Skip to content

Lab2.2SyslogOrganization

Jump to bottom
Beth edited this page Feb 2, 2025 · 10 revisions

Setting up Mgmt

Set the hostname, make a new sudo user, reset the champuser password, set the network configuration with netplan

My netplan can be found below:

image

Then on the firewall configure the nat rule:

image

And the DNS Forwarding

image

I then set up chrome remote desktop. To do this I navigated to the remote desktop page, downloaded the package, and used sudo dpkg -i [name] to unzip and run the file. Then I finished the setup via ssh and set a pin. If you need to fix the dpkg install, use sudo apt --fix broken install

Another command that might work in this situation is tar -xzvf

Creating a custom conf file for log01

Re-comment the indicated modules:

image

Navigate to the directory /etc/rsyslog.d and get the new config file:

  • sudo wget https://raw.githubusercontent.com/gmcyber/sec350-share/main/03-sec350.conf

sudo systemctl restart rsyslog then cat the new file cat 03-sec350.conf

Create a mew log on web01 with logger -t SEC350 Testing Web01>log01 custom rsyslog configuration then find the log, as shown below:

image

Then, on WEB01 change the configuration file to add a new line, as shown

Make sure to not do this on log01 as it can create a logging loop This is how you add authpriv logging to most of the linux distros we are using

image

Restart rsyslog and generate some failed password logs by sshing from rw01, they will appear as below:

image

Fixing Tree

The repo for yum was broken and needed to be fixed.

In order to do this I made a backup of the existing repo:

  • sudo mv /etc/yum.repos.d/CentOS-Base.repo /etc/yum.repos.d/CentOS-Base.repo.bak

Then created a new repo file: sudo nano /etc/yum.repos.d/CentOS-Base.repo With the following content:

image

Cleaned and created a new cache with:

  • sudo yum clean all
  • sudo yum makecache

Then finally: sudo yum install -y tree

SSH key

If you wanted to set up an ssh key to streamline connections between computers in the network, this is how you can do it

log into mgmt01:

  • ssh adminuser@172.16.150.10
  • ssh-keygen -t rsa - generate a key

Copy the public key to log01:

  • ssh-copy-id echadbourne@172.16.50.5

Verify the key is in authorized keys on log01:

  • ssh echadbourne@172.16.50.5
  • cat ~/.ssh/authorized_keys

Clone this wiki locally