Month 7: Secrets, certificates and audits

File encryption with GPG

GPG (GNU Privacy Guard) encrypts single files. Symmetric: gpg -c file asks for a passphrase, good for a quick archive. Asymmetric: gpg -e -r priya@kibbleco.example file encrypts to Priya's public key, so only her private key can decrypt it, with no shared secret to pass around. gpg -d decrypts. The same keys also sign files, which is how repositories prove packages are theirs.

$ gpg -c payroll-2026.tar.gz
$ gpg -e -r priya@kibbleco.example \
    audit-notes.txt
$ gpg -d audit-notes.txt.gpg

Disk encryption: LUKS2 and Argon2

LUKS encrypts a whole block device, so a stolen laptop or a failed disk sent for repair gives away nothing. LUKS2, the current format, keeps several key slots (passphrases or key files that unlock one master key) and uses Argon2 (argon2id) to turn a passphrase into a key. Argon2 is memory-hard: it needs lots of RAM per guess, which cripples GPU cracking rigs. LUKS1 used the weaker PBKDF2.

cryptsetup luksFormat --type luks2 /dev/sdc
cryptsetup open /dev/sdc backupdisk
mkfs.xfs /dev/mapper/backupdisk
# boot-time unlock: /etc/crypttab

Exam tip Encryption at rest protects powered-off data. A running, unlocked server is protected by everything else.

TLS, OpenSSL and LibreSSL

TLS protects web, mail and API traffic. Allow TLS 1.2 and 1.3; SSL 2/3 and TLS 1.0/1.1 are obsolete. OpenSSL is the library most Linux software uses for TLS, plus a Swiss-army command: s_client tests a server, req makes certificate requests, x509 reads certificates, dgst hashes. LibreSSL is OpenBSD's fork of OpenSSL with a cleaned-up code base and a compatible API.

$ openssl s_client -tls1_3 \
    -connect shop.kibbleco.example:443 \
    </dev/null | grep Protocol

WireGuard

WireGuard is a modern VPN built into the Linux kernel: small code, fast, fixed modern ciphers (Curve25519, ChaCha20-Poly1305), nothing to negotiate. Each peer has a key pair; the config lists peers' public keys and allowed IPs. wg-quick up wg0 starts it; wg show reports handshakes. It runs over UDP (51820 by convention).

[Interface]
PrivateKey = <store-02 private key>
Address = 10.99.0.2/24
[Peer]
PublicKey = <hq public key>
Endpoint = vpn.kibbleco.example:51820
AllowedIPs = 10.0.0.0/8

Hashes and HMAC

A hash like SHA-256 turns any input into a fixed 256-bit fingerprint. Change one byte and the hash changes completely, and you can't work backwards. Use it to verify downloads and detect changed files (sha256sum). An HMAC mixes a secret key into the hash, so it proves integrity AND that the sender knew the key: API request signatures and webhooks use it.

$ sha256sum ubuntu-24.04.iso
$ openssl dgst -sha256 -hmac "$KEY" \
    order.json

Exam tip A plain hash proves the file didn't change. An HMAC also proves who made it.

Removing weak algorithms

Retire MD5 and SHA-1 for signatures and integrity, DES/3DES and RC4 for encryption, and old SSH key exchange and MAC choices. In sshd_config, the Ciphers, MACs and KexAlgorithms lines limit the choice. On RHEL, update-crypto-policies --set DEFAULT (or FUTURE, stricter) sets the allowed algorithms for OpenSSL, SSH, GnuTLS and more at once; LEGACY re-enables old ones only for compatibility.

Exam tip Need LEGACY for one old device? Treat it as a temporary exception with a retirement date.

Trusted roots

A browser or tool trusts a certificate because it chains up to a trusted root certificate in its trust store. On Linux the system store is managed by the distro: RHEL adds anchors in /etc/pki/ca-trust/source/anchors/ then runs update-ca-trust; Debian/Ubuntu use /usr/local/share/ca-certificates/ and update-ca-certificates. Kibble's internal CA root goes there, so internal sites are trusted without warnings.

Exam tip "unable to get local issuer certificate" = the chain doesn't reach a root this machine trusts.

No-cost vs commercial CAs

No-cost CAs such as Let's Encrypt issue domain-validated certificates automatically over the ACME protocol (certbot and similar clients). They're short-lived (90 days today, and getting shorter), so automate renewal. Commercial CAs sell certificates with organization validation, support and warranties, and some extras. Both chain to roots browsers already trust.

Exam tip Short-lived certificates are fine if renewal is automated. Manual renewal is what breaks.

Avoid self-signed certificates

A self-signed certificate vouches for itself, so clients have no chain of trust. Users learn to click through warnings, which trains them to accept a real attack. For internal services, run an internal CA and push its root to company machines; for public services, use a public CA. Check expiry with openssl x509 -noout -enddate -in cert.pem, and monitor it.

Exam tip A self-signed cert in production is a finding, even when the encryption itself works.

Detection and response

Anti-malware on Linux (ClamAV: freshclam updates signatures, clamscan scans) matters most on servers that store files for Windows users or mail. Indicators of compromise (IOCs) are clues an attacker was here: unknown processes or cron jobs, new accounts, new SUID files, changed system binaries, outbound connections to strange addresses, file hashes or IPs from threat reports.

Exam tip One IOC is a reason to investigate, not proof. Preserve evidence before you clean up.

Vulnerability scanning: CVE and CVSS

A CVE is the public ID for one known vulnerability (CVE-year-number). CVSS scores its severity from 0 to 10. Scanners compare versions against CVE data. Watch out for backporting: RHEL and Ubuntu fix CVEs inside the old version number (openssh 8.7p1-38.el9 can include a fix shipped upstream in 9.8), so version-only scanners report false positives. Check the changelog: rpm -q --changelog openssh | grep CVE. Scans also find service misconfigurations. Tools: port scanners (nmap) and protocol analyzers (tcpdump, Wireshark).

