Three Linux security technologies: chroot jail, iptables, and SELinux

Linux Security Technologies

The continued popularity and rapid growth of open source software in general and the Linux operating system specifically are having a disruptive impact on proprietary software. The disruptive impacts of open source software are so pervasive that they are completely re-ordering the enterprise system strategies in many corporations globally today (Rooney, 2004). With this proliferation of open source software and the foundation being laid by the Linux operating system, there continues to be an urgent and escalating need for new security tools and applications and tools as well. Of the many security applications and tools available for the Linux operating system, the three that will be analyzed and assessed in this paper include chroot jail, iptables and SELinux. The analysis will include which organizations are sponsoring the development of each of these technologies, an explanation of how each of these technologies change the Linux operating system to make it more secure, and which types of threats each of these technologies are designed to eradicate and protect against.

chroot jail Evaluation

Originally designed and first launched in the initial release of Unix Version 7, which was first introduced in 1979, the chroot jail command limits which users have access to the root directories of UNIX. This is critically important from a system administration command standpoint, as the root directory access on a UNIX system can quickly re-order directory structures and en masse delete data and applications. During this timeframe the Berkeley System Division (BSD) UNIX was also very popular, and the vulnerability of root directory access was a very high security priority for commercial, educational and government organizations standardizing on this command. The chroot jail command was quickly integrated into the initial BSD releases due to the high priority customers of this operating system placed on its value from a security and system administration standpoint (Rooney, 2004).

There are many configuration and customization options for the chroot jail command, yet the most common use scenario is to control which user accounts have access to the root directory, / home/user directory. When this command did not exist any user could get to any location in the system, with full rights to edit, duplicate, delete or modify applications. As the UNIX kernel in Linux recompiles at application run-time, this could easily change which applications were working correctly or not (Rooney, 2004). This command also blocked unwanted access over networks connected to UNIX systems as well. Prior to this command it was possible for sophisticated users including hackers to traverse an entire network and gain access at the root level to any system they chose (Rooney, 2004). As of 2012, this command is being used to create development environments or sandboxes for testing applications and ensuring spurious or erroneous threads don't crash the system or harm other, more stable applications. This technology is now also pervasively used for creating network-wide application testing and validation for Web-based applications including social network platforms running on the Linux operating system.

Iptables evaluation

This technology is the direct result of a programmer at IBM seeing a major shortfall in the existing security in the Linux operating system. Like many other contributors to the Linux operating system, Rusty Russell, a programmer at IBM, took the initiative to create this command to avert potential security hacks via firewall deficiencies he discovered while programming TCP/IP-based applications and routines (MacVittie, 2005). What he found while programming network device drivers and communication software was the firewall code in previous Linux versions had only provided support for the UDP and ICMP commands of TCP/IP, yet not included legacy or expanded TCP/IP security parameter support (MacVittie, 2005). He also discovered that only 32-bit versions of the command were including in Linux legacy firewall support, and this represented a major risk to firewall comprehensive security levels as well (MacVittie, 2005).

Based on his testing and continued investigation, Mr., Russell created the netfilter/iptables project. Between 1998 and 2000 this technology was continually tested and validated across a range of Linux operating system server distributions and configurations. By the year 2000, this technology first appeared in Linux release 2.3.

Allocating space within memory-based tables within Linux frameworks, then using advanced programming techniques to customize Netfilter modules gives system administrators a very high level of flexibility with this technology. The Netfilter modules are specifically designed to be compatible with IP protocols including IPv4, IPv6. There have been additional enhancements to ensure compatibility with arptables to ARP integration in addition to Ethernet frames support for ebtables (MacVittie, 2005). What is also very unique about this technology is its support for a state engine within the firewall, which is very unique in an open source platform (MacVittie, 2005). Over time this technology has also had support for blocking NAT-based traffic from outside firewalls and those inbound requests outside of VPN tunneling addresses. In addition, enhancements to this technology now ensure it is compatible with iproute2 and QoS commands used often in conjunction with and across policy routers. What had started as a technology to keep Linux firewalls current is today a foundation for many of the security strategies in place for enterprise-wide deployments of this operating system.