Implementing Zero Trust Security Architecture on Rocky Linux 🔐

The traditional perimeter-based security model is obsolete in today’s cloud-first, distributed computing world. Zero Trust Architecture (ZTA) revolutionizes security by eliminating implicit trust and continuously verifying every transaction. This comprehensive guide shows you how to implement a production-ready Zero Trust security framework on Rocky Linux 9, transforming your security posture from “trust but verify” to “never trust, always verify.”

🎯 Understanding Zero Trust Architecture

Zero Trust is not a product but a comprehensive security strategy that assumes no user, device, or network should be automatically trusted. Every access request must be verified, authenticated, and authorized before granting access to resources.

Core Principles of Zero Trust

• Verify Explicitly - Always authenticate and authorize based on all available data points 🔍
• Use Least Privilege Access - Limit user access with just-in-time and just-enough-access (JIT/JEA) 🔒
• Assume Breach - Minimize blast radius and segment access to prevent lateral movement 🛡️
• Continuous Verification - Never trust, always verify throughout the session lifecycle ♾️
• Encrypt Everything - Protect data in transit and at rest across all environments 🔐

📋 Prerequisites and Architecture Planning

System Requirements

For implementing Zero Trust on Rocky Linux 9:

# Core Components Requirements
- Identity Provider (IdP): 4 GB RAM, 2 CPU cores
- Policy Engine: 8 GB RAM, 4 CPU cores
- Network Gateway: 4 GB RAM, 2 CPU cores
- Logging/SIEM: 16 GB RAM, 8 CPU cores
- Certificate Authority: 2 GB RAM, 1 CPU core

Zero Trust Architecture Components

User/Device → Identity Verification → Policy Engine → Resource Access
     ↓              ↓                      ↓               ↓
   MFA          Context Analysis    Authorization    Microsegmentation
                                         ↓
                                   Continuous Monitoring

🔧 Foundation: System Hardening

Initial Rocky Linux 9 Security Configuration

# Update system
sudo dnf update -y

# Install security tools
sudo dnf install -y \
  aide \
  audit \
  policycoreutils-python-utils \
  setools-console \
  firewalld \
  fail2ban \
  rkhunter \
  clamav \
  clamav-update

# Enable SELinux enforcing mode
sudo setenforce 1
sudo sed -i 's/SELINUX=.*/SELINUX=enforcing/' /etc/selinux/config

# Configure automatic updates
sudo dnf install -y dnf-automatic
sudo systemctl enable --now dnf-automatic.timer

Kernel Security Parameters

# Create security sysctl configuration
sudo tee /etc/sysctl.d/99-security.conf << 'EOF'
# IP Spoofing protection
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1

# Ignore ICMP redirects
net.ipv4.conf.all.accept_redirects = 0
net.ipv6.conf.all.accept_redirects = 0

# Ignore send redirects
net.ipv4.conf.all.send_redirects = 0

# Disable source packet routing
net.ipv4.conf.all.accept_source_route = 0
net.ipv6.conf.all.accept_source_route = 0

# Log Martians
net.ipv4.conf.all.log_martians = 1

# Ignore ICMP ping requests
net.ipv4.icmp_echo_ignore_broadcasts = 1

# Ignore Directed pings
net.ipv4.icmp_ignore_bogus_error_responses = 1

# Enable TCP/IP SYN cookies
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_max_syn_backlog = 2048
net.ipv4.tcp_synack_retries = 2
net.ipv4.tcp_syn_retries = 5

# Disable IPv6 if not needed
net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1
EOF

# Apply sysctl settings
sudo sysctl -p /etc/sysctl.d/99-security.conf

🆔 Identity and Access Management

Installing FreeIPA for Identity Management

# Set hostname
sudo hostnamectl set-hostname ipa.example.com

# Install FreeIPA server
sudo dnf install -y ipa-server ipa-server-dns

# Configure FreeIPA
sudo ipa-server-install \
  --realm=EXAMPLE.COM \
  --domain=example.com \
  --ds-password=DirectoryManagerPassword123! \
  --admin-password=AdminPassword123! \
  --hostname=ipa.example.com \
  --ip-address=192.168.1.100 \
  --setup-dns \
  --no-forwarders \
  --mkhomedir \
  --ssh-trust-dns \
  --unattended

