Host Configuration Assessment - Linux



A. Cent OS 

A1. File System Configuration 


A2. Services

A2.1 Ensure the following services are disabled.

Automounting, xinetd, Avahi Server, CUPS, DHCP Server, LDAP server, NFS and RPC, DNS Server, FTP Server, HTTP server, IMAP and POP3 server, Samba, HTTP Proxy Server, SNMP Server, NIS Server, rsh server, telnet server, tftp server, rsync service, talk server 

systemctl list-unit-files | grep "enabled" | grep "autofs\|xinetd\|avahi-daemon\|cups\|dhcpd\|slapd\|nfs\|named\|vsftpd\|httpd\|dovecot\|smb\|squid\|snmpd\|ypserv\|rsh.socket\|rlogin.socket\|rexec.socket\|telnet.socket\|tftp.socket\|rsyncd\|ntalk"

A2.2 Ensure the following services and service client are not installed.

X Window System, NIS Client, rsh client, talk client, telnet client, LDAP client, prelink, SETroubleshoot, MCS Translation Service (mcstrans)

rpm -qa | grep "xorg-x11\|ypbind\|rsh\|talk\|telnet\|openldap-clients\|prelink\|setroubleshoot\|mcstrans"

A2.3 Ensure the following services are in use.

auditd service, rsyslog Service, syslog-ng service, cron daemon

 
systemctl list-unit-files | grep "enabled" | grep "auditd\|rsyslog\|syslog-ng\|crond"


Time Synchonization, TCP Wrappers, AIDE, SELinux, iptables, rsyslog, syslog-ng
rpm -qa | grep "ntp\|chrony\|tcp_wrappers\|AIDE, SELinux, iptables, rsyslog, syslog-ng"

A2.4 SMTP
cat /etc/postfix/main.cf | grep "smtpd_banner"

A3. Network Configuration

A3.1 Network Parameters
sysctl -a | grep "net.ipv4.ip_forward\|net.ipv4.conf.all.send_redirects\|net.ipv4.conf.default.send_redirects\|net.ipv4.conf.all.accept_source_route\|net.ipv4.conf.default.accept_source_route\|net.ipv4.conf.all.accept_redirects\|net.ipv4.conf.default.accept_redirects\|net.ipv4.conf.all.secure_redirects\|net.ipv4.conf.default.secure_redirects\|net.ipv4.conf.all.log_martians\|net.ipv4.conf.default.log_martians\|net.ipv4.icmp_echo_ignore_broadcasts\|net.ipv4.icmp_ignore_bogus_error_responses\|net.ipv4.conf.all.rp_filter\|net.ipv4.conf.default.rp_filter\|net.ipv4.tcp_syncookies\|net.ipv6.conf.all.disable_ipv6"

CIS Recommended Host and Router network parameters:


net.ipv4.ip_forward = 0
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv4.conf.all.secure_redirects = 0
net.ipv4.conf.default.secure_redirects = 0
net.ipv4.conf.all.log_martians = 1
net.ipv4.conf.default.log_martians = 1
net.ipv4.icmp_echo_ignore_broadcasts = 1
net.ipv4.icmp_ignore_bogus_error_responses = 1
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1
net.ipv4.tcp_syncookies = 1
net.ipv6.conf.all.disable_ipv6 = 1

 A3.2 Uncommon Network Protocols

Disable the following protocol:

DCCP, SCTP, RDS, TIPC

modprobe -n -v -a dccp sctp rds tipc

A4. Logging and Auditing

A4.1 Ensure logging is configured 
ls -l /var/log/

A4.2 Configure System Accounting
cat /etc/audit/auditd.conf | grep "max_log_file\|space_left_action\|action_mail_acct\|admin_space_left_action\|max_log_file_action"
CIS recommended audit logs configuration: 
max_log_file = <mb>
space_left_action = email
action_mail_acct = root
admin_space_left_action = halt
max_log_file_action = keep_logs

A4.3 Ensure sufficient events information are collected
cat /etc/audit/audit.rules | grep "time-change\|identity\|system-locale\|MAC-policy\|logins\|session\|perm_mod\|access\|mounts\|delete\|scope\|actions\|modules"


A5. Access, Authentication and Authorization

A5.1 Configure cron

Ensure permissions are configured to 0600 (-rw-------)
ls -l /etc/ | grep "crontab\|cron.hourly\|cron.daily\|cron.weekly\|cron.monthly\|cron.d\|cron.deny\|cron.allow\|at.allow\|at.deny"


