Mitigation to secure files and file systems (en)

General Mitigations:

• Update the System Regularly:
  • Install system updates regularly to fix known security vulnerabilities. Use the command `sudo apt update && sudo apt upgrade`.
• Use a Firewall:
  • Configure a firewall (e.g., UFW) to block unnecessary traffic to your system. This will help prevent external attacks.
• Manage Users:
  • Create user accounts with minimal access rights. Avoid using the root account for daily tasks.
• Back Up Data:
  • Regularly back up your data to safeguard against damage or data loss.
• Install Antivirus:
  • Although Linux is relatively secure from viruses, installing antivirus software is still recommended, especially if you frequently download files from the internet.
• Monitor System Logs:
  • Check system logs regularly to detect suspicious activity.

Mitigations for Files and File Systems:

• Set Permissions:
  • Use the `chmod` and `chown` commands to properly set file and directory permissions. Ensure only authorized users have read, write, or execute access.
• Encryption:
  • Encrypt sensitive files using tools like `gpg` or `openssl`. This will protect your data if the files fall into the wrong hands.
• Use Secure File Systems:
  • Consider using file systems with additional security features, such as Btrfs or ZFS.
• Avoid Executing Untrusted Files:
  • Never execute files you do not trust or those from unverified sources.
• Check File Integrity:
  • Use checksums to verify file integrity. This will help you detect if files have been altered or corrupted.

Mitigations for Specific Vulnerabilities:

• OverlayFS Vulnerability:
  • Ensure you are using the latest Ubuntu kernel version that has patched this vulnerability (CVE-2023-2640 and CVE-2023-32629).
• Other Vulnerabilities:
  • Stay informed about the latest security updates for Ubuntu and other operating systems to learn about new vulnerabilities and how to address them.

Firewall Configuration Example (UFW):

# Allow SSH connections
sudo ufw allow ssh

# Allow HTTP and HTTPS traffic
sudo ufw allow http
sudo ufw allow https

# Deny all other incoming traffic
sudo ufw deny

# Enable the firewall
sudo ufw enable

Permission Setting Example:

# Create a directory with 755 permissions (rwxr-xr-x)
sudo mkdir -m 755 my_secure_directory

# Change file owner and group
sudo chown user:group my_file

Important:

• Adapt the above mitigations to suit your needs and environment.
• Keep your knowledge about operating system security up to date.
• Follow the best security practices recommended by the Ubuntu community.

Interesting Links

• Forensic: IT
• Ubuntu Documentation: [1](https://help.ubuntu.com/)
• DCloud: [2](https://dcloud.co.id/blog/cara-mitigasi-kerentanan-os-ubuntu.html)