# Configure firewall for FreeIPA
sudo firewall-cmd --add-service=freeipa-ldap --permanent
sudo firewall-cmd --add-service=freeipa-ldaps --permanent
sudo firewall-cmd --add-service=freeipa-replication --permanent
sudo firewall-cmd --add-service=dns --permanent
sudo firewall-cmd --add-service=ntp --permanent
sudo firewall-cmd --reload

Implementing Multi-Factor Authentication

# Install Google Authenticator
sudo dnf install -y google-authenticator qrencode

# Configure PAM for MFA
sudo tee /etc/pam.d/sshd-mfa << 'EOF'
#%PAM-1.0
auth       required     pam_sepermit.so
auth       required     pam_google_authenticator.so
auth       include      password-auth
auth       include      postlogin
account    required     pam_nologin.so
account    include      password-auth
password   include      password-auth
session    required     pam_selinux.so close
session    required     pam_loginuid.so
session    required     pam_selinux.so open env_params
session    required     pam_namespace.so
session    optional     pam_keyinit.so force revoke
session    include      password-auth
session    include      postlogin
EOF

# Configure SSH for MFA
sudo sed -i 's/ChallengeResponseAuthentication no/ChallengeResponseAuthentication yes/' /etc/ssh/sshd_config
echo "AuthenticationMethods publickey,keyboard-interactive" | sudo tee -a /etc/ssh/sshd_config
sudo systemctl restart sshd

User MFA Setup Script

#!/bin/bash
# setup-user-mfa.sh

USERNAME=$1

if [ -z "$USERNAME" ]; then
    echo "Usage: $0 <username>"
    exit 1
fi

# Switch to user and generate authenticator
sudo -u $USERNAME google-authenticator \
    --time-based \
    --disallow-reuse \
    --rate-limit=3 \
    --rate-time=30 \
    --window-size=3 \
    --force

echo "MFA setup complete for $USERNAME"

🔒 Certificate-Based Authentication

Setting Up Certificate Authority

# Install Easy-RSA
cd /opt
sudo git clone https://github.com/OpenVPN/easy-rsa.git
cd easy-rsa/easyrsa3

# Initialize PKI
sudo ./easyrsa init-pki

# Build CA
sudo ./easyrsa build-ca nopass

# Generate server certificate
sudo ./easyrsa gen-req server nopass
sudo ./easyrsa sign-req server server

# Create certificate for services
sudo ./easyrsa gen-req zero-trust-gateway nopass
sudo ./easyrsa sign-req server zero-trust-gateway

Implementing mTLS (Mutual TLS)

# Configure nginx for mTLS
sudo dnf install -y nginx

sudo tee /etc/nginx/conf.d/mtls.conf << 'EOF'
server {
    listen 443 ssl;
    server_name secure.example.com;
    
    # Server certificates
    ssl_certificate /etc/pki/tls/certs/server.crt;
    ssl_certificate_key /etc/pki/tls/private/server.key;
    
    # Client certificate verification
    ssl_client_certificate /etc/pki/tls/certs/ca.crt;
    ssl_verify_client on;
    ssl_verify_depth 2;
    
    # Strong SSL configuration
    ssl_protocols TLSv1.3;
    ssl_ciphers 'TLS13-AES-256-GCM-SHA384:TLS13-AES-128-GCM-SHA256';
    ssl_prefer_server_ciphers on;
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 10m;
    
    location / {
        # Pass client certificate info to backend
        proxy_set_header X-SSL-Client-Cert $ssl_client_cert;
        proxy_set_header X-SSL-Client-S-DN $ssl_client_s_dn;
        proxy_set_header X-SSL-Client-Verify $ssl_client_verify;
        proxy_pass http://backend;
    }
}
EOF