Exam tip "Vulnerable version" on a patched enterprise distro? Check for a backported fix before panicking.

Standards: OpenSCAP and CIS

CIS Benchmarks are consensus hardening guides per OS (Level 1 = safe basics, Level 2 = stricter). OpenSCAP (the oscap tool with SCAP Security Guide content) checks a system against a profile automatically and writes an HTML report; it can also generate remediation scripts.

oscap xccdf eval \
  --profile cis_server_l1 \
  --report /root/db01-cis.html \
  /usr/share/xml/scap/ssg/content/\
  ssg-rhel9-ds.xml

File integrity

AIDE records a baseline database of file hashes and attributes (aide --init), then reports anything that changed (aide --check). rkhunter scans for rootkits and suspicious changes to key binaries. Signed package verification checks a package's signature before install (rpm -K file.rpm; apt checks repo signatures). Installed file verification compares files on disk with the package database: rpm -V pkg (or rpm -Va for all), debsums or dpkg --verify on Debian.

$ sudo rpm -Vf /usr/bin/ss
S.5....T.    /usr/bin/ss

Exam tip rpm -V: S = size, 5 = checksum, T = time differ. A changed checksum on a system binary is an IOC.

Secure data destruction

shred -n 3 -z overwrites a file or disk several times, but on SSDs and copy-on-write filesystems the old blocks may survive elsewhere. badblocks -w writes test patterns over an entire disk (destructive). dd if=/dev/urandom of=/dev/sdX overwrites a whole device with random data. Cryptographic destruction destroys the encryption key (cryptsetup luksErase, or a drive's crypto erase), which makes the data unreadable at once: the best fit for SSDs.

Exam tip Encrypted from day one = destroyable in seconds. Another reason for LUKS everywhere.

Software supply chain

Every package, image and library is code someone else wrote. Protect the software supply chain: install from signed repositories, limit third-party repos, pin versions and verify hashes, scan container images, keep an SBOM (software bill of materials), and watch for typosquatted names in pip and npm.

Exam tip "curl | sudo bash" from a random site skips every supply chain check you have.

Security banners

/etc/issue is shown before a local console login; /etc/issue.net before a remote login (sshd shows it if Banner /etc/issue.net is set); /etc/motd is shown after login. Legal teams want a pre-login warning that the system is for authorized use and is monitored.

Exam tip Before login: issue (local), issue.net (remote). After login: motd.

LUKS

LUKS (Linux Unified Key Setup) encrypts a whole block device with dm-crypt. LUKS2 is the current format, and it uses Argon2 (argon2id) as the key-derivation function that turns your passphrase into a key; Argon2 is memory-hard, which slows down brute-force attacks.

• cryptsetup luksFormat /dev/sdb1 (erases the device)
• cryptsetup open /dev/sdb1 securedata → /dev/mapper/securedata, then mkfs and mount
• Unlock at boot: /etc/crypttab, plus /etc/fstab
• cryptsetup luksAddKey adds a backup passphrase or key file; luksDump shows key slots and the KDF

What and where

Old algorithms (MD5, SHA-1 signatures, 3DES, RC4, TLS 1.0/1.1, SSH diffie-hellman-group1, ssh-rsa with SHA-1) are breakable. Remove them:

• RHEL: system-wide crypto policies: update-crypto-policies --show, --set DEFAULT or FUTURE (stricter), FIPS where required
• SSH: restrict Ciphers, MACs and KexAlgorithms in sshd_config (check with ssh -Q cipher and sshd -T)
• Web servers: allow only TLS 1.2/1.3 and strong cipher suites
• Retire old certificates signed with SHA-1

The trust store

A TLS certificate is trusted when it chains up to a root CA in the system's trust store. Free CAs (Let's Encrypt, automated with certbot/ACME, 90-day certificates) and commercial CAs (longer support, organization/extended validation, warranties) are both trusted by default.

• Add an internal company CA: copy it to /etc/pki/ca-trust/source/anchors/ and run update-ca-trust (RHEL), or to /usr/local/share/ca-certificates/ and run update-ca-certificates (Debian/Ubuntu)
• Inspect a certificate: openssl x509 -in cert.pem -noout -text
• Test a server: openssl s_client -connect host:443

Why

A self-signed certificate isn't vouched for by any trusted CA, so clients show warnings, and users learn to click through warnings, which makes real man-in-the-middle attacks easy. Use a free public CA (Let's Encrypt) or an internal CA whose root you distribute to your machines. Self-signed is acceptable only for short-lived lab testing.

Measuring hardening

CIS Benchmarks are published, consensus hardening checklists for each distribution (Level 1 = basic, Level 2 = stricter). OpenSCAP scans a system against a security profile written in SCAP (for example CIS, DISA STIG, PCI DSS) and reports pass/fail, and can generate remediation scripts.

• oscap xccdf eval --profile cis --report report.html /usr/share/xml/scap/ssg/content/ssg-rhel9-ds.xml
• Content comes from the scap-security-guide package
• RHEL installers can apply a profile during installation

Three files

Linux shows banners at three different moments:

• /etc/issue: shown on local console logins, before login
• /etc/issue.net: shown to remote users before login (SSH shows it if sshd_config has Banner /etc/issue.net)
• /etc/motd: message of the day, shown after a successful login

What to write

A legal warning: authorized use only, activity monitored. Don't reveal the OS version or hostname (default issue files can include \r and \m escape codes that do).