System Security & Firewall Management Flashcards

Which command is used to check the status of the firewall on a Linux system?

Answer: firewalld-cmd --state

For systems using `firewalld`, the `firewall-cmd --state` command is used to check if the `firewalld` service is running. It will output "running" if the firewall daemon is active, or indicate if it's not. This is the standard way to quickly ascertain the operational status of `firewalld`.

What does the Linux command 'iptables' manage?

Answer: Network traffic filtering

`iptables` is a command-line utility that allows system administrators to configure the Linux kernel firewall (netfilter). It is used to set up, maintain, and inspect the tables of IP packet filter rules in the Linux kernel. This enables precise control over incoming and outgoing network traffic, enhancing system security.

Which tool simplifies firewall management on many Linux distributions?

Answer: firewalld

`firewalld` is a dynamic firewall management tool that simplifies firewall configuration on many Linux distributions, especially Red Hat-based ones like CentOS and Fedora. It uses zones and services to manage rules, allowing for easier and more flexible configuration compared to directly manipulating `iptables` rules. It can change rules without dropping existing connections.

What port number does SSH use by default?

Answer: 22

SSH (Secure Shell) uses port 22 by default for secure remote access to Linux systems. This port is standardized for SSH connections, allowing encrypted communication and secure command execution over an unsecured network. While it's common practice to change this default port for added security, 22 remains the standard.

What is the primary purpose of Fail2Ban?

Answer: Intrusion prevention

Fail2Ban is an intrusion prevention software framework that protects computer servers from brute-force attacks. It works by monitoring log files for suspicious activity, such as repeated failed login attempts, and then automatically bans the offending IP addresses using firewall rules. This significantly reduces the risk of successful brute-force attacks against services like SSH or web servers.

Which file contains firewall rules in iptables?

Answer: /etc/sysconfig/iptables

On systems that use `iptables` directly (often older systems or those not using `firewalld`), the persistent firewall rules are typically stored in `/etc/sysconfig/iptables` (and `/etc/sysconfig/ip6tables` for IPv6). This file is loaded at boot time to restore the firewall configuration. It's important to save rules to this file after making changes to ensure they persist across reboots.

What command reloads firewall rules in firewalld?

Answer: firewall-cmd --reload

The `firewall-cmd --reload` command is used to reload the `firewalld` configuration without interrupting existing connections. This is a key feature of `firewalld`'s dynamic nature, allowing administrators to apply new rules or changes to zones and services efficiently and without service disruption. It applies the changes from the configuration files.

Which of the following ports should be closed to reduce attack surface on a server?

Answer: Unused services ports

To reduce the attack surface on a server, it is crucial to close ports associated with unused services. Each open port represents a potential entry point for attackers, as it could be exploited if the service running on it has vulnerabilities. By closing unnecessary ports, you limit the ways an attacker can interact with your system, thereby enhancing security.

Which Linux security module provides Mandatory Access Control?

Answer: SELinux

SELinux (Security-Enhanced Linux) is a Linux security module that provides Mandatory Access Control (MAC) capabilities. Unlike traditional Discretionary Access Control (DAC), SELinux enforces policies that restrict what processes and users can do, regardless of standard file permissions. This provides a robust layer of security by limiting the damage even if a service is compromised.