Hello and welcome back to the official Start Cop series, the certified Carry On s pen tester.
This module will be on monitoring and managing Linux processes.
And we'll talk about Linux process management.
So it's generally important to think about security in the terms of the scope of all the.
Different methodologies that are out there.
There are so many different types of tools and many picking the right balance of security can be difficult.
And it also largely depends a lot on your organization's objectives.
It's about providing security to a system has to be built in from the ground up.
So this is the outline.
We're going to talk about security policies.
We're going to look at risks.
We're going to look at different security measures to minimize risk.
We'll look at the different types of attacks that we're going to mitigate.
We'll talk about network firewalls.
Network services.
Look at Linux's IP tables, as well as the different roles and other monitoring and logging resources.
This is our chapter flow.
So we're going to start out with security policy in our policy around work all the way up to D package
and post intrusion detection system.
So the security policy of Linux, the definition that outlines the rules and practices that are going
to be followed.
With respect to security in an organization, how can an organization protect their sensitive data?
This is typically driven by a security policy or potentially by a compliance framework that might dictate
security policy.
So in creating a security policy, you want to make sure that it's simple and easy for everyone to understand.
And the objective of the policy is to be able to protect data while keeping the privacy of users intact.
So for these three points on the screen here, the thing about what are you trying to protect?
What are you trying to protect against or what types of attacks and who are you trying to protect from?
So whether it's advanced, persistent threats.
Script kitties, nation states.
Insider threats.
All of these things go into.
Your overall security policy.
So how do we do security measures while we can do?
Services like fail to ban.
That'll make it a lot harder to be able to brute force passwords on servers we can install fail to ban.
If you're running Apache or Engine X, you want to always run an HDP mode or port four, four, three.
You always want to be running securely.
You can also use full disk encryption for devices like laptops, and especially if they're going to
be portable or that people are going to be traveling.
You want to think about this from a perspective of your data and use and your data at rest.
So Dana is just sitting on the the system not being used.
That's generally data at rest.
If you're talking about data that's on a system, it's end use.
That means data, end use.
And then you have data in transit, which is data that's traversing over some type of network.
So let's go ahead and open up our Kali Linux VM.
I'm going to go ahead and run that stat command to see what service we actually have running.
And we can see we only have Port 22 open right now listening.
So let's go ahead and do let's clear the screen.
Let's do an app dash get install fail to manage so you can see what that looks like.
Now we have to make sure we're route.
In this case, we're using the Kali Linux account or the Kelly and Kelly account
and it's going to take a little bit of time to download while it's downloading.
Kali Linux has some other things that are available.
There are not firewalls by default and Callie that there, but there are programs like the Uncomplicated
Firewall and there's even a graphical version for it as well.
So the new version of your uncomplicated firewall is usually UFW, so it's not installed by default.
So we'll do an apt dash get install.
The uncomplicated firewall or UFW.
So the main thing to think about when you're talking about weddings there are certain.
Choices you have to make and really for any Linux distro for that matter.
But notice it created a config file in the etsi ufw directory, so that'd be important for later.
But let's also install the Dewey
for the uncomplicated firewall too, so you can have some contrast.
Kelly Lennox also has a new passport function which can be used to essentially destroy all the keys
on an encrypted partition.
We're not, of course, going to do that through our virtual machine.
But this is the program if you're managing encrypted volumes.
And it supports various algorithms like a TrueCrypt, which has since been replaced by Vera Krebs and
even the Windows Bitlocker solution.
Okay.
So let's go ahead and cut out of here.
So we want to do as we want to set packet filtering rules on the firewall to stop people from being
able to scan the network.
But how do we do that?
So we have to lock down services.
So there are rules or basic security rules, and these are things you should definitely take with you,
whether you're on an ethical hacking perspective or maybe you're on the defensive team at one point,
but if you don't need a service, turn it off because every service and every port that is open.
Gives an attacker even more room to maneuver and potentially.
Find another way in.
It adds to what we call the attack surface.
So some services that might be on by default, they don't have any credentials or they allow only the
set credentials on the first use.
