Skip to content

Blue Team Competition Scenario

Jump to bottom
Fulco edited this page May 8, 2024 · 7 revisions

Scenario: Blue Team Security Competition

In this scenario, you are part of a blue team responsible for securing a Linux server during a security competition. The opposing red team will attempt to compromise your server, and your goal is to rapidly harden your system to prevent unauthorized access, maintain system integrity, and maintain access for judging and scoring service availability.

Objective

Secure the Linux server using the userkiller.sh and croncheck.sh scripts from the BlueLinuxBastion project to assist in mitigating potential attacks from the red team.

Prerequisites

  • You have root access to the Linux server.
  • UFW or iptables is installed on the server.
  • The Blue Linux Bastion scripts have been downloaded and made executable.

Step-by-Step Usage

Step 1: Initial Configuration

Before the competition starts, perform initial system checks and prepare your environment:

  1. Verify SSH and Firewall Functionality:

    • Ensure that SSH is running and accessible on the server.
    • Check if the firewall (UFW or iptables) is installed and functioning correctly.
    • This step is crucial to ensure that you have the necessary tools and services in place before proceeding with the hardening process.

  2. Prepare allowed_ips.txt:

    • Create a file named allowed_ips.txt and populate it with the IP addresses and ports that should have access to the server.
    • Include the IP addresses and PORTS of your team members, competition judges, and required services to prevent accidentally locking them out during the hardening process.
    • This file will be used by the userkiller.sh script to configure firewall rules and allow only authorized access.
    • It should be in the following format:
    192.168.1.23 8080
192.168.1.45 22

Step 2: Deploying Userkiller.sh

  1. Run userkiller.sh:

    sudo ./userkiller.sh <username_to_exclude>
    • Replace <username_to_exclude> with a username that should not be affected by the hardening process (typically, your competition admin account).
    • This script will perform various hardening tasks, such as logging out non-essential users, securing SSH configurations, updating passwords, and setting up necessary firewall rules.

  2. Monitor Outputs:

    • Observe the console output for any error messages or confirmation messages indicating successful execution.
    • Check the /var/log/userkiller.log file for detailed logs of the script's actions.
    • Monitoring the outputs helps you identify any issues or unexpected behavior during the hardening process.

Step 3: Establishing Periodic Checks with Croncheck.sh

  1. Configure cronline.txt:

    • Open the cronline.txt file generated by userkiller.sh.
    • Modify the file to include the correct path to the croncheck.sh script.
    • Set a frequent execution interval for the cron job (e.g., every 5-10 minutes) to ensure regular checks are performed.

  2. Add Cron Job:

    • Open the system's crontab using the command: 
      crontab -e
    • Paste the modified content of cronline.txt into the crontab file.
    • Save and exit the crontab file.

  3. Activate the Cron Job:

    • Ensure the cron service is running by checking its status: 
      systemctl status cron
    • If the cron service is not active, start it using: 
      systemctl start cron

Step 4: Continuous Monitoring

  1. Check Script Failure Logs:

    • Regularly monitor the /var/log/croncheck_failure.log file for any failures reported by the croncheck.sh script.
    • If any failures are detected, investigate the cause and take appropriate actions to resolve the issue.

  2. Monitor Firewall and SSH Logs:

    • Keep a close eye on the firewall logs to detect any unauthorized access attempts or suspicious activity.
    • Monitor the SSH access logs to identify any successful or failed login attempts.
    • Promptly investigate and respond to any security events or anomalies detected in the logs.

Step 5: Respond to Incidents

  1. Review Configurations:

    • If a security breach or failed check is discovered, review the server's configurations and settings.
    • Check if the userkiller.sh and croncheck.sh scripts are functioning as expected and making the necessary changes.
    • Identify any misconfigurations or weaknesses that may have led to the incident.

  2. Adjust Scripts and Configurations:

    • Based on the findings from the incident review, make necessary adjustments to the scripts and server configurations.
    • Enhance firewall rules to block specific attack patterns or unauthorized access attempts.
    • Modify SSH settings to strengthen security, such as changing the SSH port or implementing additional authentication mechanisms.

  3. Rerun Scripts:

    • After making the necessary adjustments, rerun the userkiller.sh script to apply the updated hardening measures.
    • Verify that the changes are effective by monitoring the logs and conducting thorough testing.

Step 6: Post-Competition Review

  1. Analyze Logs and Outputs:

    • After the competition ends, perform a comprehensive review of all the logs generated during the event.
    • Analyze the /var/log/userkiller.log and /var/log/croncheck_failure.log files to assess the effectiveness of the hardening measures.
    • Identify any successful breaches or attack attempts and investigate how they occurred.

  2. Lessons Learned:

    • Document the lessons learned from the competition, including the strengths and weaknesses of your hardening approach.
    • Identify areas where the scripts can be improved, or additional security measures can be implemented.
    • Share the findings with your team and discuss strategies for enhancing the scripts and overall security posture for future competitions.

Conclusion

By effectively utilizing the Blue Linux Bastion scripts and following a structured approach to system hardening, you can significantly increase your server's resilience against attacks in a competitive environment. The userkiller.sh script automates critical security tasks, while the croncheck.sh script ensures continuous monitoring and detection of any modifications to the hardened configurations.

Remember to adapt and customize the scripts based on the specific requirements and constraints of your competition environment. Regular monitoring, prompt incident response, and thorough post-competition analysis are essential for improving your blue team's performance and staying ahead of potential threats.

Clone this wiki locally