🌐 Network Microsegmentation

Installing and Configuring WireGuard

# Install WireGuard
sudo dnf install -y epel-release elrepo-release
sudo dnf install -y kmod-wireguard wireguard-tools

# Generate keys
wg genkey | sudo tee /etc/wireguard/server_private.key
sudo chmod 600 /etc/wireguard/server_private.key
sudo cat /etc/wireguard/server_private.key | wg pubkey | sudo tee /etc/wireguard/server_public.key

# Configure WireGuard interface
sudo tee /etc/wireguard/wg0.conf << 'EOF'
[Interface]
Address = 10.200.0.1/24
ListenPort = 51820
PrivateKey = <server_private_key>
PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

# Client configurations will be added here
EOF

# Enable IP forwarding
echo "net.ipv4.ip_forward = 1" | sudo tee -a /etc/sysctl.conf
sudo sysctl -p

Network Policy Engine

# Install Open Policy Agent (OPA)
curl -L -o opa https://openpolicyagent.org/downloads/v0.58.0/opa_linux_amd64_static
sudo chmod 755 opa
sudo mv opa /usr/local/bin/

# Create network policy
sudo mkdir -p /etc/opa/policies
sudo tee /etc/opa/policies/network-access.rego << 'EOF'
package network.access

default allow = false

# Allow access based on user identity and device trust
allow {
    input.user.authenticated == true
    input.user.mfa_verified == true
    input.device.trust_score >= 0.8
    input.request.destination in data.allowed_resources[input.user.role]
}

# Deny access from untrusted networks
deny {
    input.source.network in data.untrusted_networks
}

# Require additional verification for sensitive resources
additional_verification_required {
    input.request.destination in data.sensitive_resources
    input.user.last_verification_time > 3600
}
EOF

🛡️ Implementing Policy Decision Point

Policy Engine Service

#!/usr/bin/env python3
# /opt/zero-trust/policy-engine.py

from flask import Flask, request, jsonify
import requests
import jwt
import redis
import hashlib
from datetime import datetime, timedelta

app = Flask(__name__)
redis_client = redis.Redis(host='localhost', port=6379, decode_responses=True)

# Configuration
JWT_SECRET = 'your-secret-key'
OPA_URL = 'http://localhost:8181/v1/data/network/access'

class PolicyEngine:
    def __init__(self):
        self.trust_scores = {}
        
    def calculate_device_trust(self, device_info):
        """Calculate device trust score based on multiple factors"""
        score = 1.0
        
        # Check OS updates
        if device_info.get('os_updated'):
            score *= 1.0
        else:
            score *= 0.7
            
        # Check antivirus status
        if device_info.get('antivirus_active'):
            score *= 1.0
        else:
            score *= 0.8
            
        # Check disk encryption
        if device_info.get('disk_encrypted'):
            score *= 1.0
        else:
            score *= 0.6
            
        # Check certificate validity
        if device_info.get('cert_valid'):
            score *= 1.0
        else:
            score *= 0.5
            
        return score
    
    def verify_user_context(self, user_info):
        """Verify user context and behavior"""
        context = {
            'risk_score': 0,
            'anomalies': []
        }
        
        # Check login location
        usual_locations = redis_client.smembers(f"user:{user_info['id']}:locations")
        current_location = user_info.get('location')
        
        if current_location and current_location not in usual_locations:
            context['risk_score'] += 30
            context['anomalies'].append('unusual_location')
            
        # Check access time
        current_hour = datetime.now().hour
        if current_hour < 6 or current_hour > 22:
            context['risk_score'] += 20
            context['anomalies'].append('unusual_time')
            
