Cybersecurity for Small Networks A No-Nonsense Guide for the Reasonably Paranoid (Seth Enoka)（Z-Library）
Cybersecurity
A guide to implementing DIY security solutions and readily available technologies to protect home and small-office networks from attack. This book is an easy-to-follow series of tutorials that will lead readers through different facets of protecting household or small-business networks from cyber attacks. You’ll learn how to use pfSense to build a firewall, lock down wireless, segment a network into protected zones, configure a VPN (virtual private network) to hide and encrypt network traffic and communications, set up proxies to speed up network performance and hide the source of traffic, block ads, install and configure an antivirus, back up your data securely, and even how to monitor your network for unauthorized activity and alert you to intrusion.
9
Views
Registered users can read the full content for free
Register as a Gaohf Library member to read the complete e-book online for free and enjoy a better reading experience.
Page
1
C Y B E R S EC U R I T Y F O R S M A L L N E T W O R K S A N O - N O N S E N S E G U I D E F O R T H E R E A S O N A B L Y P A R A N O I D S E T H E N O K A
Page
2
(This page has no text content)
Page
3
CYBERSECURITY FOR SMALL NETWORKS
Page
4
(This page has no text content)
Page
5
San Francisco C Y B E R S E C U R I T Y F O R S M A L L N E T W O R K S A N o - N o n s e n s e G u i d e f o r t h e R e a s o n a b l y Pa r a n o i d by Seth Enoka
Page
6
CYBERSECURITY FOR SMALL NETWORKS. Copyright © 2023 by Seth Enoka. All rights reserved. No part of this work may be reproduced or transmitted in any form or by any means, electronic or mechanical, including photocopying, recording, or by any information storage or retrieval system, without the prior written permission of the copyright owner and the publisher. First printing 26 25 24 23 22 1 2 3 4 5 ISBN- 13: 978- 1- 7185- 0148-5 (print) ISBN- 13: 978- 1- 7185- 0149-2 (ebook) Publisher: William Pollock Managing Editor: Jill Franklin Production Editors: Paula Williamson and Katrina Horlbeck Olsen Developmental Editors: Jill Franklin and Eva Morrow Cover Illustrator: Gina Redman Interior Design: Octopod Studios Technical Reviewer: Kyle Rankin Copyeditor: Kim Wimpsett Compositor: Scribe Inc. Proofreader: Scribe Inc. Indexer: BIM Creatives, LLC For information on distribution, bulk sales, corporate sales, or translations, please contact No Starch Press, Inc. directly at info@nostarch.com or: No Starch Press, Inc. 245 8th Street, San Francisco, CA 94103 phone: 1.415.863.9900 www .nostarch .com Library of Congress Cataloging- in- Publication Data Names: Enoka, Seth, author. Title: Cybersecurity for small networks / by Seth Enoka. Description: San Francisco, CA : No Starch Press, Inc., [2022] | Includes index. Identifiers: LCCN 2022021005 (print) | LCCN 2022021006 (ebook) | ISBN 9781718501485 (print) | ISBN 9781718501492 (ebook) Subjects: LCSH: Local area networks (Computer networks)—Security measures. Classification: LCC TK5105.7 .E56 2022 (print) | LCC TK5105.7 (ebook) | DDC 004.6/8—dc23/eng/20220707 LC record available at https://lccn.loc.gov/2022021005 LC ebook record available at https://lccn.loc.gov/2022021006 No Starch Press and the No Starch Press logo are registered trademarks of No Starch Press, Inc. Other product and company names mentioned herein may be the trademarks of their respective owners. Rather than use a trademark symbol with every occurrence of a trademarked name, we are using the names only in an editorial fashion and to the benefit of the trademark owner, with no intention of infringement of the trademark. The information in this book is distributed on an “As Is” basis, without warranty. While every precaution has been taken in the preparation of this work, neither the author nor No Starch Press, Inc. shall have any liability to any person or entity with respect to any loss or damage caused or alleged to be caused directly or indirectly by the information contained in it.
Page
7
To my darling wife, without whom I would surely be unable to do all the things
Page
8
(This page has no text content)
Page
9
About the Author Seth Enoka is an IT and cybersecurity veteran, having worked on large and complex cybersecurity incidents and investigations all over the world. When he’s not helping organizations kick and keep adversaries out of their net- works, you can find him teaching digital forensics and incident response, mentoring and being mentored by others in the security community, work- ing through some degree or certification, or preparing for his next power- lifting competition (whenever that might be . . .). About the Technical Reviewer Kyle Rankin is the chief security officer at Purism and the author of Linux Hardening in Hostile Networks and DevOps Troubleshooting, among other books. Rankin was an award- winning columnist for Linux Journal. He speaks fre- quently on open source software and has given keynotes at SCALE and FOSDEM.
