Security
How a Linux host limits what reaches it and what runs on it: host firewalls and netfilter, mandatory access control (SELinux and AppArmor), capabilities, auditing, package and file integrity, certificates and the trust store, and a hardening checklist that ties them together. Security monitoring and scanners for fleets live under Observability and Security.
Revision Card
| Fact | Value |
| Firewalls | RHEL: firewalld (zones, --permanent + --reload); Ubuntu: ufw (inactive by default); both write nftables rules |
| Reject vs drop | firewalld rejects (refused, unreachable); ufw and drop rules time out |
| firewalld order | Deny rich rules run before allow rules unless priority is set |
| netfilter | input for this host, forward for routed traffic, prerouting DNAT, postrouting SNAT/masquerade |
| iptables view | iptables -S hides nftables tables; read nft list ruleset |
| SELinux | getenforce; labels with ls -Z; fix with semanage fcontext + restorecon, semanage port, setsebool -P |
| SELinux logs | ausearch -m AVC -ts recent, audit2why; never load audit2allow output unread |
| AppArmor | Path-based profiles in /etc/apparmor.d; aa-status, aa-complain, aa-enforce |
| Capabilities | getcap/setcap, /proc/PID/status + capsh --decode; systemd AmbientCapabilities= |
| auditd | Watch -w PATH -p wa -k KEY; ausearch -k KEY; login UID survives sudo |
| GPG | rpm -K, gpg --verify; APT keys per repository with Signed-By |
| Certificates | Names from SAN; openssl s_client -servername; -checkend for expiry |
| Trust store | RHEL /etc/pki/ca-trust/source/anchors + update-ca-trust; Ubuntu /usr/local/share/ca-certificates/*.crt + update-ca-certificates |
| Integrity | rpm -Va, debsums -s, AIDE baseline off the host |
| Backports | Distribution packages fix CVEs without changing the upstream version |
| Task | Command |
| Open a port on RHEL | sudo firewall-cmd --permanent --add-port=8080/tcp && sudo firewall-cmd --reload |
| Open a port on Ubuntu | sudo ufw allow from 10.0.0.0/8 to any port 8080 proto tcp |
| Everything netfilter does | sudo nft list ruleset |
| Label web content | sudo semanage fcontext -a -t httpd_sys_content_t '/data/www(/.*)?' && sudo restorecon -Rv /data/www |
| Let nginx proxy | sudo setsebool -P httpd_can_network_connect on |
| Low port without root | AmbientCapabilities=CAP_NET_BIND_SERVICE in the unit |
| Who changed a file | sudo ausearch -k identity --format text |
| Certificate dates and names | openssl x509 -in cert.pem -noout -dates -ext subjectAltName |
| Test a TLS server | `openssl s_client -connect host:443 -servername host -brief |