        # Check failed attempts
        failed_attempts = redis_client.get(f"user:{user_info['id']}:failed_attempts") or 0
        if int(failed_attempts) > 3:
            context['risk_score'] += 40
            context['anomalies'].append('multiple_failed_attempts')
            
        return context

@app.route('/evaluate', methods=['POST'])
def evaluate_access():
    """Evaluate access request against Zero Trust policies"""
    data = request.json
    
    # Extract request information
    user_info = data.get('user', {})
    device_info = data.get('device', {})
    request_info = data.get('request', {})
    
    # Calculate trust scores
    device_trust = PolicyEngine().calculate_device_trust(device_info)
    user_context = PolicyEngine().verify_user_context(user_info)
    
    # Prepare OPA input
    opa_input = {
        'user': {
            'id': user_info.get('id'),
            'role': user_info.get('role'),
            'authenticated': user_info.get('authenticated', False),
            'mfa_verified': user_info.get('mfa_verified', False),
            'last_verification_time': user_info.get('last_verification_time', 0)
        },
        'device': {
            'id': device_info.get('id'),
            'trust_score': device_trust
        },
        'request': {
            'destination': request_info.get('destination'),
            'action': request_info.get('action'),
            'timestamp': datetime.now().isoformat()
        },
        'context': user_context
    }
    
    # Query OPA for decision
    try:
        response = requests.post(
            OPA_URL,
            json={'input': opa_input}
        )
        opa_result = response.json()
        
        # Log decision
        log_entry = {
            'timestamp': datetime.now().isoformat(),
            'user_id': user_info.get('id'),
            'device_id': device_info.get('id'),
            'resource': request_info.get('destination'),
            'decision': opa_result.get('result', {}).get('allow', False),
            'trust_score': device_trust,
            'risk_score': user_context['risk_score']
        }
        
        redis_client.lpush('access_log', json.dumps(log_entry))
        
        # Generate access token if allowed
        if opa_result.get('result', {}).get('allow'):
            token = jwt.encode({
                'user_id': user_info.get('id'),
                'device_id': device_info.get('id'),
                'resource': request_info.get('destination'),
                'exp': datetime.utcnow() + timedelta(minutes=5)
            }, JWT_SECRET, algorithm='HS256')
            
            return jsonify({
                'allow': True,
                'token': token,
                'additional_verification': opa_result.get('result', {}).get('additional_verification_required', False)
            })
        else:
            return jsonify({
                'allow': False,
                'reason': 'Access denied by policy',
                'risk_factors': user_context['anomalies']
            }), 403
            
    except Exception as e:
        return jsonify({
            'allow': False,
            'error': str(e)
        }), 500

if __name__ == '__main__':
    app.run(host='0.0.0.0', port=5000)

Policy Engine Service Configuration

# Create systemd service
sudo tee /etc/systemd/system/zero-trust-policy.service << 'EOF'
[Unit]
Description=Zero Trust Policy Engine
After=network.target redis.service

[Service]
Type=simple
User=zero-trust
Group=zero-trust
WorkingDirectory=/opt/zero-trust
Environment="PATH=/usr/local/bin:/usr/bin"
ExecStart=/usr/bin/python3 /opt/zero-trust/policy-engine.py
Restart=always
RestartSec=10

[Install]
WantedBy=multi-user.target
EOF

# Create user and set permissions
sudo useradd -r -s /bin/false zero-trust
sudo chown -R zero-trust:zero-trust /opt/zero-trust

