7 terms
AppArmor is a Linux security module that confines programs with path-based profiles, limiting which files, capabilities and network access each may use.
auditd is the user-space daemon of the Linux audit framework that records kernel audit events such as system calls, file access and logins to disk.
Fail2ban is a Linux intrusion prevention daemon that scans logs for repeated failures and temporarily bans offending IP addresses in the firewall.
Linux capabilities split root privileges into distinct units such as CAP_NET_ADMIN, so processes receive only the specific powers they need.
PAM, the Pluggable Authentication Modules framework, lets Linux services delegate login, password and session checks to configurable module stacks.
Seccomp is a Linux kernel feature that restricts which system calls a process may make, shrinking the kernel attack surface of sandboxes and containers.
SELinux is a Linux security module that enforces mandatory access control, confining processes by labels and policy even when they run as root.