Foundational Security Techniques

Basic Security - Module I

• Boot Security
  • Explore Dell PowerEdge BIOS Security-related features
  • Discuss concepts & improve Dell PowerEdge BIOS security
  • Explain run-time boot loader vulnerabilities
  • Explore single-user mode (rootshell) and its inherent problems
  • Modify default GRUB startup options & examine results
  • Secure boot loader using MD5 hash
  • Identify key startup-related configuration files & define boot security measures
  • Identify key boot-related utilities
  • Confirm expected hardware configuration
  • Discuss INIT process, runlevel configuration & concepts
  • Explore & tighten the security of the INIT configuration
•  
• Shell Security
  • Confirm expected applications
  • Discuss Teletype Terminals (TTYs) and Pseudo Terminals (PTS)
  • Identify common TTYs and PTSs
  • Track current TTYs and PTSs - character devices
  • Discuss concepts related to privileged and non-privileged use
  • Restrict privileged login
  • Use SSH and discuss TTYs
  • Discuss the importance of consistent system-wide banners & messages
  • Define and configure system banners for pre and post-system-access
  • Identify user-logon history and correlate to TTYs
  • Identify current user-connections - console-based and network-based
  • Use lsof to identify open files and sockets
•  
• Syslog Security
  • Discuss Syslog concepts and applications
  • Explain Syslog semantics - facilities & levels - message handling & routing
  • Focus on security-related Syslog facilities
  • Examine security logs managed by Syslog
  • Configure Network Time Protocol (NTP) on interesting hosts
  • Secure NTP configuration
  • Ensure time consistency to preserve log-integrity
  • Configure Syslog replication to preserve log-integrity
  • Identify log discrepancies between Syslog hosts
•  
• Reconnaissance & Vulnerability Assessment Tools
  • Discuss Stage-1 host/network attack concepts
  • Upgrade NMAP reconnaissance tool to increase effectiveness
  • Identify NMAP files
  • Discuss TCP handshake procedure
  • Discuss half-open/SYN connections
  • Perform connect and SYN-based host/network reconnaissance
  • Identify potential vulnerabilities on interesting hosts derived from reconnaissance
  • Examine NMAP logging capabilities
  • Perform port sweeps to identify common vulnerabilities across exposed systems
  • Secure exposed daemons/services
  • Perform follow-up audit to ensure security policy compliance
  • Discuss vulnerability scanner capabilities and applications
  • Prepare system for Nessus vulnerability scanner installation - identify/install dependencies
  • Generate self-signed SSL/TLS certificates for secure client/server communications
  • Activate Nessus subscription, server and client components
  • Explore vulnerability scanner interface and features
  • Perform network-based reconnaissance attack to determine vulnerabilities
  • Examine results of the reconnaissance attack and archive results
  • Secure exposed vulnerabilities
•  
• XINETD - TCPWrappers - Chattr - Lsattr - TCPDump - Clear Text Daemons
  • Install Telnet Daemon
  • Install Very Secure FTP Daemon (VSFTPD)
  • Explore XINETD configuration and explain directives
  • Configure XINETD to restrict communications at layer-3 and layer-4
  • Restrict access to XINETD-protected daemons/services based on time range
  • Examine XINETD logging via Syslog
  • Discuss TCPWrappers security concepts & applications
  • Enhance Telnetd security with TCPWrappers
  • Confirm XINETD & TCPWrappers security
  • Discuss chattr applications & usage
  • Identify & flag key files as immutable to deter modifcation
  • Confirm extended attributes (XATTRs)
  • Discuss TCPDump applications & usage
  • Configure TCPDump to intercept Telnet & FTP - clear-text traffic
  • Use Ethereal to examine & reconstruct captured clear-text traffic
•  
• Secure Shell (SSH) & MD5SUM Applications
  • Use Ethereal to examine SSH streams
  • Generate RSA/DSA PKI usage keys
  • Configure Public Key Infrastructure (PKI) based authentication
  • Secure PKI authentication files
  • Use SCP to transfer files securely in non-interactive mode
  • Use SFTP to transfer files securely in interactive mode
  • Configure SSH to support a pseudo-VPN using SSH-Tunnelling
  • Discuss MD5SUM concepts and applications
  • Compare & contrast modified files using MD5SUM
  • Use MD5SUM to verify the integrity of downloaded files
•  
• GNU Privacy Guard (GPG) - Pretty Good Privacy (PGP) Compatible - PKI
  • Discuss GPG concepts & applications - symmetric/asymmetric encryption
  • Generate asymmetric RSA/DSA GPG/PGP usage keys - for multiple users
  • Create a local web of trust
  • Perform encrypts/decrypts and test data-exchanges
  • Sign encrypted content and verify signatures @ recipient
  • Import & export public keys for usage
  • Use GPG/PGP with Mutt Mail User Agent (MUA)
•  
• AIDE File Integrity Implementation
  • Discuss file-integrity checker concepts & applications
  • Identify online repository & download AIDE
  • Install AIDE on interesting hosts
  • Configure AIDE to protect key files & directories
  • Alter file system objects and confirm modifications using AIDE
  • Audit the file system using AIDE
•  
• Rootkits
  • Discuss rootkits concepts & applications
  • Describe privilege elevation techniques
  • Obtain & install T0rnkit - rootkit
  • Identify system changes due to the rootkit
  • Implement T0rnkit with AIDE to identify compromised system objects
  • Implement T0rnkit with chkrootkit to identify rootkits
  • T0rnkit - rootkit - cleanup
  • Implement N-DU rootkit
  • Evaluate system changes
•  
• Bastille Linux - OS-Hardening
  • Discuss Bastille Linux system hardening capabilities
  • Obtain Bastille Linux & perform a system assessment
  • Install Bastille Linux
  • Evaluate hardened system components
•  
• NPING - Flexible Packet Crafting
  • Discuss benefits
  • Download and install
  • Explore typical usage
•  
• Nikto - Web Server Vulnerability Scanner
  • Download and install
  • Discuss configuration options
  • Scan web servers
  • Evaluate results
•  

