Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×
Stay Ahead With Linux Security Features
identity management security tactics For years, we secured our Linux infrastructure by building walls: VPCs, security groups, and hardened SSH configurations. We treated the cloud like a virtual data center, assuming that if we kept the "bad guys" out of the network, our workloads were safe. . That model is no longer sufficient. Today, one of the most common paths from an initial compromise to a major cloud breach is the identity assigned to your Linux workload. When an attacker gains code execution on a Linux instance—through a...
Jul 17, 2026
security practices patch management Most of us don't hear about a kernel vulnerability until a CVE lands in our inbox or the vulnerability scanner starts complaining. By then, the patch isn't new anymore. Kernel developers may have been passing it around for review, arguing over the implementation, or revising it for days before anyone outside that community noticed it. None of those discussions are secret. They're sitting in mailing list archives, Git commits, and patch reviews where they've been the whole time. The strange...
Jul 14, 2026
Linux security cyber attacks Every Linux server in your fleet produces thousands of events every minute. From journald logs and auditd records to kernel-level eBPF hooks, your systems are constantly talking. Most of that noise is just the mundane churn of system services, CI/CD runners, or routine administrative automation. But among that noise, an attacker might be establishing a foothold, moving laterally, or setting up persistence. The challenge for any security team is: how do you separate the routine from the...
Jul 13, 2026
open-source infrastructure risk Security scanners flag exposed API keys in public repositories every day. The initial response is usually predictable: delete the commit, revoke the credential, and move on. That’s a mistake. . In a real Linux environment, an API key never stays in one place. By the time it hits a public repo, it’s already everywhere. It’s in the CI/CD pipeline. It’s in your container registry. It’s in the build logs. It’s in the backups. Git makes this worse because the history never dies. Deleting a file in...
Jul 11, 2026
open-source rootkit Most of us think of Linux rootkits as ancient history—the stuff of 90s hacking forums and clunky malware that would crash your system if you looked at it the wrong way. But if you think they’ve gone away, you’re mistaken. They’ve just gotten smarter. . Modern attackers aren't using the noisy tools of the past. Today’s threats are surgical. Many of today’s most advanced Linux rootkits operate at the kernel level or abuse legitimate system features to blend in with normal traffic. They’re...
Jul 09, 2026
Refine features
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Loading...
Explore Latest Linux Security features
We found -1 articles for you...
102
security advisorykernel updatesystem stabilityLinux 6.15-rc3: Security Advisory for UBLK Driver Enhancements
We, Linux security admins, are always on the lookout for kernel updates that enhance system stability and address critical bugs, and Linux 6.15-rc3 is no exception. Announced by Linus Torvalds , this pre-release kernel focuses on incremental improvements rather than groundbreaking features, making it a low-risk, high-value update for teams looking to ensure their systems remain reliable. . The release primarily targets fixes to the ublk driver, which handles block devices, as well as updates to the related self-tests that support its functionality. These fixes mitigate potential issues that, if left unchecked, could cause instability, data corruption, or unpredictable behavior on systems using block devices. With Torvalds emphasizing the relatively small but widespread tweaks across the kernel, we should run this update on a test system first before running it on our production systems. Staying current with kernel updates, such as 6.15-rc3, is a crucial practice for maintaining a secure and stable infrastructure—especially when incremental fixes help catch issues before they develop into larger problems. In this article, I'll explore what Linux administrators need to know about this release, why these fixes are crucial, and how staying up to date can prevent larger security issues in the future. Simplicity and Stability: The Core of Linux 6.15-rc3 Torvalds himself put it best by stating "there's absolutely nothing of huge note here". This statement emphasizes the intention behind Linux 6.15-rc3 as a minor yet worthwhile update designed to refine rather than overhaul the core kernel. With no major features or systemic modifications included in this release, Linux security admins have an opportunity to focus on less disruptive improvements that reduce volatility. This release is especially relevant in environments where reducing volatility may play just as significant a role as adopting cutting-edge features. Linux 6.15-rc3 offers many stability improvements. Most notable among themare tweaks made to the ublk driver to address long-standing issues. Its central role in managing block devices affects how storage interacts with the kernel. Fixing flaws in the ublk driver doesn't just correct technical issues but may also protect against potential instability, crashes, or data corruption if these issues are left unattended. Torvalds also highlighted modifications to self-tests for the ublk driver that add another layer of assurance for those relying on these fixes. Self-tests provide invaluable early warning of emerging issues before they escalate further, helping ensure predictable kernel behavior under various workloads or edge cases - an indispensable service to Linux admins who plan to deploy 6.15 in production environments. Why Security Admins Should Care About Small Fixes Linux 6.15-rc3 may seem insignificant at first glance; however, security administrators know better: incremental kernel updates like this one provide essential maintenance measures against vulnerabilities or costly downtimes that might otherwise go undetected. Block devices play an integral part in many systems, ranging from personal computing and enterprise storage solutions to cloud environments. If an error in their UBLK driver were to occur, this could create severe ripple effects that compromise not only performance but also the integrity of the data being handled by these devices - potentially opening entry points for