 A5.2 SSH Server Configuration

Ensure permissions are configured to 0600 (-rw-------)
ls -l /etc/ssh/sshd_config
cat /etc/ssh/sshd_config | grep "Protocol\|LogLevel\|X11Forwarding\|MaxAuthTries\|IgnoreRhosts\|HostbasedAuthentication\|PermitRootLogin\|PermitEmptyPasswords\|PermitUserEnvironment\|Ciphers\|MACs\|ClientAliveInterval\|ClientAliveCountMax\|LoginGraceTime\|AllowUsers\|AllowGroups\|DenyUsers\|DenyGroups\|Banner"

CIS recommended SSH server configuration: 
Protocol 2
LogLevel INFO
X11Forwarding no
MaxAuthTries 4
IgnoreRhosts yes
HostbasedAuthentication no
PermitRootLogin no
PermitEmptyPasswords no
PermitUserEnvironment no
Ciphers aes256-ctr,aes192-ctr,aes128-ctr,aes256-gcm@openssh.com,aes128-gcm@openssh.com,chacha20-poly1305@openssh.com
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,umac-128@openssh.com,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256
ClientAliveInterval 300
ClientAliveCountMax 0
LoginGraceTime 60
AllowUsers <userlist>
AllowGroups <grouplist>
DenyUsers <userlist>
DenyGroups <grouplist>
Banner /etc/issue.net

 A5.3 Ensure password creation requirements are configured
cat /etc/pam.d/system-auth | grep "pam_pwquality.so\|pam_unix.so\|pam_faillock.so"
cat /etc/pam.d/password-auth | grep "pam_pwquality.so\|pam_unix.so\|pam_faillock.so"
CIS Recommended PAM configuration:
password requisite pam_pwquality.so try_first_pass retry=3
password sufficient pam_unix.so remember=5
password sufficient pam_unix.so sha512
auth required pam_faillock.so preauth audit silent deny=5 unlock_time=900
auth sufficient pam_faillock.so authsucc audit deny=5 unlock_time=900

cat /etc/security/pwquality.conf | grep "minlen\|dcredit\|lcredit\|ocredit\|ucredit"

 CIS Recommended PAM configuration:

minlen=14
dcredit=-1
lcredit=-1
ocredit=-1
ucredit=-1


A5.4 Set Shadow Password Suite Parameters

cat /etc/login.defs | grep "PASS_MAX_DAYS\|PASS_MIN_DAYS\|PASS_WARN_AGE"
CIS Recommended Shadow Password Suite Parameters:

PASS_MAX_DAYS 90
PASS_MIN_DAYS 7
PASS_WARN_AGE 7

A5.5 Ensure default user umask is 027 or more restrictive
cat /etc/bashrc | grep "umask"
cat /etc/profile | grep "umask"

A6. System Maintenance

A6.1 System File Permissions
ls -l /etc/ | grep "passwd\|shadow\|group\|gshadow"

CIS Recommended System File Permission:
0644 (-rw-r--r--) group
0600 (-rw-------) group-
0600 (-rw-------) gshadow
0600 (-rw-------) gshadow-
0644 (-rw-r--r--) passwd
0600 (-rw-------) passwd-
0000 (----------) shadow
0600 (-rw-------) shadow-

Automated Assessment Tool
Lynis *
./lynis audit system -Q

Reference:
https://www.open-scap.org/tools/openscap-base/

Popular posts from this blog

Remote Desktop Protocol (RDP) Security

Image
Common Remote Desktop Protocol (RDP) Vulnerabilities Terminal Services Encryption Level is Medium or Low Microsoft Windows Remote Desktop Protocol Server Man-in-the-Middle Weakness Terminal Services Doesn't Use Network Level Authentication (NLA) Only Terminal Services Encryption Level is Medium or Low Vulnerability Assessment: Host Assessment: Remediation: Local Computer Policy/Computer Configuration/Administrative Templates/Windows Components/Remote Desktop Services/Remote Desktop Session Host/Security/Set client connection encryption level Set client connection encryption level to High Note: High: The High setting encrypts data sent from the client to the server and from the server to the client by using strong 128-bit encryption. Use this encryption level in environments that contain only 128-bit clients (for example, clients that run Remote Desktop Connection). Clients that do not support this encryption level cannot connect to RD S...
Read more

