42cursus - Born2beroot

Installation

At the time of writing, the latest stable version of Debian is Debian 12 Buster. Watch bonus installation walkthrough (no audio) here.

partition

| boot | 525 MB | ext2 | | root | 10.7 GB | ext4 | | swap | 2.5 GB | swap | | home | 5.4 GB | ext4 | | var | 3.2 GB | ext4 | | srv | 3.2 GB | ext4 | | tmp | 3.2 GB | ext2 | | var-log | 4.3 GB | ext4 |

sudo

what's is AppArmor ?

AppArmor is similar to SELinux, used by default in Fedora and Red Hat. While they work differently, both AppArmor and SELinux provide “mandatory access control” (MAC) security. In effect, AppArmor allows Ubuntu’s developers to restrict the actions processes can take. For example, one application that’s restricted in Ubuntu’s default configuration is the Evince PDF viewer. While Evince may run as your user account, it can only take specific actions. Evince only has the bare minimum of permissions needed to run and work with PDF documents. If a vulnerability were discovered in Evince’s PDF renderer and you opened a malicious PDF document that took over Evince, AppArmor would restrict the damage Evince could do. In the traditional Linux security model, Evince would have access to everything you have access to. With AppArmor, it only has access to things that a PDF viewer needs access to.

you can read more about it her

viewing AppArmor's Status `sudo apparmor_status`

what's is LVM ?

LVM is a tool for logical volume management which includes allocating disks, striping, mirroring and resizing logical volumes. With LVM, a hard drive or set of hard drives is allocated to one or more physical volumes. LVM physical volumes can be placed on other block devices which might span two or more disks. The physical volumes are combined into logical volumes, with the exception of the /boot partition. The /boot partition cannot be on a logical volume group because the boot loader cannot read it. If the root (/) partition is on a logical volume, create a separate /boot partition which is not a part of a volume group. Since a physical volume cannot span over multiple drives, to span over more than one drive, create one or more physical volumes per drive. *you can read more about it *here

what's the diffrence between aptitude and apt

they are quite similar as each of them offers you different ways to manage your packages. Therefore, there are a few differences that we can list:

1.Apt offers a command-line interface, while aptitude offers a visual interface 2.When facing a package conflict, apt will not fix the issue while aptitude will suggest a resolution that can do the job 3.aptitude can interactively retrieve and displays the Debian changelog of all available official packages

​Apt requires the user to have a solid knowledge of Linux systems and package management as you are running everything in the command line. It can be difficult for a novice to handle.

On the other hand, aptitude with its interface is more user-friendly as it offers a layer of abstraction regarding the different sub-commands to use for installation, upgrades, etc.

what's SSH ?

Before SSH, the commonly used protocol for remote connections was Telnet. However, Telnet had a significant security flaw. When you typed a command like "hello world" in your local terminal, it transmitted the command in plain text over the network. Anyone intercepting the traffic could read what you typed.

In contrast, when you use SSH, your commands are encrypted before transmission. So, "hello world" becomes something like "e#31ori98gh32!" (encrypted) before being sent to your server in Paris. This encryption ensures that your data remains confidential and secure during transmission.

benefits of SSH

Security: SSH provides a secure and encrypted connection, protecting your data from eavesdropping and unauthorized access.

Remote Management: Easily manage and administer remote servers and devices.

Authentication: SSH uses strong authentication methods, including passwords and public/private key pairs, ensuring that only authorized users can access your server.

Data Integrity: Your data remains intact and unaltered during transmission.

Portability: SSH is supported on various platforms, making it a versatile tool for remote access

what's is UFW

-UFW is stand for (Uncomplicated Firewall) so for us to know the UFW we need to understand what's is firewall first. a firewall is a security system, either software or hardware, that acts as a barrier between your computer or network and potential threats from the internet or other networks. It is like a protective wall or filter that monitors and controls incoming and outgoing network traffic based on a set of predefined security rules or policies so in very simple terms (ink of it as a security guard for your computer or network. It decides who is allowed to enter and leave, blocking anything suspicious or harmful.)

-(UFW) is a user-friendly command-line interface (CLI) tool for managing and configuring firewall rules on Linux systems, primarily used on Ubuntu and Debian-based distributions. UFW is designed to simplify the process of setting up and managing firewall rules, making it more accessible for users who may not have extensive knowledge of firewall management or the underlying iptables framework (It's like a friendly assistant for setting up rules for your firewall. It makes it easier for you to tell the security guard what's allowed and what's not, without needing to be an expert in security.)