# Start service
sudo systemctl daemon-reload
sudo systemctl enable --now zero-trust-policy

🔍 Continuous Monitoring and Verification

Setting Up Wazuh SIEM

# Install Wazuh manager
curl -s https://packages.wazuh.com/key/GPG-KEY-WAZUH | sudo gpg --no-default-keyring --keyring gnupg-ring:/usr/share/keyrings/wazuh.gpg --import
sudo chmod 644 /usr/share/keyrings/wazuh.gpg

echo "deb [signed-by=/usr/share/keyrings/wazuh.gpg] https://packages.wazuh.com/4.x/yum/ stable main" | sudo tee /etc/apt/sources.list.d/wazuh.list

sudo dnf install -y wazuh-manager

# Configure Wazuh for Zero Trust monitoring
sudo tee -a /var/ossec/etc/ossec.conf << 'EOF'
<ossec_config>
  <!-- Zero Trust specific rules -->
  <rules>
    <include>zero_trust_rules.xml</include>
  </rules>
  
  <!-- Enhanced authentication monitoring -->
  <syscheck>
    <directories check_all="yes" realtime="yes">/etc/pam.d</directories>
    <directories check_all="yes" realtime="yes">/etc/ssh</directories>
    <directories check_all="yes" realtime="yes">/etc/ssl</directories>
  </syscheck>
  
  <!-- Active response for Zero Trust violations -->
  <active-response>
    <command>firewall-drop</command>
    <location>local</location>
    <rules_id>100100,100101</rules_id>
    <timeout>3600</timeout>
  </active-response>
</ossec_config>
EOF

Custom Zero Trust Rules

<!-- /var/ossec/etc/rules/zero_trust_rules.xml -->
<group name="zero_trust">
  
  <!-- Rule: Detect authentication without MFA -->
  <rule id="100100" level="10">
    <if_group>authentication_success</if_group>
    <regex>without MFA verification</regex>
    <description>Authentication without MFA detected</description>
    <options>no_full_log</options>
  </rule>
  
  <!-- Rule: Detect untrusted device access -->
  <rule id="100101" level="12">
    <if_group>syslog</if_group>
    <regex>device trust score below threshold</regex>
    <description>Access attempt from untrusted device</description>
  </rule>
  
  <!-- Rule: Detect lateral movement -->
  <rule id="100102" level="14">
    <if_group>syslog</if_group>
    <regex>unusual network connection pattern</regex>
    <description>Possible lateral movement detected</description>
  </rule>
  
  <!-- Rule: Detect privilege escalation -->
  <rule id="100103" level="15">
    <if_sid>5300,5301,5302</if_sid>
    <time_frame>120</time_frame>
    <frequency>3</frequency>
    <description>Multiple privilege escalation attempts</description>
  </rule>
  
</group>

🌐 Service Mesh and API Gateway

Installing Istio Service Mesh

# Download Istio
curl -L https://istio.io/downloadIstio | sh -
cd istio-*
export PATH=$PWD/bin:$PATH

# Install Istio with Zero Trust configuration
istioctl install --set values.pilot.env.PILOT_ENABLE_WORKLOAD_ENTRY_AUTOREGISTRATION=true \
  --set values.global.proxy.holdApplicationUntilProxyStarts=true \
  --set meshConfig.defaultConfig.proxyStatsMatcher.inclusionRegexps[0]=".*outlier_detection.*" \
  --set meshConfig.defaultConfig.proxyStatsMatcher.inclusionRegexps[1]=".*rbac.*"

# Enable mTLS mesh-wide
kubectl apply -f - <<EOF
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: default
  namespace: istio-system
spec:
  mtls:
    mode: STRICT
EOF

API Gateway with Zero Trust

# kong-zero-trust.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: kong-zero-trust-config
data:
  kong.conf: |
    plugins = bundled,zero-trust
    
    # Zero Trust plugin configuration
    zero_trust_policy_endpoint = http://zero-trust-policy:5000/evaluate
    zero_trust_enforcement_mode = strict
    zero_trust_token_validation = true
    zero_trust_continuous_verification = true
    zero_trust_session_timeout = 300
    