Sums

• Various Tools
• Remote Confirmations
• File Metadata
• File Fragments
• Compress Content
• Archive Content
• DIR Hierarchy
• Password Sums
• Shared Secret
• Restrict History
• Downloaded Content
• Encrypt Content
• Site Credentials
• Site COOKIE
• Site COOKIE - Unique

CentOS9x Stream Administration

• Initial Environment
• ls, pwd, cd, cp, mv, rm, mkdir, rmdir, whoami
• alias, cat, file, chmod, chown, history
• STD(IN|OUT), Pipes, Redirection, Command Chaining
• ps, df, top, free
• Pagers, W-Commands
• Checksums
• Awk | Sed | Grep Usage
• BASH SHELL Environment
• Compression | Archival Tools
• SSH Equivalence
• SHELL Quoting
• Propagate Environment
• Secure Clients

• Identify Standard File Types
• Standard File Permissions
• Symbolic Links
• Transfer Permissions

• Identify SWAP environment
• Provision dedicated SWAP partitions
• Add | Remove SWAP from pool as needed
• Provision File System-based SWAP
• SWAP Share
• SWAP Persistence
• Identify default storage configuration
• Provision new storage as needed
• XFS - File System
• XFS - Grow File System
• Identify LVM defaults
• Add new partitions to LVM management
• Allocate storage to LVM Volume Groups
• Create Logical Volumes (LVs) as needed
• Overlay File System and mount where applicables
• LVM - Resize
• LVM - Mixed FS
• LVM - SWAP

• Features
• Install
• Defaults
• General Usage
• Update Accounts

• Defaults
• Shared PASS Gen
• Unique PASS Gen
• Encrypted PASS Gen
• Update Accounts
• Groups

• Discuss features | limitations
• Identify default system-wide schedule
• Peruse various default Cron Jobs
• Schedule simple job and monitor recurrence
• Evaluate results

• Peruse Default CONF
• Discuss Syslog Rules
• Explore Log Rotate defaults
• Ensure rotated logs are compressed
• Extend default retention scheme
• Force Log Rotation as needed

• Explore Default environment
• Install PKGs
• Dump important metadata from packages
• Apply Updates

• Default CONF
• Add | Confirm IPs as needed

• Install
• Copy Configuration
• SELinux - Confirm
• TLS | SSL Services
• cURL Client Tests
• Virtual Hosts
• ENC Sites Only