Connect to your server using SSH

$ ssh username@server-ip-address

Specify a custom port if your server uses a non-default SSH port

$ ssh username@server-ip-address -p custom-port

Step 1: Installing sudo

Switch to root and its environment via su -.

$ su -
Password:
#

Install sudo via apt install sudo.

# apt install sudo

Verify whether sudo was successfully installed via dpkg -l | grep sudo.

# dpkg -l | grep sudo

Step 2: Adding User to sudo Group

Add user to sudo group via adduser <username> sudo.

# adduser <username> sudo

Alternatively, add user to sudo group via usermod -aG sudo <username>.

# usermod -aG sudo <username>

Verify whether user was successfully added to sudo group via getent group sudo.

$ getent group sudo

reboot for changes to take effect, then log in and verify sudopowers via sudo -v.

# reboot
<--->
Debian GNU/Linux 10 <hostname> tty1

<hostname> login: <username>
Password: <password>
<--->
$ sudo -v
[sudo] password for <username>: <password>

Step 3: Running root-Privileged Commands

From here on out, run root-privileged commands via prefix sudo. For instance:

$ sudo apt update

Step 4: Configuring sudo

$ sudo visudo

To limit authentication using sudo to 3 attempts (defaults to 3 anyway) in the event of an incorrect password, add below line to the file.

Defaults        passwd_tries=3

To add a custom error message in the event of an incorrect password:

Defaults        badpass_message="<custom-error-message>"

To log all sudo commands to /var/log/sudo/<filename>:

$ sudo mkdir /var/log/sudo
<~~~>
Defaults        logfile="/var/log/sudo/<filename>"
<~~~>

To archive all sudo inputs & outputs to /var/log/sudo/:

Defaults        log_input,log_output
Defaults        iolog_dir="/var/log/sudo"

To require TTY:

Defaults        requiretty

To set sudo paths to /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin:

Defaults        secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin"

SSH

Step 1: Installing & Configuring SSH

Install openssh-server via sudo apt install openssh-server.

$ sudo apt install openssh-server

Verify whether openssh-server was successfully installed via dpkg -l | grep ssh.

$ dpkg -l | grep ssh

Configure SSH via sudo vi /etc/ssh/sshd_config.

$ sudo vi /etc/ssh/sshd_config

To set up SSH using Port 4242, replace below line:

13 #Port 22

with:

13 Port 4242

To disable SSH login as root irregardless of authentication mechanism, replace below line

32 #PermitRootLogin prohibit-password

with:

32 PermitRootLogin no

Check SSH status via sudo service ssh status.

$ sudo service ssh status

Alternatively, check SSH status via systemctl status ssh.

$ systemctl status ssh

Step 2: Installing & Configuring UFW

Install ufw via sudo apt install ufw.

$ sudo apt install ufw

Verify whether ufw was successfully installed via dpkg -l | grep ufw.

$ dpkg -l | grep ufw

Enable Firewall via sudo ufw enable.

$ sudo ufw enable

Allow incoming connections using Port 4242 via sudo ufw allow 4242.

$ sudo ufw allow 4242

Check UFW status via sudo ufw status.

$ sudo ufw status

Step 3: Connecting to Server via SSH

SSH into your virtual machine using Port 4242 via ssh <username>@<ip-address> -p 4242.

$ ssh <username>@<ip-address> -p 4242

Terminate SSH session at any time via logout.

$ logout

Alternatively, terminate SSH session via exit.

$ exit

User Management

Step 1: Setting Up a Strong Password Policy

Password Age

Configure password age policy via sudo vi /etc/login.defs.

$ sudo vi /etc/login.defs

To set password to expire every 30 days, replace below line

160 PASS_MAX_DAYS   99999

with:

160 PASS_MAX_DAYS   30

To set minimum number of days between password changes to 2 days, replace below line

161 PASS_MIN_DAYS   0

with:

161 PASS_MIN_DAYS   2

To send user a warning message 7 days (defaults to 7 anyway) before password expiry, keep below line as is.

162 PASS_WARN_AGE   7

Password Strength

Secondly, to set up policies in relation to password strength, install the libpam-pwquality package.

$ sudo apt install libpam-pwquality

Verify whether libpam-pwquality was successfully installed via dpkg -l | grep libpam-pwquality.

