Section 2: Linux as a Network Node and Troubleshooting Platform
by Rob VandenBrink
Linux for Networking Professionals
- Linux for Networking Professionals
- Contributors
- About the author
- About the reviewer
- Preface
- Section 1: Linux Basics
- Chapter 1: Welcome to the Linux Family
- Why Linux is a good fit for a networking team
- Why is Linux important?
- The history of Linux
- Mainstream data center Linux
- Red Hat
- Oracle/Scientific Linux
- SUSE
- Ubuntu
- BSD/FreeBSD/OpenBSD
- Specialty Linux distributions
- Open source firewalls
- Kali Linux
- SIFT
- Security Onion
- Virtualization
- Linux and cloud computing
- Picking a Linux distribution for your organization
- Summary
- Further reading
- Chapter 2: Basic Linux Network Configuration and Operations – Working with Local Interfaces
- Technical requirements
- Working with your network settings – two sets of commands
- Displaying interface IP information
- Displaying routing information
- IPv4 addresses and subnet masks
- Special-purpose addresses
- Private addresses – RFC 1918
- Assigning an IP address to an interface
- Adding a route
- Adding a route using legacy approaches
- Disabling and enabling an interface
- Setting the MTU on an interface
- More on the nmcli command
- Summary
- Questions
- Further reading
- Section 2: Linux as a Network Node and Troubleshooting Platform
- Chapter 3: Using Linux and Linux Tools for Network Diagnostics
- Technical requirements
- Network basics – the OSI model
- Layer 2 – relating IP and MAC addresses using ARP
- MAC address OUI values
- Layer 4 – how TCP and UDP ports work
- Layer 4 – TCP and the three-way handshake
- Local port enumeration – what am I connected to? What am I listening for?
- Remote port enumeration using native tools
- Remote port and service enumeration – nmap
- NMAP scripts
- Are there limits to Nmap?
- Wireless diagnostic operations
- Summary
- Questions
- Further reading
- Chapter 4: The Linux Firewall
- Chapter 5: Linux Security Standards with Real-Life Examples
- Technical requirements
- Why do I need to secure my Linux hosts?
- Cloud-specific security considerations
- Commonly encountered industry-specific security standards
- The Center for Internet Security critical controls
- Getting a start on CIS critical security controls 1 and 2
- OSQuery – critical controls 1 and 2, adding in controls 10 and 17
- The Center for Internet Security benchmarks
- Applying a CIS benchmark – securing SSH on Linux
- SELinux and AppArmor
- Summary
- Questions
- Further reading
- Section 3: Linux Network Services
- Chapter 6: DNS Services on Linux
- Technical requirements
- What is DNS?
- Two main DNS server implementations
- An organization's "internal" DNS server (and a DNS overview)
- An internet-facing DNS server
- Common DNS implementations
- Basic installation: BIND for internal use
- BIND: Internet-facing implementation specifics
- DNS troubleshooting and reconnaissance
- DoH
- DoT
- knot-dnsutils
- Implementing DoT in Nmap
- DNSSEC
- Summary
- Questions
- Further reading
- Chapter 7: DHCP Services on Linux
- How does DHCP work?
- Basic DHCP operation
- DHCP requests from other subnets (forwarders, relays, or helpers)
- DHCP options
- Securing your DHCP services
- Rogue DHCP server
- Rogue DHCP client
- Installing and configuring a DHCP server
- Basic configuration
- Static reservations
- Simple DHCP logging and troubleshooting in everyday use
- Summary
- Questions
- Further reading
- Chapter 8: Certificate Services on Linux
- Technical requirements
- What are certificates?
- Acquiring a certificate
- Using a certificate – web server example
- Building a private Certificate Authority
- Building a CA with OpenSSL
- Requesting and signing a CSR
- Securing your Certificate Authority infrastructure
- Legacy tried-and-true advice
- Modern advice
- CA-specific risks in modern infrastructures
- Certificate Transparency
- Using CT for inventory or reconnaissance
- Certificate automation and the ACME protocol
- OpenSSL cheat sheet
- Summary
- Questions
- Further reading
- Chapter 9: RADIUS Services for Linux
- Technical requirements
- RADIUS basics – what is RADIUS and how does it work?
