Episode Details

Back to Episodes
Course 44 - RH Security Specialist | Episode 11: System Tracking and Port Reconnaissance

Course 44 - RH Security Specialist | Episode 11: System Tracking and Port Reconnaissance

Published 4 weeks ago
Description
How do you know whether a Linux server is actually secure?Security professionals need more than preventive controls. They need the ability to monitor system activity, investigate suspicious behavior, audit sensitive resources, and verify what is exposed to the network.In this episode, we move from detailed internal auditing with the Linux Audit System to active network reconnaissance and firewall verification. You will learn how to manage and search audit data, create targeted monitoring rules, generate security reports, scan network services with Nmap, and validate the effectiveness of local firewall controls.The result is a practical security workflow that combines visibility, investigation, reconnaissance, and defensive verification.1. Managing the Linux Audit DaemonWe begin with the Linux Audit Daemon (auditd), which provides a framework for recording security-relevant events generated by the operating system.You will explore how administrators manage the audit service and its log lifecycle, including:
  • Starting and stopping the auditing service.
  • Managing audit log generation.
  • Controlling log growth and rotation.
  • Resuming auditing after maintenance or configuration changes.
  • Understanding the relationship between audit configuration and stored event data.
Effective audit management ensures that security records remain useful without allowing audit data to become an uncontrolled storage problem.2. Creating Real-Time Audit Rules with AuditctlAfter understanding the audit service itself, we move to auditctl, the command-line interface used to manage active audit rules.Rather than collecting every possible event, security administrators can define specific resources and activities that deserve additional monitoring.A practical example is monitoring a sensitive SSH configuration file such as:/etc/ssh/sshd_configA file watch can provide visibility when the configuration is accessed or modified, helping administrators identify unexpected changes to a critical remote-access component.This introduces an important auditing principle:Monitor the resources whose modification could materially affect system security.3. Searching Audit Data with AusearchGenerating audit records is only the beginning. Large audit logs are valuable only when administrators can efficiently search and interpret them.This is where ausearch becomes important.You will learn how to search audit records for specific categories of activity, including:
  • Failed authentication events.
  • Login-related activity.
  • Account and group modifications.
  • Events associated with particular users.
  • Activity within defined time periods.
  • Events associated with specific audited resources.
Instead of manually reading thousands of raw records, targeted searches allow security analysts to quickly isolate events relevant to an investigation.4. Turning Audit Data into Reports with AureportWhile ausearch is useful for targeted investigations, aureport provides a broader reporting perspective.You will explore how aureport can transform detailed audit information into structured, human-readable summaries.These reports can help administrators understand:
  • Authentication activity.
  • Failed login attempts.
  • Executable activity.
  • User behavior.
  • System-level events.
  • Network-related audit information.
  • Patterns that may indicate suspicious activity.
This makes audit reporting useful not only to security analysts, but also to administrators who need a high-level overview of system activity.5. Detecting Suspicious Authentication ActivityAuthentication failures are particularly valuable from a security perspective.Repeated failed login attempts against a particular account or across
Listen Now

Love PodBriefly?

If you like Podbriefly.com, please consider donating to support the ongoing development.

Support Us