And also, many services will run as route with full administrator privileges.
So you want to be careful with that.
For example, the browser exploitation framework, which is built into Kelly as the default password
of beef and beef which are hardcoded into the source code.
So if we look at.
Some of the export frameworks.
In the new version.
They've.
Move things around a little bit.
So depending on the version you install, you may see.
Things in different locations.
You can also.
Type at the the search box.
But beef is the browser exploitation framework which has been removed in the newer versions because
of security considerations.
But you can always install it.
So let's look at firewall.
So what is a firewall?
A firewall is really just a piece of software or hardware.
That checks the incoming and outgoing packets.
And based on a certain set of rules.
So the point of the firewall is that there are a couple of different kinds.
And we'll talk about those in a minute.
But you have to think about traffic from both directions, incoming and outgoing.
There's, you know, firewalls on many systems, like, for example, the Windows Defender firewall
or the uncomplicated firewall, which is in cally.
So let's go ahead and.
Let's go ahead and check on the status of the uncomplicated firewall
that's currently not running.
So we're going to go ahead and start.
I see.
It's now active and it's excellent.
So it started and finished.
So there's not currently any rules set.
But you can see this is the program for managing the Linux firewall.
The other option you have, it's also called net filter or network filter.
But you have the.
IP tables component.
You have ARB tables, you have many different options with respect to packet filtering inside of Kali
Linux.
So the Linux kernel essentially uses the net filter firewall, which can be controlled from the user
space with the IP tables and IPv6 tables.
So it's IP SIG or IP tables, that's for IP version four.
If it's IP six tables, that's for IP version six.
And there's also another tool called Firewall Builder or F.W. Builder, if you want a Google based tool.
To be able to put rules in.
So let's go ahead and.
Take a look at the gooey, uncomplicated firewall.
And this is pretty much what it looks like.
There's you can set different profiles for different networks.
You can pick whether it's incoming or outgoing.
And you can set different rules based on.
Certain programs.
Of course, it's off right now, so we had to turn it on to be able to set rules.
You can do simple, allow or deny or just even limiting particular traffic.
You can limit certain applications.
Based on categories and you can pick a direction incoming or outgoing or both.
So let's say I want to block.
Games traffic from.
On the battlefield, 1942.
And we'd say.
Deny both directions and we could add.
And we now have a role and that's it added that support for that particular application.
And then whenever we try to run that application, we'll get an entry in the log.
Let's go ahead and open up a.
New tab.
Let's do a pseudo AB dash, get install F.W. and put our password in.
So it's 40 megabytes.
It's a little bit bigger than the uncomplicated firewall, but.
And this will work on both Linux, Unix and Windows.
Believe Mako us as well.
So the firewall builder is also on.
SourceForge as well as GitHub.
If you want to download it, you click download and pick your.
It's under the new GPL license.
You go and download the version that you want.
Whether it's windows or whether it's if it's Ubuntu, you've got Debian packages, of course you can
just install it from the CALLY repository.
Now that it's installed, we can look at the multi-platform firewall configuration tool.
So it's a good and it supports firewalls based on IP tables for the kernel IP filter, PDFs and Cisco
Pix and many other different types of firewalls.
So how do we can figure firewalls or we have a net filter which does four distinct tables?
So it has, of course, the filter itself, which are the rules.
And these are net filters, a mechanism provided by the kernel that enables you to customize handlers
to implement various network related operations.
Packet Filtering Nat Network Address Translation where you're translating source and destination addresses
to particular ports.
And then you have.
That filter can be controlled with the help of the terminal and IP tables and IPv6 tables.
Mango will actually change the IP packet itself and then they're all built there or they're all table
allows other modifications before the packet reaches the connection tracking and each table contains
a list of rules called chains.
The firewall uses the standard chains to handle packets based on predefined circumstances.
With respect to the different chains and the tables we have.
Let's now take a look at the different.
Standard chains on the net filter table.
So there are three standard chains, essentially input.
Which are packets that.
Our destined for the firewall itself.
Then you have the output, which are packets that are going to be ordered by the firewall are going
to be sent out.