Penetration Testing - Network

Image
Manual Vulnerability Assessment TCP/21: FTP Anonymous FTP Enabled anonymous guest TCP/22: SSH nmap -p 22 --script ssh2-enum-algos <ip_address> SSH Weak Algorithms Supported SSH Server CBC Mode Ciphers Enabled ssh -oCiphers=<ciphers> <ip_address> SSH Weak MAC Algorithms Enabled ssh -oMACs=<algorithm> <ip_address> SSH Protocol v1 Supported ssh -1 <ip_address> -v Hardening on SSH Ciphers aes256-ctr,aes192-ctr,aes128-ctr MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,umac-128@openssh.com TCP/23: Telnet Unencrypted Telnet Server telnet <ip_address> 23 TCP/25: SMTP SMTP Service Cleartext Login Permitted telnet <ip_address> 25 EHLO <ip_address> AUTH LOGIN Mailserver answer to VRFY and EXPN requests * nc <ip_address> 25 EXPN root VRFY root TCP/53: DNS DNS Server Cache Snooping Remote Information Disclosure ...
Read more

Damn Vulnerable Web Services (DVWS) - Walkthrough

Image
Installation Damn Vulnerable Web Services  (DVWS) is an insecure web application with multiple vulnerable web service components that can be used to learn real world web service vulnerabilities. https://github.com/snoopysecurity/dvws WSDL Enumeration Spider DVWS using Burp Suite and look for service.php Requests processed by SOAP service include  check_user_information ,  owasp_apitop10 ,  population  and  return_price XPATH Injection User Login: 1' or '1'='1 User Password: 1' or '1'='1 Command Injection Original Request parameter value of name is " find "   by default  Edited Request change the parameter value of  name  from "find" to " dir "   Cross Site Tracing (XST) Hint of " The NuSOAP Library service is vulnerable to a Cross-site scripting flaw " is given by DVWS. Exploit is published at exploit DB ( https://www.exploit-db.com/e...
Read more

Server Message Block (SMB) Security

Image
Common SMB related vulnerabilities Microsoft Windows SMBv1 Multiple Vulnerabilities SMB Signing Disabled Microsoft Windows SMB NULL Session Authentication Microsoft Windows SMB Shares Unprivileged Access Network Discovery: TCP port 5357 - Web Services on Devices API (WSDAPI) File and Printer Sharing: TCP port 135 - Remote Procedure Call (RPC) TCP port 139 - NETBIOS Session Service TCP port 445 - Server Message Block (SMB) By disable NetBIOS over TCP/IP (TCP Port 139), NETBIOS name discovery will be prevented Microsoft Windows SMBv1 Multiple Vulnerabilities Vulnerability Assessment: NSE script smb-protocols can be used to check if the server supported NT LM 0.12 (SMBv1) . Host Assessment: Get-ItemProperty HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters | ForEach-Object {Get-ItemProperty $_.pspath} Remediation: Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters...
Read more

Offensive Security Testing Guide

Image
This cheat sheet compiles the commands we learned to exploit vulnerable machines. However, these commands alone may not be sufficient to obtain your Offensive Security Certified Professional (OSCP) certification. So... Try Harder! Information Gathering Operating System Windows Interesting Path "Documents and Settings"/Administrator/Desktop file:///C:/xampp/readme_en.txt file:///C:/xampp/passwords.txt file:///C:/xampp/webdav/webdav.txt file:///C:/xampp/apache/conf/extra/httpd-dav.conf file:///C:/xampp/apache/conf/extra/httpd-xampp.conf file:///C:/xampp/apache/logs/access.log file:///C:/xampp/apache/logs/error.log file:///C:/xampp/security/webdav.htpasswd file:///C:/xampp/htdocs/dashboard/phpinfo.php file:///C:/xampp/phpmyadmin/config.inc.php file:///C:/xampp/php/logs/php_error_log file:///C:/xampp/mysql/bin/my.ini C:\Users\<User>\AppData\Local\Temp #Email Address C:\Users\<User>\AppData\Local\Microsoft\Outlook Active Connection netstat -...
Read more

Host Configuration Assessment - Windows

Image
OS Information Gathering systeminfo wmic computersystem get domainrole 0 - Standalone workstation 1 - Member workstation 2 - Standalone server 3 - Member server 4 - Domain controller secedit /export /cfg cfg.ini > nul net user administrator > netuseradmin.txt auditpol.exe /get /category:* > auditpol.txt netsh advfirewall show allprofiles > firewall.txt net accounts > netaccount.txt gpresult /f /h evid/gporesult.html > nul accesschk /accepteula -q -a * > accesschk.txt *Simplify the process with Scgary ! User Right Assignment type cfg.ini | grep "^SeAuditPrivilege\|^SeCreatePagefilePrivilege\|^SeRemoteShutdownPrivilege\|^SeRemoteInteractiveLogonRight\|^SeEnableDelegationPrivilege\|^SeLockMemoryPrivilege\|^SeDenyNetworkLogonRight\|^SeChangeNotifyPrivilege\|^SeDebugPrivilege\|^SeDenyBatchLogonRight\|^SeCreateGlobalPrivilege\|^SeShutdownPrivilege\|^SeIncreaseQuotaPrivilege\|^SeTrustedCredManAccessPrivilege\|^SeDenyIn...
Read more

