Lpic3 - Security

1. Introduction

An overview of the LPIC-3 certification, outlining the scope and objectives of the security-related topics covered.

2. Version Information

Details on the versions of the certification exams and any relevant updates or changes.

3. Translations of Objectives

Information on how the objectives are translated into various languages to support a global audience.

4. Objectives

4.1 Topic 331: Cryptography

4.2 Topic 332: Host Security

4.3 Topic 333: Access Control

4.4 Topic 334: Network Security

4.5 Topic 335: Threats and Vulnerability Assessment

5. Future Change Considerations

Topic 331: Cryptography - Detailed Overview and Enterprise Commands

331.1 X.509 Certificates and Public Key Infrastructures

1. X.509 Certificates

2. Trust Chains and PKI

3. Generating and Managing Keys

4. Certification Authority (CA)

5. Certificate Management

6. Using Let’s Encrypt and Certbot

7. Using CFSSL

8. Key Commands and Files

Example Files:

Topic 331.2: X.509 Certificates for Encryption, Signing, and Authentication

Description:
This topic focuses on using X.509 certificates for server and client authentication in Apache HTTPD, specifically version 2.4 or higher. The goal is to understand SSL/TLS protocols, configure Apache HTTPD for secure communication, and use OpenSSL for testing.

1. SSL/TLS Protocols and Ciphers

Configuration Example:
To set up TLS in Apache HTTPD and define cipher suites, add the following to httpd.conf or a virtual host configuration file:

# Enable SSL/TLS
LoadModule ssl_module modules/mod_ssl.so

# Enable HTTPS
<VirtualHost *:443>
    SSLEngine on
    SSLCertificateFile "/path/to/server.crt"
    SSLCertificateKeyFile "/path/to/server.key"
    SSLCertificateChainFile "/path/to/chain.crt"
    
    # Protocols
    SSLProtocol all -SSLv2 -SSLv3

    # Cipher suites
    SSLCipherSuite HIGH:!aNULL:!MD5

    # Server Name Indication (SNI)
    ServerName example.com
    
    # HTTP Strict Transport Security (HSTS)
    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
    
    # DocumentRoot and other configurations
    DocumentRoot "/var/www/html"
</VirtualHost>

2. Configuring Apache HTTPD with mod_ssl

Installation:
Ensure mod_ssl is installed. On Debian/Ubuntu:

sudo apt-get install apache2
sudo apt-get install libapache2-mod-ssl

On Red Hat/CentOS:

sudo yum install httpd
sudo yum install mod_ssl

Configuration:

3. Server and Client Authentication with Certificates

4. OCSP Stapling

5. Using OpenSSL for SSL/TLS Testing

6. Useful Files and Terms

Files:

Topic 331.3: Encrypted File Systems

Description:
This topic involves setting up and configuring encrypted file systems using various tools and technologies. Candidates should be familiar with block device encryption, file system encryption, and relevant utilities for implementing encryption in a Linux environment.

1. Block Device and File System Encryption

2. Using dm-crypt with LUKS

Basic Commands and Configuration:

3. Using eCryptfs

Basic Commands and Configuration:

4. Awareness of Plain dm-crypt

Basic Commands and Configuration:

5. Clevis for LUKS Devices

Basic Commands and Configuration:

6. Useful Files, Terms, and Utilities

Topic 331.4: DNS and Cryptography

1. Understanding DNS and DNSSEC

2. Configuring and Managing DNSSEC with BIND

3. Using DNS for Certificate Information

4. Awareness of Other DNS Security Measures

5. Useful Files, Terms, and Utilities

Topic 332.1: Host Hardening

Description:
Candidates should be adept at securing Linux systems against common threats through a variety of techniques, including configuring boot loader security, managing services, and implementing security features in systemd. This section focuses on ensuring that systems are hardened against potential attacks.

1. Configure BIOS and Boot Loader (GRUB 2) Security

2. Disable Unused Software and Services

3. Configure Capabilities for systemd Units

4. Address Space Layout Randomization (ASLR), Data Execution Prevention (DEP), and Exec-Shield

5. Manage USB Devices with USBGuard

6. SSH Certificates for Authentication

7. Work with chroot Environments

8. Use systemd for Process Limiting

9. Linux Meltdown and Spectre Mitigations

10. Awareness of Polkit and Virtualization

11. Useful Files, Terms, and Utilities

Topic 332.3: Resource Control

Description:
Candidates should be proficient in restricting the resources that services and programs can consume on a Linux system. This involves configuring user limits, managing control groups (cgroups), and using systemd features to control resource usage.