attackers or leading to data loss altogether. Fixing bugs in drivers goes beyond improving functionality - it also protects the systems that depend on them! Self-tests accompanying these fixes guarantee their rigorous validation - an opportunity for security admins to avoid surprises once their kernel hits production. Furthermore, these self-tests not only verify specific fixes but also provide an additional layer of accountability, reassuring Linux users about the release's reliability —a particularly vital function in environments that prioritize uptime, as even slightregressions in functionality can quickly become larger operational issues. The Importance of Kernel Updates in Security Maintenance We, Linux security admins, understand that the kernel is more than just the heart of our OS; it's often one of the primary targets for attackers and a key area where harmful code can create failure points with wide-reaching effects. Prioritizing kernel updates as part of routine security maintenance is essential. LinuxSecurity has put together a guide on how to update and upgrade your Linux distro to take advantage of kernel updates like Linux 6.15-rc3 and other issues patched by your distro(s). An often-held belief among administrators managing production systems is that minor kernel updates, such as Linux 6.15-rc3, can be safely disregarded. While such releases do not significantly change existing functionality, they often patch emerging bugs that can quickly become larger issues over time if left unaddressed. A seemingly minor issue could easily turn into downtime, disrupted workflows, or a compromised security posture if left unpatched. Testing kernel updates before rolling them out across production environments is equally important. While Linus Torvalds noted the "nothing massive" nature of his fixes, each kernel update still poses a potential for unexpected compatibility problems or edge case behaviors. Security admins should use these pre-release cycles as opportunities to run tests that identify areas where an update could cause issues with current setups and environments. Preparation and proactive testing play a crucial part in ensuring smooth adoption processes. Open-Source Tools for Applying Kernel Updates Without Rebooting As open-source advocates, various tools are available to us for applying kernel updates without requiring a reboot. These tools are based on live patching, which allows critical updates to be applied directly to the running kernel. A few excellent options include: Ksplice Ksplice is a tool for updating the Linuxkernel without requiring a system reboot. It works by applying patches directly to the running kernel in memory, avoiding service disruptions. Ksplice eliminates downtime while ensuring the kernel is secure and up to date which is great for servers or systems that require high availability. KernelCare KernelCare simplifies kernel patching by automatically applying security updates to the running kernel without the need for a reboot. It periodically checks for available patches and seamlessly integrates them into the active system. This reduces downtime, improves security, and eliminates the need for manual intervention. Canonical Livepatch Canonical Livepatch is specifically designed for Ubuntu systems, enabling live kernel patching without restarting the machine. It downloads and applies patches directly to the kernel in use, focusing on critical security vulnerabilities. Using Livepatch can result in smoother system maintenance for users running production workloads on Ubuntu servers. What Happens if Issues Go Unpatched? The fixes in Linux 6.15-rc3 may focus primarily on the ublk driver, but the implications of leaving these bugs unpatched could be significant. At a minimum, failing to address driver issues can lead to performance degradation or instability for systems using affected block devices. Such behavior can compromise system reliability, causing unpredictable behavior that disrupts workloads or costs valuable time in troubleshooting. More concerning are the potential security risks associated with unpatched vulnerabilities. Even seemingly low-impact bugs can open the door for attackers to exploit systems, especially in enterprise environments handling sensitive data. Vulnerabilities may start as minor errors in system behavior but can become exploitable as hackers develop creative ways to take advantage of them. This is why vigilance about kernel updates is essential—not just for performance reasons but as part of a broader security strategy. From a practicalperspective, choosing to patch these issues ensures admins won’t need to face escalation down the line. Whether it’s preventing data corruption, avoiding unnecessary downtime, or blocking potential vulnerabilities, staying up to date with kernel releases like Linux 6.15-rc3 is a proactive way to secure systems and create long-term stability. Looking Ahead Toward the Stable Release As Linux 6.15-rc3 progresses toward becoming a stable kernel version that security administrators can depend on, pre-release cycles offer us opportunities to identify issues, collect feedback, and refine the kernel before widespread deployment. Linux administrators who participate in testing and evaluation during these pre-release cycles gain early insights into the software's practical impacts and contribute to its robustness for broader deployment. As this release candidate approaches stability, security teams should plan upgrades on an organized timeline so they can implement any officially released updates promptly. Kernel changes — even incremental ones — must be carefully integrated to minimize disruptions. Linux 6.15-rc3 is an indicator of one of the world's most widely used operating systems' ongoing efforts and commitment to security, reliability, and performance. Security-conscious administrators should take note: even minor fixes must be addressed as part of holistic system maintenance practices. Refinements to tools like the UBLK driver, as well as efforts towards self-test improvements, demonstrate that Linux is continuing its journey towards improved security, reliability, and performance - targets worth keeping an eye out for in this release, which quietly impacts stability worldwide. . Updates in Linux 6.15-rc3 enhance the ublk driver, addressing crucial stability fo issues for improved security.. linux, security, admins, always, lookout, kernel, updates, enhance, system, stabilit. . Brittany Day
Apr 22, 2025
•