• SFTP Only USER
• SFTP Only USER - NOLOGIN
• SFTP Only Group - Control
• NMap Intro

SysLOG with rSysLogD

• Discuss Features
• Default Environment
• Kernel Firewall LOG
• Split LOGs by Priorities
• UDP | TCP Logging
• Dual L4 Logging
• Multiple Hosts
• Basic Queueing
• Reliable Event Logging Protocol (RELP)
• RELP - Remote Only
• RELP Only
• Traditional to RELP
• SysLOG Clear-Text - Confirm
• Property Filters
• Expression Filters
• Relay Chain

Netfilter Tables

• Features
• SSHGuard
• Ruleset Basics
• Persistence
• Sample Rules
• Inbound Filtering
• Dormant Table
• Manage Tables | Chains | Rules
• Counters
• Sets
• LOG Basics
• LOG with Sets
• Closed-Port LOGs
• LOG Options
• Re-Route LOGs
• Jump Targets
• Chain Jumping
• GoTo Chains
• Meta Selectors

Debian 12x Administration

• Features
• Download
• Graphical Install
• Text Install
• Post-Install Tweaks

• Explore usage of the following useful commands
• tty | /dev/pts | w | whoami | who
• set | env | export | unset
• cat | echo | touch | rm
• pwd | ls | cd | mkdir | alias | umask
• head | tail
• dd
• find
• history
• STDIN, STDOUT, STDERR, UNIX Pipes, Redirection, Command Chaining
• ps, df, free, top, dd
• stat, which, w, who
• tar | gzip | bzip2 | xz
• ZSH Setup

• Network Tools | IP Configuration
• Examine default IP configuration
• Extend IP configuration to facilitate additional addresses
• Static IP Config
• Dual: Dynamic | Static Config
• Multiple Interfaces
• Dual Network Services
• Confirm communications

PHP One-Liners

• General Usage
• Count Lines
• Word Count
• Count Chars
• Split Lines into ARRAY
• Count Instances of Fields
• Transform Delimiters
• Anonymize LOGs
• Extract Unique SRCs
• Lines by Error Code
• LOG By Code
• Summarize Error Codes
• Pre-Seed Error Codes
• Random Strings
• Varied Passwords
• Expose Undefined Passwords
• Outdated Passwords
• Hash | Un-Hash

Cloud Storage with GlusterFS

• Discuss Features:
• Default Volume Type
• Common Volume Types
• Transport Types
• File System Support
• Storage Model

• Features
• Provision Storage
• Allocate GlusterFS Brick
• Persistence
• Generate IO
• Multiple File Systems
• Various Sizes
• Stop | Remove Volume
• Reconstitute Volume
• Server Mount
• Evaluate

OpenPGP with GPG

• Discuss Features:
• Primary Tool
• Private | Public Keys
• Public Key Cryptography Standards (PKCS)
• Encryption | Decryption
• Signing | Verification

• Features
• General Usage
• Create Content
• Encrypt
• PassPhrase Protect
• Binary | Text Encryption
• Share
• Decrypt

SSL-TLS with OpenSSL

• Discuss Features:
• Primary Tool
• Private | Public Keys
• Certificate Signing Requests (CSRs)
• Self-Signed Certificates
• Public Key Cryptography Standards (PKCS)
• Encryption | Decryption
• Random String Generation
• Message Digests
• SSL-TLS Client

• Features
• General Usage
• Retrieve Site Certificates
• Determine OCSP Configuration
• Probe supported TLS Versions
• Extract Certificate for local usage
• Retrieve Certificate with NMap
• Retrieve Certificate Chain

• Discuss
• Generate Private Keys
• Generate Correlating CSRs
• Confirm Keys | CSRs
• Self-Signed Certificates

SSH Variables

• Discuss Features
• Bare VARs
• SSH Client
• Double Quotes
• Single Quotes
• SSH Environment

SHELL Variables

• Discuss Features
• Terminal (TTY)
• CLI Arguments
• Process ID
• Backgrounded
• SHELL Local
• Environment
• Persistence
• Aliases
• Command Substitution
• Increment | Decrement
• Dynamism