Blue Team Competition Scenario

Scenario: Blue Team Security Competition

Table of Contents

• Scenario: Blue Team Security Competition
  • Objective
  • Prerequisites
  • Step-by-Step Usage
    • Step 1: Initial Configuration
    • Step 2: Deploying Userkiller.sh
    • Step 3: Establishing Periodic Checks with Croncheck.sh
    • Step 4: Monitoring Network Connections with Conchecker.sh
    • Step 5: Continuous Monitoring
    • Step 6: Respond to Incidents
    • Step 7: Post-Competition Review
  • Conclusion

In this scenario, you are part of a blue team responsible for rapidly securing a Linux server during a security competition. The opposing red team will attempt to compromise your server, and your goal is to rapidly harden your system to prevent unauthorized access and maintain system integrity.

Objective

Secure the Linux server using the userkiller.sh, croncheck.sh, and conchecker.sh scripts from the BlueLinuxBastion project to mitigate potential attacks from the red team. Ensure the integrity of the system configuration and monitor for any unauthorized changes.

Prerequisites

• You have root access to the Linux server.
• UFW or iptables is installed on the server.
• The Blue Linux Bastion scripts have been downloaded and made executable.

Step-by-Step Usage

Step 1: Initial Configuration

Before the competition starts, perform initial system checks and prepare your environment:

• Verify that SSH and the firewall are functioning.
• Prepare the allowed_ips.txt with IPs and ports that should have access to prevent locking out your team or the judges.

Step 2: Deploying Userkiller.sh

1. Run userkiller.sh:

   sudo ./userkiller.sh <username_to_exclude>

   • Replace <username_to_exclude> with a username that should not be affected by the hardening process (typically, your competition admin account).
   • This script will log out non-essential users, secure SSH configurations, update passwords, and set up necessary firewall rules.

2. Monitor Outputs:

   • Observe the console output and /var/log/userkiller.log for any errors or confirmation messages indicating successful execution.

Step 3: Establishing Periodic Checks with Croncheck.sh

1. Configure cronline.txt:

   • Modify cronline.txt to include the correct path to croncheck.sh and set a frequent execution interval (e.g., every 15 minutes).
   • Add this cron job to the system's crontab:

     crontab -e
     # Paste the modified cronline.txt content here

2. Activate the Cron Job:

   • Ensure the cron job is running by checking the system's cron log or using:

     systemctl status cron

3. Understand Croncheck.sh Functionality:

   • The croncheck.sh script performs the following checks:
     • Verifies that the backup user exists and has sudo access.
     • Checks if the SSH configuration file is unchanged and has the immutable flag set.
     • Checks if the firewall rules are unchanged based on the defined rules.
   • If any of these checks fail, the script logs the failure in /var/log/script_failure.log.

Step 4: Monitoring Network Connections with Conchecker.sh

1. Run conchecker.sh:

   sudo ./conchecker.sh <username_to_exclude>

   • Replace <username_to_exclude> with the username of the current user's SSH connection to exclude from the connection checks.
   • This script will monitor network connections, identify unauthorized connections, and prompt for actions to kill associated processes and block the connections using firewall rules.

2. Review Logs:

   • Check the /var/log/conchecker.log file for detailed logs of the script's actions and any unauthorized connections detected.

Step 5: Continuous Monitoring

• Regularly check /var/log/script_failure.log to see if croncheck.sh encounters any issues with the backup user, SSH configuration, or firewall rules.
• Monitor the /var/log/conchecker.log file for any unauthorized connection attempts detected by conchecker.sh.
• Maintain vigilance on firewall logs and SSH access logs to detect any unauthorized attempts to access the server.

Step 6: Respond to Incidents

• If you discover any security breaches, failed checks, or unauthorized connections, review the configurations and adjust the scripts as necessary.
• Enhance firewall rules or SSH settings in response to the attack patterns observed.
• Use conchecker.sh to promptly kill unauthorized processes and block the associated connections.
• If croncheck.sh reports failures, investigate the cause and take appropriate actions:
  • If the backup user is missing or lacks sudo access, recreate the user with the necessary permissions.
  • If the SSH configuration file has been modified, review the changes, revert them if necessary, and ensure the immutable flag is set.
  • If the firewall rules have been altered, compare them with the expected rules and reconfigure the firewall accordingly.

Step 7: Post-Competition Review

• After the competition, review all logs and script outputs to assess the effectiveness of your hardening measures.
• Analyze any successful breaches or attempts and adjust your scripts for future competitions.
• Evaluate the performance of croncheck.sh and conchecker.sh in detecting and responding to unauthorized changes and connections.

Conclusion

Using the Blue Linux Bastion scripts, including userkiller.sh, croncheck.sh, and conchecker.sh, effectively increases your server's resilience against attacks in a competitive environment. By automating critical security tasks, ensuring continuous monitoring, actively identifying and responding to unauthorized connections, and regularly checking the integrity of system configurations, you can maintain a robust security posture throughout the competition.