Endpoint Protection · Topic 5 of 9
Linux Access, Remote Security and Security Tools
Control Linux users, passwords, sudo and PAM, secure SSH and remote access, and know Linux security tools from auditd and Lynis to Fail2ban.
- 4 min
- /etc/passwd is world readable, /etc/shadow is root only.
- Root is UID 0, and administrators use sudo.
- SSH uses TCP 22, with keys and no direct root login.
What it is
Once a Linux system is installed and hardened, the defender controls who can log in, how they authenticate, how they connect remotely and which tools watch the system. This page covers user and password management, secure remote access with SSH, and the common Linux security tools and frameworks.
How it works
Linux user access and password management
| File | Content |
|---|---|
| /etc/passwd | Account list: name, user ID, group ID, home directory, shell. Readable by everyone. |
| /etc/shadow | Password hashes and aging data. Readable only by root. |
| /etc/group | Group definitions and members |
| /etc/sudoers | Who may run which commands with elevated rights |
Key points:
- Root has user ID 0. Any other account with UID 0 is a red flag and may be a backdoor.
- Users should work as normal accounts and use sudo for individual commands, which is logged. Direct root login is disabled.
- Service accounts get no login shell and no password.
- Password aging (the chage command, or settings in /etc/login.defs) sets minimum and maximum age and warnings. Passwords are stored as salted hashes in /etc/shadow.
- PAM (Pluggable Authentication Modules) is the framework that applies authentication rules, such as password quality, lockout after failed attempts and multifactor modules.
- Lock or remove unused accounts, and review accounts with empty passwords.
- Use groups and file permissions for access, and central directories (LDAP or SSSD with Active Directory) for many systems.
Useful logs: /var/log/auth.log on Debian and Ubuntu, /var/log/secure on Red Hat family systems, and the journal.
Linux network and remote access security
SSH (TCP 22) replaced Telnet (23) and rsh because it encrypts the session. Hardening steps:
- Use key based authentication and disable password logins where possible.
- Disable direct root login (PermitRootLogin no).
- Allow only named users or groups, and use SSH protocol 2 only.
- Do not rely on obscurity: moving SSH to another port only reduces log noise and does not stop a determined attacker.
- Limit access by firewall to management networks, or place SSH behind a VPN or bastion host.
- Use idle timeouts and a limit on authentication attempts.
- Protect private keys with a passphrase.
- Replace FTP (21) and Telnet with SFTP and SSH. Remove old r-services.
Network hardening also includes a default deny firewall, disabling IP forwarding on hosts that are not routers, TCP SYN cookies and turning off unused listening services. Check what is listening with a socket listing tool and compare it to what should be.
Linux security tools and frameworks
| Tool or framework | Purpose |
|---|---|
| auditd (Linux Audit) | Records security relevant system calls and file access |
| SELinux, AppArmor | Mandatory access control |
| Fail2ban | Reads logs and bans addresses with repeated failures |
| iptables, nftables, ufw, firewalld | Host firewall |
| Lynis | Security auditing and hardening advice |
| OpenSCAP | Scans against SCAP content and CIS or STIG profiles |
| AIDE, Tripwire | File integrity monitoring |
| ClamAV | Open source antimalware scanner |
| rkhunter, chkrootkit | Search for known rootkits |
| OSSEC, Wazuh | Host based intrusion detection and log analysis |
| Snort, Suricata | Network intrusion detection and prevention |
| Nmap | Port scanning to verify what is exposed |
Frameworks and benchmarks used as a target are the CIS Benchmarks, DISA STIGs and the NIST Cybersecurity Framework.
A worked example
Logs show thousands of failed SSH logins for the root user from one address. The defender disables root login, turns off password authentication in favor of keys, restricts port 22 to the management network, and installs Fail2ban to ban repeat offenders. A Lynis report afterward lists remaining weaknesses.
How the exam asks about this
- "Which file stores Linux password hashes?" → /etc/shadow.
- "Which tool bans IP addresses after repeated failed logins?" → Fail2ban.
- "Which protocol replaces Telnet with an encrypted session?" → SSH.
What to remember for the exam
- /etc/passwd is world readable, /etc/shadow is root only.
- Root is UID 0, and administrators use sudo.
- SSH uses TCP 22, with keys and no direct root login.
- PAM sets authentication rules, and auditd records events.
- Lynis audits, Fail2ban reacts, AIDE detects file changes, Wazuh and OSSEC are host IDS.
Key based SSH is only as strong as the private key. A stolen key without a passphrase is a stolen identity.
Common mistakes
Putting hashes in /etc/passwd. Modern systems keep them in /etc/shadow, which normal users cannot read.
Allowing everyone to sudo. Sudo rules should name users and commands, and be reviewed.
Treating Fail2ban as a replacement for strong authentication. It slows guessing but does not fix weak passwords.
Check yourself
What is special about UID 0?
It is the root superuser. Any other account with UID 0 has full control and should not exist.
Why is SSH preferred over Telnet?
It encrypts the session, including credentials.
Which tool performs file integrity monitoring on Linux?
AIDE (Tripwire is another).
Topic 5 of 9 in Endpoint Protection
Test yourself on Endpoint Protection
The full EC-Council 312-38 question bank has 800 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by EC-Council. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.