Zero Trust Network Security: Basic Configuration Guide

The traditional network security model trusts everything inside the internal network. The Zero Trust model advocates the opposite: "Never trust, always verify." This approach is critically important in modern cloud and hybrid environments. This guide shows you how to implement Zero Trust principles using existing Linux tools.

What is Zero Trust?

Zero Trust is a security model defined by Forrester Research analysts in 2010. Its core assumption is: No user, device, or service inside or outside the network is automatically trusted.

Core Principles

Never trust, always verify: Every access request must go through authentication
Least privilege: Users should only access the resources they need
Micro-segmentation: Divide the network into small, isolated segments
Continuous monitoring: Log all network traffic and access
Device security: Verify device security before granting access

Traditional vs Zero Trust Comparison

Feature	Traditional	Zero Trust
Trust model	Trust internal network	Trust nothing
Authentication	At network perimeter	On every access
Access control	IP-based	Identity-based
Segmentation	Flat network	Micro-segmentation
Monitoring	Perimeter-focused	Everywhere

Practical Implementation: Zero Trust with Linux Tools

1. SSH Certificate-Based Authentication

Using certificates instead of passwords is a cornerstone of Zero Trust.

hljs bash

# Create SSH CA (Certificate Authority)
mkdir -p /etc/ssh/ca
cd /etc/ssh/ca

# Create CA key pair
ssh-keygen -t ed25519 -f ssh_ca -C "SSH Certificate Authority"

# Sign user key
ssh-keygen -s /etc/ssh/ca/ssh_ca \
  -I "user@hostname" \
  -n username \
  -V +52w \
  ~/.ssh/id_ed25519.pub

# View certificate
ssh-keygen -L -f ~/.ssh/id_ed25519-cert.pub

# Zero Trust SSH configuration

# Disable password login
PasswordAuthentication no
ChallengeResponseAuthentication no

# Certificate-based authentication
TrustedUserCAKeys /etc/ssh/ca/ssh_ca.pub

# Disable root login
PermitRootLogin no

# Allow only specific users
AllowUsers deploy admin

# Session timeout
ClientAliveInterval 300
ClientAliveCountMax 2

2. Micro-Segmentation with iptables

hljs bash

# Restrict inter-service communication
# Example: Web server can only connect to database

# Default policies
sudo iptables -P INPUT DROP
sudo iptables -P FORWARD DROP
sudo iptables -P OUTPUT ACCEPT

# Allow loopback
sudo iptables -A INPUT -i lo -j ACCEPT

# Allow established connections
sudo iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# SSH access (management network only)
sudo iptables -A INPUT -p tcp --dport 22 -s 10.0.1.0/24 -j ACCEPT

# Web server (public)
sudo iptables -A INPUT -p tcp --dport 80 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 443 -j ACCEPT

# Database (web server only)
sudo iptables -A INPUT -p tcp --dport 3306 -s 10.0.2.10 -j ACCEPT

# Redis (application server only)
sudo iptables -A INPUT -p tcp --dport 6379 -s 10.0.2.0/24 -j ACCEPT

# Log and drop everything else
sudo iptables -A INPUT -j LOG --log-prefix "DROPPED: "
sudo iptables -A INPUT -j DROP

3. Identity-Based Access Control

hljs bash

# Multi-factor authentication with PAM
sudo apt install libpam-google-authenticator -y

# Set up TOTP for user
google-authenticator

# PAM configuration
sudo nano /etc/pam.d/sshd

# /etc/pam.d/sshd
auth required pam_google_authenticator.so

# Enable MFA in SSH config
ChallengeResponseAuthentication yes
AuthenticationMethods publickey,keyboard-interactive

4. Continuous Monitoring and Auditing

hljs bash

# Install auditd
sudo apt install auditd -y

# Monitor critical files
sudo auditctl -w /etc/passwd -p wa -k passwd_changes
sudo auditctl -w /etc/shadow -p wa -k shadow_changes
sudo auditctl -w /etc/sudoers -p wa -k sudoers_changes

# Monitor network connections
sudo auditctl -a always,exit -F arch=b64 -S connect -k network_connect

# View audit logs
sudo ausearch -k passwd_changes
sudo aureport --auth

5. Service Account Isolation

hljs bash

# Create separate user for each service
sudo useradd -r -s /bin/false -d /var/lib/myapp myapp

# Specify user in service file
sudo nano /etc/systemd/system/myapp.service

hljs ini

[Service]
User=myapp
Group=myapp
NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=strict
ProtectHome=true
ReadWritePaths=/var/lib/myapp
CapabilityBoundingSet=
AmbientCapabilities=

6. Docker Network Isolation

hljs bash

# Each application runs in its own network
docker network create --driver bridge --subnet 172.20.0.0/24 frontend-net
docker network create --driver bridge --subnet 172.21.0.0/24 backend-net
docker network create --driver bridge --subnet 172.22.0.0/24 db-net

# Containers connect only to required networks
docker run --network frontend-net nginx
docker run --network backend-net,frontend-net myapp
docker run --network db-net postgres

Zero Trust Maturity Model

Zero Trust implementation is a gradual process:

Level 1: Basic

SSH key-based authentication
Port restriction with firewall
Strong password policy
Basic log monitoring

Level 2: Intermediate

Multi-factor authentication (MFA)
Micro-segmentation
Service account isolation
Centralized log management

Level 3: Advanced

Certificate-based authentication
Continuous behavioral analysis
Automated threat response
Zero standing access (Just-in-Time)

Practical Checklist

hljs bash

#!/bin/bash
# Zero Trust security check script

echo "=== Zero Trust Security Check ==="

# Is SSH password login disabled?
if grep -q "PasswordAuthentication no" /etc/ssh/sshd_config; then
    echo "[OK] SSH password login disabled"
else
    echo "[WARNING] SSH password login enabled!"
fi

# Is root login disabled?
if grep -q "PermitRootLogin no" /etc/ssh/sshd_config; then
    echo "[OK] SSH root login disabled"
else
    echo "[WARNING] SSH root login enabled!"
fi

# Is firewall active?
if sudo ufw status | grep -q "Status: active"; then
    echo "[OK] UFW firewall active"
else
    echo "[WARNING] UFW firewall inactive!"
fi

# Is Fail2Ban running?
if systemctl is-active --quiet fail2ban; then
    echo "[OK] Fail2Ban running"
else
    echo "[WARNING] Fail2Ban not running!"
fi

echo "Check complete."

Zero Trust is a philosophy, not a product. Start with existing tools and gradually increase your maturity level. Aim for continuous improvement rather than perfection.

Conclusion

Zero Trust is a comprehensive security approach required by modern security threats. It's possible to implement basic Zero Trust principles with Linux tools. SSH certificates, micro-segmentation, MFA, and continuous monitoring can significantly strengthen your security posture.

Zero Trust Network Security: Basic Configuration Guide

Table of Contents