Chapter 10 - Securing Your System

Question 1

what is a super server / super daemon?

10-525

Answer 1

this is a program that listens for network connections on behalf of another program

Question 2

linux has two primary super daemons. what are their names?

10-525

Answer 2

inetd

xinetd

Question 3

the socket type entry tells the system what kind of connection to expect. tell me three of them and contrast them.

10-526

Answer 3

stream - reliable two way connection
dgram - less reliable connection with less overhead
raw - low-level connection to the network

Question 4

how is xinetd an extended super daemon?

10-528

Answer 4

provides the functionality of the legacy inetd, but it also has security options that are similar to those of TCP wrappers

Question 5

there is a configuration tool you can use to bind a server only to the loopback interface. what is that tool?

10-529

Answer 5

Samba Web Administration Tool

SWAT

Question 6

in linux, how do you program the packet filter firewall capabilities of the kernel?

10-530

Answer 6

set up the firewall rules by using the iptables program followed by various options

Question 7

tell me 2 ways you can disable your unused servers for the sake of security

10-531

Answer 7

uninstall the package

reconfigure the server

Question 8

tell me 3 audit tools available to use for security reasons

10-531

Answer 8

netstat
lsof
remote network scanners

Question 9

when you want to quickly spot servers listening for connections, what command do you type?

10-533

Answer 9

netstat -lp

Question 10

tell me 2 things that lsof is used for

10-534

Answer 10

identify what files are open

find who’s accessing those files

Question 11

the network scanner Nmap is used in security audits by scanning for what?

10-535

Answer 11

open ports

Question 12

what’s a scanning tool that is more user friendly than Nmap? (hint: built on top of Nmap and has a GUI)

10-537

Answer 12

Nessus

Question 13

what would you use the fuser command for?

10-537

Answer 13

to determine the processes currently using a particular network port

Question 14

you need to move all password information from the /etc/password file to the locked-down /etc/shadow file. what command do you run to accomplish this?

10-541

Answer 14

pwconv

Question 15

when mitigating password risks, you should use secure remote login protocols. tell me 2 protocols to disable and 2 to use instead and why

10-541

Answer 15

disable Telnet and FTP
use SSH and SFTP

because Telnet and FTP use cleartext passwords

Question 16

tell me how to build a strong password in 2 steps

10-542

Answer 16

choose a base that’s easy to remember but difficult to guess

modify that base in ways that increase the difficulty of guessing the password

Question 17

which is more secure, su or sudo?

10-545

Answer 17

sudo

Question 18

you will find 2 types of entries in the /etc/sudoers file. what are they?

10-546

Answer 18

aliases

user specification

Question 19

there are two primary commands for determining who is currently logged onto a system. what are they?

10-547

Answer 19

who

w

Question 20

if you want to see if anyone has been directly accessing the root account, what command do you use?

10-549

Answer 20

last root

Question 21

PAM (Pluggable Authentication Modules) limit lines consist of four fields. tell me what they are.

10-551

Answer 21

domain
type
item
value

Question 22

an example of a limit is:
@limited hard cpu 2

what does this mean?

10-552

Answer 22

hard CPU limit of 2 minutes applied to the limited group. members of the group can log in and run programs, but if a program consumes more than 2 minutes of CPU time, it will be terminated

Question 23

tell me 4 things that SSH does that makes it so awesome

10-555

Answer 23

encrypts the password exchange
encrypts all subsequent data transfers
provides file transfer features
provides the ability to tunnel other network protocols

Question 24

you have 2 config files.
one is sshd_config
the other is ssh_config
tell me the difference between the two

10-556

Answer 24

sshd_config controls the OpenSSH server

ssh_config controls the SSH client program ssh

Question 25

what command do you use to copy files via SSH?

10-559

Answer 25

scp

Question 26

to revoke a key

1-566

Answer 26

$ gpg –gen-revoke jennie@luna.edu

Question 27

super user prompt

normal user prompt

Answer 27

the pound sign

the dollar sign