CO4509 Linux Security: Comparative Analysis of SELinux, iptables & Bro

This report provides an in-depth analysis of three Linux security tools: SELinux, iptables, and Bro. The SELinux section details its architecture, decision-making process, configuration files (specifically /etc/sysconfig/selinux), and the implications of different SELinux states (enforcing, permissive, disabled). It explains how SELinux enhances security by implementing Mandatory Access Control (MAC). The iptables section describes its role as a built-in firewall, explaining chains (INPUT, OUTPUT, FORWARD), targets (ACCEPT, DROP), and how to configure iptables rules to create a Stateful Packet Inspection (SPI) firewall. The report emphasizes the importance of properly configuring iptables to manage network traffic effectively. It also touches on using Bro, without providing specific details due to lack of content in the solution. The report concludes with a proposal, justifying which systems would be most suitable for securing a small business network, based on their individual strengths and configurations.

University
Essay Title
by
Your Name
Date
Lecturer’s Name and Course Number

1. SELinux
A brief description of SELinux
SELinux (Security-Enhanced Linux) this is an integrated 2.6 times kernel architecture utilizing
the LSM (Linux security modules). This project was done by the SELinux community and the
(NSA) United States National Security Agency. Integration of Red Hat Enterprise Linux and
SELinux was a combined venture between the Red Hat and NSA
MAC (Mandatory Access Control) is a flexible system developed into Linux kernel which is
provided by SELinux. As per the Linux DAC (Discretionary Access Control), software or a
process operating as a client (SUID or UID) contains the client’s authorization to items like files,
sockets, and other procedures. Executing MACkernel shields the framework away from being
flawed or malicious software’s which could destroy or damage it.
For instance when an application which is a subject tries to view an item such as a file, the policy
implementation administrator in the kernel looks for an AVC (access vector cache); at this point
the subject and the object authorization are cached. I the event a choice cannot be made in the
information in the access vector cache, the inquiry progresses to the server responsible for
security, the searches the security setting of the software and the file arrangement. The
authorization is then denied or allowed with access vector cache: unauthorized message subtle in
/var/log/messages in the event the authorization is denied

Figure 1: Decision-making process of SELinux
Results obtained
In this section, this paper will demonstrate the SELinux configuration files and the associated file
systems.
The SELinux Pseudo-File System
The SELinux pseudo-file framework comprises commands which are generally and normally
utilized by the kernel’s subsystem. The file type setting is analogous to the /proc/ pseudo-file
framework.
The below figure 2 is the content generated on the /selinux/ directory
Figure 2 SELinux directory
Configuration files of SELinux
This paper of the paper will demonstrate the policies files and SELinux configuration situated in
the /etc/ directory.
Configuration File: /etc/sysconfig/selinux
When configuring SELinux under Red Hat Enterprise Linux on can use two approaches namely:-
1. Editing the configuration file manually: /etc/sysconfig/selinux.
2. System-config-SELinux Security Level Configuration Tool.

The primary configuration file for disabling or enabling SELinux is the
/etc/sysconfig/selinux and also for a configuration that the approach to implementing on the
system and the procedure on how to ensure that it is well implemented.
In the actual configuration file, /etc/selinux/config a meaningful configuration is contained in
the etc/sysconfig/selinux.
The below are full subsets of choices that are available for configuration
1. Defining the highest level state of SELinux on the system hence one utilize:
SELINUX=enforcing|permissive|disabled
 Permissive – A policy is not enforced but a warning is printed by SELinux
system. This is a great tool for troubleshooting or debugging purposes. In this
permissive mode since more subjects can continue in actions thus more
denials are logged that can either be denied from taking place.
 Enforcing- the enforcing of SELinux security policy.
 Disabled- the enabling of SELinux is complete. the hooks of the SELinux are
detached from the kernel and the pseudo-file framework is unregistered.
Activities performed when SELinux is deactivated might bring about the system of the file never
again containing the right security setting, That is, the security setting characterized by the
approach. The most ideal approach to label the file framework again is by making the auto
relabel or the flag file and restart the computer. This leads to the relabel happening from the first
stages of the boot procedure before any other procedures start operating on the framework.
Utilizing this method implies that processes cannot incidentally make documents in the incorrect
setting or boot in the wrong setting.
It is conceivable to utilize the fix-files relabel command before empowering SELinux to relabel
the framework of the file. This technique isn't suggested due to the fact that after completing, it is
as yet conceivable to have other processes possibly operating on the framework in the incorrect
setting. These procedures would make documents that would likewise be in the incorrect setting.

