reading guide from stratified index samples; jump to passages in the text
AI guide
【One-Line Pitch】
A hands-on tour of Linux security that teaches you to think like both attacker and defender, using real commands and exercises to explain how users, permissions, processes, and mandatory access control actually work. Best for students, career-changers, and early-career professionals who already know basic Linux and want practical security skills.
【Book Arc】
- **Opening (~0%–10%)**: Orients you to the book's dual offensive/defensive approach and its exercise-driven format, then starts with Bash as the foundational tool both sides rely on.
- **Early (~10%–30%)**: Builds command-line fluency—Bash arguments, builtins, variables, history, job control—and shows how attackers abuse configuration files and shell features for persistence.
- **Middle (~30%–55%)**: Moves into identity and authentication: user/group management, password hashing and salting, cracking hashes with John the Ripper, and the PAM stack that governs login decisions.
- **Late (~55%–85%)**: Covers processes and Systemd services, including how services are managed and how attackers use them for persistence, alongside file permissions, ACLs, and access control.
- **Ending (~85%–100%)**: Introduces mandatory access control with SELinux and AppArmor—contexts, policies, booleans, logs—and closes with how software is installed and verified.
【Key Takeaways】
- **Bash is a security surface, not just a convenience** (Early): shell configuration files, history behavior, and prompt hooks can be used to maintain persistence or capture credentials, so defenders must audit them.
- **Password security depends on hashing design** (Middle): salts prevent precomputed lookup tables, and deliberately slow algorithms make brute-force cracking costly—understanding this explains why /etc/shadow is structured as it is.
- **Hash cracking is a practical skill, not a theoretical one** (Middle): combining /etc/passwd and /etc/shadow with tools like John the Ripper demonstrates why file permissions on shadow files matter.
- **PAM is the gatekeeper for authentication** (Middle): its stacked rules and return codes determine whether a user can log in to a service, making misconfigurations a high-impact risk.
- **User and group management has many moving parts** (Early–Middle): tools like useradd, adduser, groupadd, and chage interact with multiple databases, and small mistakes can lock out or expose accounts.
- **Systemd services are a persistence mechanism** (Late): understanding how services are defined and started is essential for both hardening and incident response.
- **Permissions go beyond the basic rwx bits** (Late): ACLs, extended attributes, SELinux contexts, and AppArmor profiles provide layered control that standard Unix permissions cannot.
- **Software installation and verification is part of the security lifecycle** (Ending): knowing how packages are validated helps prevent supply-chain and tampering attacks.
【Reading Tips】
- **Do the exercises**: the book is built around hands-on practice, and the concepts stick only if you actually run the commands on a lab VM.
- **Skim the Bash chapter if you're already comfortable** with shell basics, but slow down on history manipulation, PROMPT_COMMAND, and configuration-file persistence—those are the security-relevant parts.
- **Treat the password-cracking chapter as a lab, not a lecture**: set up an isolated system, copy the sample files, and walk through unshadow and John the Ripper yourself.
- **Use the SELinux/AppArmor material as a reference**: it is dense and distribution-specific, so plan to return to it when you actually configure a hardened system.
- **Keep a notes file of commands and file paths** as you go; the book's value is in building a reusable toolkit, not in memorizing prose.
【Coverage Limits】
The excerpts cover the book's structure, Bash, users/groups, authentication, password cracking, PAM, and the beginning of SELinux/AppArmor, but do not include detailed content on process management, Systemd internals, or software verification. This guide reflects only what the excerpts show.
Passage locations
Excerpt 1
uide to System Processes, Permissions, and Protection — Mike O’Leary Table of ConTenTs 6.3.5. Advanced Permissions on Files and Directories ....................
View in text
Excerpt 2
ate the method. What limitations, if any, does it possess? 1-21. suppose an attacker has root access on an OpensUse system and wants to use a Bash configurat...
View in text
Excerpt 3
version 1 (SYSV), dynamically linked, interpreter /lib64/ ld-linux- x86-64.so.2, BuildID[sha1]=c6ec648712b8e61735d4b1a 3b03632704420aa3b, for GNU/Linux 3.2.0...
View in text
Excerpt 4
ed @5, character count 9 0:00:43:34 - Switching to length 7 0:00:43:34 - Expanding tables for length 7 to character count 6 0:00:43:34 - Trying length 7, fix...
View in text
Recommended for You
{{#thumbnailUrl}}
{{/thumbnailUrl}}
{{^thumbnailUrl}}
{{/thumbnailUrl}}
Loading recommended books...
Failed to load, please try again later
Tip the Site
Scan the WeChat Pay or Alipay code to tip. No login required.
WeChat Pay
Alipay