Thời lượng

40 giờ

Mục tiêu khóa học

• Khóa học tập trung làm thế nào bảo đảm an toàn cho hệ thống điều hành linux.
• Đặc biệt tập trung vào bảo đảm các dịch vụ mạng
• Giúp học viên có thể quản trị và xây dựng hệ thống linux an toàn.
• Giúp học viên hiểu rõ các lỗ hổng bảo mật tiềm năng, biết làm thế nào audit và triển khai an toàn các dịch vụ mới.

Đối tượng tham gia khóa học

• Nhân viên quản tri hệ thống.
• Chuyên viên bảo mật.
• Các cá nhân yêu thích và muốn tìm hiểu làm thế nào để xây dựng và quản trị hệ thống linux an toàn.

Điều kiện tiên quyết

• Đã học qua khóa học lpi 1,2 hoặc có kiến thức tương đương.

Nội dung khóa học

1. SECURITY CONCEPTS

- Basic Security Principles

- RHEL6 Default Install

- RHEL6 Firewall

- Minimization – Discovery

- Service Discovery

- Hardening

- Security Concepts

• LAB TASKS

- Removing Packages Using RPM

- Firewall Configuration

- Process Discovery

- Operation of the setuid() and capset() System Calls

- Operation of the chroot() System Call

2. SCANNING, PROBING, AND MAPPING VULNERABILITIES

- The Security Environment

- Stealth Reconnaissance

- The WHOIS database

- Interrogating DNS

- Discovering Hosts

- Discovering Reachable Services

- Reconnaissance with SNMP

- Discovery of RPC Services

- Enumerating NFS, Samba, CUPS Shares

- Nessus Insecurity Scanner

- Configuring OpenVAS

• LAB TASKS

- NMAP

- OpenVAS

- Advanced nmap Options

3. PASSWORD SECURITY AND PAM

- Unix Passwords

- Password Aging

- Auditing Passwords

- PAM Overview

- PAM Module Types

- PAM Order of Processing

- PAM Control Statement

- PAM Modules

- pam_unix

- pam_cracklib.so

- pam_pwcheck.so

- pam_env.so

- pam_xauth.so

- pam_tally2.so

- pam_wheel.so

- pam_limits.so

- pam_nologin.so

- pam_deny.so

- pam_warn.so

- pam_securetty.so

- pam_time.so

- pam_access.so

- pam_listfile.so

- pam_lastlog.so

- pam_console.so

• LAB TASKS

- John the Ripper

- Cracklib

- Using pam_listfile to Implement Arbitrary ACLs

- Using pam_limits to Restrict Simultaneous Logins

- Using pam_nologin to Restrict Logins

- Using pam_access to Restrict Logins

- su & pam

- Using pam to authenticate FTP’s users

4. SECURE NETWORK TIME PROTOCOL (NTP)

- The Importance of Time

- Hardware and System Clock

- Time Measurements

- NTP Terms and Definitions

- Synchronization Methods

- NTP Evolution

- Time Server Hierarchy

- Operational Modes

- NTP Clients

- Configuring NTP Clients

- Configuring NTP Servers

- Securing NTP

- NTP Packet Integrity

- Useful NTP Commands

- Synchronize file’s modified time in NFS, FTP

• LAB TASKS

- Configuring and Securing NTP

- Peering NTP with Multiple Systems

5. SECURING THE FILESYSTEM

- Filesystem Mount Options

- NFS Properties

- NFS Export Option

- NFSv4 and GSSAPI Auth

- Implementing NFSv4

- Implementing Kerberos with NFS

- GPG – GNU Privacy Guard

- File Encryption with OpenSSL

- File Encryption With encfs

- Linux Unified Key Setup (LUKS)

• LAB TASKS

- Securing Filesystems

- Securing NFS

- Implementing NFSv4

- File Encryption with GPG

- File Encryption With OpenSSL

- LUKS-on-disk format Encrypted Filesystem

6. AIDE

- Host Intrusion Detection Systems

- Using RPM as a HIDS

- Introduction to AIDE

- AIDE Installation

- AIDE Policies

- AIDE Usage

• LAB TASKS

- File Integrity Checking with RPM

- File Integrity Checking with AIDE

7. ACCOUNTABILITY WITH KERNEL AUDITD

- Accountability and Auditing

- Simple Session Auditing

- Simple Process Accounting & Command History

- Kernel-Level Auditing

- Configuring the Audit Daemon

- Controlling Kernel Audit System

- Creating Audit Rules

- Searching Audit Logs

- Generating Audit Log Reports

- Audit Log Analysis

• LAB TASKS

- Auditing Login/Logout

- Auditing File Access

- Auditing Command Execution

8. SELINUX

- DAC vs. MAC

- Shortcomings of Traditional Unix Security

- AppArmor

- SELinux Goals

- SELinux Evolution

- SELinux Modes

- Gathering Information

- SELinux Virtual Filesystem

- SELinux Contexts

- Managing Contexts

- The SELinux Policy

- Choosing an SELinux Policy

- Policy Layout

- Tuning and Adapting Policy

- Booleans

- Permissive Domains

- Managing File Contexts

- Managing Port Contexts

- SELinux Policy Tools

- Examining Policy

- SELinux Troubleshooting

- SELinux Troubleshooting Continued

• LAB TASKS

- Exploring SELinux Modes

- SELinux Contexts in Action

- Managing SELinux Booleans

- Creating Policy with Audit2allow

- Creating & Compiling Policy from Source

9. SECURING APACHE

- Apache Overview

- httpd.conf – Server Settings

- Configuring CGI

- Turning Off Unneeded Modules

- Delegating Administration

- Apache Access Controls (mod_access)

- .HTAccess

- HTTP User Authentication

- Standard Auth Modules

- HTTP Digest Authentication

- SSL Using mod_ssl.so

- Authentication via SQL (PostgreSQL)

- Authentication via LDAP

- Scrubbing HTTP Headers

- Metering HTTP Bandwidth

• LAB TASKS

- Hardening Apache by Minimizing Loaded Modules

- Scrubbing Apache & PHP Version Headers

- Protecting Web Content

- Using the suexec Mechanism

- Create a TLS CA key pair

- Using SSL CA Certificates with Apache

- Enable Apache SSL Client Certificate Authentication

10. SECURING EMAIL SYSTEMS

- SMTP Implementations

- Security Considerations

- chrooting Postfix

- Email with GSSAPI/Kerberos Auth

• LAB TASKS

- Postfix In a Change Root Environment