UNDERCODE COMMUNITY

▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑 Checking the system logs :
During the audit, you need to make sure that the daemon is running Syslog , and all significant events occurring in the system are recorded in event logs. During the audit, it is also necessary to make sure that the policy for storing event logs takes into account the requirements of current legislation and the security policy
instagram.com/UndercOdeTestingCompany

🦑 𝕃𝔼𝕋𝕊 𝕊𝕋𝔸ℝ𝕋 :

1) Event logs on Linux:

/var/log/auth.log - log of the authorization system (logins and authentication mechanism).
/var/log/dpkg.log - install / uninstall packages log using dpkg.
/var/log/yum.log - package installation / removal log using yum.
/ var / log / faillog - a log of unsuccessful login attempts and their limit for each account.
/var/log/kern.log - kernel log, (a detailed log of messages from the Linux kernel).
/ var / log / maillog or /var/log/mail.log - mail server log.
/ var / log / wtmp - log-in system (registration time and duration of all users of the system).
/ var / run / utmp - information about the users currently logged in to the system.
/ var / log / lastlog - records of previous logins.
/ var / log / boot - information that is logged during system boot

2) Protecting system files

> GRUB bootloader protection
To protect the GRUB bootloader, the administrator must use password encryption in MD5 format :

[root @ machine ~] # grub-md5-crypt

3) After executing the command, the administrator needs to open the file /boot/grub/menu.lst or /boot/grub/grub.conf and add the MD5 password:
[root @ machine ~] # vi /boot/grub/menu.lst

or

[root @ machine ~] # vi /boot/grub/grub.conf

4) The newly created MD5 password can be added to the GRUB configuration file.

5) Protecting the boot directory / BOOT
During the audit, it is necessary to check the status of the / boot directory , since the kernel of the system and related files are located in the / boot directory . You need to make sure that this directory is allowed read-only access, which prevents unauthorized changes to important files in the system. To check, open the / etc / fstab file and check the configuration:
# vi / etc / fstab

6) The file should contain the line:

LABEL = / boot / boot ext2 defaults, ro 1 2

7) Checking open ports and active connections
The following script can be used to check services running on the system:
#! / bin / bash
if (($ (ps -ef | grep -v grep | grep $ service | wc -l)> 0))
then
echo “$ service is running !!!”
else
/etc/init.d/$service start
Fi

🦑 View network connections

# netstat -anop
or
# lsof -i (lsof -ni)
or
# iptraf

8) Listened ports
Using the Netstat command, you can view all open ports and their associated commands. Example script:

# netstat – tulpn
A script for port scanning is:
scan () {
if [[-z $ 1 || -z $ 2]]; then
echo “Usage: $ 0 <host> <port, ports, or port-range>”
return
fi
local host = $ 1
local ports = ()
case $ 2 in
* - *)
IFS = - read start end <<< “$ 2”
for ((port = start; port <= end; port ++)); do
ports + = ($ port)
done
;;
*, *)
IFS =, read -ra ports <<< “$ 2”
;; *)
ports + = ($ 2) ;;
esac
for port in “$ {ports [@]}”; do
alarm 1 “echo> / dev / tcp / $ host / $ port” &&
echo “port $ port is open” ||
echo “port $ port is closed”
done
}

9) iptables firewall

During the audit, it is necessary to check the configuration of the Linux firewall to prevent unauthorized access. To control traffic, rules should be created in iptables that will filter incoming, outgoing and forwarded packets taking into account the IP address and TCP / UDP port number.

# iptables -n -L -v --line-numbers

ICMP / broadcast requests

10) During the audit, you must verify that the systems are configured to ignore ping and broadcast requests. To do this, make sure that the following lines are added to the “/etc/sysctl.conf” file :

# ignore ICMP requests:
net.ipv4.icmp_echo_ignore_all = 1
# ignore broadcast requests:
net.ipv4.icmp_echo_ignore_broadcasts = 1

11) Checking installed updates
The latest updates must be installed on the systems:
# yum updates
# yum check-update

206 viewsUnder Code, 00:14