- Implementing RADIUS with local Linux authentication
- RADIUS with LDAP/LDAPS backend authentication
- NTLM authentication (AD) – introducing CHAP
- Unlang – the unlanguage
- RADIUS use-case scenarios
- VPN authentication using user ID and password
- Administrative access to network devices
- RADIUS configuration for EAP-TLS authentication
- Wireless network authentication using 802.1x/EAP-TLS
- Wired network authentication using 802.1x/EAP-TLS
- Using Google Authenticator for MFA with RADIUS
- Summary
- Questions
- Further reading
- Chapter 10: Load Balancer Services for Linux
- Technical requirements
- Introduction to load balancing
- Round Robin DNS (RRDNS)
- Inbound proxy – Layer 7 load balancing
- Inbound NAT – Layer 4 load balancing
- DSR load balancing
- Load balancing algorithms
- Server and service health checks
- Datacenter load balancer design considerations
- Datacenter network and management considerations
- Building a HAProxy NAT/proxy load balancer
- Before you start configuring – NICs, addressing, and routing
- Before you start configuring – performance tuning
- Load balancing TCP services – web services
- Setting up persistent (sticky) connections
- Implementation note
- HTTPS frontending
- A final note on load balancer security
- Summary
- Questions
- Further reading
- Chapter 11: Packet Capture and Analysis in Linux
- Technical requirements
- Introduction to packet capturing – the right places to look
- Capturing from either end
- Switching the monitoring port
- Intermediate in-line host
- Network tap
- Malicious packet capture approaches
- Performance considerations when capturing
- Capturing tools
- tcpdump
- Wireshark
- TShark
- Other PCAP tools
- Filtering captured traffic
- Wireshark capture filters (capturing your home network traffic)
- tcpdump capture filters – VoIP phones and DHCP
- More capture filters – LLDP and CDP
- Collecting files from a packet capture
- Troubleshooting an application – capturing a VoIP telephone call
- Wireshark display filters – separating specific data in a capture
- Summary
- Questions
- Further reading
- Chapter 12: Network Monitoring Using Linux
- Technical requirements
- Logging using Syslog
- Log size, rotation, and databases
- Log analysis – finding "the thing"
- Alerts on specific events
- Syslog server example – Syslog
- The Dshield project
- Network device management using SNMP
- SNMP NMS deployment example – LibreNMS
- SNMPv3
- Collecting NetFlow data on Linux
- What is NetFlow and its "cousins" SFLOW, J-Flow, and IPFIX?
- Flow collection implementation concepts
- Configuring a router or switch for flow collection
- An example NetFlow server using NFDump and NFSen
- Summary
- Questions
- Further reading
- Commonly used SNMP OIDs
- Chapter 13: Intrusion Prevention Systems on Linux
- Technical requirements
- What is an IPS?
- Architecture options – where does an IPS fit in your data center?
- IPS evasion techniques
- Detecting a WAF
- Fragmentation and other IPS evasion methods
- Classic/network-based IPS solutions – Snort and Suricata
- Suricata IPS example
- Constructing an IPS rule
- Passive traffic monitoring
- Passive monitoring with P0F – example
- Zeek example – collecting network metadata
- Summary
- Questions
- Further reading
- Chapter 14: Honeypot Services on Linux
- Technical requirements
- Honeypot overview – what is a honeypot, and why do I want one?
- Deployment scenarios and architecture – where do I put a honeypot?
- Risks of deploying honeypots
- Example honeypots
- Basic port alerting honeypots – iptables, netcat, and portspoof
- Other common honeypots
- Distributed/community honeypot – the Internet Storm Center's DShield Honeypot Project
- Summary
- Questions
- Further reading
- Assessments
- Chapter 2 – Basic Linux Network Configuration and Operations – Working with Local Interfaces
- Chapter 3 – Using Linux and Linux Tools for Network Diagnostics
- Chapter 4 – The Linux Firewall
- Chapter 5 – Linux Security Standards with Real-Life Examples
- Chapter 6 – DNS Services on Linux
- Chapter 7 – DHCP Services on Linux
- Chapter 8 – Certificate Services on Linux
- Chapter 9 – RADIUS Services for Linux
- Chapter 10 – Load Balancer Services for Linux
- Chapter 11 – Packet Capture and Analysis in Linux
- Chapter 12 – Network Monitoring Using Linux
- Chapter 13 – Intrusion Prevention Systems on Linux
- Chapter 14 – Honeypot Services on Linux
- Why subscribe?
- Other Books You May Enjoy
Section 2: Linux as a Network Node and Troubleshooting Platform
In this section, we'll continue to build our Linux host, adding tools for network diagnostics and troubleshooting. We'll add the Linux firewall to the mix, starting to secure our host. Finally, we'll discuss rolling out Linux security standards to an entire organization, discussing various methods, regulatory frameworks, hardening guides, and frameworks.
This part of the book comprises the following chapters:
-
No Comment
..................Content has been hidden....................
You can't read the all page of ebook, please click here login for view all page.