Then you have four packets, which means packets that pass through the firewall, which is not their
source nor their destination.
So with the NAT table, there's also three standard chains, one for pre routing, which modifies packets
as soon as they arrive, one for post routing, which modifies them when they're ready to go on their
way.
Then lastly, the output to modify packages generated by the firewall itself.
So let's look at the different syntax table.
Or syntax of IP tables.
IP six tables four.
IP versus six.
So there's that.
The three major options are Dash L, which lists the rules in the in the chain.
So let's go back over to our Kelly Box.
Go ahead and make it full screen.
So we can see IP tables dash to the table and then.
A.
C or D for the chain and then the rule.
So we'll go ahead and do.
So I tables is not currently in use in this case.
Because it's using the uncomplicated firewall.
So one of the things I was saying about you have to enable it for the system so you can either use IP
tables or you can use the uncomplicated firewall.
So if we do IP tables, dash and dash L for input when else we don't have, it's not showing up because
we're not sudo.
So we have to be root.
So there's all of the IP chains or the IP tables.
Chains.
Some of these were added in by the uncomplicated firewall, as we have, except we have a drop.
So we can pick our.
Let's go inside the screen again.
So this is all the input roles.
So our uncomplicated firewall before logging, before input, after input.
So these are how you essentially manipulate the roles if we're going to do a dash and that will actually
create a new chain.
If you want to test a new service.
Or something like that.
That might be a reason why you're going to you would create a new change.
So we just created a new chain.
And there we can see our new chain at the bottom.
So we need to create new change.
That's definitely.
The way you do it.
If you're doing a chain that is empty and you say, do you want to delete it later?
You can do that with the following command.
In the IP table's dash X and then the name of the chain.
And now notice when we do the IP tables.
Dash l command that the chain is no longer there.
So that's how you add and remove chains within IP tables.
We can also add roles at the end of given chains.
We can delete individual roles inside of the chain.
You can use the dash F for flushing a chain as well.
And the syntax is pretty much the same for IPv6 tables.
You just put a six in front of the.
Or in between IP and tables.
And there's all the six change.
So if you wanted to, once you have your change, then you can start working with things like roles.
For example, if you wanted to deny all incoming traffic, you could do IP tables.
Dash IP and you could say Input drop.
Essentially.
All of the traffic.
I would now be not permitted to come through based on the rule.
So we do have IP tables.
You can also do dash dash list as well, which does the same thing as the upper case low case L.
And if there's the input.
RC drop.
So let's change that back to accept.
So the screen here
and there we go.
So we can now accept traffic again.
You can do that for many different ways.
IPv4 tables or IP tables applies to IP version for IPv6 tables, of course, applies to IP version six.
So now let's look at the different rules.
So each rule creates essentially one invocation of IP tables or IP six tables and rules are stored in
a script.
So the system is automatically configured the same way every time it boots.
So we want we already installed F.W. Builder.
So let's go ahead and run that.
And we now have our gooey here.
We see our quick start.
You can watch the guide or you can sit close and you can go ahead and start looking at your different
rules.
You can look at standard filters.
Standard rules.
You can do a user.
We can create new firewall or call the new object.
New firewall and will pick what software it's running on so we can add in.
We can essentially build out our network with this tool.
It's very useful.
Let's say this one's an RSA and we'll say next and then you'll have to give it.
The S&P read and write community string.
Or you can configure the interfaces manually.
Then you have to actually add the physical interface and the IP address.
The main thing to think about when you're building an actual firewall, you want to think about your.
Interfaces, you know, networks, your servers and then what ports you want to allow.
So the services are based on IP, ICMP, TCP, UDP.
It could be even.
Be done based on policies.
You can actually add new firewalls and services from this menu as well.
I'll say this one's IP tables.
Call it the county firewall and we'll say boom and finish.
Now let's talk about monitoring and logging.
Monitoring and logging are pretty important with security, especially from a defensive side, but also
from an offensive side, because you can get a lot of information from logs.
So they need to be monitored securely.
