Deep security

In Part III you saw SELinux contexts, the -Z flag, and the setsebool switches. Here we go further: you write your own slice of policy, encrypt a disk, catch every touch of a file, and build a firewall that tracks connection state.

Host security is not one command. It is a set of layers, each closing its own gap. We start by checking the system against a ready list instead of inventing rules from scratch.

CIS Benchmarks: a baseline instead of guesswork

A CIS Benchmark is a document with concrete settings for a system: which kernel parameter to set, which service to turn off, which permissions on which file. The Center for Internet Security maintains it, and every item is numbered and justified. Checking by hand is slow, so you use a scanner.<