Lesson 11: Securing Your System

This document is created by Nguyen Hoang Chi Chi.Nguyen.e4w@gmail.com Page 1

 Objectives covered

o 110.1 Perform security administration tasks (weight: 3)

o 110.2 Set up host security (weight: 3)
o 110.3 Securing data with encryption (weight: 4)

This document is created by Nguyen Hoang Chi Chi.Nguyen.e4w@gmail.com Page 2

 Perform security administration tasks

This document is created by Nguyen Hoang Chi Chi.Nguyen.e4w@gmail.com Page 3

 Locating SUID/SGID Files

This document is created by Nguyen Hoang Chi Chi.Nguyen.e4w@gmail.com Page 4

 Securing passwords

/etc/passwd and /etc/shadow

This document is created by Nguyen Hoang Chi Chi.Nguyen.e4w@gmail.com Page 5

 Securing passwords – Account status

This document is created by Nguyen Hoang Chi Chi.Nguyen.e4w@gmail.com Page 6

 Limit user access to system resources

This document is created by Nguyen Hoang Chi Chi.Nguyen.e4w@gmail.com Page 7

 Auditing User Access

This document is created by Nguyen Hoang Chi Chi.Nguyen.e4w@gmail.com Page 8

 Auditing User Access

This document is created by Nguyen Hoang Chi Chi.Nguyen.e4w@gmail.com Page 9

 Switch user - su utility

This document is created by Nguyen Hoang Chi Chi.Nguyen.e4w@gmail.com Page 10

 sudo utility

USERNAME HOSTNAME-OF-SYSTEM=(USER:GROUP) COMMANDS

This document is created by Nguyen Hoang Chi Chi.Nguyen.e4w@gmail.com Page 11

 Set up host security

This document is created by Nguyen Hoang Chi Chi.Nguyen.e4w@gmail.com Page 12

 Discovering Open Ports with nmap

This document is created by Nguyen Hoang Chi Chi.Nguyen.e4w@gmail.com Page 13

 Identifying Open Ports with netstat

This document is created by Nguyen Hoang Chi Chi.Nguyen.e4w@gmail.com Page 14

 Surveying Network Sockets via ss and
systemd.socket

This document is created by Nguyen Hoang Chi Chi.Nguyen.e4w@gmail.com Page 15

 Auditing Open Files with lsof and fuser

This document is created by Nguyen Hoang Chi Chi.Nguyen.e4w@gmail.com Page 16

 Auditing Open Files with lsof and fuser

This document is created by Nguyen Hoang Chi Chi.Nguyen.e4w@gmail.com Page 17

 Disabling unused services

This document is created by Nguyen Hoang Chi Chi.Nguyen.e4w@gmail.com Page 18

 Using Super server for network services

This document is created by Nguyen Hoang Chi Chi.Nguyen.e4w@gmail.com Page 19

 Configuring xinetd

This document is created by Nguyen Hoang Chi Chi.Nguyen.e4w@gmail.com Page 20

 Configuring xinetd

/etc/xinetd.d/

/etc/xeitd.conf

This document is created by Nguyen Hoang Chi Chi.Nguyen.e4w@gmail.com Page 21

 Using TCP Wrappers

This document is created by Nguyen Hoang Chi Chi.Nguyen.e4w@gmail.com Page 22

 Securing data with encryption

This document is created by Nguyen Hoang Chi Chi.Nguyen.e4w@gmail.com Page 23

 Key concepts

Asymetric key example

This document is created by Nguyen Hoang Chi Chi.Nguyen.e4w@gmail.com Page 24

 Data hashing and message digest

This document is created by Nguyen Hoang Chi Chi.Nguyen.e4w@gmail.com Page 25

 Digital Signature

This document is created by Nguyen Hoang Chi Chi.Nguyen.e4w@gmail.com Page 26

 Secure Shell (SSH)

This document is created by Nguyen Hoang Chi Chi.Nguyen.e4w@gmail.com Page 27

 Secure Shell (SSH)

Vital configuration on sshd_config

This document is created by Nguyen Hoang Chi Chi.Nguyen.e4w@gmail.com Page 28

 Authenticate with SSH key

This document is created by Nguyen Hoang Chi Chi.Nguyen.e4w@gmail.com Page 29

 Authenticate with SSH key

This document is created by Nguyen Hoang Chi Chi.Nguyen.e4w@gmail.com Page 30

 Authenticate with Authentication Agent

This document is created by Nguyen Hoang Chi Chi.Nguyen.e4w@gmail.com Page 31

 SSH Tunneling

This document is created by Nguyen Hoang Chi Chi.Nguyen.e4w@gmail.com Page 32

 Using SSH more securely

This document is created by Nguyen Hoang Chi Chi.Nguyen.e4w@gmail.com Page 33

 Using GNU Privacy Guard (GPG or GnuPG)

This document is created by Nguyen Hoang Chi Chi.Nguyen.e4w@gmail.com Page 34

 Using GNU Privacy Guard (GPG or GnuPG)

Generate keys and transfer the public key

Receiver

Public key is sent to

the sender for
encrypting data

Sender

This document is created by Nguyen Hoang Chi Chi.Nguyen.e4w@gmail.com Page 35

 Using GNU Privacy Guard (GPG or GnuPG)

Encrypting and decrypting the data

Receiver

Sender
Encrypted data is
sent to the receiver

This document is created by Nguyen Hoang Chi Chi.Nguyen.e4w@gmail.com Page 36

 Using GNU Privacy Guard (GPG or GnuPG)

Signing Messages and Verifying Signatures

Receiver

Signed Encrypted data is sent to the receiver

Sender

This document is created by Nguyen Hoang Chi Chi.Nguyen.e4w@gmail.com Page 37

 Using GNU Privacy Guard (GPG or GnuPG)

Revoking a Key

Receiver

Revocation certificate is sent to sender

Sender

This document is created by Nguyen Hoang Chi Chi.Nguyen.e4w@gmail.com Page 38

 Question...!

This document is created by Nguyen Hoang Chi Chi.Nguyen.e4w@gmail.com Page 39