Week 4: Networking and Security
Part 1: Lecture Notes (First 2 Hours)
1. Networking Concepts in Unix
Networking in Unix involves configuring and managing network interfaces, IP addresses, and
network protocols. Understanding these concepts is crucial for Unix system administrators.
1) Network Interfaces
Network interfaces represent physical or virtual network connections (e.g., eth0,
wlan0).
Use ifconfig or ip addr to view and manage network interfaces.
To configure a network interface with a static IP address, use sudo ifconfig
interface_name ip_address netmask netmask_address.
Set a default gateway with sudo route add default gw gateway_address.
Loopback interface (lo) provides a way to send network traffic to oneself.
2) IP Addressing and Subnetting
IP addresses uniquely identify devices on a network, with IPv4 (e.g., [Link])
and IPv6 (e.g., 2001:db8::1).
Subnetting divides networks into smaller segments, allowing for better traffic
management and security.
Understanding subnet masks and CIDR notation (e.g., /24) is essential for network
configuration.
Use ipcalc to calculate subnets, network addresses, and broadcast addresses.
3) Routing and Default Gateways
Routing determines how network traffic is directed between different networks.
Default gateways route traffic outside the local network.
Use ip route to view the system's routing table and configure routing rules.
Understanding routing protocols such as OSPF and BGP is beneficial for advanced
networking scenarios.
4) Name Resolution (DNS)
DNS (Domain Name System) resolves domain names to IP addresses.
Use nslookup or dig to query DNS servers and troubleshoot DNS issues.
System-wide DNS configurations are usually stored in /etc/[Link].
DNS caching and secondary DNS servers can improve resolution speed and
redundancy.
5) Common Network Services
Unix systems often run various network services, such as SSH, FTP, HTTP, and
SMTP.
Understanding these services and their configurations is crucial for network
administration.
Use netstat to view active network connections and listening ports.
Configuring firewall rules helps secure network services and restrict unwanted
access.
2. System Security in Unix
System security involves implementing measures to protect Unix systems from unauthorized
access, data breaches, and other security threats.
1) User Authentication and Authorization
User authentication verifies user identity through passwords, SSH keys, or other
mechanisms.
User authorization determines what resources users can access based on roles or
group memberships.
Use passwd to change user passwords and chage to manage password expiration
policies.
Implement multi-factor authentication for enhanced security.
2) File Permissions and Ownership
Unix systems use file permissions to control who can read, write, or execute files.
Ownership determines which user and group own a file or directory.
Use chmod to set file permissions and chown to change file ownership.
Implement access controls to restrict unauthorized file access.
3) Firewall Configuration and Management
Firewalls control network traffic by allowing or denying connections based on
defined rules.
Use iptables or firewalld to configure firewall rules on Unix systems.
Implement basic firewall rules to allow necessary traffic and block unauthorized
connections.
Logging firewall activity helps detect security threats and unauthorized access
attempts.
4) Intrusion Detection and Prevention Systems (IDPS)
IDPS monitor network traffic and system activity to detect and prevent security
breaches.
Tools like Snort and Suricata are commonly used for intrusion detection in Unix
environments.
Implementing IDPS helps identify and respond to suspicious activities promptly.
Regularly update IDPS rule sets to address new threats and vulnerabilities.
5) System Security Best Practices
Apply security patches and software updates regularly to mitigate known
vulnerabilities.
Disable unnecessary services and network connections to reduce the attack surface.
Implement security audits and vulnerability assessments to identify potential
security risks.
Educate users about security risks and best practices to promote a security-
conscious environment.
Part 2: Practicals (Last 2 Hours)
Practical Exercises:
1. Configure a Network Interface
Use ifconfig or ip addr to view existing network interfaces and their configurations.
Configure a network interface with a static IP address using sudo ifconfig
interface_name ip_address netmask netmask_address.
Set a default gateway with sudo route add default gw gateway_address.
Test the network configuration by pinging another device on the network to ensure
connectivity.
2. Configure DNS
Open /etc/[Link] to edit system-wide DNS settings.
Add or modify DNS server entries with nameserver dns_ip_address.
Test DNS resolution using nslookup domain_name or dig domain_name.
If DNS resolution fails, check /etc/[Link] for correct DNS configuration
order and investigate network connectivity.
3. Set File Permissions and Ownership
Use chmod to set file permissions: chmod permission_value file_name. For
example, chmod 755 [Link] allows read, write, and execute for the owner, and
read/execute for others.
Change file ownership with chown: sudo chown owner:group file_name. For
example, sudo chown user1:usergroup [Link] assigns ownership to user1 and group
usergroup.
Test the permissions by attempting to read, write, or execute the file with different
user accounts.
Check permissions with ls -l file_name to confirm the correct permissions and
ownership settings.
4. Configure a Basic Firewall
Use iptables to set up basic firewall rules. For example, sudo iptables -A INPUT -p
tcp --dport 22 -j ACCEPT allows SSH traffic.
To deny all other incoming connections, use sudo iptables -A INPUT -j DROP.
After configuring firewall rules, test them by attempting to connect from different
devices or sources.
Use iptables -L to list current firewall rules and verify their order and effectiveness.
5. Implement User Authentication and Authorization
Create a new user with sudo adduser new_username. Follow the prompts to set the
user's home directory and password.
Configure SSH keys for passwordless authentication: Generate a key with ssh-
keygen, then add the public key to the ~/.ssh/authorized_keys file on the server.
Test user authentication by logging in as the new user and using the SSH key if
configured.
Set user authorization by modifying group memberships or access permissions for
specific resources.
6. Monitor System Resource Usage
Use top or htop to monitor real-time system resource usage, including CPU,
memory, and process statistics.
Analyze system resource trends using sar. For example, sar -u displays CPU
utilization over time, while sar -r shows memory usage.
Identify resource-intensive processes and analyze their impact on system
performance.
Investigate processes with high resource usage, looking for anomalies or
performance bottlenecks.
7. Set Up Intrusion Detection
Install an intrusion detection system like Snort or Suricata: sudo apt install snort or
equivalent.
Configure basic IDS rules to detect common security threats.
Test the IDS by simulating common attack scenarios, such as a port scan, and
observe the generated alerts.
Review IDS logs to ensure proper detection and rule activation.
Regularly update IDS rules to keep up with emerging threats.
Revision Questions:
1. What are network interfaces, and how do you configure them in Unix?
2. Explain the role of DNS in name resolution and how to configure it in Unix.
3. Describe the importance of file permissions and ownership in Unix security.
4. What is the purpose of a firewall, and how do you configure it in Unix?
5. How does user authentication differ from user authorization in Unix?
6. What are common system monitoring tools used in Unix, and what do they monitor?
7. Describe steps to set up basic intrusion detection in Unix.
8. How do you set a default gateway in Unix, and why is it important?
9. Explain the different states in the process lifecycle and their significance in process
management.
10. What are some best practices for maintaining Unix system security?