Linux for Networking Professionals: Securely configure and operate Linux network services for the enterprise

Linux for Networking Professionals
Contributors
About the author
About the reviewer
Preface
    Who this book is for
    What this book covers
    To get the most out of this book
    Download the color images
    Download the example code files 
    Conventions used
    Get in touch
    Share Your Thoughts
Section 1: Linux Basics
Chapter 1: Welcome to the Linux Family
    Why Linux is a good fit for a networking team
        Why is Linux important?
        The history of Linux
    Mainstream data center Linux 
        Red Hat
        Oracle/Scientific Linux
        SUSE
        Ubuntu
        BSD/FreeBSD/OpenBSD
    Specialty Linux distributions
        Open source firewalls
        Kali Linux
        SIFT
        Security Onion
    Virtualization
        Linux and cloud computing
    Picking a Linux distribution for your organization
    Summary
    Further reading
Chapter 2: Basic Linux Network Configuration and Operations – Working with Local Interfaces
    Technical requirements
    Working with your network settings – two sets of commands
    Displaying interface IP information
        Displaying routing information
    IPv4 addresses and subnet masks
        Special-purpose addresses
        Private addresses – RFC 1918
    Assigning an IP address to an interface
        Adding a route
        Adding a route using legacy approaches
        Disabling and enabling an interface
        Setting the MTU on an interface
        More on the nmcli command
    Summary
    Questions
    Further reading
Section 2: Linux as a Network Node and Troubleshooting Platform
Chapter 3: Using Linux and Linux Tools for Network Diagnostics
    Technical requirements
    Network basics – the OSI model
    Layer 2 – relating IP and MAC addresses using ARP
        MAC address OUI values
    Layer 4 – how TCP and UDP ports work
        Layer 4 – TCP and the three-way handshake
    Local port enumeration – what am I connected to?  What am I listening for?
    Remote port enumeration using native tools
    Remote port and service enumeration – nmap
        NMAP scripts
        Are there limits to Nmap?
    Wireless diagnostic operations
    Summary
    Questions
    Further reading
Chapter 4: The Linux Firewall
    Technical requirements
    Configuring iptables
        iptables from a high level
        The NAT table
        The mangle table
        Order of operations in iptables
    Configuring nftables
        nftables basic configuration
        Using include files
        Removing our Firewall Configuration
    Summary
    Questions
    Further reading
Chapter 5: Linux Security Standards with Real-Life Examples
    Technical requirements
    Why do I need to secure my Linux hosts?
    Cloud-specific security considerations
    Commonly encountered industry-specific security standards
    The Center for Internet Security critical controls
        Getting a start on CIS critical security controls 1 and 2
        OSQuery – critical controls 1 and 2, adding in controls 10 and 17
    The Center for Internet Security benchmarks
        Applying a CIS benchmark – securing SSH on Linux
    SELinux and AppArmor
    Summary
    Questions
    Further reading
Section 3: Linux Network Services
Chapter 6: DNS Services on Linux
    Technical requirements
    What is DNS?
    Two main DNS server implementations
        An organization's "internal" DNS server (and a DNS overview)
        An internet-facing DNS server
    Common DNS implementations
        Basic installation: BIND for internal use
        BIND: Internet-facing implementation specifics
    DNS troubleshooting and reconnaissance 
    DoH
    DoT
        knot-dnsutils
        Implementing DoT in Nmap
        DNSSEC 
    Summary
    Questions
    Further reading
Chapter 7: DHCP Services on Linux
    How does DHCP work?
        Basic DHCP operation
        DHCP requests from other subnets (forwarders, relays, or helpers)
        DHCP options
    Securing your DHCP services
        Rogue DHCP server
        Rogue DHCP client
    Installing and configuring a DHCP server
        Basic configuration
        Static reservations
        Simple DHCP logging and troubleshooting in everyday use
    Summary
    Questions
    Further reading
Chapter 8: Certificate Services on Linux
    Technical requirements
    What are certificates?
    Acquiring a certificate
    Using a certificate – web server example
    Building a private Certificate Authority
        Building a CA with OpenSSL
        Requesting and signing a CSR
    Securing your Certificate Authority infrastructure
        Legacy tried-and-true advice
        Modern advice
        CA-specific risks in modern infrastructures
    Certificate Transparency
        Using CT for inventory or reconnaissance
    Certificate automation and the ACME protocol
    OpenSSL cheat sheet
    Summary
    Questions
    Further reading
Chapter 9: RADIUS Services for Linux
    Technical requirements
    RADIUS basics – what is RADIUS and how does it work?