102
kernel securityrootkitsecurity risksCrowdStrike Incident Overview: Kernel Security Risks and Safety Measures
Balancing strong security measures while minimizing operational risks is a constant juggling act in cybersecurity. The recent global outage caused by that bad CrowdStrike update underscores the risks of relying on kernel-level modules for security. . In this article, we'll dive into that incident, discuss the dangers of kernel-level security, and look at some examples of Linux rootkits and kernel security modules. Plus, we'll share some handy tips to help Linux administrators prevent such disasters in the future. What Happened to CrowdStrike’s Kernel Module? CrowdStrike released a software update in July 2024 for its Falcon monitoring product. Falcon is a kernel-level security module for Windows, which means it operates extremely deep within the operating system. This update was flawed and proved to be disastrous. The bug caused a chain reaction that brought down critical systems worldwide. The compromised systems at airports caused massive delays. Given the nature of their work, you can imagine how terrifying it is for hospitals to experience operational disruptions. Even banks were not spared. This led to financial chaos and downtime. This incident is a stark reminder of the risks associated with integrating security modules at a deep level. This can have devastating, sweeping effects when something goes wrong on the kernel level. This is a perfect example of the high-stakes game we play regarding cybersecurity. One minor glitch can bring critical infrastructures around the world to a halt. It warns everyone in the tech and security industries about the importance of rigorous testing and careful deployment, especially with something as fundamental as kernel-level software. Understanding Kernel Drivers Windows and Linux are built around a component called the "kernel." The kernel is responsible for critical functions, such as managing system resources and controlling hardware operations. The kernel can be modified to support new hardware and functionalities using "drivers."Drivers are usually required for new hardware like GPUs, but they can also perform other functions, such as cybersecurity. Kernel Level Security Modules Security software uses Kernel-level drivers to operate at a very low level of the OS. They can monitor and control basic operations like network connections and file access, allowing a comprehensive defense from malware and other cyber threats. However, embedding the security functionality within the kernel poses substantial risks. Unlike typical software bugs, kernel code flaws can cause severe system failures, which may only cause isolated crashes. What Does This Mean for System Administrators? The CrowdStrike failure highlights the risks that system administrators face, especially those who manage Linux environments and rely on security integrations at the kernel level. The risks include widespread system instability, complicated recovery processes, cascading failures, and complex recovery procedures. Linux administrators are at greater risk due to the custom kernels they use, their reliance on dependencies from open-source, and the need for careful patch management. This incident highlights the importance of robust testing, progressive updates, and diverse security measures to protect system stability and integrity. Kernel-level Integration Risks The risks of kernel-level integrations for system administrators and Linux users cannot be understated. System Stability Kernel drivers have full access to all critical system functions. One bug can cause widespread system failures. Recovery Is Complex: Fixing problems often requires manual intervention, such as booting in recovery mode and applying low-level fixes. This can be laborious and time-consuming. Cascading Failures: As shown in the CrowdStrike case, kernel-level bugs can cascade failures on interconnected systems, increasing the impact. Linux Administrators are at Risk As a Linux admin, I quickly learned that managing security was a complex challenge. Acolleague working as an administrator for a mid-sized company discovered that the network had been compromised by a sophisticated rootkit at the kernel level. The rootkit was undetectable despite the company's strict security protocols, allowing the attacker to steal sensitive customer data over weeks. Only after noticing abnormal network traffic patterns was the breach detected. This experience highlighted the specific risks we, as Linux administrators, face. We must always stay on top of the evolving threats. Kernel vulnerabilities can be devastating, giving attackers access to deep and often undetectable information. To ensure that the systems I manage remain as secure as they can be, I no longer just rely on routine patches and updates but also take advanced measures such as implementing robust security modules, performing regular audits, and ensuring continuous monitoring. This story is a constant reminder to remain vigilant and maintain the integrity and safety of Linux environments. Linux's stability and robustness are often its greatest strengths, but these can be vulnerabilities if kernel-level security modules are involved. Customized Kernels: Many Linux systems use kernels tailored to meet specific needs. Third-party kernel drivers may disrupt these carefully tuned systems. Open-Source Dependencies: Linux administrators rely on many open-source components that may need to be tested rigorously for compatibility with the latest kernel modules. Patch Management: Linux distributions are decentralized, so updates and patches must be managed carefully. This is because they must ensure stability. Linux Rootkits and Their Effects In my research into the effects of Linux Rootkits, I've looked at several famous examples that have historically compromised Linux Systems. Adore , Knark , and Phalanx2 are three examples that demonstrate remarkable abilities to conceal malicious activities and avoid detection. Adore, which provided hidden backdoors to intruders, wasespecially insidious. Knark, on the other hand, manipulated kernel operations to remain undetected. Phalanx2 was notable for its combination of hiding abilities and keylogging, allowing it to steal sensitive data efficiently. These studies have shown rootkits can lead to prolonged unauthorized access and significant data breaches. Rootkit: Adore (2000) Adore is one of the first well-known rootkits available for