Server security

What a server exposes and what it keeps running after an update, password policy and fail2ban, a service with least privilege, AppArmor and auditd — up to getting a new server ready for publication.

10 stages7 labs~7 hours medium

Progress Stages: 0 of 10

The track has not been started. The first stage is «Auditing listening services», ~1 hour.

Start stage 1

Module 1

What a server exposes

Which services listen on extra addresses and how to close them with binding and a filter; when an update needs a restart.

3 stages · ~2 hours

Stage 1 of 10
1 · Auditing listening servicesAuditing listening services
7 steps · 1 lab · ~1 hour 7 steps · 1 lab · ~1 hour
1. The server through an outsider's eyes exercises 0 of 1 on a machine 5 min
2. 2 A socket inventory on a machine 7 min
3. 3 Binding: the service listens only to itself on a machine 6 min
4. 4 The filter: let through only what is needed theory 6 min
5. 5 The admin panel behind the filter on a machine 4 min
6. 6 Too much is visible from the network lab 35 min
7. 7 Summary summary 2 min
Start stage 1
2
Stage 2 of 10
2 · The update is in, the vulnerability is still aliveThe update is in, the vulnerability is still alive
7 steps · 1 lab · ~55 min 7 steps · 1 lab · ~55 min
1. The update is installed exercises 0 of 1 on a machine 5 min
2. 2 The name is gone, the file stays theory 5 min
3. 3 Restart and check on a machine 5 min
4. 4 One library, many services on a machine 8 min
5. 5 Data gets stale too on a machine 5 min
6. 6 After the update lab 25 min
7. 7 Summary summary 2 min
Start stage 2
3 · Module test 10 questions · pass mark 70%

Module 2

Logins and passwords

Password policy and lockout after failed attempts in PAM; a fail2ban jail on the journal and checking the ban.

3 stages · ~2 hours

4
Stage 4 of 10
4 · PAM: password policy and lockoutPAM: password policy and lockout
8 steps · 1 lab · ~1 hour 8 steps · 1 lab · ~1 hour
1. A weak password gets through exercises 0 of 1 on a machine 4 min
2. 2 The PAM stack theory 3 min
3. 3 A password quality policy theory 3 min
4. 4 Check and turn on on a machine 7 min
5. 5 Misses with no consequences on a machine 5 min
6. 6 Locking the account on a machine 6 min
7. 7 A password can be anything lab 30 min
8. 8 Summary summary 2 min
Start stage 4
5
Stage 5 of 10
5 · Password brute force and fail2banPassword brute force and fail2ban
7 steps · 1 lab · ~55 min 7 steps · 1 lab · ~55 min
1. The brute force is on, no bans exercises 0 of 1 on a machine 6 min
2. 2 How fail2ban works theory 3 min
3. 3 Where fail2ban takes refusals from theory 4 min
4. 4 When a ban fires theory 5 min
5. 5 Aim the jail at the journal on a machine 4 min
6. 6 The brute force goes on lab 30 min
7. 7 Summary summary 3 min
Start stage 5
6 · Module test 9 questions · pass mark 70%

Module 3

Confinement and audit

Restricting a service with systemd, an AppArmor denial without turning the profile off, an audit rule and finding who changed a file.

4 stages · ~3 hours

7
Stage 7 of 10
7 · A service with least privilegeA service with least privilege
6 steps · 1 lab · ~55 min 6 steps · 1 lab · ~55 min
1. The service asks for more than it needs exercises 0 of 1 on a machine 5 min
2. 2 Who the service runs as on a machine 8 min
3. 3 Take away access to the system on a machine 8 min
4. 4 The score and capabilities on a machine 7 min
5. 5 The service can do anything lab 25 min
6. 6 Summary summary 2 min
Start stage 7
8
Stage 8 of 10
8 · AppArmor: when the profile denies accessAppArmor: when the profile denies access
5 steps · 1 lab · ~50 min 5 steps · 1 lab · ~50 min
1. The permissions are right, but there is no access exercises 0 of 1 on a machine 7 min
2. 2 The profile on top of permissions on a machine 10 min
3. 3 What is denied and how to add it on a machine 10 min
4. 4 The service is denied access lab 20 min
5. 5 Summary summary 3 min
Start stage 8
9
Stage 9 of 10
9 · Who changed the file: auditdWho changed the file: auditd
6 steps · 1 lab · ~50 min 6 steps · 1 lab · ~50 min
1. The file changes by itself exercises 0 of 1 on a machine 6 min
2. 2 Watching a file on a machine 8 min
3. 3 Who and with what theory 6 min
4. 4 So the rule does not disappear on a machine 7 min
5. 5 The config changes by itself lab 20 min
6. 6 Summary summary 3 min
Start stage 9
10 · Module test 10 questions · pass mark 70%

Final lab
A server ready for publication ~1 hour
Final test 18 questions · pass mark 80%

What a server exposes

1 · Auditing listening servicesAuditing listening services

2 · The update is in, the vulnerability is still aliveThe update is in, the vulnerability is still alive

Logins and passwords

4 · PAM: password policy and lockoutPAM: password policy and lockout

5 · Password brute force and fail2banPassword brute force and fail2ban

Confinement and audit

7 · A service with least privilegeA service with least privilege

8 · AppArmor: when the profile denies accessAppArmor: when the profile denies access

9 · Who changed the file: auditdWho changed the file: auditd

Already know this?