Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

My Linux+ Bizzle > Linux Security > Flashcards

Linux Security Flashcards

1
Q

How do you check if AppArmor is up and running?

A

sudo aa-status

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

How would you setup a port/protocol rule on ufw

A

sudo ufw allow PORT/PROTOCOL comment “STRING”

You don’t need the comment but would help if an unusual port etc

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

How would you add more than one port to the ufw rule

A

eg. “… allow 21,22/tcp …”. For itemised

or
“…. allow 30000:40000/udp …” for a range

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Prioritise a ufw rule to the top of the table

A

sudo ufw prepend RULE …

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

How to insert a ufw rule into a specific point on the table

A

First:
sudo ufw status numbered

Then:
sudo ufw insert LINE NO RULE

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Create a ufw rule for ssh with a more restricted scope of inbound sources I.e local machines only

A

sudo ufw allow proto tcp from 192.168.0.0/24 to any port 22

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Remove a ufw rule

A

sudo ufw status numbered
sudo ufw remove LINE NO

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What’s the syntax for adding an entry to the bottom of the sudoers file?

A

username ALL=(ALL) All
Where from=(who as). What commands

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Where is the sudoers file?

A

/etc/sudoers

Edit with Visudo

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Where is the SE Linux configuration

A

/etc/selinux/config

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Default policy setting of SELinux?

A

Targeted: Only enforces network daemon policy rules

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Non default SEL settings

A

minimum - only specified process
mls - US military & gov
strict - all daemons, not recommended

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

How to change SEL state

A

sudo getenforce permissive/enforcing

To disable you have to change the config file!

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What utility do you use to view and set SEL context for user accounts?

A

semanage

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What does chcon do and What is the syntax?

A

Change default SEL context;
chcon -u USER -r ROLE -t TYPE /FILE

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Where does SEL log its security events?

A

/var/log/audit/audit.log.
Can use audit2allow to generate policy to allow a denied event

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

AppArmor is usually installed by default in Ubuntu but what packages might you need to get?

A

apparmor-utils
apparmor-profiles

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Where are AppArmor profiles stored?

A

/etc/apparmor.d

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is noteworthy about AA profile names?

A

That usually reference the application path but swap the / for .
eg usr.bin.mysqld

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

How do you view a list of active network ports without an AA profile defined?

A

sudo aa-unconfined

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

How do you turn off (but not disable) an AA profile?

A

aa-complain Profile_PATH

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

How do you turn an AA profile off and on?

A

sudo aa-disable PATH
sudo aa-enforce PATH

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What tools are required to setup joining AD?

A

sssd-ad, sssd-tools, realmd, adcli

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

How do you test if you can join the AD realm (domain)?

A

sudo realm -v discover DOMAIN

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Once everything is setup, how do you join an AD domain (realm)?

A

sudo realm join -U USER@DOMAIN domain.name

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What tools required to connect a current sys to OpenLDAP

A

libnss-ldapd, libpam-ldapd, ldap-utils

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Where do you modify an individual users ssh config?

A

~/.ssh/config

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Where do you modify every user’s ssh config?

A

/etc/ssh/ssh_config

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Where do you modify an ssh server (incoming) config?

A

/etc/ssh/sshd_config

30
Q

What is the full command to generate an SSH ID key pair?

A

ssh-keygen -t ed25519 -f ~/.ssh/id_ed25519

31
Q

How would you send your pubkey to the remote SSH server?

A

ssh-copy-id USER@HOST

For a dry run then use -n

32
Q

How to check if a program is compatible to use PAM

A

ldd /bin/PATH | grep libpam.so

33
Q

Where are would a PAM compatible program have its config file?

A

/etc/pam.d

34
Q

Three common PAM modules for enforcing strong passwords?

A

pam_unix.so
pam_pwhistory.so
pam_pwquality.so (pam_cracklib.so)

35
Q

Two PAM modules to protect against brute force

A

pam_tally.so (Deb)
pam_faillock.so (Rhel)

36
Q

PAM module to incorporate into an LDAP env?

A

pam_ldap.so

37
Q

How do you check firewalld is running?

A

firewall-cmd —state
Or
systemctl status firewalld

38
Q

Commands to modify firewalld zones

A

firewall-cmd —get-zones
—get-default-zone
—set-default-zone=ZONE
—get-active-zones
—permanent —new-zone=NEWZONE

39
Q

Change an interface to a diff firewalld zone - 2 steps to do this.