Linux. It allows an attacker to hide files, processes, and network connections. Effect: Administrators discovered hidden backdoors, which compromised the integrity of systems. Adore’s ability to conceal its presence rendered traditional detection methods useless, and many systems were unknowingly exposed to long-term spying. Rootkit: Knark (2001) Knark manipulates the Linux kernel to intercept and control calls. It could hide users, files, processes, and even admin tools from standard admin tools. Effect: Infected systems are virtually undetectable, which allows attackers to conduct covert operations like data exfiltration or extended control of the compromised system. Rootkit: Phalanx2 (2003) Phalanx2 has been designed as a sophisticated rootkit to backdoor Linux. It can hide directories, files, and processes and log keystrokes. Phalanx2 combined its hiding abilities and keylogging to cause severe data breaches. These included the theft of sensitive credentials and intellectual property, which extended the attacker's ability to control the infected system. Rootkits: A Parallel Threat Rootkits are another issue that Linux administrators should be concerned about when it comes to kernel-level integration. These malicious programs insert themselves insidiously into the Linux kernel, avoiding detection and maintaining persistent control over the computer. Rootkits: How Do They Work? Rootkits can hide their presence by altering core operating system components: Rootkits can hide themselves by injecting code into the kernel. They can interceptsystem calls, modify kernel data structures, and evade anti-virus tools. File and Process Hider: Rootkits can hide files, directories, and processes, making detection more difficult. Keystroke Logging & Credential Theft: Rootkits often include functionality that allows them to steal sensitive information, such as user credentials, data, and other sensitive information, directly from operating systems. Rootkits: How Do They Impact Security and Integrity Rootkits compromise vital components and allow attackers to alter system files or hide from detection mechanisms. This section highlights the potential threats, including data breaches, unauthorized data manipulations, and possible system downtimes. The section also highlights the broader implications of IT environments for trust and reliability. This report highlights the need for proactive measures such as regular audits and advanced detection tools. Comprehensive security protocols are also necessary to reduce these risks. A rootkit is a serious threat to the integrity and security of any system. Invisibility: Because rootkits are so low-level, they may be undetectable by traditional security tools. This allows the attacker to remain undetected in the system for long periods. Data Integrity: Rootkits can alter system logs, monitor traffic, and change application behavior, making it difficult to trust data or activities on a compromised machine. They grant attackers root-level privileges, which allows them to take any action they want on the system, including exfiltrating information or deploying more malware. Examples of Linux Kernel Security Modules There are several examples of how Linux kernel modules can enhance system security. SELinux and AppArmor are three prominent solutions. SELinux uses mandatory access controls to enforce strict policies. On the other hand, AppArmor uses path-based control to specify file permissions. TOMOYO, on the other hand, focuses more on policy learning to create customsecurity profiles that are tailored to specific system behavior. In my research, I've learned how these modules collectively strengthen the security of Linux systems by providing robust mechanisms for managing permissions and enforcing security policies. Module: SELinux (Security-Enhanced Linux) Purpose : Designed to provide a robust and flexible Mandatory Access Control (MAC) mechanism for Linux. Function : SELinux enforces security policies that limit program and user capabilities, tightly controlling access permissions to reduce the risk of system exploitation. Module: AppArmor (Application Armor) Purpose : Provides a security framework that protects operating systems and applications from external or internal threats. Function : AppArmor uses profiles to define permissible actions for applications, preventing them from performing unauthorized actions. Module: Seccomp (Secure Computing Mode) Purpose : Designed to limit the system calls that applications can make, thereby reducing the attack surface. Function : Seccomp is used to sandbox programs by allowing them to execute only a specific subset of system calls, making it harder for attackers to exploit vulnerabilities within those applications. Kernel Security Issues: How Can I Reduce Risk? Kernel-level security issues can pose significant risks to your Linux systems, making it crucial to have a strong defense strategy. As a Linux admin, you know these vulnerabilities can lead to severe consequences, including system breaches and data loss. This guide provides practical recommendations to help you mitigate these risks and protect your systems from potential rootkit threats. Let's dive into some essential steps you can take to fortify your kernel security. Secure Your Policies Establish and enforce sound security policies based on the principle of least privilege. Access to critical resources should only be granted on a need-to-know basis. Regularly review and update your policies to stayon top of new threats. Stay up to date with the latest updates. It is essential to keep your system updated. Developers patch kernel vulnerabilities regularly, so you want to keep your system safe. Automate updates whenever possible and create a bulletproof process for emergency patches. Use Advanced Security Modules Frameworks such as SELinux and AppArmor can boost your system's safety. These advanced modules enforce strict access controls, making breaches harder to commit. Make sure they are configured correctly and monitored. Real-Time Monitoring and Auditing Continuous monitoring and auditing will help you monitor your system's activities. Tools such as an Intrusion Detection System (IDS) and security Information and Event Management (SIEM) are used to detect suspicious behavior before it becomes a problem. Layer your security measures. Adopt a defense-in-depth strategy, layering several security controls to avoid a single failure point. When one security measure fails, other measures can keep your system safe. Perform Regular Security Audits Conduct security audits and risk assessments regularly to detect potential vulnerabilities. Third-party security experts provide unbiased views and can make actionable suggestions for improving your defenses. Use rootkit scanners to detect possible exploits. Containerization and Virtualization Virtualization and containerization are great ways to separate workloads. By isolating services and applications, you can reduce the risk that a single security breach will compromise your entire system. Keep in touch with the Security Community. Engage with the cybersecurity community to stay informed about the latest threats. Participate in forums, open-source projects, and security conferences for insights and to keep up with possible risks. Follow these guidelines to reduce the risk of rootkits. Layered, comprehensive security will make your system resilient and ready for anything. Keep Learning about Rootkits and KernelSecurity Modules CrowdStrike poignantly reminds us of the dangers of relying solely on kernel-level modules for security. Rootkits are a parallel threat, highlighting the need to be cautious when extending the kernel. Kernel-level security provides unparalleled control and access, but the possibility of catastrophic failures should something go wrong requires a balanced approach. Linux administrators must be vigilant due to the OS's decentralized nature and customization ability. Organizations can improve their security posture by implementing rigorous tests, adopting phased deployment strategies, leveraging diverse tools, maintaining robust recovery protocols, and being vigilant about rootkits. The ultimate goal is to build a flexible and resilient security framework capable of coping with the threats it was designed to counter and the vulnerabilities it might inadvertently introduce. . The CrowdStrike case emphasizes the need for strong kernel-level security for Linux admins to protect systems from privilege escalation, module manipulation, and data exposure risks. Kernel Security, Rootkit Threats, CrowdStrike Risks, Linux Administrators, Security Modules. . Dave Wreski
Jul 21, 2024
•
102
security advisorysystem stabilitySELinuxRHEL 9.4 Security Enhancements: Leading Cybersecurity Innovations
In the evolving cybersecurity landscape, staying ahead of threats while ensuring system stability and compliance is paramount for businesses and developers. Red Hat Enterprise Linux (RHEL) version 9.4 emerges as a beacon of innovation and security, encapsulating the best open-source technology to meet these challenges head-on. . As a cornerstone of enterprise environments, RHEL's latest release brings forth myriad enhancements and features designed to bolster the security and compliance posture of Linux systems. This article delves into the critical security advancements in RHEL 9.4, demonstrating how they contribute to creating a more secure, efficient, and compliant Linux operating environment for enterprises and developers. How Is RHEL 9.4 Leading the Charge in Cybersecurity and Technological Innovations? RHEL 9.4 marks a significant leap in cybersecurity enhancements, signaling Red Hat's commitment to staying at the forefront of security and technological advancements. With updates spanning from SELinux policy customization capabilities to cryptographic standards enhancements and container security improvements, this release is poised to address the pressing security concerns faced by today's enterprises. Notably, the inclusion of deny rules in SELinux, advancements in cryptographic protocols through OpenSSL and libkcapi, and bolstering container security via Keylime for trusted computing underscore Red Hat's focus on delivering a secure and robust platform. Introducing customizable TLS/SSL encryption settings for Rsyslog and passwordless authentication configurations heralds a new era of secure system administration and identity management. In embracing these enhancements, RHEL 9.4 offers businesses and developers a secure, stable foundation for deploying critical applications, ensuring compliance, and safeguarding against the evolving landscape of cyber threats. This release exemplifies how open-source technology continues to drive innovation in cybersecurity, offering the Linuxcommunity a platform that is not only technologically advanced but also rigorously secured against future vulnerabilities. Whether managing enterprise infrastructure, developing applications, or ensuring compliance, the security-focused improvements in RHEL 9.4 underscore its value as an essential tool in your cybersecurity arsenal. As we explore the depths of these enhancements, it becomes evident that RHEL 9.4 is not just an update but a substantial stepping stone towards a more secure and compliant future in the open-source ecosystem. SELinux Enhancements In the security realm, RHEL 9.4 introduces SELinux userspace release 3.6, which stands out for adding deny rules . This feature opens up new avenues for tailoring SELinux policies with greater precision, allowing users to refine access controls and enhance their systems' overall security posture. Cryptographic Upgrades The Red Hat Enterprise Linux (RHEL) 9.4 release bolsters its security posture with several cryptographic upgrades to improve security across network communications and data encryption processes. One critical area where these upgrades manifest is in the control over Message Authentication Codes (MACs) within Secure Shell (SSH) policies. Understanding MACs in SSH Message Authentication Codes are essential components of secure communications. They act like seals on an envelope, ensuring the data inside hasn't been tampered with during transit. In the context of SSH, widely used for secure remote access to Linux systems, MACs help confirm the integrity and authenticity of the data exchanged between the client and server. Cryptographic Policy Enhancements In RHEL 9.4, cryptographic policies have been fine-tuned to give users more detailed control over these MACs. Security-conscious administrators can now define their systems' MAC algorithms when establishing SSH connections. With varying degrees of strength and performance across different MAC algorithms, administrators can tailor their SSH configurations to balancesecurity needs with system efficiency. Imagine cryptographic policies as rules that guide how your system approaches encryption and security protocols. These policies might have been broader in the past, adhering to preset security levels (e.g., DEFAULT, LEGACY, FUTURE). With the updates in RHEL 9.4, the policies become more granular, allowing an admin to specify the exact MACs acceptable for use, thereby fine-tuning the system’s security by enabling or disabling certain algorithms as needed. Additional Cryptographic Upgrades in RHEL 9.4 The text provided outlines advancements beyond SSH MAC control: OpenSSL TLS Toolkit : OpenSSL now supports a drop-in directory for provider-specific configuration. This means customized security settings, including new encryption algorithms or security protocols, can be integrated into OpenSSL's configuration without altering the core configuration files, facilitating a more modular and manageable approach to custom cryptographic setups. stunnel TLS/SSL Tunneling Service : With version 5.71, stunnel provides enhanced support for modern PostgreSQL clients and modifies how it operates when RHEL is in Federal Information Processing Standards (FIPS) mode. FIPS mode enforces stricter cryptographic standards and algorithms in compliance with government security guidelines. The behavior changes in stunnel ensure that it remains compliant in these high-security environments. libkcapi 1.4.0 : This update introduces new tools and options, like specifying target filenames when calculating hash sums with a new -T option. Such features add to the toolkit for managing cryptographic operations adhering to improved and updated standards. The RHEL 9.4 release brings about a significant leap in cryptographic control for the average Linux user concerned with security. From establishing airtight SSH sessions with precise MAC algorithm settings to leveraging updated cryptographic tools compliant with modern standards, RHEL 9.4 offers the community a platform wheresecurity is at the forefront and customization is key. Users can be confident their systems are equipped to handle the evolving threats in the cyber landscape while maintaining compliance with stringent security regulations. Container Security Security within containers also sees a boost, including Keylime server components (the verifier and registrar) as containerized entities, facilitating their deployment more securely and isolatedly. Keylime is an open-source project that provides highly scalable remote attestation and automated remediation for cloud and edge computing environments. The aim is to enhance these infrastructures' security by ensuring that remote machines' hardware and software configurations meet certain trustworthiness criteria before they are allowed to perform specific functions or access certain data. Integrating Keylime in RHEL 9.4 helps organizations meet stringent hardware and software integrity verification compliance requirements. By automating the attestation process, organizations can ensure continuous oversight and control over the security state of their infrastructures, essential in industries subject to heavy regulations like finance, healthcare, and government sectors. Rsyslog Enhancements The update to the Rsyslog system is also significant. It introduces customizable TLS/SSL encryption settings and additional options for capability dropping, contributing to logger security enhancements. Identity Management For Identity Management, RHEL 9.4 offers the capacity to enable and configure passwordless authentication in SSSD using biometric devices compatible with the FIDO2 specification, such as YubiKeys, thereby promoting usability and security. Red Hat Enterprise Linux (RHEL) 9.4 introduces several enhancements and new features to its Identity Management (IdM) capabilities. One notable development is the improved integration with external identity providers (IdPs) through support for the OAuth2 device authorization flow. This enhancement enablesIdM users to be associated with external IdPs more seamlessly, facilitating a more integrated and secure authentication experience across different platforms and services. Additionally, the update to RHEL 9.4 includes significant improvements in managing identities and system configurations, aiming to streamline administrative tasks and bolster security. While the specific details of all the identity management features in RHEL 9.4 are vast, emphasizing the OAuth2 integration highlights Red Hat's focus on modernizing authentication mechanisms and enhancing security frameworks to support contemporary cloud-native applications and services. General Security Stability While the release notes focus on feature introductions and updates, it's essential to recognize that each version of RHEL undergoes rigorous security testing and hardening. In RHEL 9.4, users can expect a secure, stable, and robust platform for deploying and running essential applications. These highlights represent Red Hat's continued focus on delivering a secure, enterprise-ready operating system that addresses modern businesses' evolving threats and compliance requirements. The updated security features in RHEL 9.4 will help users fortify their systems against unauthorized access and protect sensitive data while modernizing and streamlining security management tasks. Our Final Thoughts on RHEL 9.4 The RHEL 9.4 release brings about a significant leap in cryptographic control for the average Linux user concerned with security. From establishing airtight SSH sessions with precise MAC algorithm settings to leveraging updated cryptographic tools compliant with modern standards, RHEL 9.4 offers the community a platform where security is at the forefront and customization is key. Users can be confident their systems are equipped to handle the evolving threats in the cyber landscape while maintaining compliance with stringent security regulations. . RHEL 9.4 strengthens organizational safety through innovative capabilities,emphasizing encryption, SELinux enhancements, and user identity governance.. RHEL 9.4 Features, Enhanced Security in RHEL, SELinux Improvements, Cryptographic Security Upgrades. . Dave Wreski
May 09, 2024
•
102
system stabilityopen source distributioninstallation guideRocky Linux Installation Guide: Step-By-Step Process for Enterprises
