Linux Essentials Preparation · lesson 23 of 23 · 25 min
Linux Security Tools Overview
Linux provides a rich ecosystem of security tools for intrusion prevention, auditing, and malware detection. The Linux Essentials exam covers the purpose and basic usage of key tools.
Fail2ban
Fail2ban — monitors log files for failed authentication attempts and automatically bans offending IP addresses using iptables/firewalld rules.
How it works: Reads log files (e.g., /var/log/auth.log). When a source IP exceeds the threshold of failed attempts (default: 5 in 10 minutes), it adds a firewall rule to ban that IP for a configurable duration (default: 10 minutes).
Configuration: /etc/fail2ban/jail.conf (default) and /etc/fail2ban/jail.local (overrides). Key settings: bantime, findtime, maxretry.
Commands: fail2ban-client status — shows active jails. fail2ban-client status sshd — shows SSH jail stats. fail2ban-client set sshd unbanip 1.2.3.4 — unban an IP.
Use case: Protects SSH, web servers, mail servers from brute force attacks.
auditd, lynis, chkrootkit, ClamAV
auditd (Linux Audit Daemon) — kernel-level auditing framework. Records system calls, file access, user actions. Rules defined in /etc/audit/audit.rules. ausearch queries audit logs. aureport generates reports. Essential for compliance (PCI-DSS, HIPAA).
lynis — security auditing and hardening tool. Scans the system for misconfigurations, vulnerabilities, and hardening opportunities. Generates a report with suggestions. lynis audit system. Agentless — runs locally.
chkrootkit — checks for rootkits (malicious software that hides itself). Scans for known rootkit signatures, suspicious binaries, and system modifications. chkrootkit runs the scan. Output: “INFECTED” or “not infected” for each check.
rkhunter (Rootkit Hunter) — similar to chkrootkit. Checks for rootkits, backdoors, and local exploits. rkhunter --check. Maintains a database of known-good file hashes.
ClamAV — open-source antivirus for Linux. Primarily used to scan files for Windows malware (useful on mail servers). clamscan -r /home — recursive scan. freshclam — updates virus definitions. clamd — daemon mode for real-time scanning.
Exam Tip
Fail2ban = brute force protection (bans IPs). auditd = kernel-level auditing for compliance. lynis = security hardening audit. chkrootkit/rkhunter = rootkit detection. ClamAV = antivirus (open source).
Key Terms
Key Terms
Knowledge Check — 10 Questions
Linux Essentials — Security Tools
Fail2ban protects against:
- Rootkits
- Brute force attacks by banning IPs after repeated failed logins
- Viruses
- SQL injection
- Answer: Brute force attacks by banning IPs after repeated failed logins
Fail2ban monitors auth logs and adds firewall rules to ban IPs that exceed the failed login threshold. auditd is used for:
- Antivirus scanning
- Kernel-level auditing of system calls and file access
- Rootkit detection
- Firewall management
- Answer: Kernel-level auditing of system calls and file access
auditd provides kernel-level auditing — records who accessed what files, which system calls were made, and user actions. Required for compliance. lynis audit system performs:
- A rootkit scan
- A security audit with hardening recommendations
- An antivirus scan
- A network port scan
- Answer: A security audit with hardening recommendations
lynis scans the system for security misconfigurations and provides a prioritised list of hardening recommendations. chkrootkit is used to detect:
- Open firewall ports
- Rootkits — malicious software that hides itself on the system
- Failed login attempts
- Virus-infected files
- Answer: Rootkits — malicious software that hides itself on the system
chkrootkit scans for known rootkit signatures and suspicious system modifications that indicate a rootkit infection. ClamAV on a Linux mail server is primarily used to:
- Protect Linux from Linux malware
- Scan email attachments for Windows malware before delivery
- Monitor network traffic
- Detect rootkits
- Answer: Scan email attachments for Windows malware before delivery
ClamAV on Linux mail servers scans emails for Windows malware — preventing infected attachments from reaching Windows clients. freshclam is used to:
- Update ClamAV virus definitions
- Scan files with ClamAV
- Start the ClamAV daemon
- Remove detected viruses
- Answer: Update ClamAV virus definitions
freshclam downloads the latest ClamAV virus database. Run regularly (or via cron) to keep definitions current. Fail2ban configuration is primarily in:
- /etc/fail2ban/jail.conf and jail.local
- /etc/iptables/fail2ban.conf
- /var/log/fail2ban.conf
- /etc/ssh/fail2ban.conf
- Answer: /etc/fail2ban/jail.conf and jail.local
jail.conf = default config. jail.local = local overrides (do not edit jail.conf directly — it may be overwritten on updates). rkhunter differs from chkrootkit by:
- Being Windows-only
- Maintaining a database of known-good file hashes for comparison
- Only checking network connections
- Being part of the kernel
- Answer: Maintaining a database of known-good file hashes for comparison
rkhunter stores hashes of system binaries and compares them on each run — detects if critical files have been modified by a rootkit. ausearch is used with:
- ClamAV
- auditd — to query the audit log
- Fail2ban
- lynis
- Answer: auditd — to query the audit log
ausearch queries the auditd log. ausearch -k auth finds authentication events. aureport generates summary reports.
Fail2ban adds _____ rules to block offending IP addresses.
Answer: firewall
Fail2ban uses iptables or firewalld to add firewall rules that block the offending IP for the configured bantime.
Previous lesson: Firewall management: ufw, firewalld, iptables basics — rules, chains, policies
Back to Linux Essentials Preparation