10.2 Possible Security Measures

10.2 Possible Security Measures

Quick Answer: Once the policy exists, you implement it with concrete measures: disable or uninstall services you do not need, filter traffic with nftables, enforce password quality with libpam-pwquality, rate-limit brute-force attacks with fail2ban, add a second authentication factor, keep the system patched with apt update && apt full-upgrade, and encrypt the disk with LUKS at install time.

Disable or Remove Unneeded Services

Every running service is attack surface. The first hardening step is to enumerate what is active and shut down the rest:

systemctl list-units --type=service --state=running
systemctl disable --now apache2
systemctl mask apache2

disable --now stops the service immediately and removes its boot-time symlink; mask goes further by linking the unit to /dev/null so it cannot be started at all, even accidentally or as a dependency of another unit. If you genuinely do not need a package, remove it with apt purge <package> (purge also deletes configuration files, unlike plain remove). On Kali this matters doubly: with 600+ tools installed, some pull in daemons — know which ones you actually use.

Firewalling

Modern Debian and Kali use nftables (the nft command) as the packet-filtering framework, replacing the older iptables/xtables stack. Inspect the active ruleset with nft list ruleset. A default-deny inbound policy with explicit allows is the classic posture:

nft add table inet filter
nft add chain inet filter input { type filter hook input priority 0 \; policy drop \; }
nft add rule inet filter input ct state established,related accept
nft add rule inet filter input iif lo accept

For interactive use many administrators prefer the simpler ufw front end. One exam caution: Kali Linux Revealed teaches the kernel firewall as netfilter, configured from user space with iptables (IPv4) and ip6tables (IPv6). nftables is the modern replacement for that user-space stack — and on current Debian/Kali the iptables command is itself an nft-backed front end — but if a question asks for "Linux's firewall implementation" as the book states it, the answer is netfilter.

Strong Passwords and pwquality

You can enforce password strength with the libpam-pwquality PAM module — install it first (sudo apt install libpam-pwquality; it is not part of a default Kali install) and configure it in /etc/security/pwquality.conf. Key options:

A classic exam trap: by default pwquality checks apply to regular users, but root can override them with a warning — enforce_for_root closes that gap. Even the best pwquality settings cannot rescue the default live-image credentials kali/kali; change them immediately on any persistent install.

Throttling Brute-Force Attacks with fail2ban

fail2ban monitors log files for repeated authentication failures and dynamically bans the source IP address by inserting firewall rules. It is not part of a default Kali install — the book tells you to run sudo apt update && sudo apt install fail2ban first. Its architecture:

• Filters (in /etc/fail2ban/filter.d/) define the regular expressions that recognize a failed login in a given service's log.
• Jails (in /etc/fail2ban/jail.conf) pair a filter with a log path, thresholds, and a ban action.
• On Debian and Kali, the sshd jail is enabled by default via /etc/fail2ban/jail.d/defaults-debian.conf — most other jails ship disabled.

Never edit jail.conf directly — it is overwritten on package upgrades. Put overrides in /etc/fail2ban/jail.local or a new file under jail.d/:

[DEFAULT]
bantime  = 1h
findtime = 10m
maxretry = 5

[sshd]
enabled = true

Here maxretry failures within findtime trigger a ban lasting bantime. Inspect runtime state with the client tool:

fail2ban-client status            # lists active jails
fail2ban-client status sshd       # shows banned IPs and counters for the sshd jail
fail2ban-client unban 203.0.113.7 # manually lift a ban

Two-Factor Authentication Concepts

Authentication factors fall into three categories: something you know (password), something you have (phone, hardware token), and something you are (fingerprint). Two-factor authentication (2FA) combines two different categories — two passwords are not 2FA. On Linux the common implementation is time-based one-time passwords (TOTP, RFC 6238) through the libpam-google-authenticator PAM module: after enrolling a shared secret into an authenticator app, PAM demands both the password and the six-digit code. Because codes expire every 30 seconds, a captured credential alone becomes useless to a remote attacker.

Patching and Disk Encryption

On a rolling distribution, keeping the system updated is a front-line security measure, not a chore. Use sudo apt update && sudo apt full-upgrade — full-upgrade (not plain upgrade) is required on kali-rolling because it is allowed to remove packages when dependencies change; apt upgrade will install new packages if a dependency needs them but never removes one, so it holds back every upgrade that would require a removal — reporting them as "The following packages have been kept back" — and leaves the system partially updated. Subscribe to Kali's security announcements so you know which updates are urgent.

Finally, LUKS (Linux Unified Key Setup) full-disk encryption is offered by the Kali installer. It encrypts entire partitions with AES and demands a passphrase at boot, protecting confidentiality if the machine is lost or seized — essential for a laptop carrying client data. The trade-offs: you must choose it at installation time (retrofitting means reinstalling), and every boot requires the passphrase interactively, which complicates unattended or remote reboots. Some installers also offer an encrypted LVM variant; the exam point is that FDE is an install-time decision with a boot-time cost. The book pairs full-disk encryption with two more laptop measures. First, the LUKS nuke password (cryptsetup-nuke-password): a second passphrase that, when entered at the boot prompt, destroys every LUKS key slot and makes the disk permanently unrecoverable — protection for a machine that may be seized or confiscated. Second, a VPN kill switch: firewall rules that forbid all outbound traffic except through your VPN, so that when the tunnel drops you notice immediately instead of silently leaking a client's IP addresses over the local network.