1. Understand and Configure ulimits

2. Understand and Configure Control Groups (cgroups)

3. Systemd Slices, Scopes, and Services

4. Useful Files, Terms, and Utilities

Example Commands

Topic 333.1: Discretionary Access Control (DAC)

Description:
Candidates should have a solid understanding of Discretionary Access Control (DAC) and be able to implement it using Access Control Lists (ACLs) and extended attributes on Linux systems.

1. Understanding and Managing File Ownership and Permissions

2. Managing Access Control Lists (ACLs)

3. Understanding and Managing Extended Attributes

Example Commands and Use Cases

Topic 333.2: Mandatory Access Control (MAC)

Description:
Candidates should be proficient with Mandatory Access Control (MAC) systems, with a focus on SELinux (Security-Enhanced Linux), and should have a general awareness of other MAC systems like AppArmor and Smack. They should understand the core concepts of MAC, type enforcement, role-based access control, and how these differ from discretionary access control.

1. Understanding Core Concepts

2. SELinux Configuration and Management

3. Awareness of Other MAC Systems

Example Commands and Use Cases

This guide provides an overview of Mandatory Access Control (MAC) systems, focusing on SELinux, with essential commands and configurations for implementing and managing MAC policies on Linux systems.

Mandatory Access Control (MAC) - Enterprise

Here’s a detailed guide to the enterprise commands and configuration files related to SELinux, focusing on their use in managing and configuring SELinux policies in a Linux environment.

SELinux Commands and Utilities

  1. getenforce

    • Description: Displays the current mode of SELinux.
    • Usage:
      getenforce
    • Output:
      • Enforcing: SELinux is enforcing policies.
      • Permissive: SELinux is in permissive mode, logging violations but not enforcing policies.
      • Disabled: SELinux is disabled.

  2. setenforce

    • Description: Sets the mode of SELinux to either enforcing or permissive.
    • Usage:
      setenforce [Enforcing|Permissive]
    • Examples:
      • Set SELinux to enforcing mode:
        setenforce 1
      • Set SELinux to permissive mode:
        setenforce 0

  3. selinuxenabled

    • Description: Checks if SELinux is enabled on the system.
    • Usage:
      selinuxenabled
    • Output:
      • Returns nothing if SELinux is enabled.
      • Returns a non-zero exit code if SELinux is disabled.

  4. getsebool

    • Description: Displays the current values of SELinux booleans.
    • Usage:
      getsebool -a
    • Examples:
      • Display all SELinux booleans:
        getsebool -a
      • Check the value of a specific boolean:
        getsebool httpd_can_network_connect

  5. setsebool

    • Description: Sets the value of SELinux booleans.
    • Usage:
      setsebool [boolean] [on|off]
    • Examples:
      • Enable a boolean:
        setsebool httpd_can_network_connect on
      • Disable a boolean:
        setsebool httpd_can_network_connect off

  6. togglesebool

    • Description: Toggles the state of SELinux booleans.
    • Usage:
      togglesebool [boolean]
    • Example:
      • Toggle the state of a boolean:
        togglesebool httpd_can_network_connect

  7. fixfiles

    • Description: Fixes the SELinux contexts on files according to the policy.
    • Usage:
      fixfiles [restore|relabel] [options]
    • Examples:
      • Relabel files based on the current policy:
        fixfiles relabel

  8. restorecon

    • Description: Restores the default SELinux security context of files and directories.
    • Usage:
      restorecon [options] [file|directory]
    • Examples:
      • Restore context of a directory:
        restorecon -R /path/to/directory

  9. setfiles

    • Description: Sets SELinux contexts for files based on the file contexts file.
    • Usage:
      setfiles [options] /etc/selinux/targeted/contexts/files/file_contexts /path/to/directory
    • Example:
      • Set file contexts:
        setfiles /etc/selinux/targeted/contexts/files/file_contexts /path/to/directory

  10. newrole

    • Description: Changes the current SELinux role of the user.
    • Usage:
      newrole -r [role] -t [type] [command]
    • Examples:
      • Change to a new role:
        newrole -r sysadm_r

  11. setcon

    • Description: Sets the SELinux security context for a process.
    • Usage:
      setcon [context] [command]
    • Examples:
      • Run a command with a specific context:
        setcon system_u:system_r:unconfined_t /bin/bash

  12. runcon

    • Description: Executes a command with a specified SELinux context.
    • Usage:
      runcon [context] [command]
    • Examples:
      • Run a command with a specific context:
        runcon system_u:system_r:unconfined_t /bin/bash

  13. chcon

    • Description: Changes the SELinux security context of files and directories.
    • Usage:
      chcon [options] [context] [file|directory]
    • Examples:
      • Change context of a file:
        chcon -t httpd_sys_content_t /var/www/html/index.html

  14. semanage

    • Description: Manages SELinux policy components, such as file contexts and port types.
    • Usage:
      semanage [options] [subcommand]
    • Examples:
      • Add a file context:
        semanage fcontext -a -t httpd_sys_content_t "/var/www/html(/.*)?"
      • Apply the new context:
        restorecon -R /var/www/html

  15. sestatus

    • Description: Displays the status of SELinux.
    • Usage:
      sestatus
    • Output:
      • Provides information on SELinux status, including mode, policy, and policy version.

