Linux Boot Camp. Our Lady of the Lake University Computer Information Systems & Security Department Kevin Barton Artair Burnett

Size: px

Start display at page:

Download "Linux Boot Camp. Our Lady of the Lake University Computer Information Systems & Security Department Kevin Barton Artair Burnett"

Cory Gordon
8 years ago
Views:

1 Linux Boot Camp Our Lady of the Lake University Computer Information Systems & Security Department Kevin Barton Artair Burnett

2 Schedule for the Week Schedule for the Week Mon Welcome from Enrollment Management Introduction to VMWare Player Introduction to Linux Live USB Introduction to Linux Command Line Lunch Familiarization with Fedora Core 12 Securing FC12 - User Accounts - File Management - Personal File Sharing - Services - File Permissions Tue Securing Ubuntu - Finding your way around the OS - User Accounts - Root Log In - Services & Ports - Updates Lunch Port and Network Scanning - Installing Nessus - Configuring Nessus Server - Launching Nessus Client - Performing Scan - Reviewing Scan

Sharing - Services - File Permissions Tue Securing Ubuntu - Finding your way around the OS - User Accounts - Root Log In - Services & Ports -

3 Schedule for the Week Wed Workstation Configurations - User Accounts - Services - Ports - File Sharing Server Configurations - User Accounts - Services - Ports - File Sharing Troubleshooting - Problems with Scoring Engine Lunch Hardening Fedora Core 12 (Instructor Guided) Thu Hardening Fedora Core 12 (Student Hands-On) Hardening Ubuntu (Student Hands-On) Fri Competition

Troubleshooting - Problems with Scoring Engine Lunch Hardening Fedora Core 12 (Instructor

4 General Hardening Process Access Control File Shares Ports & Services Anti-Virus Protection* Operating System Updates Monitoring & Auditing Backups Securing Applications

5 General Hardening Process Access Control includes: Deleting or locking unnecessary account Limiting permissions on accounts Particular interest is administration rights Authentication Password rules Password updates Access control configured in O/S, applications, or network

Particular interest is administration rights Authentication Password

6 General Hardening Process File Shares Controlling shares for: Remote Users Local Users Privileged Users File shares configured in the O/S

7 General Hardening Process Ports & Services Allows remote access to a computer Open ports & services are remote attack vectors Open port means a computer is listening for connections on that port Open ports are for inbound connections, not outbound Outbound connections are established dynamically Ports & Services configured in O/S and firewall

for connections on that port Open ports are for inbound connections, not outbound

8 General Hardening Process Anti-Virus Protection Windows Most popular O/S Most targeted O/S for malware Many AV options Windows AV achieved through AV software Linux/Unix Much less frequently targeted by malware Few AV options Linux AV protection managed with root permissions

achieved through AV software Linux/Unix Much less frequently

9 General Hardening Process Operating System Updates New installs require immediate updates O/S updates are not trouble free Slow Can introduce new problems Can require restarts Never ends!

10 General Hardening Process Monitoring & Auditing Logging Configured in the O/S Records events Select types of events to record Auditing The process of reviewing logs Identify significant events that could indicate an attack Monitoring Similar to auditing, but real-time events vs historical events Vulnerability Scanning Many different scanners available, all require caution We will use Nessus

events that could indicate an attack Monitoring Similar to auditing, but real-time events vs

11 General Hardening Process Backups Software Archive software & licenses System Create & maintain recovery disks Create & maintain current system configuration Create backups for encryption keys Data Local & Remote Backups

disks Create & maintain current system configuration

12 General Hardening Process Securing Applications Only include applications that are required Access control within applications Updates & patches

13 General Hardening Process Rules of thumb: Least Privilege Users and processes have the minimum access or permissions required to perform their job Least Function Systems have the minimum functions required to function Deny All / Permit by Exception

required to perform their job Least Function Systems have the

14 Notes on Fedora Core 12 & Ubuntu GUI-based Linux Distributions Securing them: Will be primarily through GUI, but: Some hardening steps will be Command Line Sequence of Hardening Steps: Instructed by navigation in the GUI, but Sequence during competition will consider: Criticality of each step Time and resource requirements of each step

Some hardening steps will be Command Line Sequence of Hardening Steps: Instructed by

15 Fedora Core 12 Navigation Hardening Category Tasks System/Preferences/File Management Access Control Behavior tab - Executable Text Files - Select Ask Each Time System/Preference/Personal File Sharing File Shares Share Files over the Network - Deselect Share public files on network Share Files over Bluetooth - Deselect Share public files over Bluetooth Receive Files over Bluetooth - Deselect Receive files in Downloads folder over Bluetooth System/Administration/Authentication Access Control Options - Select Use Shadow Passwords

files on network Share Files over Bluetooth - Deselect Share public files over Bluetooth Receive Files over Bluetooth - Deselect

