Course 44 - RH Security Specialist | Episode 11: System Tracking and Port Reconnaissance

How do you know whether a Linux server is actually secure?Security professionals need more than preventive controls. They need the ability to monitor system activity, investigate suspicious behavior, audit sensitive resources, and verify what is exposed to the network.In this episode, we move from detailed internal auditing with the Linux Audit System to active network reconnaissance and firewall verification. You will learn how to manage and search audit data, create targeted monitoring rules, generate security reports, scan network services with Nmap, and validate the effectiveness of local firewall controls.The result is a practical security workflow that combines visibility, investigation, reconnaissance, and defensive verification.1. Managing the Linux Audit DaemonWe begin with the Linux Audit Daemon (auditd), which provides a framework for recording security-relevant events generated by the operating system.You will explore how administrators manage the audit service and its log lifecycle, including:Starting and stopping the auditing service.Managing audit log generation.Controlling log growth and rotation.Resuming auditing after maintenance or configuration changes.Understanding the relationship between audit configuration and stored event data.Effective audit management ensures that security records remain useful without allowing audit data to become an uncontrolled storage problem.2. Creating Real-Time Audit Rules with AuditctlAfter understanding the audit service itself, we move to auditctl, the command-line interface used to manage active audit rules.Rather than collecting every possible event, security administrators can define specific resources and activities that deserve additional monitoring.A practical example is monitoring a sensitive SSH configuration file such as:/etc/ssh/sshd_configA file watch can provide visibility when the configuration is accessed or modified, helping administrators identify unexpected changes to a critical remote-access component.This introduces an important auditing principle:Monitor the resources whose modification could materially affect system security.3. Searching Audit Data with AusearchGenerating audit records is only the beginning. Large audit logs are valuable only when administrators can efficiently search and interpret them.This is where ausearch becomes important.You will learn how to search audit records for specific categories of activity, including:Failed authentication events.Login-related activity.Account and group modifications.Events associated with particular users.Activity within defined time periods.Events associated with specific audited resources.Instead of manually reading thousands of raw records, targeted searches allow security analysts to quickly isolate events relevant to an investigation.4. Turning Audit Data into Reports with AureportWhile ausearch is useful for targeted investigations, aureport provides a broader reporting perspective.You will explore how aureport can transform detailed audit information into structured, human-readable summaries.These reports can help administrators understand:Authentication activity.Failed login attempts.Executable activity.User behavior.System-level events.Network-related audit information.Patterns that may indicate suspicious activity.This makes audit reporting useful not only to security analysts, but also to administrators who need a high-level overview of system activity.5. Detecting Suspicious Authentication ActivityAuthentication failures are particularly valuable from a security perspective.Repeated failed login attempts against a particular account or across multiple accounts can indicate:Misconfigured applications.Forgotten credentials.Automated authentication attempts.Password-guessing activity.Potential brute-force attacks.By combining targeted searches with audit reports, administrators can move from individual events toward recognizing patterns of suspicious behavior.The objective is not simply to collect failed logins, but to understand their frequency, distribution, and context.6. Introducing Network Reconnaissance with NmapAfter examining activity inside the Linux system, the episode shifts toward understanding what an attacker could discover from the network.We introduce Nmap, one of the most widely used tools for network discovery and security assessment.In an authorized testing environment, Nmap can help identify:Hosts that are reachable.Open network ports.Exposed services.</b