SECTION 9 Cyber Security

In this episode we review our IT skills. We start of with a review of Dorothy’s Linux skills. I asked her a bunch of questions to see what she’s learned. We also talk about Windows, network engineering and security.

LINUX QUESTIONS & ANSWERS

LINUX COMMANDS

What is the command for changing directories? cd

What is the command for listing a directory? ls

What is the command for listing a directory as a list with more info? ls -l

What is the command for listing a directory as a list with more info? ls -a

What is the command for showing the last part of a file? tail

How do you edit a file? nano + name of file

How do you create a new file? nano & press enter. Add test. Ctrl+X, name file, enter. Or nano + name of new file.

What is the command for showing the process tree? ps axu

What is the command for reading a file? less + name of file

LINUX FILE SYSTEM

Where are the log files located? /var/log/

Where are the config files located? /etc

Where are user files located? /home

What is /usr for? General software is installed here.

What is /usr/local for? /usr/local is “for use by the system administrator when installing software locally”.

What is /var for? This folder contains log files about the software on your computer.

What is /etc/init.d for? The init.d directory contains a number of start/stop scripts for various services on your system.

DHCP

What is DHCP used for? A service that automatically provides network configuration. Must have a server and a client.

What are the 3 different configuration options for DHCP? Dynamic (Address Pool), by Manual Allocation (MAC address) and Automatic.

Which configuration option did we use? Dynamic

 

In our last episode we talked about setting up a DHCP server on Debian. It was harder than we thought it would be. This episode is round 2. This was a totally different experience. We were done in a matter of minutes. Dorothy and I talk about the differences between round 1 and 2. We now have a process we can use for installing and configuring future services. This was a great learning experience for both of us.

What follows are our instructions that we created in round 2. The steps may change in the future, but this is a good start.

INSTRUCTIONS

* Official Ubuntu Documentation – We followed these instructions.

* How to install a DHCP Server in Ubuntu and Debian – For some reason we didn’t use this

* Install DHCP: apt install isc-dhcp-server

* Edit isc-dhcp-server file & add the appropriate interface: INTERFACESv4=“enp0s3”

* Make back up copy of dhcpd.conf file

* Edit dhcpd.conf to match the following configuration:

# minimal sample /etc/dhcp/dhcpd.conf

default-lease-time 600;

max-lease-time 7200;

subnet 10.500.5.0 netmask 255.255.255.0 {

range 10.500.5.100 10.500.5.200;

option routers 10.500.5.1;

option domain-name-servers 10.500.1.2;

option domain-name "example.lan";

}

Testing

* Restart the service: systemctl restart isc-dhcp-server.service

* Check /var/log/syslog for failures: tail syslog

* Check DHCP is working by plugging a device into the network and wait for it to ask for IP address: tail -f syslog

This is what it’s suppose to look like when it works:

Jan 30 20:16:15 debian dhcpd[1397]: DHCPDISCOVER from 55:ee:75:50:88:ec via enp0s3

Jan 30 20:16:16 debian dhcpd[1397]: DHCPOFFER on 10.500.5.100 to 55:ee:75:50:88:ec (DESKTOP-O40EC06) via enp0s3

Jan 30 20:16:16 debian dhcpd[1397]: DHCPREQUEST for 10.500.5.100 (10.500.5.6) from 55:ee:75:50:88:ec (DESKTOP-O40EC06) via enp0s3

Jan 30 20:16:16 debian dhcpd[1397]: DHCPACK on 10.500.5.100 to 55:ee:75:50:88:ec (DESKTOP-O40EC06) via enp0s3

 

We finally found time to focus on our Raspberry Pi data center project. This time we installed and configured a DHCP server on our test server. While the process looks simple, it turned out to be a lot of work. We spent a lot of time trying to figure out why it wouldn’t work. In the end we managed to get it working. We can now say we’ve built our own Linux DHCP server.

LINKS

* Debian – The Linux distro on our virtual machine

* DHCP Documentation – We used the documentation on the Ubuntu website

It’s time to talk about our new project. Dorothy has a stack of 4 Raspberry Pi’s on her desk. The goal is to learn Linux by installing and configuring, Linux, DHCP, DNS, and SSH. Other services will be added later. A big part of this project is documentation. For that, we’re using the Wiki software DokuWiki. This is a big step in the right direction.

LINKS

* Raspbian – Linux OS for the Raspberry Pi

* DokuWiki – Wiki software that we use for our documentation

In this episode we talk about our backup solution. We also talk about how the backup process relates to security. This leads us into BIA, BCP, RPO, RTO, and the recovery process.

LINKS

* Business Continuity – This covers Business Continuity Planning and Business Impact Analysis

* RPO – Recovery Point Objective

* RTO – Recovery Time Objective

* CISA – Certified Information Systems Auditor 

How do the processor flaws Meltdown & Spectre affect Section 9? A lot of information floating around on the web isn’t very clear. Thanks to a SANS webinar by Jake Williams, we were able to finger this out.

Table – SANS, Jan 4 2018, Webcast Meltdown and Spectre – understanding and mitigating the threats

LINKS

*  Jake Williams

* Webcast: Meltdown and Spectre – understanding and mitigating the threats – You will need a SANS account to access it. It is listed in the archives.

* Chrome Site Isolation 

We’ve decided to take a break for the holidays. We we will be back in January. This should give us time to catch up on projects and improve the show. Thank’s for listening!

LINKS

* Professor Messer

 

 

This week we learned a few things about prioritizing vulnerabilities and OWASP application security. When it comes to vulnerabilities, you don’t have to secure everything. You can prioritize them and focus on the most important ones. We also learned that OWASP has a top 10 list of application security best practices. You can see how these work buy playing around with Mutillidae, a vulnerable web application.

LINKS

* OWASP

* Mutillidae

 

In this episode we talk about authenticated scans with OpenVAS. We cover the planning process, implementing authenticated scans, & lesions learned.

LINKS

* How To Create SSH Keys With Putty

* Initial Server Setup with Ubuntu 16.04 – Includes ssh key configuration

* Windows Update: FAQ

 

I decided it was time to implement vulnerability scanning for Section 9.  We go over why we need it, & how to implement the OpenVAS vulnerability scanner. We also talk about some of the things I learned along the way.

Instructions for installing OpenVAS

*

OpenVAS 9 install on Ubuntu 16.04

*

openvas vulnerability scanner