Linux Security Foundations A Practical Guide to System Processes, Permissions, and Protection (Mike O’Leary)（Z-Library）

【One-Line Pitch】 A hands-on tour of Linux security that teaches you to think like both attacker and defender, using real commands and exercises to explain how users, permissions, processes, and mandatory access control actually work. Best for students, career-changers, and early-career professionals who already know basic Linux and want practical security skills. 【Book Arc】 - **Opening (~0%–10%)**: Orients you to the book's dual offensive/defensive approach and its exercise-driven format, then starts with Bash as the foundational tool both sides rely on. - **Early (~10%–30%)**: Builds command-line fluency—Bash arguments, builtins, variables, history, job control—and shows how attackers abuse configuration files and shell features for persistence. - **Middle (~30%–55%)**: Moves into identity and authentication: user/group management, password hashing and salting, cracking hashes with John the Ripper, and the PAM stack that governs login decisions. - **Late (~55%–85%)**: Covers processes and Systemd services, including how services are managed and how attackers use them for persistence, alongside file permissions, ACLs, and access control. - **Ending (~85%–100%)**: Introduces mandatory access control with SELinux and AppArmor—contexts, policies, booleans, logs—and closes with how software is installed and verified. 【Key Takeaways】 - **Bash is a security surface, not just a convenience** (Early): shell configuration files, history behavior, and prompt hooks can be used to maintain persistence or capture credentials, so defenders must audit them. - **Password security depends on hashing design** (Middle): salts prevent precomputed lookup tables, and deliberately slow algorithms make brute-force cracking costly—understanding this explains why /etc/shadow is structured as it is. - **Hash cracking is a practical skill, not a theoretical one** (Middle): combining /etc/passwd and /etc/shadow with tools like John the Ripper demonstrates why file permissions on shadow files matter. - **PAM is the gatekeeper for authentication** (Middle): its stacked rules and return codes determine whether a user can log in to a service, making misconfigurations a high-impact risk. - **User and group management has many moving parts** (Early–Middle): tools like useradd, adduser, groupadd, and chage interact with multiple databases, and small mistakes can lock out or expose accounts. - **Systemd services are a persistence mechanism** (Late): understanding how services are defined and started is essential for both hardening and incident response. - **Permissions go beyond the basic rwx bits** (Late): ACLs, extended attributes, SELinux contexts, and AppArmor profiles provide layered control that standard Unix permissions cannot. - **Software installation and verification is part of the security lifecycle** (Ending): knowing how packages are validated helps prevent supply-chain and tampering attacks. 【Reading Tips】 - **Do the exercises**: the book is built around hands-on practice, and the concepts stick only if you actually run the commands on a lab VM. - **Skim the Bash chapter if you're already comfortable** with shell basics, but slow down on history manipulation, PROMPT_COMMAND, and configuration-file persistence—those are the security-relevant parts. - **Treat the password-cracking chapter as a lab, not a lecture**: set up an isolated system, copy the sample files, and walk through unshadow and John the Ripper yourself. - **Use the SELinux/AppArmor material as a reference**: it is dense and distribution-specific, so plan to return to it when you actually configure a hardened system. - **Keep a notes file of commands and file paths** as you go; the book's value is in building a reusable toolkit, not in memorizing prose. 【Coverage Limits】 The excerpts cover the book's structure, Bash, users/groups, authentication, password cracking, PAM, and the beginning of SELinux/AppArmor, but do not include detailed content on process management, Systemd internals, or software verification. This guide reflects only what the excerpts show.