Secure Shell Version 2x

Open Secure Shell version 2 (OpenSSHv2) Security - Module VIII

• Introduction - Topology - Features
  • Discuss course outline
  • Explore system configuration
  • Identify key systems to be used
  • Explore network topology
  • Enumerate and discuss key OpenSSHv2 features
•  
• Identify Key OpenSSHv2 Components
  • Identify installed OpenSSHv2 related packages
  • Peruse related startup and run-control script files
  • Locate 'sshd' on the file system
  • Discuss related client | server configuration files
•  
• OpenSSHv2 Client - /ssh/
  • Discuss features and benefits
  • Obtain shell access on a remote system
  • Configure /etc/hosts to provide local name resolution for OpenSSHv2
  • Identify and discuss pseudo-terminals - pty
  • Redirect X11/X.org traffic to localhost via SSH
  • Bind 'ssh' to specific source IP address and test connectivity
  • Execute commands on remote system without allocating a pseudo-terminal
  • Debug 'ssh' connectivity
  • Explore the system-wide client configuration file
  • Explore user configuration file
•  
• Secure Copy Program (SCP) - /scp/
  • Discuss features and benefits
  • Locate 'scp' on the file system
  • Discuss usage
  • Copy, non-interactively, previously generated data to remote systems
  • Test 'scp' with global and user configuration directives
  • Debug 'scp' connectivity
  • Limit transfer rate to conserve bandwidth
•  
• Secure File Transfer Program (SFTP) - /sftp/
  • Discuss features and benefits
  • Locate 'sftp' on the file system
  • Discuss usage
  • Connect to remote system using 'sftp' interactive shell
  • Issue puts and gets and evaluate results
  • Identify the sftp-server subsystem
  • Peruse process list while connected to OpenSSHv2 server
  • Illustrate batch file usage
•  
• SSH Key Scan Utility - /ssh-keyscan/
  • Discuss features and benefits
  • Locate 'ssh-keyscan' on the file system
  • Discuss usage
  • Scan the network from STDIN for OpenSSHv2 public keys - RSA (SSHv1 & SSHv2) | DSA
  • Scan the network based on a file with a list of hosts for OpenSSHv2 public keys
  • Populate ~/.ssh/known_hosts file using 'ssh-keyscan' with BASH for loop
  • Compare and contrast STDOUT with the output file
•  
• SSH Key Generation Utility - /ssh-keygen/
  • Discuss features and benefits
  • Locate 'ssh-keygen' on the file system
  • Discuss usage
  • Generate RSA-2 usage keys
  • Identify RSA-2 public and private key pair
  • Generate DSA usage keys
  • Identify DSA public and private key pair
  • Expose usage keys' fingerprint using 'ssh-keygen'
  • Generate RSA-2 | DSA usage keys for all hosts
•  
• Public Key Infrastructure (PKI) - Password-less Logins
  • Discuss features and benefits
  • Identify key files for client and server implemenation of password-less (PKI-based) logins
  • Copy manually, RSA-2 | DSA public keys to remote system's ~/.ssh/authorized_keys file
  • Test password-less logins
  • Use 'ssh-copy-id' to seamlessly populate remote system with RSA-2 | DSA usage keys
  • Test password-less connectivity after using 'ssh-copy-id'
  • Confirm password-less connectivity using SSH clients /ssh|scp|sftp/ in debug mode
  • Connect to privileged account from non-privileged account using PKI
  • Configure RSA-1 connectivity using PKI
•  
• System-wide OpenSSHv2 Configuration Directives
  • Identify key directory and files associated with client | server configuration
  • Explore primary server configuration file
  • Discuss applicability of directives
  • Alter and test several SSHD directives
  • Explore OpenSSHv2 configuration on RedHat Linux
  • Explore OpenSSHv2 configuration on Solaris 10
•  
• Port Forwarding - Pseudo-VPN Support - /Local|Remote|Gateway/
• Discuss features and benefits
• Implement local port forwarding using 'ssh'
• Configure remote port forwarding using 'ssh'
• Test circumvention of local firewall using remote port forwarding
• Implement gateway ports to share forwarded /local|remote/ with connected users
• Test connectivity
•  
• Windows Integration - /PuTTY|WinSCP/
  • Discuss features and applications
  • Download and install PuTTY
  • Explore PuTTY's features
  • Configure PKI logins
  • Download and install WinSCP
  • Explore WinSCP's features
  • Move data between Windows, Linux and Solaris
•  
• Syslog | Syslog-NG Configuration
  • Discuss features and benefits
  • Identify default configuration
  • Redirect OpenSSHv2 data using Syslog and Syslog-NG
  • Examine results
  • Enable debugging
•  
• Host-based Authentication
  • Discuss applicability and caveats
  • Identify key configuration files and directives
  • Implement host-based authentication
  • Test results
•  
• OpenSSHv2 Source Installation
  • Discuss features and benefits
  • Download current OpenSSHv2 source code
  • Compile and install
  • Restart services|daemons
  • Test new version of OpenSSHv2
•  
• Secure OpenSSHv2 Implementation
  • Discuss features and benefits
  • Identify key configuration file
  • Enumerate and implement key directives
  • Test configuration
•  
• Upgrade OpenSSHv2
  • Identify target systems
  • Download latest OpenSSH source code
  • Compile with compatible options
  • Test installation
•  
• CHROOT - SFTP Connections
  • Discuss features and benefits
  • Implement CHROOT SFTP sessions for specific users
  • Evaluate results
•  