$ dpkg -l | grep libpam-pwquality

Configure password strength policy via sudo vi /etc/pam.d/common-password, specifically the below line:

$ sudo vi /etc/pam.d/common-password
<~~~>
25 password        requisite                       pam_pwquality.so retry=3
<~~~>

To set password minimum length to 10 characters, add below option to the above line.

minlen=10

To require password to contain at least an uppercase character and a numeric character:

ucredit=-1 dcredit=-1

To set a maximum of 3 consecutive identical characters:

maxrepeat=3

To reject the password if it contains <username> in some form:

reject_username

To set the number of changes required in the new password from the old password to 7:

difok=7

To implement the same policy on root:

enforce_for_root

Finally, it should look like the below:

password        requisite                       pam_pwquality.so retry=3 minlen=10 ucredit=-1 dcredit=-1 maxrepeat=3 reject_username difok=7 enforce_for_root

Step 2: Creating a New User

Create new user via sudo adduser <username>.

$ sudo adduser <username>

Verify whether user was successfully created via getent passwd <username>.

$ getent passwd <username>

Verify newly-created user's password expiry information via sudo chage -l <username>.

$ sudo chage -l <username>
Last password change					: <last-password-change-date>
Password expires					: <last-password-change-date + PASS_MAX_DAYS>
Password inactive					: never
Account expires						: never
Minimum number of days between password change		: <PASS_MIN_DAYS>
Maximum number of days between password change		: <PASS_MAX_DAYS>
Number of days of warning before password expires	: <PASS_WARN_AGE>

Step 3: Creating a New Group

Create new user42 group via sudo addgroup user42.

$ sudo addgroup user42

Add user to user42 group via sudo adduser <username> user42.

$ sudo adduser <username> user42

Alternatively, add user to user42 group via sudo usermod -aG user42 <username>.

$ sudo usermod -aG user42 <username>

Verify whether user was successfully added to user42 group via getent group user42.

$ getent group user42

cron

Setting Up a cron Job

Configure cron as root via sudo crontab -u root -e.

$ sudo crontab -u root -e

To schedule a shell script to run every 10 minutes, replace below line

23 # m h  dom mon dow   command

with:

23 */10 * * * * sh /path/to/script

Check root's scheduled cron jobs via sudo crontab -u root -l.

$ sudo crontab -u root -l

Bonus

#1: Installation

Watch bonus installation walkthrough (no audio) here.

#2: Linux Lighttpd MariaDB PHP (LLMP) Stack

Step 1: Installing Lighttpd

Install lighttpd via sudo apt install lighttpd.

$ sudo apt install lighttpd

Verify whether lighttpd was successfully installed via dpkg -l | grep lighttpd.

$ dpkg -l | grep lighttpd

Allow incoming connections using Port 80 via sudo ufw allow 80.

$ sudo ufw allow 80

Step 2: Installing & Configuring MariaDB

Install mariadb-server via sudo apt install mariadb-server.

$ sudo apt install mariadb-server

Verify whether mariadb-server was successfully installed via dpkg -l | grep mariadb-server.

$ dpkg -l | grep mariadb-server

Start interactive script to remove insecure default settings via sudo mysql_secure_installation.

$ sudo mysql_secure_installation
Enter current password for root (enter for none): #Just press Enter (do not confuse database root with system root)
Set root password? [Y/n] n
Remove anonymous users? [Y/n] Y
Disallow root login remotely? [Y/n] Y
Remove test database and access to it? [Y/n] Y
Reload privilege tables now? [Y/n] Y

Log in to the MariaDB console via sudo mariadb.

$ sudo mariadb
MariaDB [(none)]>

Create new database via CREATE DATABASE <database-name>;.

MariaDB [(none)]> CREATE DATABASE <database-name>;

Create new database user and grant them full privileges on the newly-created database via GRANT ALL ON <database-name>.* TO '<username-2>'@'localhost' IDENTIFIED BY '<password-2>' WITH GRANT OPTION;.

MariaDB [(none)]> GRANT ALL ON <database-name>.* TO '<username-2>'@'localhost' IDENTIFIED BY '<password-2>' WITH GRANT OPTION;

Flush the privileges via FLUSH PRIVILEGES;.

MariaDB [(none)]> FLUSH PRIVILEGES;

Exit the MariaDB shell via exit.

MariaDB [(none)]> exit

Verify whether database user was successfully created by logging in to the MariaDB console via mariadb -u <username-2> -p.

