ONE LAB.

ONE LAB. ONE LAB. LAB COULD ACTUALLY AND THAT'S NOT CLICKBAIT. Y'ALL COMMENTED ON THE LAST LABS, TO DELIVER. FIRST LAB THAT WE'RE GONNA DO SECURITY SERIES. NATE IS NATE. AND CYBER SECURITY INFORMATION SYSTEMS SE ENGINEER PEOPLE BREAK INTO THE INDUSTRY. FOLLOW BE DOING SOMETHING THAT I HAVEN'T SEEN ANYBODY ELSE DO ONLINE. I'M SURE IT'S I JUST HAVEN'T PERSONALLY SEEN IT. STIG LINUX VM. STIG SECURITY TECHNICAL IMPLEMENTATION GUIDE → Red Hat Enterprise Linux NOW, WE ARE COUPLE THINGS BEFORE WE GET STARTED. NEED SOME TYPE OF HYPERVISOR, 01 HYPERVISOR Somewhere to run the VM WHETHER THAT'S PROXMOS OR VIRTUAL BOX, ANYTHING OF THAT NATURE, TO RUN. AND THIS LINUX VM. THERE'S PLENTY OF TUTORIALS SUPER SIMPLE TO SET UP. ONCE YOU HAVE YOU ARE GOING DOWNLOAD A REL 9 OR REL 10 IMAGE FROM RED HAT THEMSELVES FOR FREE. THAT BY SETTING UP A DEVELOPER ACCOUNT. AND BEFORE WE WE'RE ACTUALLY GOING TO INSTALL THE OPEN SCAPS SCANNER ONTO OUR RED HAT VM. SCANNER = the oscap binary SECURITY-GUIDE = the content it scans ONCE YOU HAVE READY TO GET GOING. NOW, THE FIRST STEP BEFORE WE EVEN GET INTO STIGGING THE RED HAVE VM. YOU'RE GOING TO WANT A BACKUP, BE CHANGING A LOT OF SETTINGS THAT COULD ACTUALLY BREAK THE IMAGE SO YOU'RE GONNA WANT AN UNDO SHOW YOU HOW ON SCREEN RIGHT HERE. NOW, RULE ONE RULE 1 OF COMPLIANCE IS YOU ACTUALLY WANT TO SCAN WHATEVER VM OR BOX YOU'RE TO GET A WHOLE PICTURE. YOU DON'T KNOW WHAT'S BEEN INSTALLED OR IF FRESH INSTALL. YOU NEED TO NEED TO HARDEN. SO BY TYPING THIS COMMAND ON YOUR VIRTUAL MACHINE. BASELINE. THIS IS THE STARTING POINT 0 = clean 1 = error 2 = scan run, rules failed NOW, THE RESULT IS NOT GONNA LOOK PRETTY. OUR BASELINE, THIS IS OUR STARTING AND WHAT WE IS ACTUALLY WHAT SEPARATES PRACTITIONERS THAT KNOW WHAT THEY'RE VERSUS ONES WHO PICK ONE, RED FINDING. PICK DIRECT ROOT LOGIN OVER SSH. ONE CHECKBOX 01 - SETTING PermitRootLogin no One line in sshd config V-257985 RHEL 9 must not permit direct logons to the root account via SSH -- CAT II 02 - RHEL STIG 03 - CCI CCI-004045 The atomic control statement the STIG maps to 04 - NIST SP 808-53 IA-2 (5) The catalog systems are authorized against. PermitRootLogin → V-257985 → CCI-004045 → IA-2 (5) THAT'S THE EVIDENCE. NIST 853 IS A CATALOG WHICH SYSTEMS GET DIRECTLY AUTHORIZED AGAINST. AND IF YOU THAT CHAIN UP, YOU SOUND LIKE DO THIS FOR A LIVING. NOW, WE'RE GONNA DIRECTLY CHANGE THIS THEN RESCAN. AND WATCH WHAT HAPPENS. AS YOU BASED OFF THE RESULT: PASS 1 control satisfied IT IS NOW A GREEN SETTING, WHICH MEANS WE HAVE SATISFIED AT NOW WITH OPEN SCP SCANNING, YOU CAN ACTUALLY FIX MULTIPLE CONTROLS AT ONCE. NOT GOING ONE AND IF YOU'RE HARDENING A WHOLE FLEET YOU CAN USE TOOLS LIKE ANSIBLE TO ACTUALLY ACCOMPLISH THIS FOR YOU. WITH THIS COMMAND RIGHT HERE. BEFORE 1% 37% 41% AFTER 3% 82% 91% CAN SEE, AFTER OUR SCAN, WE HAVE OUR BEFORE AND AFTER APPEAR ON SCREEN, AND YOUR ARF.XML IS ACTUALLY PULL DIRECTLY INTO THE DISA STIG VIEW stig-after-arf.xml NOT A FINDING V-257985 NOT A FINDING V-257936 NOT A FINDING V-257951 NOT A FINDING V-258010 NOT A FINDING THAT'S THE EVIDENCE. EVIDENCE THE AUDITOR WOULD ACTUALLY WANT. NOW THAT MAY SOUND LIKE A LOT, LITERALLY SOMETHING THAT PEOPLE DO EVERYDAY AT A SMALL SCALE AND A LARGE SCALE. SO IF YOU DO THIS LAB, THE WRITE-UP 01 Baseline scan + score 02 One finding, walked up the chain 03 What you changed, and why 04 Before / after ARF + screenshots WELL, WRITE UP THAT YOU STAND OUT EXPONENTIALLY. I CANNOT EVEN TELL YOU HOW RARE IT IS. The scan is SEEN ANYBODY TALK ABOUT THIS BEFORE. NOW, SOMETHING TO POINT OUT THAT DOD BASELINES ALSO WANT FIPS MODE ENABLED, SO MAKE SURE YOU DO THAT UPON INSTALL. BUT OTHER THAN YOU JUST HARDENED A LINUX SYSTEM. LOVE YOU GUYS LIKE ALWAYS, ONE. PEACE.