Web Server Hardening - Apache Tomcat

Image
Reference: https://tomcat.apache.org/tomcat-8.0-doc/security-howto.html 1. Remove Extraneous Resources Removing sample resources C:\xampp\Tomcat\webapps\docs C:\xampp\Tomcat\webapps\examples Removing Manager Application if not using C:\xampp2\Tomcat\webapps\host-manager C:\xampp2\Tomcat\webapps\manager C:\xampp2\Tomcat\conf\Catalina\localhost\manager.xml Disable unused Connector C:\xampp2\tomcat\conf\server.xml cat server.xml | grep "Connector" 2. Limit Server Platform Information Leaks Alter the Advertised server information Audit: cd $CATALINA_HOME/lib jar xf catalina.jar org/apache/catalina/util/ServerInfo.properties grep server.info org/apache/catalina/util/ServerInfo.properties Remediation: server.info=<SomeWebServer> server.number=<someversion> server.built= Disable X-Powered-By HTTP Header and Rename the Server Value for all Connectors Turn off TRACE Affected file: $CATALINA_HOME/conf/server.xml Remediation:...
Read more

Content Page

The Cheat Sheets offer a variety of information security cheat sheets on various security assessments and provides code to simplify testing and verification processes. Penetration Testing Network CMS - WordPress Mobile - Android Mobile - iOS Web Service (API) Security Damn Vulnerable Web Services - Walkthrough OWASP Series 2017  A1 Injection 2017  A3 Sensitive Data Exposure 2017  A4 XML External Entities (XXE) 2017 A6 Security Misconfiguration 2017 A7 Cross-Site Scripting (XSS) 2017 A8 Insecure Deserialization Configuration Assessment Windows Linux Network Device Web Server Hardening Apache PHP MySQL SSL Security Database Assessment Oracle PostgreSQL Database Assessment Tool Host Device Hardening Server Message Block (SMB) Security Remote Desktop Protocol (RDP) Security Social Engineering Social Engineering Testing - Phishing Email Security Malware Exploitation using Shell Post Exploitation Physical ...
Read more

Mobile Penetration Testing - Android

Image
Testing Environment Android Emulator Geny Motion: https://www.genymotion.com/fun-zone/ Android Debug Bridge (ADB) C:\Users\<User>\AppData\Local\Android\Sdk\platform-tools adb -s <specific device> shell #Specific Device adb -d shell #Device adb -e shell #Emulator Basic ADB command adb install <apk file> adb pull <location> adb push <file> <location> Basic Linux command cat /proc/version #Kernel version cat /proc/cpuinfo #Processor Information ps #Processes cat /system/etc/permissions/platform.xml #Permission and GID Information Gathering Retrieve APK file from Device (Recommended) adb shell pm list packages pm path <package> adb pull <apk path> Retrieve APK file from Internet https://apkpure.com To check the certificate information keytool -printcert -file CERT.RSA #C:\Program Files\Java\jre1.8.0_131\bin\keytool.exe Android Manifest Analysis 1. Activity, Service, Content Provider, Broadcast ...
Read more

Penetration Testing with OWASP Top 10 - 2017 A7 Cross-Site Scripting (XSS)

Image
XSS flaws occur whenever an application includes untrusted data in a new web page without proper validation or escaping, or updates an existing web page with user-supplied data using a browser API that can create HTML or JavaScript. XSS allows attackers to execute scripts in the victim's browser which can hijack user sessions, deface web sites, or redirect the user to malicious sites. DOM-Based XSS Proof of Concept <html> <head> <title>DOM-based Cross-site Scripting</title> </head> <body> Hi, <script> var pos = document.URL.indexOf("name=")+5; //finds the position of value var userInput = document.URL.substring(pos,document.URL.length); //copy the value into userInput variable document.write(unescape(userInput));  //writes content to the webpage </script> </body> </html> XSS Validation Bypass <Script>alert(1)</script> <script<script>>alert(1)</script> <svg onload=...
Read more