There's a program called Log Check, which will monitor logs every hour by default.
And I'll send unusual messages to administrators.
And so.
Let's go ahead and switch over to our Kelly Box and we'll.
So we'll go do an app, get install log check because it's not installed.
So you have to do a little bit of work there to get it installed first.
You can have it report different values, whether it's a paranoid level, server level and even a workstation
level.
So paranoid is very verbose and should be probably restricted to servers that are.
Your highest high importance servers and things like firewalls and so on and so forth.
So server is the default mode that's recommended for most servers.
So it's good to look at log check.
So this will scan your logs for interesting lines.
So the list of moderate files in the.
Etsy log check stakeholder.
And it also will look at the ah syslog directory as well.
So there's log check and we can see the different log files and also the config file
as the config file for based on want you want to monitor.
So this is the ah syslog config.
So this is what is kind of getting run by standard on Linux.
So it's keeping track of the crime job, the authorization log, the privileged authorization log,
the user log.
These are all going to be in your var slash log directory.
So you could have log check monitor some of these as well.
Generally you want to customize log check to include some extra messaging depending on services.
Unless you want to get a lot of just non useful information.
So again, we saw that the log check log files and now let's talk about top topics is a very flexible
tool comes with most Linux distributions.
It's good to go back to our Kelly distro and let's look at top.
So this displays Linux processes and essentially you can look at things like your command line, you
can look at CPU memory, all that kind of stuff.
So.
Unlike other commands, like peace, it's interactive.
So you can browse through the list or you can kill processes.
So let's let's just go ahead and open it up.
So there's top.
You can see that it has the up time currently one user, what kind of load it has, you can see things
like memory and then notice there's a process ID the user and then a priority and it also keeps track
of the percentages of your CPU and your memory.
So the upper half has the output with resources while the lower half has the processor.
So you can actually use the arrow keys to scroll down through it or the page up and page down keys.
And if you want to quit, just press quit.
There's one more logging tool that I want to show you because I do like variety and I like color in
my slides.
So let's go ahead and look at each top.
You're not going to have it by default in most cases.
It's very much like Bob.
And it also has a.
Little fancier interface, for lack of a better word.
So let's go ahead and look at H Top.
Notice that you have a color coded scheme.
You actually get kind of a bar graph chart showing how much memory out of how much swapped space as
well and what the average load is.
And it's just and it has some at the bottom notice, it has some different commands.
You can change the nice values which will get into a little bit later.
You can search for specific processes.
Like, for example, I wanted to search for Firefox.
It's not currently running, but maybe I want to search for
the current job so I can jump right to it.
So it's a nice way to be able to.
Work with it.
You can actually look at the tree structure as well and see where the processes have spawned from.
So if you scroll up to the top, you can see the what folder that the file is coming out of and where
it's running from.
So it's a very useful monitoring tool.
You can also filter out based on certain criteria.
So maybe I want a filter based on just us.
Our.
So it's very, very useful.
And once you're done, you can hit enter.
If you want to collapse everything you can press f six.
Maybe you want to customize it to what you want it to show.
So it's even though it's a command line utility, it's a very useful tool.
Let's go ahead and put it out of here.
Let's look at one more.
There is genome system monitor
and it is very much like top and provides a lot of the same features.
But it may not be installed by default depending on what
flavor or what desktop environment of call you installed.
So you will have to install it.
And this is this is the actual package.
But there's a couple other dependencies that when the libraries that go with it.
So we can go ahead and let that install.
Go and clear the screen.
And there's the genome system monitor.
So it's roughly the same features as TOP, but it's in a more graphical interface and click between
resources processes.
It's also very similar to the Windows Task Manager.
You can click on processes and them or you have a little menu down here at the bottom right where you
can get some more information.
How much CPU time?
What the.
The priority is the nice value and the other information about it.
So it's a very, very useful utility to have.
You can see your CPU kind of in real time, see what file systems you have loaded, of course, on singular
disk.
So you may have more disks here if you if you run this, but no.
So we looked at top h top and also genome system monitor.
So if you want to kill an application that you're in, you can hit control C, we can go back to top
it.