The daemons which are guarded by the default focused on approach include httpd (apache.te),
dhcpd, nscd, squid, named, syslogd, portmap, ntpd, and snmpd. The others among the
framework keep running in the unconfined_t domain. The unconfined_t domain permits subjects
and protests that security setting to work utilizing standard Linux security.
The policy files for the daemons are situated in src/selinux/arrangement/directed/spaces/program.
These files are liable to change as more up to date forms of Red Hat Enterprise Linux are
developed.
Implementations for the above policies for these daemons can be switched on or off, utilizing
Boolean qualities operated by the system config-selinux Or the Security Level Configuration
Tool.
The incentive of setting a Boolean for a focused on daemon to zero deactivates approach
progress for the daemon. For instance, you can set dhcpd_disable_trans to zero to keep it away
from changing dhcpd that comes from the unconfined_t area to the space indicated in dhcpd.te.
Utilize the getsebool command to outline all SELinux Booleans. Taking a case of utilizing the
setsebool summon to set a SELinux Boolean. The - P choice rolls out the improvement
changeless. Lack of this alternative at reboot, the Boolean would be reset to 1.
Strict - Full SELinux security, that applies to all daemons. Settings for Security are
characterized for all subjects and components, as well as each activity is handled by the strategy
requirement server.
SETLOCALDEFS=0|1 - manages how neighborhood definitions (clients and Booleans) are
arranged. This incentive is then set to one to have these definitions managed by load approach
from files in /etc/selinux/<policyname> or then again set it to zero to make them be managed by
semanage.
Defense - a number of online sources will instruct you to deactivate SELinux for different things
to work. Be that as it may, this isn't right. You shouldn't decrease your server security. You
should design SELinux appropriately.

2 Iptables
A brief description of the iptables
CentOS have to a great degree intense built-in firewall, regularly called iptables or Netfilter. The
iptables refers to the module of the userspace, that is, the part that the operator interacts with at
the line of command so as to input the rules or principles of the firewall into predefined tables.
On the other hand, Netfilter is a bit module, incorporated with the part that really performs the
tasks of filtering. numerous GUI front closures for iptables exists which enable operators to
include or characterize principles on point and snap UI basis, yet these regularly do not have to
adapt to utilizing the interface of the charge line and breaking point the users’ comprehension of
what is actually taking place. We will take in the charge line interface of iptables.
Iptables locates principles into predetermined chains which include FORWARD, INPUT and
OUTPUT which are marked in correspondence to any system activity usually termed as IP
bundles or packets, pertinent to those chains and a conclusion is arrived at concerning what is to
be done with every bundle in view of the result of those principles, that is, tolerating or rejecting
the bundle. The activities above are alluded to as targets, where the two most regular
predetermined targets are ACCEPT to acknowledge a bundle or
DROP to drop a bundle.
Chain
The following are three chains predefined in the table of filters that principles can be included for
handling IP bundles going via the chains below. These include:
 INPUT chain– refers to those bundles bound for a computer of the host.
 OUTPUT chain – refers to those bundles beginning from the computer of the host.
FORWARD chain – it alludes to neither those bundles which are neither bound for nor
beginning from the computer of the host, yet going via or directed by the host PC. This
chain is utilized on the off chance that you are utilizing your computer as a switch.
Generally, we will be managing the INPUT chain to channel bundles entering the computer.
Principles are included a rundown to each chain. A bundle is checked against each principle
thusly, beginning at the best, and on the off chance that it coordinates that principle, at that point

