Course 44 - RH Security Specialist | Episode 6: Locking Down the File System — CyberCode Academy

This episode provides a practical guide to strengthening Linux file system security, progressing from protecting shared directories against accidental or unauthorized deletions to implementing granular access controls and continuously monitoring system integrity.The lesson focuses on three essential Linux security mechanisms: the Sticky Bit, File Access Control Lists (FACL), and the Advanced Intrusion Detection Environment (AIDE). Together, these technologies provide multiple layers of protection for shared resources, user permissions, and critical system files.1. Preventing Unauthorized Deletions with the Sticky BitShared directories often require multiple users to have write access. However, traditional write permissions can create a problem: users may be able to delete or rename files created by other users.The Sticky Bit provides an additional layer of protection for these environments.Key ConceptsThe episode demonstrates how to enable the Sticky Bit using:chmod o+t When applied to a shared directory, the Sticky Bit restricts file deletion and renaming so that these operations can generally be performed only by:

The file owner
The directory owner
The root user

This makes the Sticky Bit particularly useful for shared workspaces and temporary directories where multiple users need write access without gaining control over one another's files.2. Implementing Granular Permissions with FACLTraditional Linux permissions are based on three primary ownership categories:

User
Group
Others

While this model is effective for many scenarios, it can become restrictive when a specific user needs additional permissions without changing the ownership or group structure.File Access Control Lists (FACL) provide a more granular solution.The episode introduces the primary tools used to manage ACLs:setfacl getfacl With FACL, administrators can assign specific permissions to individual users or groups while preserving the existing standard Unix permission model.Managing ACL PermissionsThe lesson demonstrates how to:

Grant read and write access to specific users
Inspect existing ACL configurations
Modify individual ACL entries
Use ACL masks to control the maximum effective permissions
Configure default ACLs for permission inheritance
Ensure newly created files and directories receive the intended access rules

This provides a much more flexible permission model for multi-user Linux environments.3. Understanding ACL MasksACL masks provide an important mechanism for controlling the maximum effective permissions available to ACL users and groups.Rather than modifying every individual ACL entry, administrators can use the mask to restrict the effective permissions applied across multiple entries.This becomes especially useful when managing complex shared directories where permissions must be adjusted without rebuilding the entire ACL configuration.The episode also demonstrates how to inspect the resulting ACL entries and distinguish between configured permissions and their effective permissions.4. Configuring Persistent ACL SupportFor ACL-based access control to remain reliable across system reboots, the underlying file system must support ACL functionality.The episode explains how mount configuration can be managed through:/etc/fstab This provides a foundation for ensuring that ACL-related behavior remains consistent as file systems are mounted and managed by the operating system.The broader lesson is that file system security is not only about assigning permissions; it also requires understanding how storage configuration affects those permissions.5. Monitoring System Integrity with AIDEFile permissions control who can access resources, but they do not necessarily reveal whether important system files have been modified.This is where the Advanced Intrusion Detection Environment (AIDE) becomes valuable.AIDE is a file integrity monitoring solution that establishes a trusted baseline of system files and later compares the current system state against that baseline.The episode introduces the process of creating the initial baseline database:aide --init Once the baseline has been established, administrators can perform integrity checks using:aide --check These checks can reveal unexpected changes to monitored files and directories.6. Understanding AIDE Change ReportsAIDE can report multiple types of file changes, allowing administrators and security teams to investigate unexpected modifications.Examples include changes involving:

File size
File metadata
MD5 checksums
SHA-256 checksums
Other monitored file attributes

The combination of multiple integrity indicators makes AIDE useful for identifying potentially unauthorized modifications to critical system components.When unexpected changes are detected, the resulting information can also contribute to a broader forensic investigation.7. Automating Integrity MonitoringManual integrity checks are useful during troubleshooting and investigations, but continuous monitoring requires automation.The episode demonstrates how AIDE checks can be scheduled through cron, allowing integrity verification and reporting to occur automatically on a recurring basis.A typical monitoring workflow becomes:Establish Baseline → Schedule Checks → Detect Changes → Review Reports → Investigate Unexpected ModificationsThis transforms file integrity monitoring from an occasional administrative task into a continuous security control.8. Building a Layered Linux File System Security ModelThe three technologies covered in this episode address different aspects of Linux security:Sticky Bit
Protects files within shared directories from unauthorized deletion or renaming.FACL<