Lecture 7 - Firewalls & Server Hardening

Front 1

What is a firewall?

Back 1

A piece of software or hardware that controls incoming and outgoing network traffic.

Front 2

A firewall filters traffic based upon a given ______ _______.

Back 2

rule set

Front 3

What does a firewall separate?

Back 3

A firewall separates trusted and untrusted networks.

Front 4

Where are firewalls used? (3)

Back 4

1. Routers
2. Computers
3. Watchdog devices

Front 5

What types of firewalls will I encounter in Linux? (3)

Back 5

1. IP Tables
2. system-config-firewall-tui
3. UFW

Front 6

What does UFW stand for?

Back 6

Uncomplicated firewall.

Front 7

What is UFW?

Back 7

Is used on debian based distro's and was designed to be an easy
to use and understand command line firewall. This is another front
end software that runs on IPTables.

Front 8

What are IPTables?

Back 8

Is comprised of the nefilter kernel module and the Iptables software. The software works upon tables and chains that allow you the customize when and where traffic is either permitted or denied.

Front 9

What is system-config-firewall-tui?

Back 9

GUI Version of IPTables

This software is the most commonly used command line GUI of IPTables.

Front 10

IPtables is built upon tables and chains that filter all network traffic 3 chains: (3)

Back 10

1. Input: traffic originating from another computer destined to our computer.

2. Output: traffic originating from out computer destined for another computer.

3. Forward: traffic passing through the computer (if your computer is acting as a router).

Front 11

________ __________ are added to each of these chains. When this is matched, it either ACCEPTs or DROPs the packet.

Back 11

Filtering rules.

Front 12

What is bastion host?

Back 12

A bastion host is defined as a "hardened server" that is exposed to foreign networks and grants access to our own.

Front 13

What is server hardening?

Back 13

Server hardening is the process of installing and configuring software to make a server as secure as possible.

Front 14

Server hardening includes the following 6 things.

Back 14

1. Installing patches
2. Enhance security on sudo access
3. Understanding logs and how to maintain them (chattr +a logs)
4. Securing SSH
5. Remove FTP and other insecure software
6. Disable Root Account

Front 15

What 4 pieces of software are used to harden a server?

Back 15

1. Tripwire
2. Snort
3. SSHGuard
4. AppArmor

Front 16

What 2 server hardening softwares to do use in this class?

Back 16

1. Tripwire
2. Snort

Front 17

What 2 commands do we run to ensure that the server is up to date so that any exploit that may be present for the server is patched?

Back 17

sudo yum update

sudo yum upgrade

Front 18

_______ is the Linux equivalent of the attrib command in DOS.

Back 18

Chattr

Front 19

What does the chattr -i flag do?

Back 19

The -i flag allows us to set a file to immutable. This means the file unable to be altered, renamed, or have a shortcut created to it.

Front 20

What does the chattr -a flag do?

Back 20

The -a flag allows the administrator to make a file append mode only. This option is perfect for log files.

Front 21

After changing the file permissions we can view the alterations using the ___________ command.

Back 21

lsattr

Front 22

What is the command to disable root account?

Back 22

sudo passwd -l root

Front 23

What is the command to enable root account?

Back 23

sudo passwd -u root

Front 24

What is Tripwire?

Back 24

Tripwire is an Intrusion Detection System (IDS). Think of Tripwire as a house alarm. Only notifying you if your house has been broken into. The problem with IDS's is they only deter criminals, They do not prevent them. Please note that tripwire is not support by Redhat.

Tripwire keeps a database about information on all core files in the operating system. Then once a day does a scan for these files and sees if anything has changed. After the scan has completed tripwire emails you the results.

Front 25

What is Snort?

Back 25

Snort is a real time intrusion prevention system (IPS): This is the same type of security that is used in bank vaults.

The criminal breaks into the bank and needs a passcode to enter the vault. The criminal enters the wrong passcode and gets locked out of the vault. Metal bars come down and separate the criminal and vault.