    Implementing RADIUS with local Linux authentication
    RADIUS with LDAP/LDAPS backend authentication
        NTLM authentication (AD) – introducing CHAP
    Unlang – the unlanguage
    RADIUS use-case scenarios
        VPN authentication using user ID and password
        Administrative access to network devices
        RADIUS configuration for EAP-TLS authentication
        Wireless network authentication using 802.1x/EAP-TLS
        Wired network authentication using 802.1x/EAP-TLS
    Using Google Authenticator for MFA with RADIUS
    Summary
    Questions
    Further reading
Chapter 10: Load Balancer Services for Linux
    Technical requirements
    Introduction to load balancing
        Round Robin DNS (RRDNS)
        Inbound proxy – Layer 7 load balancing
        Inbound NAT – Layer 4 load balancing
        DSR load balancing
    Load balancing algorithms
    Server and service health checks
    Datacenter load balancer design considerations
        Datacenter network and management considerations
    Building a HAProxy NAT/proxy load balancer
        Before you start configuring – NICs, addressing, and routing
        Before you start configuring – performance tuning 
        Load balancing TCP services – web services
        Setting up persistent (sticky) connections
        Implementation note
        HTTPS frontending
    A final note on load balancer security
    Summary
    Questions
    Further reading
Chapter 11: Packet Capture and Analysis in Linux
    Technical requirements
    Introduction to packet capturing – the right places to look
        Capturing from either end
        Switching the monitoring port
        Intermediate in-line host
        Network tap 
        Malicious packet capture approaches
    Performance considerations when capturing
    Capturing tools
        tcpdump
        Wireshark
        TShark
        Other PCAP tools
    Filtering captured traffic
        Wireshark capture filters (capturing your home network traffic)
        tcpdump capture filters – VoIP phones and DHCP
        More capture filters – LLDP and CDP
        Collecting files from a packet capture
    Troubleshooting an application – capturing a VoIP telephone call
        Wireshark display filters – separating specific data in a capture
    Summary
    Questions
    Further reading
Chapter 12: Network Monitoring Using Linux
    Technical requirements
    Logging using Syslog
        Log size, rotation, and databases
        Log analysis – finding "the thing"
        Alerts on specific events
        Syslog server example – Syslog
    The Dshield project
        Network device management using SNMP
        SNMP NMS deployment example – LibreNMS
        SNMPv3
    Collecting NetFlow data on Linux
        What is NetFlow and its "cousins" SFLOW, J-Flow, and IPFIX?
        Flow collection implementation concepts
        Configuring a router or switch for flow collection
        An example NetFlow server using NFDump and NFSen
    Summary
    Questions
    Further reading
        Commonly used SNMP OIDs
Chapter 13: Intrusion Prevention Systems on Linux
    Technical requirements
    What is an IPS?
    Architecture options – where does an IPS fit in your data center?
    IPS evasion techniques
        Detecting a WAF
        Fragmentation and other IPS evasion methods
    Classic/network-based IPS solutions – Snort and Suricata
    Suricata IPS example
    Constructing an IPS rule
    Passive traffic monitoring
        Passive monitoring with P0F – example
    Zeek example – collecting network metadata
    Summary
    Questions
    Further reading
Chapter 14: Honeypot Services on Linux
    Technical requirements
    Honeypot overview – what is a honeypot, and why do I want one?
    Deployment scenarios and architecture – where do I put a honeypot?
    Risks of deploying honeypots
    Example honeypots
        Basic port alerting honeypots – iptables, netcat, and portspoof
        Other common honeypots
    Distributed/community honeypot – the Internet Storm Center's DShield Honeypot Project
    Summary
    Questions
    Further reading
Assessments
    Chapter 2 – Basic Linux Network Configuration and Operations – Working with Local Interfaces
    Chapter 3 – Using Linux and Linux Tools for Network Diagnostics
    Chapter 4 – The Linux Firewall
    Chapter 5 – Linux Security Standards with Real-Life Examples
    Chapter 6 – DNS Services on Linux
    Chapter 7 – DHCP Services on Linux
    Chapter 8 – Certificate Services on Linux
    Chapter 9 – RADIUS Services for Linux
    Chapter 10 – Load Balancer Services for Linux
    Chapter 11 – Packet Capture and Analysis in Linux
    Chapter 12 – Network Monitoring Using Linux
    Chapter 13 – Intrusion Prevention Systems on Linux
    Chapter 14 – Honeypot Services on Linux
    Why subscribe?
Other Books You May Enjoy
    Packt is searching for authors like you
    Share Your Thoughts