a move is made, for example, tolerating (ACCEPT) or rejecting (DROP) the bundle. When a
principle is coordinated and a move made, at that point, the bundle is prepared by the result of
that principle and is not handled by additional principles in the chain. On the off chance that a
bundle goes down through every one of the principles in the chain and achieves the base without
being coordinated against any principle, at that point the standard activity is taken for that chain.
This is alluded to as the standard approach and is sometimes fixed to DROP or ACCEPT the
bundle.
The idea of standard strategies inside chains develops double major conceivable outcomes which
we should consider before we choose the manner in which we will arrange the firewall.
 a standard strategy can be set to DROP every bundle and later sum up principles to
permit (ACCEPT) bundles which might have come from confided in the addresses of
the IP, or for particular ports from which the controls run, for instance, FTP server, Bit
Torrent, Samba document server, Web Server, among others or on the other hand,
 A standard approach can be set to ACCEPT every bundle and later add principles to
explicitly prevent (DROP) bundles which might come from particular irrelevant IP
addresses or for particular ports where there are personal controls or no processes
running.
Mostly, the first outcome is considered for the INPUT chain where we require being in charge of
what is allowed to get to our computer and the second one can be considered for the chain of the
OUTPUT that the user mostly have confidence in the movement which is going out or beginning
from our computer.
How to configure iptables
Operating with iptables on the basis of the command line needs basic benefits, hence you should
progress toward becoming base for most things we will do.
Iptables ought to be introduced or installed as a matter of course to all CentOS 5.x and 6.x
establishments. The user can verify whether iptables is introduced on your framework by:

Additionally, to check whether iptables is really I operation, we can look to ascertain that the
modules of the iptables are stacked and utilize the - L switch for the purpose of reviewing the
present stacked principles:
In the event that iptables is not operating, you can activate it by running:
We will utilize a case-based way to deal with analyzing the different commands of the iptables.
We will make an extremely basic arrangement of principles to create a Stateful Packet Inspection
(SPI) firewall which will permit every single active association, however, obstruct all
undesirable approaching associations.
The above gives the following output

1. iptables -P INPUT ACCEPT - when making remote connections the standard approach
on the INPUT chain should first be incidentally set to ACCEPT generally as soon as the
present standards are flushed, the user will be bolted out of the server.
2. iptables -F - the - F change is - utilized to flush every current standard so that the user
can begin with a spotless condition from which to include upcoming guidelines.
3. iptables -A INPUT - I lo -j ACCEPT - it is an ideal opportunity now to begin including
a few standards. We utilize the - A switch to include the principle to a particular chain,
and, in this case, the INPUT chain. At that point, for interface to indicate bundles
coordinating or bound for the lo (localhost, 127.0.0.1) interface the I switch is utilized,
and lastly - j (hop) to the objective activity for bundles coordinating the principle - for
this situation ACCEPT. Hence, this principle will permit every approaching bundle
bound for the localhost interface to be acknowledged. This is largely needed as a number
of programming applications hope to have the capacity to interact with the localhost
connector.
4. iptables -A INPUT -m state --state ESTABLISHED, RELATED -j ACCEPT – this
principle performs the majority of the tasks, and in this case, the user includes it (- A) to
the chain of the INPUT. At this point, the user utilizes the M-switch to stack a module or
state. The module of the state can look at the condition of a bundle and decide whether
NEW, RELATED or ESTABLISHED. NEW alludes to approaching bundles which are
new, approaching connections which were not started by the system of the host.
RELATED and ESTABLISHED allude to approaching bundles which are a piece of an
effectively settled connection or identified with and as of now settled connection.
5. iptables -A INPUT -p tcp --dport 22 -j ACCEPT- at this point we include a principle
permitting SSH associations over the tcp port 22 to avert coincidental lockouts when
operating remote frameworks over an SSH association.

6. iptables -P INPUT DROP – The function of the P- switch is to set the standard approach
on the predefined chain. The standard approach on the chain of the INPUT is then set to
DROP which implies that if an approaching bundle is not similar to any of the
accompanying principles, it will be declined. In the event that we were interfacing
remotely by means of SSH and had not included the rules above, we would have recently
kept ourselves out of the system.
7. iptables -P FORWARD DROP- at this point, the user has set the standard approach on
the FORWARD chain to DROP as he or she is not utilizing the computer as a switch
hence there ought not to be any bundles going via his or her computer.
8. iptables -P OUTPUT ACCEPT – at this point the standard approach on the OUTPUT
chain is set to ACCEPT as the user need to permit all cordial movements.
9. iptables -L -v - lastly, the user can line (- L) the principles he or she has recently added
to confirm whether they have been accurately stacked.
3.Bro
Description of Bro
"Bro has initially been created by Vern Paxson, who keeps on driving the task now
together with a center group of analysts and engineers at the International Computer Science
Institute in Berkeley, CA; and the National Center for Supercomputing Applications in Urbana-
Champaign, IL." ^1 Liam Randall expressed amid a Shmoocon 2013 introduction that "Brother
IDS is just the principal awesome application to be composed in the Bro organize programming
dialect." at the end of the day, Bro itself isn't an IDS; rather, it's a scripting stage that is intended
to work with arrange movement.
The Bro system contrasts from numerous customary IDS as it's intended to be adaptable
and productive while being very stageful with analyzer for various conventions paying little heed
to the port they are running on. Brother IDS traverses the full range from parcel catch, movement
examination, stream recording, information cautioning, and scripting. Furthermore, the Bro
arrange security observing structure furnishes the expert with far reaching logs to drive
examination and knowledge into value-based information on the system. While open source,
business upheld is accessible by Broalla