Page
10
(This page has no text content)
Page
11
B R I E F C O N T E N T S Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .xvii Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xix Chapter 1: Getting Started with a Base Linux System and Network Map . . . . . . . . . . . . . . . . 1 Chapter 2: Architecting and Segmenting Your Network . . . . . . . . . . . . . . . . . . . . . . . . . . 25 Chapter 3: Filtering Network Traffic with Firewalls . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 Chapter 4: Securing Wireless Networks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53 Chapter 5: Creating a Virtual Private Network . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67 Chapter 6: Improving Browsing and Privacy with the Squid Proxy . . . . . . . . . . . . . . . . . . . 91 Chapter 7: Blocking Internet Advertisements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105 Chapter 8: Detecting, Removing, and Preventing Malware . . . . . . . . . . . . . . . . . . . . . . . 117 Chapter 9: Backing Up Your Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 131 Chapter 10: Monitoring Your Network with Detection and Alerting . . . . . . . . . . . . . . . . . 149 Chapter 11: Tips for Managing User Security on Your Network . . . . . . . . . . . . . . . . . . . . 177 Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 185
Page
12
(This page has no text content)
Page
13
C O N T E N T S I N D E T A I L ACKNOWLEDGMENTS xvii INTRODUCTION xix How to Use This Book: What to Expect . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xx Recommended (But Not Required) Knowledge . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xxi Recommended Hardware . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xxi Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .xxiii 1 GETTING STARTED WITH A BASE LINUX SYSTEM AND NETWORK MAP 1 Linux Operating Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 #1: Creating an Ubuntu Virtual Machine . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 Hypervisor Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 VMware Workstation and VMware Player for Windows . . . . . . . . . . . . . . . . . 3 VMware Fusion and VMware Fusion Player for macOS . . . . . . . . . . . . . . . . . . 4 VirtualBox . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 #2: Creating a Physical Linux System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 Bootable USB on Windows . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 Bootable USB on macOS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 Using the Bootable USB . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 #3: Creating a Cloud- Based Linux System . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 Finalizing the Linux Installation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 Hardening Your Ubuntu System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 #4: Installing System Packages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 #5: Managing Linux Users . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 #6: Securing Remote Access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 Generating SSH Keys . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 Remote Login with SSH . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 #7: Capturing VM Configurations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 Taking Snapshots in VMware . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 Taking Snapshots in VirtualBox . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 Network Topology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 #8: Checking Your IP Address . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 On Windows . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 On a Mac . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 On Linux . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 #9: Creating a Network Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 #10: Transferring Files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
Page
14
xii Contents in Detail 2 ARCHITECTING AND SEGMENTING YOUR NETWORK 25 Network Devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 Hubs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 Switches . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 Routers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 Creating Trust Zones . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 Physical Segmentation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 Logical Segmentation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 #11: Segmenting Your Network . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 Ethernet Segmentation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 3 FILTERING NETWORK TRAFFIC WITH FIREWALLS 33 Types of Firewalls . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34 iptables . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35 #12: Installing iptables . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36 iptables Firewall Rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37 Configuring iptables . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38 Logging iptables Behavior . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43 pfSense . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44 #13: Installing the pfSense Firewall . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45 Hardening pfSense . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47 pfSense Firewall Rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48 #14: Testing Your Firewall . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51 4 SECURING WIRELESS NETWORKS 53 #15: Disabling IPv6 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54 #16: Limiting Network Devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55 Creating an Asset List . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56 Static IP Addressing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57 MAC Address Filtering . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59 #17: Segmenting Your Network . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60 #18: Configuring Wireless Authentication . . . . . . . . . . . . . . . . . . . . . . . . . . 62 WEP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62 WPA/WPA2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62 WPA3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65 5 CREATING A VIRTUAL PRIVATE NETWORK 67 Drawbacks of Third- Party VPNs and Remote Access Services . . . . . . . . . . . . . . . . . . . . 68 OpenVPN . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68 EasyRSA . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69 Wireguard . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69
Page
15