Just make sure that it's not still actually running.
So it's very important to be able to search for things and monitor things within Kelly Olynyk for anything
anyone exists or for that matter.
Let's go ahead and get out of this menu.
F10 to quit.
So the screen.
So we looked at top, we looked at each top and we looked at genome system monitor.
There's also a.
One more we can look at.
There's piece, and if you type the AWACS command, you kind of get a same similar view to what you
get in top.
You just don't get as much information and it's not formatted as nicely.
So some people like the peace command or the essentially it's just a snapshot of the current processes.
So if you want a more up to date real time monitoring solution, that's why you want to.
So let's talk about the advanced intrusion detection environment.
The advanced intrusion detection environment.
This may not be installed.
Essentially what this does is it looks at things like file integrity.
So if any files were modified are and you have any previous images with the system, this will help
guard against that.
Let's go ahead and clear the screen,
do an app dash, get install aid.
And of course, it is case sensitive.
So it's roughly 2500 kilobytes and it takes a little bit to set up the config files.
So aid stores its configuration in two places the etsy slash adt slash can or dot config file and the
etsy slash A.D. slash a deacon thing dot d file.
As the aide went ahead and installed.
So the advanced intrusion detection environment.
So you can do a check for inconsistencies.
Of course, you have to initialize the database to do this.
And.
You can start based on regular expressions.
So it's going to aid the aid.
I mean, we have to.
First.
Let's go look at the config file, actually.
So there's the config file and it's going to say this is an example of a log that's being set.
And that as you can.
Run this as a daily cron job based on a database.
There are lots more useful things you can do with this program.
So that's the config file there.
Some people have called ADE the free trip wire, which is the.
Professional version.
So essentially, if you're going to do some additional hardening on a system, this is a good option.
It is a small, yet powerful open source idea tool.
And it has many different features.
So you can install it on almost every flavor of Linux.
So we can do an eight dash movie to see what version we're running.
So that matters.
We have AC Linux, we have different hash files.
So these are some of the different options that come with it.
If we want to edit the aid config file, we can open it with our favorite text editor.
And sometimes instructions do change to this.
Be aware that just because something is in one place the first time you do it, it may not necessarily
be there the next time.
So in the NCA directory now we're going to have to actually change to the directory or putting in the
the full path would have actually helped.
So now we have the aid.
Config file.
So there's some default permissions, the default rules that it looks at.
You can actually defined new custom rules.
So.
For example, if you wanted to look for things like access control, you could put in a rule.
And it has a pretty well documented.
File as far as config files go.
So of course you want to make sure these paths are good.
You can change the verbose level.
Maybe we want to go ahead and add a rule.
And what we'll do is we'll go ahead and comment here.
This rule is going to check access control only chip changes and file slash directory permissions.
So then we'll make the roll call.
This firm's equals P.
Plus U plus g plus a, c, l plus C, Linux plus.
So essentially we can almost use regular expression type syntax.
So there's our rule that we've just added.
And we're going to go ahead and escape from in certain mode because the reason why we're going to.
Right.
Quit and there we go.
Maybe we might want to check, file and content type.
There's all kinds of rules you can put in or.
So let's look at one more command since we have the I.D. taken care of, let's go and change back to
the home directory.
And we're going to go ahead and we're going to look at the D package command, another useful command,
which is essentially the Debian package manager as it's aptly named.
So if we want to understand the different options that DE package can do, so it actually maintains
a certain amount of information on install packages.
So if you want to get a whole lot of information, you can do D, package dash L and see all the different
packages, packages that are there, what version they are, and a little bit about them.
So maybe this is not so useful.
So let's not look at the whole thing.
Let's do a D package.
Dash l and let's grep for Apache two.
Maybe we only want to see the things that are with respect to our web server.
Maybe you want to look at the list of the packages that apply to the uncomplicated firewall.
And there we go.
So there's all the different.
Files that were installed by a particular package.
You can also install with a package as well.
If you're sudo to root, you can do d package.
Dash I and then the name of the file
so that for some reason a package won't install with the apt, you might be able to do it.