Sums

• Various Tools
• Remote Confirmations
• File Metadata
• File Fragments
• Compress Content
• Archive Content
• DIR Hierarchy
• Password Sums
• Shared Secret
• Restrict History
• Downloaded Content
• Encrypt Content
• Site Credentials
• Site COOKIE
• Site COOKIE - Unique

CentOS9x Stream Administration

• Initial Environment
• ls, pwd, cd, cp, mv, rm, mkdir, rmdir, whoami
• alias, cat, file, chmod, chown, history
• STD(IN|OUT), Pipes, Redirection, Command Chaining
• ps, df, top, free
• Pagers, W-Commands
• Checksums
• Awk | Sed | Grep Usage
• BASH SHELL Environment
• Compression | Archival Tools
• SSH Equivalence
• SHELL Quoting
• Propagate Environment
• Secure Clients

• Identify Standard File Types
• Standard File Permissions
• Symbolic Links
• Transfer Permissions

• Identify SWAP environment
• Provision dedicated SWAP partitions
• Add | Remove SWAP from pool as needed
• Provision File System-based SWAP
• SWAP Share
• SWAP Persistence
• Identify default storage configuration
• Provision new storage as needed
• XFS - File System
• XFS - Grow File System
• Identify LVM defaults
• Add new partitions to LVM management
• Allocate storage to LVM Volume Groups
• Create Logical Volumes (LVs) as needed
• Overlay File System and mount where applicables
• LVM - Resize
• LVM - Mixed FS
• LVM - SWAP

• Features
• Install
• Defaults
• General Usage
• Update Accounts

• Defaults
• Shared PASS Gen
• Unique PASS Gen
• Encrypted PASS Gen
• Update Accounts
• Groups

• Discuss features | limitations
• Identify default system-wide schedule
• Peruse various default Cron Jobs
• Schedule simple job and monitor recurrence
• Evaluate results

• Peruse Default CONF
• Discuss Syslog Rules
• Explore Log Rotate defaults
• Ensure rotated logs are compressed
• Extend default retention scheme
• Force Log Rotation as needed

• Explore Default environment
• Install PKGs
• Dump important metadata from packages
• Apply Updates

• Default CONF
• Add | Confirm IPs as needed

• Install
• Copy Configuration
• SELinux - Confirm
• TLS | SSL Services
• cURL Client Tests
• Virtual Hosts
• ENC Sites Only

• SFTP Only USER
• SFTP Only USER - NOLOGIN
• SFTP Only Group - Control
• NMap Intro