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: kong-gateway
spec:
  replicas: 3
  selector:
    matchLabels:
      app: kong-gateway
  template:
    metadata:
      labels:
        app: kong-gateway
    spec:
      containers:
      - name: kong
        image: kong:3.4-alpine
        env:
        - name: KONG_DATABASE
          value: "off"
        - name: KONG_PROXY_ACCESS_LOG
          value: "/dev/stdout"
        - name: KONG_PROXY_ERROR_LOG
          value: "/dev/stderr"
        - name: KONG_ADMIN_ACCESS_LOG
          value: "/dev/stdout"
        - name: KONG_ADMIN_ERROR_LOG
          value: "/dev/stderr"
        volumeMounts:
        - name: kong-config
          mountPath: /etc/kong/kong.conf
          subPath: kong.conf
      volumes:
      - name: kong-config
        configMap:
          name: kong-zero-trust-config

🔐 Data Protection and Encryption

Implementing Encryption at Rest

# Install and configure Tang (Network Bound Disk Encryption)
sudo dnf install -y tang

# Enable and start Tang
sudo systemctl enable --now tangd.socket

# Configure automatic disk encryption with Clevis
sudo dnf install -y clevis clevis-luks clevis-dracut

# Bind LUKS volume to Tang server
sudo clevis luks bind -d /dev/sda2 tang '{"url":"http://tang.example.com"}'

# Create encryption policy for databases
sudo tee /etc/encrypt-at-rest.policy << 'EOF'
{
  "version": "1.0",
  "policies": [
    {
      "name": "database-encryption",
      "paths": ["/var/lib/mysql", "/var/lib/postgresql"],
      "algorithm": "AES-256-GCM",
      "key_rotation": "30d",
      "compliance": ["PCI-DSS", "HIPAA"]
    },
    {
      "name": "log-encryption",
      "paths": ["/var/log/audit", "/var/log/secure"],
      "algorithm": "AES-256-CBC",
      "key_rotation": "90d",
      "compliance": ["SOC2"]
    }
  ]
}
EOF

Transparent Data Encryption Service

#!/usr/bin/env python3
# /opt/zero-trust/encryption-service.py

import os
import json
from cryptography.fernet import Fernet
from cryptography.hazmat.primitives import hashes
from cryptography.hazmat.primitives.kdf.pbkdf2 import PBKDF2HMAC
import base64

class EncryptionService:
    def __init__(self, master_key_path='/etc/zero-trust/master.key'):
        self.master_key_path = master_key_path
        self.load_or_generate_master_key()
        
    def load_or_generate_master_key(self):
        """Load existing master key or generate new one"""
        if os.path.exists(self.master_key_path):
            with open(self.master_key_path, 'rb') as f:
                self.master_key = f.read()
        else:
            self.master_key = Fernet.generate_key()
            os.makedirs(os.path.dirname(self.master_key_path), exist_ok=True)
            with open(self.master_key_path, 'wb') as f:
                f.write(self.master_key)
            os.chmod(self.master_key_path, 0o600)
    
    def derive_key(self, context):
        """Derive encryption key based on context"""
        kdf = PBKDF2HMAC(
            algorithm=hashes.SHA256(),
            length=32,
            salt=context.encode(),
            iterations=100000,
        )
        key = base64.urlsafe_b64encode(kdf.derive(self.master_key))
        return key
    
    def encrypt_file(self, filepath, context):
        """Encrypt file with context-based key"""
        key = self.derive_key(context)
        f = Fernet(key)
        
        with open(filepath, 'rb') as file:
            file_data = file.read()
        
        encrypted_data = f.encrypt(file_data)
        
        with open(filepath + '.enc', 'wb') as file:
            file.write(encrypted_data)
        