  16. seinfo

    • Description: Provides information about SELinux policy.
    • Usage:
      seinfo [options]
    • Examples:
      • Display policy information:
        seinfo -a

  17. apol

    • Description: SELinux policy analysis tool for reviewing and analyzing SELinux policies.
    • Usage:
      apol [options]
    • Examples:
      • Run the application:
        apol

  18. seaudit

    • Description: Analyzes SELinux audit logs and provides suggestions.
    • Usage:
      seaudit [options] [logfile]
    • Examples:
      • Analyze audit logs:
        seaudit /var/log/audit/audit.log

  19. audit2why

    • Description: Analyzes SELinux audit logs and provides explanations for denials.
    • Usage:
      audit2why < [logfile]
    • Examples:
      • Analyze logs to find why access was denied:
        audit2why < /var/log/audit/audit.log

  20. audit2allow

    • Description: Generates SELinux policy modules based on audit logs.
    • Usage:
      audit2allow -a -M [module_name]
    • Examples:
      • Create a policy module to allow denied access:
        audit2allow -a -M mymodule

Configuration Files and Directories

Network Security: Network Hardening

Here’s a detailed overview of the commands, utilities, and files related to network hardening, focusing on securing networks, analyzing traffic, and configuring network services:

1. FreeRADIUS Commands and Configuration

2. Network Traffic Analysis

3. Wireless Network Analysis

4. Rogue Router and DHCP Message Handling

5. Awareness of Additional Tools

Files and Directories

Understanding these commands and configuration files will help you secure and analyze network traffic, manage RADIUS authentication, and handle potential threats in your network environment.

Network Intrusion Detection: Tools and Configuration

Here’s a detailed overview of the commands, utilities, and files related to network intrusion detection and monitoring. This includes implementing bandwidth monitoring, and configuring and using Snort and OpenVAS.

1. Bandwidth Usage Monitoring

2. Snort

3. OpenVAS

Summary

  1. Bandwidth Monitoring:

    • Use ntop to monitor and analyze network bandwidth and traffic.

  2. Snort Configuration and Management:

    • snort: Main command to run Snort for IDS/IPS.
    • snort-stat: Generates statistics for Snort.
    • pulledpork.pl: Manages and updates Snort rules.
    • /etc/snort/*: Contains configuration and rules for Snort.

  3. OpenVAS Configuration and Management:

    • openvas-adduser: Adds users to OpenVAS.
    • openvas-rmuser: Removes users from OpenVAS.
    • openvas-nvt-sync: Syncs the NVT feed.
    • openvassd: OpenVAS Scanner daemon.
    • openvas-mkcert: Creates SSL/TLS certificates for OpenVAS.
    • openvas-feed-update: Updates OpenVAS feeds.
    • /etc/openvas/*: Contains configuration files for OpenVAS.

Here’s an overview of the netfilter packet filtering tools and utilities for configuring and managing network traffic on Linux. This includes iptables, ip6tables, ipset, and related commands and concepts.

1. Common Firewall Architectures

2. Packet Filtering with iptables and ip6tables

3. Connection Tracking and NAT

4. IP Sets

5. Awareness of Other Tools

Summary

  1. Firewall Architectures:

    • DMZ: Adds security by isolating external-facing services.

  2. iptables and ip6tables:

    • Manage IPv4 and IPv6 packet filtering, NAT, and connection tracking.

  3. Connection Tracking and NAT:

    • Track connections and manage address translation.

  4. ipset:

    • Manage sets of IP addresses or ports for use in iptables rules.

  5. Other Tools:

    • nftables and nft: Modern replacement for iptables.
    • ebtables: Layer 2 filtering.
    • conntrackd: Synchronize connection tracking tables.

Virtual Private Networks (VPNs): OpenVPN, IPsec, and WireGuard

Here’s an overview of the VPN technologies and tools you need to be familiar with for setting up remote access and site-to-site VPNs, including OpenVPN, IPsec (using strongSwan), and WireGuard.

1. VPN Principles

2. VPN Protocols

3. Configuration and Operation

4. Example Configurations

Summary

  1. VPN Principles:

    • Bridged: Extends the local network.
    • Routed: Connects different subnets.

  2. Protocols:

    • OpenVPN: Flexible and highly configurable.
    • IPsec: Secure IP communications; often used with IKEv2.
    • WireGuard: Modern and efficient; simpler setup.