16 Fedora Core 12 Navigation Hardening Category Tasks System/Administration/Authentication Access Control Options tab, Options line - Select Use Shadow Passwords System/Administration/Firewall Ports & Services Ensure Firewall is enabled System/Administration/Firewall Ports & Services Trusted Services tab - Deselect all services that are not specifically required System/Administration/Firewall Ports & Services Other Ports tab - Review for any enabled services System/Administration/Firewall Ports & Services Trusted Interfaces tab - Deselect all interfaces System/Administration/Firewall Ports & Services Port Forwarding tab - Review all assigned port forwarding options, and remove unless specifically required

not specifically required System/Administration/Firewall Ports & Services Other Ports tab - Review for any enabled services System/Administration/Firewall Ports & Services

17 Fedora Core 12 Navigation Hardening Category Tasks System/Administration/Firewall Ports & Services ICMP Filter tab - Deselect Destination Unreachable, Echo Request, Parameter Problem, Redirect, Router Advertisement, Router Solicitation, Source Quench, Time Exceeded - Select Echo Reply, if desired System/Administration/Firewall Ports & Services Custom Rule tab - Review and remove any rules that are not desired System/Administration/Server Settings/NFS File Shares NFS Server Configuration - Review all file share rules - Delete any that are not desired

Echo Reply, if desired System/Administration/Firewall Ports & Services Custom Rule tab - Review and remove any rules that are not desired

18 Fedora Core 12 Navigation Hardening Category Tasks System/Administration/Services Ports & Services Review Enabled services Disable undesired services - Recommend creating a list of normally enabled services to have during competition, and keeping track of what services are disabled in the event that problems arise Starting, Stopping and Checking the status of services may require command line. From Root: - /sbin/service service daemon status - /sbin/service service daemon start - /sbin/service service daemon stop

of what services are disabled in the event that problems arise Starting, Stopping and Checking the status of services may require

19 Fedora Core 12 Navigation Hardening Category Tasks System/Administration/Users & Groups Access Control Users tab - Review all user accounts - Lock all accounts that are not valid - Double click account - Select Account Info tab - Select Local password is locked - Update all accounts that are kept - Change password on User Data tab - Enable password expiration on Password Info tab - Remove users from privileged account groups on Groups tab

Info tab - Select Local password is locked - Update all accounts that are kept - Change password on User Data

20 Fedora Core 12 Navigation Hardening Category Tasks System/Administration/Users & Groups Access Control Users tab - Review all groups from Groups tab - Delete suspicious groups. Each user should have their own group, groups not associated with a user are not part of the default configuration and should be reviewed.

21 Fedora Core 12 Navigation Hardening Category Tasks System/Administration/Software Updates Operating System Updates Download and Install Update Use CLI if having problems installing updates from GUI - CLI from Root: yum update - Update Boot Loader with /sbin/grub-install /dev/sda (sda represents device, view devices under Applications/System Tools/System Monitor/Resources System/Administration/Services Auditing & Monitoring Enable and start auditd - auditd runs by default, but verify it is running (enabled & started) - Verify by CLI with /sbin/service auditd status

22 Fedora Core 12 Disable SSH Root Login SSH Root Login could allow an attacker to gain root access by logging into SSH Block this attack vector by editing the SSH configuration file, stopping SSH service, and blocking Port 22 (SSH) at the firewall

23 Fedora Core 12 To Disable SSH Root Login, you need: Text Editor: We will use VI A Terminal: Navigate Applications/System Tools/Terminal Login as Root (su) Enter the command vi /etc/ssh/sshd_config Scroll down until you find: #LoginGraceTime 2m #PermitRootLogin yes #StrictModes yes #MaxAuthTries 6

24 Fedora Core 12 Disable SSH Root Login See this link for detailed instructions on using the text editor VI The line that says PermitRootLogin yes must be changed to PermitRootLogin no Move the cursor to yes, Type i to insert text, and enter no. Delete yes Hit Esc to quit editing Enter :w to save the change Enter :q to exit VI editor Restart the service with /etc/init.d/sshd restart

25 Fedora Core 12 Navigation Hardening Category Tasks Applications/System Tools/Terminal Monitoring & Auditing Determine IP Address - Enter command ifconfig - IP address shown as inet addr: - Not the IP address. You will need it to scan the machine with Nessus View Active Network Connections - Get Root access - Enter lsof i -n - Review for anomalies

Linux Boot Camp. Our Lady of the Lake University Computer Information Systems & Security Department Kevin Barton Artair Burnett

Linux Boot Camp. Our Lady of the Lake University Computer Information Systems & Security Department Kevin Barton Artair Burnett Linux Boot Camp Our Lady of the Lake University Computer Information Systems & Security Department Kevin Barton Artair Burnett Schedule for the Week Schedule for the Week Mon Welcome from Enrollment Management