        # Secure delete original
        os.remove(filepath)
        
    def decrypt_file(self, filepath, context):
        """Decrypt file with context-based key"""
        key = self.derive_key(context)
        f = Fernet(key)
        
        with open(filepath, 'rb') as file:
            encrypted_data = file.read()
        
        decrypted_data = f.decrypt(encrypted_data)
        
        output_path = filepath.replace('.enc', '')
        with open(output_path, 'wb') as file:
            file.write(decrypted_data)
        
        return output_path

📊 Zero Trust Dashboard

Monitoring Dashboard Setup

<!-- /var/www/html/zero-trust-dashboard.html -->
<!DOCTYPE html>
<html>
<head>
    <title>Zero Trust Security Dashboard</title>
    <script src="https://cdn.jsdelivr.net/npm/chart.js"></script>
    <style>
        body { 
            font-family: Arial, sans-serif; 
            margin: 20px;
            background-color: #1a1a1a;
            color: #fff;
        }
        .dashboard-grid {
            display: grid;
            grid-template-columns: repeat(auto-fit, minmax(300px, 1fr));
            gap: 20px;
        }
        .metric-card {
            background: #2a2a2a;
            border-radius: 8px;
            padding: 20px;
            box-shadow: 0 4px 6px rgba(0,0,0,0.1);
        }
        .metric-value {
            font-size: 2em;
            font-weight: bold;
            color: #4CAF50;
        }
        .alert {
            background: #f44336;
            color: white;
            padding: 10px;
            border-radius: 4px;
            margin: 10px 0;
        }
    </style>
</head>
<body>
    <h1>Zero Trust Security Dashboard</h1>
    
    <div class="dashboard-grid">
        <div class="metric-card">
            <h3>Trust Score Average</h3>
            <div class="metric-value" id="trust-score">0.00</div>
        </div>
        
        <div class="metric-card">
            <h3>Active Sessions</h3>
            <div class="metric-value" id="active-sessions">0</div>
        </div>
        
        <div class="metric-card">
            <h3>Failed Authentications (24h)</h3>
            <div class="metric-value" id="failed-auth">0</div>
        </div>
        
        <div class="metric-card">
            <h3>Policy Violations (24h)</h3>
            <div class="metric-value" id="violations">0</div>
        </div>
    </div>
    
    <div class="metric-card" style="margin-top: 20px;">
        <h3>Real-time Access Requests</h3>
        <canvas id="access-chart"></canvas>
    </div>
    
    <div class="metric-card" style="margin-top: 20px;">
        <h3>Recent Alerts</h3>
        <div id="alerts-container"></div>
    </div>
    
    <script>
        // Initialize chart
        const ctx = document.getElementById('access-chart').getContext('2d');
        const accessChart = new Chart(ctx, {
            type: 'line',
            data: {
                labels: [],
                datasets: [{
                    label: 'Allowed',
                    data: [],
                    borderColor: 'rgb(75, 192, 192)',
                    tension: 0.1
                }, {
                    label: 'Denied',
                    data: [],
                    borderColor: 'rgb(255, 99, 132)',
                    tension: 0.1
                }]
            },
            options: {
                responsive: true,
                scales: {
                    y: {
                        beginAtZero: true
                    }
                }
            }
        });
        
        // Update dashboard data
        async function updateDashboard() {
            try {
                const response = await fetch('/api/zero-trust/metrics');
                const data = await response.json();
                
                // Update metrics
                document.getElementById('trust-score').textContent = data.avgTrustScore.toFixed(2);
                document.getElementById('active-sessions').textContent = data.activeSessions;
                document.getElementById('failed-auth').textContent = data.failedAuth;
                document.getElementById('violations').textContent = data.violations;
                
                // Update chart
                if (data.accessHistory) {
                    accessChart.data.labels = data.accessHistory.timestamps;
                    accessChart.data.datasets[0].data = data.accessHistory.allowed;
                    accessChart.data.datasets[1].data = data.accessHistory.denied;
                    accessChart.update();
                }
                
                // Update alerts
                const alertsContainer = document.getElementById('alerts-container');
                alertsContainer.innerHTML = '';
                data.recentAlerts.forEach(alert => {
                    const alertDiv = document.createElement('div');
                    alertDiv.className = 'alert';
                    alertDiv.textContent = `[${alert.timestamp}] ${alert.message}`;
                    alertsContainer.appendChild(alertDiv);
                });
                