  3. Configuration:

    • OpenVPN: /etc/openvpn/
    • strongSwan (IPsec): /etc/strongswan.conf, /etc/strongswan.d/
    • WireGuard: /etc/wireguard/

  4. Commands:

    • OpenVPN: openvpn, openvpn --config
    • strongSwan: ipsec start, ipsec status
    • WireGuard: wg-quick up, wg-quick down

Common Security Vulnerabilities and Threats

Understanding common security vulnerabilities and threats is crucial for protecting systems, networks, and applications. Here’s a breakdown of major types of security threats and vulnerabilities, including conceptual explanations and examples:

1. Threats Against Individual Nodes

2. Threats Against Networks

3. Threats Against Applications

4. Threats Against Credentials and Confidentiality

5. Honeypots

Summary

  1. Individual Nodes:

    • Trojans, Viruses, Rootkits, Keyloggers

  2. Networks:

    • DoS/DDoS, MitM, ARP/NDP Forgery, Rogue Devices, Spoofing

  3. Applications:

    • Buffer Overflows, SQL Injection, Code Injection, XSS, CSRF, Privilege Escalation

  4. Credentials and Confidentiality:

    • Brute Force, Rainbow Tables, Phishing, Social Engineering

  5. Honeypots:

    • Decoy Systems for Monitoring and Research

Here is a detailed list of commands and information for each tool and utility related to common security vulnerabilities and threats:

1. Trojans, Viruses, and Rootkits

2. Keyloggers

3. DoS and DDoS

4. Man-in-the-Middle (MitM) Attacks

5. ARP and NDP Forgery

6. Rogue Access Points, Routers, and DHCP Servers

8. Buffer Overflows

9. SQL Injection

10. Code Injection

11. Cross-Site Scripting (XSS)

12. Cross-Site Request Forgery (CSRF)

13. Privilege Escalation

14. Brute Force Attacks

15. Rainbow Tables

16. Phishing

17. Social Engineering

oolkit` and follow the prompts for various social engineering attacks.

18. Honeypots

This detailed information should help in understanding and using these tools for analyzing and mitigating security vulnerabilities and threats.

Here’s a detailed overview of penetration testing concepts, commonly used tools, and specific commands and functionalities related to the Nmap network scanner:

Penetration Testing Concepts

  1. Concepts of Penetration Testing and Ethical Hacking:

    • Penetration Testing: A simulated cyber attack against a computer system to check for exploitable vulnerabilities.
    • Ethical Hacking: Conducting penetration testing with permission to find and fix vulnerabilities before malicious hackers can exploit them.

  2. Legal Implications:

    • Authorization: Ensure you have explicit permission from the system owner before testing.
    • Scope: Clearly define the boundaries of the test to avoid legal issues.
    • Compliance: Follow laws and regulations applicable in your region.

  3. Phases of Penetration Testing:

    • Active Information Gathering: Directly interacting with the target to collect information (e.g., scanning).
    • Passive Information Gathering: Collecting information without directly interacting with the target (e.g., social media).
    • Enumeration: Identifying and listing detailed information about the target system (e.g., user accounts, shares).
    • Gaining Access: Exploiting vulnerabilities to gain access to the target system.
    • Privilege Escalation: Gaining higher-level permissions on the target system.
    • Access Maintenance: Ensuring continued access to the target system (e.g., installing backdoors).
    • Covering Tracks: Erasing evidence of the attack to avoid detection.

  4. Metasploit Framework:

    • Architecture and Components:
      • Modules: Exploits, payloads, encoders, and auxiliaries.
      • Metasploit Console: Interactive shell to launch and manage attacks.
      • Metasploit Community: Integrates various security tools for comprehensive testing.
    • Module Types:
      • Exploits: Code that takes advantage of vulnerabilities.
      • Payloads: Code that runs after an exploit succeeds (e.g., reverse shell).
      • Auxiliary: Various tools for scanning, fuzzing, etc.

  5. Nmap Network Scanner:

    • Scanning Methods:
      • TCP Connect Scan: nmap -sT [target]
      • SYN Scan: nmap -sS [target] (stealthier than TCP connect scan)
      • UDP Scan: nmap -sU [target]
    • Version Scanning: nmap -sV [target] (identifies service versions)
    • Operating System Detection: nmap -O [target]
    • Nmap Scripting Engine (NSE):
      • Running Scripts: nmap --script [script_name] [target]
      • Common Scripts: nmap --script=vuln [target] (runs vulnerability scanning scripts)
    • Combining Options: nmap -sS -sV -O [target] (run SYN scan, version detection, and OS detection)

  6. Awareness of Other Tools:

    • Kali Linux: A Linux distribution containing a suite of penetration testing tools.
    • Armitage: A graphical front-end for Metasploit.
    • Social Engineer Toolkit (SET): A framework for social engineering attacks.

Nmap Commands and Usage