Contents in Detail xiii #19: Creating a VPN with OpenVPN . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70 Set Up the Certificate Authority . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71 Create the OpenVPN Server Certificate and Key . . . . . . . . . . . . . . . . . . . . . 72 Configure OpenVPN . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76 #20: Creating a VPN with Wireguard . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82 Installing Wireguard . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82 Set Up the Key Pairs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83 Configure Wireguard . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83 Test Your VPN . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89 6 IMPROVING BROWSING AND PRIVACY WITH THE SQUID PROXY 91 Why Use a Proxy? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92 #21: Setting Up Squid . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93 Configuring Squid . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93 Configuring Devices to Use Squid . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 97 Testing Squid . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98 Blocking and Allowing Domains . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98 Protecting Personal Information with Squid . . . . . . . . . . . . . . . . . . . . . . . . . 100 Disabling Caching for Specific Sites . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101 Squid Proxy Reports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 104 7 BLOCKING INTERNET ADVERTISEMENTS 105 Browser- Level Ad Blocking . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 106 #22: Blocking Ads in Google Chrome . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 106 #23: Blocking Ads in Mozilla Firefox . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 107 #24: Controlling Brave’s Privacy Settings . . . . . . . . . . . . . . . . . . . . . . . . . . 108 #25: Blocking Ads with Pi- Hole . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108 Configure Pi- Hole . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109 Using Pi- Hole . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113 Configure DNS on Your Endpoints . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 116 8 DETECTING, REMOVING, AND PREVENTING MALWARE 117 Microsoft Defender for Windows . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 118 Choosing Malware Detection and Antivirus Tools . . . . . . . . . . . . . . . . . . . . . . . . . . . 119 Antivirus Farm . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 120 Signatures and Heuristics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 120 #26: Installing Avast on macOS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 120 #27: Installing ClamAV on Linux . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 122 #28: Using VirusTotal . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 124 #29: Managing Patches and Updates . . . . . . . . . . . . . . . . . . . . . . . . . . . . 125 Windows Update . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 126 macOS Software Update . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 126 Linux Updates with apt . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 127
Page
16
xiv Contents in Detail #30: Installing Automox . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 128 Installing Automox . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 128 Using Automox . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 129 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 130 9 BACKING UP YOUR DATA 131 Backup Types . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 132 Devising a Backup Schedule . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 133 Onsite and Offsite Backups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 133 What to Back Up and What Storage to Use . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 134 #31: Using Windows Backup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 134 #32: Using Windows Backup and Restore . . . . . . . . . . . . . . . . . . . . . . . . . 135 #33: Using macOS Time Machine . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 137 #34: Using Linux duplicity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 138 Creating Local Backups with duplicity . . . . . . . . . . . . . . . . . . . . . . . . . . . . 139 Creating Network Backups with duplicity . . . . . . . . . . . . . . . . . . . . . . . . . . 140 Restoring duplicity Backups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 141 Additional duplicity Considerations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 141 Cloud Backup Solutions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 142 Backblaze . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 143 Carbonite . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 144 Virtual Machine Snapshots . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 145 Testing and Restoring Backups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 146 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 147 10 MONITORING YOUR NETWORK WITH DETECTION AND ALERTING 149 Network Monitoring Methods . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 150 Network Traffic Access Points . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 150 Switch Port Analyzers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 152 #35: Configuring a SPAN Port . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 153 Security Onion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 153 #36: Building a Security Onion System . . . . . . . . . . . . . . . . . . . . . . . . . . . 154 Installing Security Onion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 155 #37: Installing Wazuh . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 161 Installing Wazuh on Windows . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 162 Installing Wazuh on macOS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 164 Installing Wazuh on Linux . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 165 #38: Installing osquery . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 166 Installing osquery on Windows . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 167 Installing osquery on macOS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 167 Installing osquery on Linux . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 168 A Network Security Monitoring Crash Course . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 168 Using osquery . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 168 Using Wazuh . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 171 Using Security Onion as a SIEM Tool . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 172 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 175
Page
17
Contents in Detail xv 11 TIPS FOR MANAGING USER SECURITY ON YOUR NETWORK 177 Passwords . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 177 Password Managers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 178 Password Breach Detection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 179 Multifactor Authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 179 Browser Plug-ins . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 181 Adblock Plus . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 181 Ghostery . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 182 HTTPS Everywhere . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 182 Internet of Things Considerations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 183 Additional Resources . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 184 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 184 INDEX 185
Page
18
(This page has no text content)
Page
19
A C K N O W L E D G M E N T S There are altogether too many individuals I should thank, and I’m all too likely to leave out an important name or two, so I’d like to acknowledge the cybersecurity community as a whole. Thank you for being as open and gen- erous with your time and expertise as I aspire to be.
Page
20
(This page has no text content)
The above is a preview of the first 20 pages. Register to read the complete e-book.
AI Reading Assistant
Whole-book reading guide from stratified index samples; jump to passages in the text
AI guide
【One-Line Pitch】
A hands-on, tutorial-driven playbook for anyone who wants to secure a home or small-office network using affordable, off-the-shelf hardware and open-source tools—no enterprise budget or security team required. Best for reasonably paranoid DIYers, IT generalists, and small-business owners willing to follow step-by-step instructions.