            } catch (error) {
                console.error('Failed to update dashboard:', error);
            }
        }
        
        // Update every 5 seconds
        setInterval(updateDashboard, 5000);
        updateDashboard();
    </script>
</body>
</html>

🔧 Troubleshooting Zero Trust Implementation

Common Issues and Solutions

# Debug authentication failures
journalctl -u sshd -f | grep -E "(Failed|Invalid|authentication)"

# Check policy engine decisions
curl -X POST http://localhost:5000/evaluate \
  -H "Content-Type: application/json" \
  -d '{
    "user": {"id": "test", "authenticated": true, "mfa_verified": true},
    "device": {"id": "device1", "os_updated": true, "antivirus_active": true},
    "request": {"destination": "resource1", "action": "read"}
  }'

# Verify certificate chain
openssl verify -CAfile /etc/pki/tls/certs/ca.crt \
  -untrusted /etc/pki/tls/certs/intermediate.crt \
  /etc/pki/tls/certs/server.crt

# Test mTLS connection
openssl s_client -connect secure.example.com:443 \
  -cert client.crt \
  -key client.key \
  -CAfile ca.crt

Performance Optimization

# Tune Redis for session management
echo "maxmemory 2gb" | sudo tee -a /etc/redis/redis.conf
echo "maxmemory-policy allkeys-lru" | sudo tee -a /etc/redis/redis.conf

# Optimize policy engine
# Enable caching for policy decisions
sudo tee -a /opt/zero-trust/config.yaml << 'EOF'
cache:
  enabled: true
  ttl: 300
  max_size: 10000
  
performance:
  worker_processes: 4
  max_connections: 1000
  decision_timeout: 100ms
EOF

🎯 Best Practices

Implementation Checklist

1. Identity Foundation

   • ✅ Strong authentication (MFA everywhere)
   • ✅ Centralized identity management
   • ✅ Regular access reviews
   • ✅ Privileged access management

2. Device Trust

   • ✅ Device inventory and classification
   • ✅ Continuous health monitoring
   • ✅ Compliance validation
   • ✅ Certificate-based identification

3. Network Security

   • ✅ Microsegmentation
   • ✅ Encrypted communications (mTLS)
   • ✅ Software-defined perimeter
   • ✅ No implicit trust zones

4. Data Protection

   • ✅ Encryption at rest and in transit
   • ✅ Data classification
   • ✅ Access based on data sensitivity
   • ✅ DLP integration

5. Monitoring and Response

   • ✅ Continuous monitoring
   • ✅ Behavioral analytics
   • ✅ Automated response
   • ✅ Audit trail maintenance

Security Recommendations

• Implement least privilege access everywhere
• Use short-lived credentials and tokens
• Monitor and log all access attempts
• Regular security assessments
• Incident response planning
• User training and awareness

📚 Resources and Next Steps

Advanced Topics

1. AI/ML Integration - Behavioral analysis and anomaly detection
2. Quantum-Safe Cryptography - Prepare for post-quantum threats
3. Zero Trust for IoT - Extending to device networks
4. Cloud-Native Zero Trust - Kubernetes and container security
5. Supply Chain Security - Zero Trust for software delivery

Useful Resources

• NIST SP 800-207: Zero Trust Architecture
• CISA Zero Trust Maturity Model
• Rocky Linux Security Guide
• Open Policy Agent Documentation
• FreeIPA Documentation

Implementing Zero Trust Security Architecture on Rocky Linux 9 requires a fundamental shift in how we approach security. By eliminating implicit trust and continuously verifying every transaction, organizations can significantly improve their security posture. Start with identity and device trust, gradually expand to network and data protection, and remember that Zero Trust is a journey, not a destination. Stay vigilant, keep learning, and never trust, always verify! 🔐