▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑 Security Express Audit Scripts for Linux (ITGC)
Verification of accounts
twitter.com/Undercodenews

🦑 𝕃𝔼𝕋𝕊 𝕊𝕋𝔸ℝ𝕋 :

1) List all users.
The user list is stored in the / etc / passwdfile file. To get a list of users, you can use the following script:

bin / bash
# userslistinthesystem.sh
# count and Lists existing “real” users in the system.
echo
echo “[*] Existing users (sorted alphabetically):”
echo
grep '/ bin / bash' / etc / passwd | grep -v 'root' | cut -f1
-d ':' | sort
echo
echo -n “[*] Number of real users found:“
grep '/ bin / bash' / etc / passwd | grep -v 'root' | wc -l
echo

2) List the blocked accounts
During the audit, you need to check the list of blocked and unblocked users ( accountName ). The following command is suitable for this:
#! / bin / bash
echo
# passwd –s accountName

3) View statistics for all users
The auditor must ensure that the ac command is enabled on the system to review user activity:
#! / bin / bash
# ac
To view the activity of a user connection session with totals for each day, use the command:
#! / bin / bash
# ac -d
To display information about the session activity (in hours) of the user connection “user” :
#! / bin / bash
# ac user

4) Viewing user activity
System applications psacct or acct work in the background and track the activity of each user in the system, as well as the resources consumed by him. To check the activity of users in the system, run the following script:
#! / usr / bin / envksh
last -Fa | awk '
/ wtmp begins / {next; }
/ still logged in / {next; }
$ 0 == reboot {next; }
NF> 0 {
if (NR> 1)
printf (“
”);
printf (“User: t% s
”, $ 1); # user
printf (“Start: t% s% s% s% s
”, $ 3, $ 4, $ 5, $ 6);
if ($ 9 == “down”)
printf (“End: tshutdown
”);
else
printf (“End: t% s% s% s% s
”, $ 9, $ 10, $ 11, $ 12);
if ( substr ($ NF, 1, 1) == “(“)
{
t = $ NF;
h = “localhost”;
}
else
{
t = $ (NF-1);
h = $ NF;
}
gsub (“[()]”, “”, t);
printf (“Time On: t% s
”, t);
printf (“Remote Host: t% s
”, h);
} '

Written by Underc0de
▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑 Checking the password policy :

1) Accounts with an empty password
During the audit, you need to make sure that the system does not have or has blocked accounts that allow you to enter the system without entering a password. This rule can be checked with the command:

# cat / etc / shadow | awk -F: ($ 2 == ””) {print $ 1} '

2) Password complexity check
During the audit, it is necessary to check the password complexity settings in order to reduce the risk of password attacks using brute force (brute force) or dictionary matching. To set this rule in the system you must use authentication plugins (PAM).
The auditor can check the corresponding setting in the configuration file:

# vi /etc/pam.d/system-auth

3) Checking the password age
During the audit, you need to check the password expiration setting. To check the password expiration, use the change command . This command displays detailed information about the password expiration date, as well as the date it was last changed.
The following command is used to view information about the “age” of passwords:

#chage -l username

To change the password expiration time for a specific user, use the commands listed below:

#chage -M 60 username
#chage -M 60 -m 7 -W 7 userName

Parameters ( to set the password expiration date):
-M - maximum validity period in days.
-m is the minimum validity in days.
-W - setting the warning in days.

4) Using duplicate passwords
The authorization settings in the system must comply with the password policy. The file containing the password history is located in / etc / security / opasswd. For verification, you must perform the following steps:

for RHEL: open the file '/etc/pam.d/system-auth':

# vi /etc/pam.d/system-auth

for Ubuntu / Debian / Linux Mint: open the file '/ etc /pam.d/common-password ':

# vi /etc/pam.d/common-password

Add the following line to the' auth 'section:

auth sufficient pam_unix.so likeauthnullok

To prevent the last six passwords from being used, add the following line:

Password sufficient pam_unix. so nullokuse_authtok md5 shadow remember = 6

After executing the command, the system will store a history of the previous six passwords, and if any user tries to update the password using any of the last six, he will receive an error message.

5) Secure connection settings
Remote connection protocols to the Telnet and Rlogin system are very old and vulnerable, due to the transmission of the password over the network in unencrypted form. For dedicated and secure connections, the Secure Shell (SSH) protocol must be used . The auditor also needs to make sure that the root login option is disabled, the default SSH port is changed, remote access is allowed only for specific authorized users. Checked settings are located in the SSH configuration file:

> # vi / etc / ssh / sshd_config

6) Logging on as root (root login)

During the audit, the auditor should check the prohibition of remote login with root privileges.

# PermitRootLogin = yes

7) Verification of SSH service account login

During the audit, the auditor should check the service account with a passwordless SSH login value. Typically, system administrators use this feature for programmed backups, transferring files, and running scripts in remote control mode.

Check your sshd_config settings (/ etc / ssh / sshd_config) are correct one last time.

# PermitRootLogin without-password

# RSAAuthentication = yes

# PubkeyAuthentication = yes

8) Checking access lists in Denyhosts and Fail2ban
During the audit, you need to check the settings of the DenyHosts and Fail2ban access lists . These are scripts used to monitor and analyze SSH access logs and to protect against attacks by brute force passwords.

🦑 Features DenyHosts:
saves and tracks the logs from the / var / log / secure file , noting all successful and unsuccessful login attempts, and filters them.
monitors failed login attempts
sends an email notification of blocked hosts and suspicious login attempts

1) Features of Fail2ban:

2) Saves and tracks logs from the files / var / log / secure and /var/log/auth.log , / var / log / pwdfail
highly customizable and multithreaded
monitors log files on a regular basis

Written by Underc0de
▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

12) Checking CRON Jobs Automatically

The auditor should check who is allowed and forbidden to perform tasks in cron. Access to cron is controlled using the /etc/cron.allow and /etc/cron.deny files .

# echo ALL >> / etc / cron.deny

13) Checking SELINUX Forced Security

During the audit, it is important to check the status of SELinux . This mechanism must be enabled in the system.
There are three SELinux modes :
Enforcing: SELinux policy is enforced. SELinux denies access based on SELinux policy rules.
Permissive: SELinux policy is not forced. SELinux does not block access, but bans are logged as actions that would be banned if the policy were enforced.
Disabled: SELinux is disabled. Only discrete DAC rules are used.
During the audit, you can use the following script to check SELinux status or use the system-configselinux, getenforce, or sestatus commands:
ENABLED = cat / selinux / enforce
if [“ $ ENABLED ”== 1]; then
echo “SELinux is enabled, disable? (yes / no): ”
read disable
if [$ disable ==“ yes ”]; then
echo “disabling selinux”
setenforce 0
fi
fi


🦑 LBSA script for checking basic security options
LBSA (Linux Basic Security Audit script) is a basic security configuration audit script for Linux systems. The script should be run from the command line with root privileges , or ideally run on a schedule on a regular basis using the cron scheduler to systematically check configuration changes.

» The purpose of this script is an express audit of security settings and uploading a report with a description of possible parameters that can be changed to provide a higher degree of security. In the case, if there are no recommendations for any option, the script simply displays one line with working out the check, and the final decision is always up to the administrator. Before starting the test, the developers strongly recommend that you read the manual and study the recommended sections for more information.

Written by Underc0de
▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑 Most requested hacking tutorials

T.me/UndercodeTesting

🦑 paid pdfs