Configuration of Bro
These are the fundamental configuration to modify to the minimal BroControl installation that
will deal with a solitary Bro case on the
Hence starting the BroControl shell
When it is the first-run through utilization of the shell, one needs to perform an initial installation
of the BroControl setup
Hence start Bro
In the event that there are errors while attempting to begin the Bro example, you can see the
points of interest with the diag command. On the off chance that began effectively, the Bro case
will start dissecting traffic as indicated by a default policy and output the outcomes in the
$PREFIX/logs
Of course, logs are composed out in comprehensible (ASCII) organization and information is
sorted out into segments (tab-delimited). Logs that are a piece of the present turn interim are
aggregated in $PREFIX/logs/current/(if Bro isn't running, the index will be vacant). For instance,
the http.log contains the aftereffects of Bro HTTP convention examination. Here are the initial
couple of sections of http.log:

Logs that the arrangement with analysis of a system protocol will frequently begin this way: a
timestamp, UID (unique connection identifier), and a connection 4-tuple (originator have/port
and responder have/port). The UID can be utilized to recognize all logged movement
(conceivably over different log documents) related with a given association 4-tuple over its
lifetime.
The rest of the sections of convention particular logs at that point detail the convention
subordinate movement that is happening. E.g. http.log's next couple of segments (abbreviated for
quickness) demonstrate a demand to the base of Bro site
The objective of most Bro organizations might be to send email cautions when a system occasion
requires human intercession/examination, yet in some cases that contentions with Bro's objective
as a conveyance to remain approach and site nonpartisan – the occasions on one system might be
less important than similar occasions on another. Accordingly, conveying Bro can be an iterative
procedure of refreshing its approach to take distinctive activities for occasions that are seen, and
utilizing its scripting dialect to automatically expand movement investigation precise.
One of the initial steps to take in tweaking Bro may be to get acquainted with the notification it
can create as a matter of course and either tone down or heighten the move that is made when
particular ones happen.
A System That Can Used To Aid Securing a Small Business
To secure a small business one can use Bro. Bro IDS (intrusion detection system) is an open
source UNIX based system NIDS or IDS which attenuate on system security in spite of the fact
that this open source is additionally offered a public stage for more typical system traffic
analysis. Also, Bro is a signature based interruption IDS (intrusion detection system) this implies
it attempts to combine a signature to network activity as follow to looks for an attack, Bro was
made by Vern Paxson in 1998, and it created more than 15 years (Stallings, 2017). This open
source works by noticed intrusion by the fastest analysis system activity after that execute event
direct an analyzer to evaluate the behavior by considering about skeptical. The looks at

incorporate investigating of specific attacks to signature and event as suspicious exercises like
atypical. Bro is ordinarily allocating as the main system connection which it is processed to
observe each traffic entering and leaving the system, furthermore, this open source gives
performances illustration, assembling, filtering and assessing the system traffic. Besides, Bro can
be dividing into two unique layers: the first is Bro event engine, this fragment assumes liability
to evaluating perform undertaking mindfulness and proceeded system movement packets by a
procedure through C++ to deliver events amid a suspicious activity happening on the system.

Bibliography
Pathan, A.S.K. ed., 2016. Security of self-organizing networks: MANET, WSN, WMN, VANET.
CRC press.
Rodriguez, R.J., Schweikert, W.R., Thornton, Y.M., Powell, W.S., Perez-Piris, E.R., Cuenco,
J.S. and Mikurak, M.G., Forcepoint Federal LLC, 2015. Science, technology, engineering and
mathematics based cyber security education system. U.S. Patent 9,159,246.
White, G.B., Fisch, E.A. and Pooch, U.W., 2017. Computer system and network security. CRC
press.
Stallings, W., 2017. Cryptography and network security: principles and practice (p. 743). Upper
Saddle River, NJ: Pearson.