【Book Arc】
- **Opening (~0%–10%)**: Sets the philosophy and the toolkit—why small networks are worth defending and which low-cost devices (pfSense firewall, ASUS wireless router, managed switch, network TAP) and platforms (Ubuntu, virtual machines) the tutorials will rely on.
- **Early (~10%–32%)**: Builds the foundation—installing and hardening a base Ubuntu system (bootable USB, VM setup, hostname, SSH key–based remote access) and drawing an accurate network map/diagram as the basis for every later control.
- **Middle (~32%–50%)**: Moves into architecture—explains IP addressing, NAT, and then the book's highest-leverage idea: segmenting the network into trust zones (primary, secondary/IoT, tertiary/guest) using VLANs and a managed switch.
- **Late (~50%–80%)**: Applies controls on top of that architecture—firewall configuration with pfSense, wireless lockdown, VPN and proxy setup, ad blocking, antivirus, and endpoint management (e.g., Automox).
- **Ending (~80%–100%)**: Closes the loop with resilience and visibility—backup types and schedules (Windows Backup, macOS Time Machine, Linux duplicity) and network security monitoring with SPAN ports, Security Onion, Wazuh, and osquery, including a monitoring crash course.
【Key Takeaways】
- **Architecture beats gadgets** (Middle): The book's central claim is that how you segment and architect the network delivers the biggest security gain for the least effort and money—separating high-risk from high-value devices matters more than any single tool.
- **Trust zones are the organizing principle** (Middle): Endpoints are grouped by sensitivity—primary devices holding private data get the strictest controls and monitoring; IoT and guest devices live in looser segments so a compromised smart device can't pivot inward.
- **A network diagram is a security tool** (Early): You can't protect what you haven't inventoried; keeping an up-to-date map of devices, IPs, and MAC addresses reveals where controls belong and what "normal" looks like.
- **Harden the base system first** (Early): Disabling password logins in favor of SSH keys, blocking direct root login, and trimming data-sharing defaults during OS install eliminate whole classes of guessing attacks before anything else is built.
- **Cheap, proven hardware goes a long way** (Opening): A modest pfSense appliance, a mid-range wireless router, and a managed switch provide enterprise-grade capability without enterprise pricing—DIY is viable if you accept the trade-offs.
- **Defense includes recovery** (Ending): Backups are treated as a security control, not an afterthought—choose backup types, set a schedule, and combine onsite with offsite copies across Windows, macOS, and Linux.
- **Visibility closes the loop** (Ending): Monitoring tools (Security Onion, Wazuh, osquery, SPAN ports) turn a passively configured network into one that can detect and alert on unauthorized activity.
- **Privacy hygiene is part of the habit** (Early): Declining data-sharing options during setup is framed as good practice for life, not just for one VM—small defaults compound.
【Reading Tips】
- **Deep-read the segmentation chapter** (Middle): It's the conceptual spine; everything later (firewall rules, VLANs, monitoring placement) assumes you understand trust zones.
- **Skim setup mechanics you don't need**: Bootable-USB and VM-install walkthroughs are platform-specific—jump to the sections matching your OS and hardware rather than reading all variants.
- **Treat it as a lab manual**: Follow tutorials in order on real or virtual gear; the value is in doing, and snapshots/VMs let you experiment safely.
- **Don't skip the monitoring and backup chapters** even if they feel less exciting—they're what let you recover and notice when prevention fails.
- **Watch for version drift**: Tool installs (pfSense, Security Onion, Wazuh, osquery) change over time; cross-check current documentation when a step doesn't match.
【Coverage Limits】
These excerpts are dominated by front matter, the table of contents, and the early Linux/network-mapping chapters; the detailed content of the firewall, VPN, proxy, and monitoring chapters is only partially represented, so specifics there are inferred from chapter titles and the blurb rather than fully verified.
Passage locations
Page 9
le Networks and DevOps Troubleshooting, among other books. Rankin was an award- winning columnist for Linux Journal. He speaks fre- quently on open source so...
View in text
Excerpt 2
s on a network, allowing you to collect network traffic as it travels between devices as well as networks. You can analyze cap- tured traffic to identify sus...
View in text
Excerpt 3
assword guessing) against your systems. Generating SSH Keys SSH key pairs are generally accepted to be more secure than passwords or passphrases. SSH keys ar...
View in text
Excerpt 4
you implement other security controls in your environment. For example, your internet of things (IoT) devices are, in all likelihood, less tested, updated, a...
View in text
Recommended for You
{{#thumbnailUrl}}
{{/thumbnailUrl}}
{{^thumbnailUrl}}
{{/thumbnailUrl}}
Loading recommended books...
Failed to load, please try again later
Tip the Site
Scan the WeChat Pay or Alipay code to tip. No login required.
WeChat Pay
Alipay