Linux System Hardening

This guide contains the answer and steps necessary to get to them for the Linux System Hardening room.

Table of contents

• Physical Security
• Filesystem Partitioning and Encryption
• Firewall
• Remote Access
• Securing User Accounts
• Software and Services
• Update and Upgrade Policies
• Audit and Log Configuration

Physical Security

1. What command can you use to create a password for the GRUB bootloader?

   The answer can be found in the text.

   Click for answer

   grub2-mkpasswd-pbkdf2

2. What does PBKDF2 stand for?

   A quick search can give us the answer.

   Click for answer

   Password-based Key Derivation Function 2

Filesystem Partitioning and Encryption

1. What does LUKS stand for?

   The answer can be found in the text.

   Click for answer

   Linux Unified Key Set

2. We cannot attach external storage to theVM, so we have created a /home/tryhackme/secretvault.img file instead. It is encrypted with the password 2N9EdZYNkszEE3Ad. To access it, you need to open it using cryptsetup and then mount it to an empty directory, such as myvault. What is the flag in the secret vault?

   First we must open the encrypted image using cryptsetup.

   console

   Copy

   sudo cryptsetup luksOpen secretvault.img secretvault
   or
   sudo cryptsetup open --type luks /path/to/dump desired-name
   

   Now we can mount this device to the myvault folder and look inside.

   console

   Copy

   sudo umount /dev/mapper/secretvault
   

   

   Now we can check to see if the device is mounted and look for our flag.

   

   Click for answer

   THM{LUKS_not_LUX}

Firewall

1. There is a firewall running on the Linux VM. It is allowing port 22 TCP as we can ssh into the machine. It is allowing another TCP port; what is it?

   For this we can use the handy ufw command.

   console

   Copy

   ufw status
   

   

   Click for answer

   12526

2. What is the allowed UDP port?

   The can be found with the previous command.

   Click for answer

   14298

Remote Access

1. What flag is hidden in the sshd_configfile?

   To find the flag, we must open the files located at:

   console

   Copy

   /etc/ssh/sshd_config
   

   

   Click for answer

   THM{secure_SEA_shell}

Securing User Accounts

1. One way to disable an account is to edit the passwd file and change the account’s shell. What is the suggested value to use for the shell?

   The answer to this question can be found in the text.

   Click for answer

   /sbin/nologin

2. What is the name of the RedHat and Fedora systems sudoers group?

   The answer to this question can be found in the text.

   Click for answer

   wheel

3. What is the name of the sudoers group on Debian and Ubuntu systems?

   The answer to this question can be found in the text.

   Click for answer

   sudo

4. Other than tryhackme and ubuntu, what is the username that belongs to the sudoers group?

   This can be found by looking through the /etc/passwd file and filtering on 'root'.

   Click for answer

   blacksmith

Software and Services

1. Besides FTPS, what is another secure replacement for TFTP and FTP?

   The answer to this question can be found in the text.

   Click for answer

   SFTP

Update and Upgrade Policies

1. What command would you use to update an older Red Hat system?

   The answer to this question can be found in the text.

   Click for answer

   yum update

2. What command would you use to update a modern Fedora system?

   The answer to this question can be found in the text.

   Click for answer

   dnf update

3. What two commands are required to update a Debian system? (Connect the two commands with&&.)

   The answer to this question can be found in the text.

   Click for answer

   apt update && apt upgrade

4. What does yum stand for?

   A quick search should give us the answer.

   Click for answer

   Yellowdog Updater Modified

5. What does dnf stand for?

   A quick search should give us the answer.

   Click for answer

   Dandified YUM

6. What flag is hidden in the sources.list file?

   We can find the file by using:

   console

   Copy

   find / -name sources.list 2>/dev/null
   

   

   Click for answer

   THM{not_Advanced_Persistent_Threat}

Audit and Log Configuration

1. What command can you use to display the last 15 lines of kern.log?

   The answer to this question can be found in the text.

   Click for answer

   tail -n 15 kern.log

2. What command can you use to display the lines containing the word denied in the filesecure?

   The answer to this question can be found in the text.

   Click for answer

   grep denied secure