With the increasing popularity of Linux over the years, and the various Linux distributions that are constantly being released, it can be hard to choose the correct one for you. Because Linux is open source, and is not overseen by a specific vendor, knowing and picking the correct distribution can be challenging, however, no matter your requirements, you are bound to find a Linux distribution that suits your needs. . In this guide, we will explore Rocky Linux, why it is starting to become a good choice for enterprises, and how to get an image running on a virtual machine. What is Rocky Linux? Rocky Linux is a free linux distribution, forked off from CentOS, with the intention to eventually replace CentOS when Red Hat decided to step away from it. It is compatible with the RHEL operating system source code which makes it an ideal operating system for many use cases. Being that it is 100% compatible with Enterprise Linux, it makes it kind of a simple, drag and drop-in solution. Furthermore, not only is it very stable and user-friendly, but it is also a perfect choice for your servers and desktop applications. Being that a lot of administrators widely use CentOS and have been looking for a workaround ever since RedHat discontinued support, Rocky Linux was and is the perfect choice. The Co-Founder of CentOS is also the founder of Rocky Linux so with high promise and potential, not only did he try to create something sustainable and something to replace CentOS, but he also created something that could tackle the issues of CentOS. The result: an operating system with high functionality, great security, and very adaptable to any situation. How Does It Compare to Its Predecessor, centOS? The single most essential feature of CentOS for users was its binary compatibility with RHEL. CentOS featured all of the features that made RHEL the leading enterprise-class Linux. If you wanted to run industry standard technology without having to deal with corporate, CentOS was the man for the job! However, justas quickly as CentOS rose, it quickly fell. Red Hat discontinued support for CentOS leaving users and companies alike with no replacement. Following the demise of CentOS, Rocky Linux has received widespread adoption and community support, and its future seems quite promising. It runs well as a server since it is built on RHEL's reliable source code, and it can thus be utilized to power multiple production workloads. When Red Hat changed the relationship between future development by Fedora to development for CentOS, it was no longer a stable version of RHEL. Rocky Linux on the other hand was built to be a better, more stable version of RHEL and CentOS, whilst still running off the RHEL binaries. To say the least, ever since its release, Rocky Linux has then grown to one of the biggest distributions today. Pros of Rocky Linux Compatibility Rocky Linux's compatibility with Red Hat Enterprise binaries increases efficiency and reassures many customers about the distribution's performance. Moreover, Rocky Linux makes it easy to migrate from CentOS, Alma Linux and other distributions using one tool. Rocky Linux also has fixed Cloud apps and container images being used without issue. Open Source The fact that Rocky Linux is open source is one of its most notable features, which has helped to create a sizable and cohesive support community for it. Uninterrupted and free from any obstacles, it can offer a variety of updates to meet user needs and offer a full level of security, giving users hope for a successful future for Rocky Linux as a desirable replacement for its precursor. Stability Since Rocky Linux was developed to take the position of CentOS, it should emphasize the stability of CentOS as its key characteristic and perform flawlessly in this area to win over people. As a result, Rocky Linux prioritizes system reliability despite systems with recent updates and instability. Support Before the release of Rocky Linux, the developer was aware of the requirements of CentOS users and theuseful features of CentOS that were crucial for its users, so he made the decision to stick with the open-source path and establish a sizable and potent support community so that users could choose this distribution for their activities without any concern. Cons of Rocky Linux Still too soon Although the operating system is still in its early stages, future plans are already being prepared. The frequency of updates will depend on how dedicated the community is and how strong the financial support is. Currently, several major corporations serve as sponsors. How long this assistance will really be provided, though, is unclear. Updates It always takes time for new apps to get live. Rocky Linux, the CentOS replacement, has up to this point operated extremely steadily on every server, much like CentOS. However, since rolling releases and regular updates are the norm here, you will probably choose CentOS Stream if you always want to have the most recent version of the operating system. Rocky Linux operates substantially more slowly in contrast. Users that appreciate durability will find the system more suited as well as developers who want a distro that releases updates constantly. Is Rocky Linux Secure? One of the primary goals when creating Rocky Linux was to maintain stability whilst also being secure at the enterprise level. Now, with the release of Rocky Linux 9 not too long ago, we have received just that. Below are just a few of the security features that were implemented: Since the cryptographic hash functions generated by SHA-1 are no longer regarded as secure, the use of SHA-1 message digests for cryptographic purposes has been discouraged. OpenSSL has significant enhancements in version 3.0.1, including support for additional protocols, formats, algorithms, and more. Other changes include a provider concept, a new versioning system, an enhanced HTTP(S) client, and more. The most notable change in OpenSSH 8.7p1 is the substitution of the SFTP protocol for the SCP/RCPprotocol, which provides more predictable filename processing. Significant improvements have been made to SELinux speed, memory overhead, load time, and other factors. Moreover, being that Rocky Linux heavily relies on released security package updates from RHEL, it is safe to say that it will continue to remain secure. How To Install Rocky Linux When it comes to installing Rocky Linux, you can either opt for Rocky Linux 8 or Rocky Linux 9, RL9 being the latter rather than the former. Although RL8 is still very usable, there are notable differences between the two versions. In comparison to RHEL and RL8, Rocky Linux 9 now ships with Apache HTTP Server 2.4.51 and nginx 1.20 support, support for MariaDB 10.5, MySQL 8.0, PostgreSQL 13, and Redis 6.2, support for Varnish Cache 6.6 and Squid 5.2 as proxy caching servers, new versions of popular dynamic programming languages such as Node.js 16, Perl 5.32, PHP 8.0, Python 3.9, and Ruby 3.0, and support for OpenSSL 3.0.1, OpenSSH 8.7.01, and automatically configured compliance settings for PCI-DSS, HIPAA, and DISA. With that being said, let's get into the install! The most recent download link for Rocky Linux can be found download , as well as different architectures, different ISOs whether it be DVD, minimal, boot, or torrent, and finally, you can find a checksum of said downloaded file to confirm the integrity of the download beforehand. If you are on a Linux system, you can run the command below to download using wget: wget Once downloaded, if you’d like to perform a checksum, you can run the following command below: wget Afterwards, you should have a checksum file called CHECKSUM in the respective directory. Run the command below to confirm the checksum: sha256sum -c CHECKSUM --ignore-missing If everything is successful, you should be greeted with the following message: Rocky-9.0-x86_64-minimal.iso: OK Depending onthe ISO you used, the name will vary e.g x86_64-minimal.iso, x86_64-boot.iso, or x86_64-DVD.iso. Once done, we can move ahead with the installation. For many use cases, you will find yourself creating a bootable USB unless you are using a software such as VirtualBox or VMWare. For this example, we will be using VirtualBox to simulate one possible use case. Virtual Box Setup Step 1: Assign a name Step 2: Configure Machine Settings Here we are configuring the “Motherboard” so to speak. Here you can configure the amount of RAM, the boot order, chipset, so on and so forth. For the boot order, you want to have the floppy/optical options first to load our OS onto the Virtual Hard Drive. After installation, we then put the Hard Disk as the first option. Here, we are configuring the processor(s) and execution cap. At an enterprise level, if you plan to use the virtual machine for intensive loads, then a higher processor amount will most likely be needed. Step 3: Configuring Storage Here we are configuring the Optical Drive which is used to load the ISO file onto the virtual machine. Make sure to click on “Choose a disk file…” from the dropdown menu after clicking the blue CD icon. Afterwards, it should look something like this: Step 4: Configure Network Settings Here we are configuring the network settings. Depending on how you would like to use Rocky Linux, and considering you have the hardware to support these virtual machines such as a rack, you might want to bridge this to your network. Things such as DNS servers, DHCP servers, etc require this to be bridged rather than using something like NAT. Installation: Once everything is set up properly, we can launch up our virtual machine. After doing so, you should be greeted with this screen: For this instance, we will be selecting the second option. After selecting that, you will be greeted with a welcome screen like below: Here, we select the language that we want our serverto run. Here, you can configure a couple of things. Firstly, we can configure network settings like below: We can also configure security settings and profiles. The great thing about Rocky Linux is that they have pre-made and pre-configured security profiles that you can choose from. They range from low-level security to enterprise-grade fortress-like security. For this instance, we used a very low-level security profile. We can also configure storage settings and create partitions as needed, however, for this instance I will be using the standard configuration. We can also choose how we want to set up our instance of RL9 (base environment) as well as any software such as making RL9 a DNS server or DHCP server. After going through everything and the install finishes, you will be prompted to reboot your system: After you reboot your machine, you should be greeted with the following screen below: Here, we select the first option and it should take us to this screen: When you get to this screen, just click on start setup. One of the reasons why RL9 is so popular is for its ability to make a Linux server operate with a GUI, plus it being completely open-source, hence FREE! After you click on that button, you should see this screen Here, we can connect any accounts that we may have. After doing this step, or skipping it, you should see this as shown below: This is the account creation process. You first input your name and username as shown above and you will then be greeted by the screen below: Here you will set a password. For this instance, I set a low-security password that could probably be cracked. Our suggestion would be to use randomized passwords or something big in length with a mixture of lowercase and uppercase letters, numbers, and special characters. After that, we should finally be at this screen as shown below: Finally, we have installed RL9! Depending on how you set up your instance, you may have different tools,settings, and security configurations however, this is the general greeting screen you will see. The reason why RL9 is such a game changer is because they’ve basically provided administrators with a fully capable, enterprise-level distribution of linux that is full GUI. Tools such as DHCP set up, DNS set up, and so forth are all within a GUI. It is essentially the windows server of linux so to speak. Rocky Linux 9 is not only ready for high, operation-intensive enterprises, but it is doing so in style making it easier for administrators. Final Thoughts There is a distinction between a Linux workstation and a server. The distribution you choose may have an impact on the performance of your server which is why it is critical to select the appropriate Linux distribution for your needs. For the same reason, this is why Rocky Linux is a gift to many Linux users and admins alike who grieve the loss of CentOS 8.0 and are not fans of Fedora. Users and admins migrating from CentOS to Rocky Linux will be pleasantly pleased by the distributions familiar appearance and feel. Moreover, Rocky Linux is very easy to navigate and traverse for new Linux users making it a great choice for many use cases. . Rocky Linux is quickly becoming a preferred choice for businesses after CentOS's discontinuation, offering stability, security, and easy RHEL compatibility. Rocky Linux Installation, Open Source Distro, Secure Linux Systems, Enterprise Support. . Brian Gomez
Sep 26, 2022
•
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!