Security hardening

# Check OS and kernel version
uname -r
cat /etc/os-release

# List installed packages and versions
dpkg -l                            # Debian/Ubuntu
rpm -qa                            # RHEL/CentOS

# Check for available updates (shows what's unpatched)
apt list --upgradable 2>/dev/null
yum check-update 2>/dev/null

# Last time the system was updated
ls -la /var/cache/apt/pkgcache.bin
stat /var/lib/apt/lists/ | grep "Modify"

# Update everything (on your own lab systems)
sudo apt update && sudo apt dist-upgrade

# Check if SELinux is running and in what mode
sestatus

# Output:
# SELinux status:                 enabled
# SELinuxfs mount:                /sys/fs/selinux
# SELinux mount point:            /sys/fs/selinux
# Loaded policy name:             targeted
# Current mode:                   enforcing     ← enforcing | permissive | disabled
# Mode from config file:          enforcing
# Policy MLS status:              enabled
# Policy deny_unknown status:     denied
# Max kernel policy version:      33

# Quick mode check
getenforce
# Enforcing / Permissive / Disabled

# View SELinux context on files
ls -Z /etc/passwd
# system_u:object_r:passwd_file_t:s0 /etc/passwd

# View context of running processes
ps auxZ | grep apache
# unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 root 1234 apache2

# View your own context
id -Z

# Set to permissive for current session (no reboot needed)
setenforce 0

# Re-enable
setenforce 1

# Permanently disable (requires reboot) — edit config
cat /etc/selinux/config
# SELINUX=enforcing  ← change to disabled or permissive

# Check if you're running in an unconfined context (unrestricted)
id -Z | grep "unconfined"

# Look for booleans that weaken policy
getsebool -a | grep "on$"               # All enabled booleans
getsebool httpd_execmem                 # Specific boolean
getsebool httpd_can_network_connect_db  # Often enabled for web apps

# Find files with permissive types (less restricted)
seinfo --permissive 2>/dev/null

# Check if AppArmor is running
aa-status
sudo apparmor_status

# Output:
# apparmor module is loaded.
# 15 profiles are loaded.
# 15 profiles are in enforce mode.   ← full restrictions
# 0 profiles are in complain mode.   ← log only, no blocking
# 3 processes have profiles defined.

# List all loaded profiles
cat /sys/kernel/security/apparmor/profiles 2>/dev/null

# Check if a specific binary has a profile
aa-status | grep apache
aa-status | grep mysql

# View profile contents
cat /etc/apparmor.d/usr.sbin.apache2 2>/dev/null

# Processes NOT covered by AppArmor (unconfined)
aa-status | grep "unconfined"

# Set a profile to complain mode (no blocking)
aa-complain /usr/sbin/apache2

# Disable a specific profile
aa-disable /usr/sbin/apache2

# Reload all profiles
apparmor_parser -r /etc/apparmor.d/*

cat /etc/hosts.allow

# # Allow SSH from the local network
# sshd : 10.129.14.0/24
#
# # Allow FTP from a specific host
# ftpd : 10.129.14.10
#
# # Allow Telnet from any host in this domain
# telnetd : .inlanefreight.local

cat /etc/hosts.deny

# # Deny all services from this domain
# ALL : .inlanefreight.com
#
# # Deny SSH from a specific host
# sshd : 10.129.22.22
#
# # Deny FTP from a subnet
# ftpd : 10.129.22.0/24

<service> : <client>

# Examples:
ALL : ALL                    # All services from all clients
sshd : 192.168.1.0/24       # SSH from a subnet
httpd : .example.com         # HTTP from a domain (note the leading dot)
ALL : LOCAL                  # All services from localhost

# View all rules
sudo iptables -L -n -v

# View NAT rules (port forwards, masquerading)
sudo iptables -t nat -L -n -v

# View specific chain
sudo iptables -L INPUT -n -v
sudo iptables -L OUTPUT -n -v

# Check if iptables is active
sudo iptables -L | grep -v "^Chain\|^target\|^$"

# View all rules
sudo nft list ruleset

# View a specific table
sudo nft list table inet filter

# Status and rules
sudo ufw status verbose

# Check UFW logs
cat /var/log/ufw.log | tail -30

# Check if fail2ban is running
systemctl status fail2ban

# View active jails and ban counts
sudo fail2ban-client status
sudo fail2ban-client status sshd

# Check banned IPs
sudo fail2ban-client status sshd | grep "Banned IP"

# View fail2ban config
cat /etc/fail2ban/jail.conf
cat /etc/fail2ban/jail.local 2>/dev/null

# Ban threshold — how many failures before a ban
grep "maxretry\|bantime\|findtime" /etc/fail2ban/jail.conf

# Lynis — system security audit tool (if installed)
lynis audit system 2>/dev/null

# chkrootkit — rootkit scanner (if installed)
chkrootkit 2>/dev/null

# rkhunter — rootkit hunter (if installed)
rkhunter --check 2>/dev/null

# Check for IDS/IPS tools running
ps aux | grep -E "snort|suricata|ossec|aide|tripwire"

cat /etc/ssh/sshd_config | grep -v "^#\|^$"