But the package command.
You can also uninstall certain packages as well with the Dash R command.
And you can also verify a package as well.
These are all the different check sums that.
The package is going to be concerned with.
So it will take some time.
So this command should print out a line for every package that fails verification.
Let's go ahead and do D package dash V.
And so sometimes these commands do change.
See, that's still in there.
Daschle for all.
I got to put the package name.
Silly me.
So let's go ahead and do let's say TB dump.
All right, how about.
Now let's go ahead and get into some practice questions.
So the network layer firewall works as a.
Frame, filter, packet filter or both a frame as well as packet filter or none of the above.
Correct answer is B network layer firewall works as a packet filter.
It can also filter against certain ports and protocols as well.
But this is one of the most basic types of firewalls that we talked about.
Question two Network layer firewalls have two subcategories known as stateful and stateless firewalls.
Bit oriented for firewall and byte oriented firewalls or frame firewalls and packet firewalls or none
of the above.
The answer is.
A stateful and stateless firewalls.
Again, many of the firewalls of today are considered what are known as Next-Gen firewalls.
They combine elements of both stateful and stateless filtering.
So a stateful firewall means that it can keep track of the state or the TCP connection.
Stateless firewalls are typically just packet filters.
So a firewall is installed at the point where the secure internal network and untrusted external network
meet, which is also known as what?
A choke point.
A meeting point.
Firewall point or a secure point.
The answer is a choke point.
This is also another word for DMZ or demilitarized zone.
DMZ typically has two firewalls, one facing the public Internet and one facing the internal network.
And then in the DMZ are the demilitarized zone as the last bastion of.
Servers and security that.
Users and also administrators can go through before they're allowed to get access to the trusted network.
You might have things like an email server at the choke point or some web server that needs to be accessible
from.
External systems.
All right.
Let's get on to number four.
Which of the following are the types of firewalls?
We just went over this briefly.
We have packet filtering firewalls, dual home gateway firewalls.
Screened hosted firewalls.
Or D all of the above.
Answer is a packet filtering firewall.
So a proxy firewall filters out what layer?
And we're referencing the OSSI model.
Which is prerequisite knowledge for this course, but.
Physical layer, the data link layer, the network layer or the application layer.
And the answer is D the application layer.
So let's recap what we talked about.
So we talked about running Kaley on publicly accessible servers.
Do you want to change any default passwords for services that might be configured?
If you don't need the service, turn it off.
You can also use fail to band to detect and block password guessing attacks.
If you do run web services like Apache, run them over IDPs to keep attackers from sniffing your traffic.
You can implement firewall rules to forbid all the outbound traffic.
Remember we talked about firewalls filtering both in ingress traffic and egress traffic or inbound and
outbound.
We looked at the log chat program, how to monitor log files every hour by default, and also sending
unusual log messages and emails to the administrator for further analysis.
And we looked at top and top, as well as the genome system monitor for an interactive tool to display
currently running processes.
So you want to have log checks and monitoring your processes as part of your continuous monitoring program.
Ideally, you want to have those logs being generated and sent somewhere that's centrally managed.
And then we looked at the Advanced Intrusion Detection Environment Tool.
This tool checks for file integrity and will detect any changes against a previously recorded image
of the valid system.
So it has to have a baseline first and it must have a database that's been initialized.
So as a summary to recap, we talked about security policies.
We looked at different security measures that are out there.
We looked at securing network services.
We looked at using firewalls for network security and the different types of firewalls, stateless and
stateful.
We talked about the uncomplicated firewall.
We talked about the graphical uncomplicated firewall.
We also looked at the firewall builder program.
If you want to build out your network and your firewalls from a graphical perspective, we looked at
IP tables in the various chains that are part of that, and we looked at the different rule sets that
can be applied to them and then how to add and remove different chains as well as adding and removing
rules.
We also talked about monitoring and logging with top and top and monitoring systems in real time.
And we also looked at the advanced intrusion detection environment or aid program.
I thank you for your attention in this module.
And we'll see you in the next one.