Blue Team Competition Scenario

Scenario: Blue Team Security Competition

Objective

Secure the Linux server using the userkiller.sh, croncheck.sh, conchecker.sh, and begin discovery with rapidenum.sh scripts from the BlueLinuxBastion project to mitigate potential attacks from the red team. Ensure the integrity of the system configuration, monitor for any unauthorized changes, and perform network scans to identify potential vulnerabilities.

Prerequisites

You have root access to the Linux server.
UFW or iptables is installed on the server.
Nmap is installed on the server.
The Blue Linux Bastion scripts have been downloaded and made executable.

Step-by-Step Usage

Step 1: Initial Configuration

Before the competition starts, perform initial system checks and prepare your environment:

Verify that SSH and the firewall are functioning.
Prepare the allowed_ips.txt with IPs and ports that should have access to prevent locking out your team or the judges.

Step 2: Deploying Userkiller.sh

Run userkiller.sh:
```
sudo ./userkiller.sh <username_to_exclude> [log_file_path]
```
- Replace <username_to_exclude> with a username that should not be affected by the hardening process (typically, your competition admin account).
- (Optional) Specify the log_file_path to override the default log file location (/var/log/userkiller.log).
- This script will log out non-essential users, secure SSH configurations, update passwords, set up necessary firewall rules, and manage system services.
Monitor Outputs:
- Observe the console output and the specified log file (default: /var/log/userkiller.log) for any errors or confirmation messages indicating successful execution.
Manage System Services:
- During the execution of userkiller.sh, you will be prompted to review the list of enabled and running system services.
- Enter the names of services you want to disable, separated by spaces, or press Enter to skip disabling any services.
- Review the selected services carefully to avoid accidentally disabling critical system services.
- The script will attempt to stop and disable the selected services and log the success or failure of each operation.
Run System Updates:
- After running userkiller.sh, it's important to update the system packages to ensure you have the latest security patches and bug fixes.
- Run the following commands to update the system:
```
sudo apt update
sudo apt upgrade -y
```
- The apt update command refreshes the package lists from the repositories, and apt upgrade -y upgrades all installed packages to their latest available versions.
- Monitor the output for any errors or prompts that may require your attention.
- Once the update process is complete, restart the system if necessary:
```
sudo reboot
```

Step 3: Establishing Periodic Checks with Croncheck.sh

Configure cronline.txt:
- Modify cronline.txt to include the correct path to croncheck.sh and set a frequent execution interval (e.g., every 15 minutes).
- Add this cron job to the system's crontab:
```
crontab -e
# Paste the modified cronline.txt content here
```
Activate the Cron Job:
- Ensure the cron job is running by checking the system's cron log or using:
```
systemctl status cron
```
Understand Croncheck.sh Functionality:
- The croncheck.sh script performs the following checks:
  - Verifies that the backup user exists and has sudo access.
  - Checks if the SSH configuration file is unchanged and has the immutable flag set.
  - Checks if the firewall rules are unchanged based on the defined rules.
- If any of these checks fail, the script logs the failure in /var/log/croncheck_failure.log.

Step 4: Monitoring Network Connections with Conchecker.sh

Run conchecker.sh:
```
sudo ./conchecker.sh <username_to_exclude>
```
- Replace <username_to_exclude> with the username of the current user's SSH connection to exclude from the connection checks.
- This script will monitor network connections, identify unauthorized connections, and prompt for actions to kill associated processes and block the connections using firewall rules.
Review Logs:
- Check the /var/log/conchecker.log file for detailed logs of the script's actions and any unauthorized connections detected.

Step 5: Performing Network Scans with rapidenum.sh

Run rapidenum.sh:
```
sudo ./rapidenum.sh <network_range>
```
- Replace <network_range> with the network range you want to scan (e.g., 10.1.1.0/24).
- This script will perform network scans using Nmap to check for open ports associated with specific TCP and UDP services on the specified network range.
Review Scan Results:
- The scan results will be saved in the HostServices directory, with separate files for each service scanned.
- Review the generated files to identify any open ports or services that may pose a security risk.
Adjust Firewall Rules:
- Based on the scan results, consider adjusting the firewall rules to allow or block specific ports and services as needed.
- Update the allowed_ips.txt file if necessary to include any additional IP addresses or ports that should be allowed.

Step 6: Continuous Monitoring

Regularly check /var/log/croncheck_failure.log to see if croncheck.sh encounters any issues with the backup user, SSH configuration, firewall rules, or disabled services.
Monitor the /var/log/conchecker.log file for any unauthorized connection attempts detected by conchecker.sh.
Periodically run rapidenum.sh to perform network scans and identify any newly opened ports or services.
Maintain vigilance on firewall logs and SSH access logs to detect any unauthorized attempts to access the server.

Step 7: Respond to Incidents

If you discover any security breaches, failed checks, or unauthorized connections, review the configurations and adjust the scripts as necessary.
Enhance firewall rules or SSH settings in response to the attack patterns observed.
Use conchecker.sh to promptly kill unauthorized processes and block the associated connections.
If you discover any critical services that were accidentally disabled, re-enable them using systemctl start <service> and systemctl enable <service>.
If croncheck.sh reports failures, investigate the cause and take appropriate actions:
- If the backup user is missing or lacks sudo access, recreate the user with the necessary permissions.
- If the SSH configuration file has been modified, review the changes, revert them if necessary, and ensure the immutable flag is set.
- If the firewall rules have been altered, compare them with the expected rules and reconfigure the firewall accordingly.

Step 8: Post-Competition Review

After the competition, review all logs and script outputs to assess the effectiveness of your hardening measures.
Analyze any successful breaches or attempts and adjust your scripts for future competitions.
Evaluate the performance of croncheck.sh, conchecker.sh, and rapidenum.sh in detecting and responding to unauthorized changes, connections, and open ports.

Conclusion

Using the Blue Linux Bastion scripts, including userkiller.sh, croncheck.sh, conchecker.sh, and rapidenum.sh, effectively increases your server's resilience against attacks in a competitive environment. By automating critical security tasks, ensuring continuous monitoring, actively identifying and responding to unauthorized connections, performing regular network scans, and regularly checking the integrity of system configurations, you can maintain a robust security posture throughout the competition.

Navigation Menu