$ mariadb -u <username-2> -p
Enter password: <password-2>
MariaDB [(none)]>

Confirm whether database user has access to the database via SHOW DATABASES;.

MariaDB [(none)]> SHOW DATABASES;
+--------------------+
| Database           |
+--------------------+
| <database-name>    |
| information_schema |
+--------------------+

Exit the MariaDB shell via exit.

MariaDB [(none)]> exit

Step 3: Installing PHP

Install php-cgi & php-mysql via sudo apt install php-cgi php-mysql.

$ sudo apt install php-cgi php-mysql

Verify whether php-cgi & php-mysql was successfully installed via dpkg -l | grep php.

$ dpkg -l | grep php

Step 4: Downloading & Configuring WordPress

Install wget via sudo apt install wget.

$ sudo apt install wget

Download WordPress to /var/www/html via sudo wget http://wordpress.org/latest.tar.gz -P /var/www/html.

$ sudo wget http://wordpress.org/latest.tar.gz -P /var/www/html

Extract downloaded content via sudo tar -xzvf /var/www/html/latest.tar.gz.

$ sudo tar -xzvf /var/www/html/latest.tar.gz

Remove tarball via sudo rm /var/www/html/latest.tar.gz.

$ sudo rm /var/www/html/latest.tar.gz

Copy content of /var/www/html/wordpress to /var/www/html via sudo cp -r /var/www/html/wordpress/* /var/www/html.

$ sudo cp -r /var/www/html/wordpress/* /var/www/html

Remove /var/www/html/wordpress via sudo rm -rf /var/www/html/wordpress

$ sudo rm -rf /var/www/html/wordpress

Create WordPress configuration file from its sample via sudo cp /var/www/html/wp-config-sample.php /var/www/html/wp-config.php.

$ sudo cp /var/www/html/wp-config-sample.php /var/www/html/wp-config.php

Configure WordPress to reference previously-created MariaDB database & user via sudo vi /var/www/html/wp-config.php.

$ sudo vi /var/www/html/wp-config.php

Replace the below

23 define( 'DB_NAME', 'database_name_here' );^M
26 define( 'DB_USER', 'username_here' );^M
29 define( 'DB_PASSWORD', 'password_here' );^M

with:

23 define( 'DB_NAME', '<database-name>' );^M
26 define( 'DB_USER', '<username-2>' );^M
29 define( 'DB_PASSWORD', '<password-2>' );^M

Step 5: Configuring Lighttpd

Enable below modules via sudo lighty-enable-mod fastcgi; sudo lighty-enable-mod fastcgi-php; sudo service lighttpd force-reload.

$ sudo lighty-enable-mod fastcgi
$ sudo lighty-enable-mod fastcgi-php
$ sudo service lighttpd force-reload

#3: File Transfer Protocol (FTP)

Step 1: Installing & Configuring FTP

Install FTP via sudo apt install vsftpd.

$ sudo apt install vsftpd

Verify whether vsftpd was successfully installed via dpkg -l | grep vsftpd.

$ dpkg -l | grep vsftpd

Allow incoming connections using Port 21 via sudo ufw allow 21.

$ sudo ufw allow 21

Configure vsftpd via sudo vi /etc/vsftpd.conf.

$ sudo vi /etc/vsftpd.conf

To enable any form of FTP write command, uncomment below line:

31 #write_enable=YES

To set root folder for FTP-connected user to /home/<username>/ftp, add below lines:

$ sudo mkdir /home/<username>/ftp
$ sudo mkdir /home/<username>/ftp/files
$ sudo chown nobody:nogroup /home/<username>/ftp
$ sudo chmod a-w /home/<username>/ftp
<~~~>
user_sub_token=$USER
local_root=/home/$USER/ftp
<~~~>

To prevent user from accessing files or using commands outside the directory tree, uncomment below line:

114 #chroot_local_user=YES

To whitelist FTP, add below lines:

$ sudo vi /etc/vsftpd.userlist
$ echo <username> | sudo tee -a /etc/vsftpd.userlist
<~~~>
userlist_enable=YES
userlist_file=/etc/vsftpd.userlist
userlist_deny=NO
<~~~>

Step 2: Connecting to Server via FTP

FTP into your virtual machine via ftp <ip-address>.

$ ftp <ip-address>

Terminate FTP session at any time via CTRL + D.