linux:security [Cygnus]

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.
====== Library ======

https://wazuh.com/ - XDR , SIEM https://habr.com/ru/articles/867162/ \\

https://attack.mitre.org/
Слайд представляет собой русскоязычный перевод матрицы MITRE ATT&CK (раздел Enterprise).   \\
Техника: [T1562 / T1685] Impair Defenses (Отключить или модифицировать инструменты).  \\
 Подтехника: [T1562.002 / T1685.006] Disable or Modify Tools: Clear Linux or Mac System Logs (Очистить журналы системы Linux или Mac).
\\   Источник: База знаний MITRE ATT&CK (адаптированный/переведенный интерфейс с официального сайта attack.mitre.org)

opensource opsec review


====== Linux Security  ======
  * https://pberba.github.io/security/2022/01/30/linux-threat-hunting-for-persistence-systemd-timers-cron/#73-monitoring-addition-to-cron


====== Zerotrust ======
https://docs.linuxserver.io/images/docker-kasm/ kasm

====== Zerotrust Browser ======
https://github.com/m1k1o/neko https://docs.linuxserver.io/images/docker-kasm/#usage \\


====== Headline ======
https://zeek.org/
====== Example Metasploit Framework ======
https://habr.com/ru/companies/npoechelon/articles/347702/ - Metasploit Framework

====== FIPS security for ubuntu ======
  - USG - Ubuntu Security Guide (usg) -  DISA-STIG compliance  - [[https://ubuntu.com/security/certifications/docs/fips-enablement|link]] ++ Detail|<code BASH>
  # USG - Ubuntu Security Guide (usg)

sudo apt-get install libopenscap8
oscap -v
oscap -V  

sudo apt install ubuntu-advantage-tools
sudo ua attach |||||
sudo ua enable usg
sudo apt install usg -y

# generate report in /var/lib/usg/ , report can show result.sh ./result_XXXXX.txt
sudo usg audit cis_level1_server  > result_usg_$(date +"%y%m%d").txt

TAILOR_FILENAME=tailor_cis_level1_server$(date +"%y%m%d").xml

# generate tailor for customize  
sudo usg generate-tailoring cis_level1_server $TAILOR_FILENAME

#turn all off
sed -i 's/selected="true"/selected="false"/g' $TAILOR_FILENAME


# turn all what we need
sed -i '/xccdf_org.ssgproject.content_rule_sshd_set_keepaliv/s/selected="false"/selected="true"/g' $TAILOR_FILENAME
sed -i '/xccdf_org.ssgproject.content_rule_sshd_set_idle_timeout/s/selected="false"/selected="true"/g' $TAILOR_FILENAME
sed -i '/xccdf_org.ssgproject.content_rule_sshd_disable_rhosts/s/selected="false"/selected="true"/g' $TAILOR_FILENAME
sed -i '/xccdf_org.ssgproject.content_rule_sshd_disable_root_login/s/selected="false"/selected="true"/g' $TAILOR_FILENAME
sed -i '/xccdf_org.ssgproject.content_rule_sshd_set_login_grace_time/s/selected="false"/selected="true"/g' $TAILOR_FILENAME
sed -i '/xccdf_org.ssgproject.content_rule_sshd_set_max_auth_tries/s/selected="false"/selected="true"/g' $TAILOR_FILENAME
sed -i '/xccdf_org.ssgproject.content_rule_sshd_set_maxstartups/s/selected="false"/selected="true"/g' $TAILOR_FILENAME
sed -i '/xccdf_org.ssgproject.content_rule_sshd_use_strong_ciphers/s/selected="false"/selected="true"/g' $TAILOR_FILENAME
sed -i '/xccdf_org.ssgproject.content_rule_sshd_use_strong_kex/s/selected="false"/selected="true"/g' $TAILOR_FILENAME
sed -i '/xccdf_org.ssgproject.content_rule_sshd_use_strong_macs/s/selected="false"/selected="true"/g' $TAILOR_FILENAME
sed -i '/xccdf_org.ssgproject.content_rule_file_permissions_sshd_config/s/selected="false"/selected="true"/g' $TAILOR_FILENAME


usg audit --tailoring-file $TAILOR_FILENAME


sudo usg generate-fix  --output ./fix.sh --tailoring-file $TAILOR_FILENAME


</code>  
++

====== Openscap ======

  -  Security Technical Implementation Guide
    -  https://medium.com/@aika.nazhimidinova/cis-benchmark-of-ubuntu-22-04-openscap-security-guide-707f206e73c8
    -  https://medium.com/defense-unicorns/stig-scanning-with-openscap-675c7292d7cb 
    -  https://medium.com/@raveen.gatla/the-ultimate-guide-for-security-compliance-with-openscap-part-1-26da99824c1b
  -  ++ Detail|<code BASH>
 
  sudo apt-get install libopenscap8
  oscap -v
  oscap -V

  sudo oscap xccdf eval --profile xccdf_org.ssgproject.content_profile_cis_level1_server --results-arf arf.xml --report $1 /usr/share/ubuntu-scap-security-guides/1/benchmarks/ssg-ubuntu2004-ds.xml



 oscap info /usr/share/ubuntu-scap-security-guides/1/benchmarks/ssg-ubuntu2204-ds-1.2.xml
 sudo oscap xccdf eval --profile xccdf_org.ssgproject.content_profile_stig --report report.html /usr/share/ubuntu-scap-security-guides/1/benchmarks/ssg-ubuntu2204-ds-1.2.xml


 oscap xccdf generate fix --profile xccdf_org.ssgproject.content_profile_stig --fix-type bash /usr/share/ubuntu-scap-security-guides/1/benchmarks/ssg-ubuntu2204-ds-1.2.xml > fix_sig.sh
 grep '2 echo "' ./fx_sig.sh

</code>
++