SysLOG with rSysLogD

• Discuss Features
• Default Environment
• Kernel Firewall LOG
• Split LOGs by Priorities
• UDP | TCP Logging
• Dual L4 Logging
• Multiple Hosts
• Basic Queueing
• Reliable Event Logging Protocol (RELP)
• RELP - Remote Only
• RELP Only
• Traditional to RELP
• SysLOG Clear-Text - Confirm
• Property Filters
• Expression Filters
• Relay Chain

Netfilter Tables

• Features
• SSHGuard
• Ruleset Basics
• Persistence
• Sample Rules
• Inbound Filtering
• Dormant Table
• Manage Tables | Chains | Rules
• Counters
• Sets
• LOG Basics
• LOG with Sets
• Closed-Port LOGs
• LOG Options
• Re-Route LOGs
• Jump Targets
• Chain Jumping
• GoTo Chains
• Meta Selectors

Debian 12x Administration

• Features
• Download
• Graphical Install
• Text Install
• Post-Install Tweaks

• Explore usage of the following useful commands
• tty | /dev/pts | w | whoami | who
• set | env | export | unset
• cat | echo | touch | rm
• pwd | ls | cd | mkdir | alias | umask
• head | tail
• dd
• find
• history
• STDIN, STDOUT, STDERR, UNIX Pipes, Redirection, Command Chaining
• ps, df, free, top, dd
• stat, which, w, who
• tar | gzip | bzip2 | xz
• ZSH Setup

• Network Tools | IP Configuration
• Examine default IP configuration
• Extend IP configuration to facilitate additional addresses
• Static IP Config
• Dual: Dynamic | Static Config
• Multiple Interfaces
• Dual Network Services
• Confirm communications

PHP One-Liners

• General Usage
• Count Lines
• Word Count
• Count Chars
• Split Lines into ARRAY
• Count Instances of Fields
• Transform Delimiters
• Anonymize LOGs
• Extract Unique SRCs
• Lines by Error Code
• LOG By Code
• Summarize Error Codes
• Pre-Seed Error Codes
• Random Strings
• Varied Passwords
• Expose Undefined Passwords
• Outdated Passwords
• Hash | Un-Hash

Cloud Storage with GlusterFS

• Discuss Features:
• Default Volume Type
• Common Volume Types
• Transport Types
• File System Support
• Storage Model

• Features
• Provision Storage
• Allocate GlusterFS Brick
• Persistence
• Generate IO
• Multiple File Systems
• Various Sizes
• Stop | Remove Volume
• Reconstitute Volume
• Server Mount
• Evaluate

OpenPGP with GPG

• Discuss Features:
• Primary Tool
• Private | Public Keys
• Public Key Cryptography Standards (PKCS)
• Encryption | Decryption
• Signing | Verification

• Features
• General Usage
• Create Content
• Encrypt
• PassPhrase Protect
• Binary | Text Encryption
• Share
• Decrypt

SSL-TLS with OpenSSL

• Discuss Features:
• Primary Tool
• Private | Public Keys
• Certificate Signing Requests (CSRs)
• Self-Signed Certificates
• Public Key Cryptography Standards (PKCS)
• Encryption | Decryption
• Random String Generation
• Message Digests
• SSL-TLS Client

• Features
• General Usage
• Retrieve Site Certificates
• Determine OCSP Configuration
• Probe supported TLS Versions
• Extract Certificate for local usage
• Retrieve Certificate with NMap
• Retrieve Certificate Chain

• Discuss
• Generate Private Keys
• Generate Correlating CSRs
• Confirm Keys | CSRs
• Self-Signed Certificates

SSH Variables

• Discuss Features
• Bare VARs
• SSH Client
• Double Quotes
• Single Quotes
• SSH Environment

SHELL Variables

• Discuss Features
• Terminal (TTY)
• CLI Arguments
• Process ID
• Backgrounded
• SHELL Local
• Environment
• Persistence
• Aliases
• Command Substitution
• Increment | Decrement
• Dynamism