A

Modify the adapter config in /etc/sysconfig/network-scripts
Then systemctl restart firewalld

40
Q

How to add/remove a service(common proto) rule to firewalld

A

firewall-cmd zone=ZONE —add/remove-service=SERVICE

(SERVICE from —get-services)

41
Q

How do you save firewalld rules beyond current session

A

Add —permanent
Or reload the firewall

42
Q

How to add a nonstandard service/port role to firewalld

A

—zone=ZONE —permanent —add-port=PORT/PROTO (tcp/udp)

43
Q

Keep going old chap

A

You got this

44
Q

Give an example of a standard ACCEPT for iptables (http for this example)

A

iptables -A INPUT -p tcp —dport 80 -j ACCEPT

45
Q

Give an example of an iptables rule to block ssh from a specific source

A

iptables -A INPUT -s 6.6.6.6 -p tcp —dport 22 REJECT/DROP

46
Q

How to make an iptables adjustment persist

A

iptables-save or on some distros there’s no -

47
Q

What are the three different chains in iptables?

A

INPUT
FORWARD
OUTPUT

48
Q

How might you monitor in a state in iptables?

A

(…) -m state —state RELATED, ESTABLISHED (…)

49
Q

What file to edit password requirements?

A

/etc/login.defs

50
Q

The /etc/login.defs file can modify settings for password length and age, but how might you go about fixing a complexity requirement.

A

Add the pwquality.so module into the PAM rules and edit appropriately.

51
Q

How would you edit settings for the PAM pwquality.so module?

A

RHEL - /etc/pam.d/system-auth and password-auth

DEB - /etc/pam.d/common-password and common-auth
Then add appropriate directives to the end of the line: “password requisite pam_pwqualty.so”

52
Q

What’s an easy trick to restrict service accounts (especially root) from making system changes

A

Edit their /etc/passwd to run the /usr/bin/nologin as their default shell. That we they can operate but not run scripts etc

53
Q

How might you stop someone from walking up to the console and using root login?

A

Create a file /etc/securetty on the system. If nothing in it that means no consoles are permitted access with root.

54
Q

How do you block root access over ssh?

A

Modify the /etc/ssh/sshd_config file and edit the appropriate commented line.

55
Q

How to disable/change ctrl alt del?

A

systemctl mask ctrl-alt-del.target

On sysV you need to modify the appropriate line in /etc/inittab

56
Q

How would you secure ‘at’ and ‘cron’

A

They have at.allow and cron.deny files in /etc

57
Q

How would you pass on messages to users?

A

/etc/login.warn
/etc/motd

58
Q

How to block USB storage devices?

A

Modify /etc/modbrope.d/blacklist.conf with the lines:

blacklist uas
blacklist usb:storage

Save then reboot!

59
Q

How to improve and customise security logging?

A

Use the auditd package:
Edit /etc/audit/audit.rules and use auditctl command

60
Q

Top 4 services you should consider disabling?

A

FTP
Telnet
Finger
Mail services

61
Q

What are two really easy network security layers you might want to consider implementing:

A

TCP wrappers .allow and .deny
Also
hosts.allow and .deny

62
Q

How is the SELinux security context format laid out

A

User:Type:Role:Level

63
Q

An easy method of checking and enabling/disabling SE Linux policies?

A

getsebool -a
setsebool (-P) POLICY on/off

64
Q

How do you read the SEL /var/log/audit/audit.log ?

A

use audit2allow

65
Q

What are the 4 PAM service types?

A

Account
Auth
Password
Session

66
Q

What are the 6 PAM control-flags

A

Include
Optional
Requisite
Required
Substack
Sufficient

67
Q

pam_tally2.so and pam_faillock.so shared options are?

A

deny=n
silent
unlock_time=n

68
Q

Unlock with pam_tally2

A

sudo pam_tally2 -r -u USER

69
Q

Where are UFW profiles stored

A

/etc/default/ufw/applications.d

70
Q

Why is /bin/nologin used?

A

It prevents a (sys account) user from logging in from any terminal

71
Q

See the firewalld zone you’re in and rules attached to them

A

firewall-cmd —list-all
Also use —zone=NAME for a different zone to what you’re on

72
Q

Where to make actual AppArmor profile changes

A

/etc/apparmor.d/local

My Linux+ Bizzle (15 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions