Lab 03.5 Hardening the OS

Created in 2019 - for Chapter 4 in ISBN: 978-0-7897-5912-2.

Goals

1. Harden Windows 2019 server
   1. Create an Update Plan / Policy and automate the policy where possible.
      1. Decide how updates should be installed for your situation
      2. Set the updates using either
         1. the GUI or

         2. Through the registry HKEY_LOCAL_MACHINE > SOFTWARE > Policies > Microsoft > Windows > WindowsUpdate > AU or

         3. Via powershell

            1. Install-Module PSWindowsUpdate

            2. Get-Command -module PSWindowsUpdate # to list the commands available.

            3. Add-WUServiceManager -MicrosoftUpdate # to enable additional updates.

            4. Install-WindowsUpdate -MicrosoftUpdate -AcceptAll -AutoReboot and add the following to log the result to a file: | Out-File "\\server\share\log$($env.computername-Get-Date -f yyyy-MM-dd)-MSUpdates.log" -Force

   2. Remove unnecessary programs - List installed programs from Power Shell!

      1. Get-ItemProperty HKLM:\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\* | Select-Object DisplayName, DisplayVersion, Publisher, InstallDate | Format-Table –AutoSize

   3. Stop or remove unnecessary services. (You can do this via the services app or through powershell.

   4. Audit open ports (See Dr. A's list of WindowsAdministration/PowerShellScripts on this wiki)

2. Harden Linux (Ubuntu/Kali).

   1. Automate updates Unattended-Updates package

   2. Protect SSH by not allowing password logins I know we still have my RDP which allows password logins, but we'll fix that later

3. Be able to answer these questions
   1. How much update automation should be done? In production environments, how is this handled?
   2. How do we collect status information (Windows and Linux)?
   3. How do you know if an OS or application is vulnerable? We'll look at this more later.
   4. What tools are available to manage patches, updates etc. for each of the OSs that we have installed.
   5. What happens when a snap shot is in play? Should one ever be used in production?

   6. What are the advantages and disadvantages of moving services to non-standard ports? Remember, applications behind the firewall do not need to be on non-standard ports because the firewall will probably force non-standard ports in our configuration. Also talk about virtual IPs! Show them on our firewall

Essentially we are going to take a shot at implementing least functionality. See NIST and DoD

Lab Directions / Setup

First we are going to install a new application that you must now keep running at all times. Treat it like its a production system.

1. Install the latest Moin wiki on your Ubuntu system. Use it to document your plan, configuration etc. Make it available outside your network on port 80/443.

Scenario. You are trying to protect your network from attack by hardening the operating systems in use: Windows Server 2019, Ubuntu, Kali and a legacy system that requires Ubuntu 14.04 (our metasploitable application). Unfortunately, circumstances forbid you from changing the Ubuntu 14 server. So for now, we'll just firewall outside access, and look at giving outside access later.

1. Create a plan to harden your systems. Include the following sections for each of your operating systems.

   1. Updating Windows Server 2019 in 2021, I dropped the Windows 10 VM from the labs. We won't be installing WSUS - that happens in Windows Admin class

   2. Updating Linux systems
2. For each of the above update sections sure to include the following:
   1. Policy including rationale for the actions and automation where appropriate. Include a WSUS installation as part of your Windows Plan.

   2. Configuration is usually controlled on windows by Group Policy, what is available for Linux? You should check out the unattended-upgrades package.

   3. What role do backups or snapshots play in the upgrade process. They essentially slow your VM to a crawl - why is that?

   4. Testing Plan for update - What tests should you run after updates to guarantee your applications will continue to operate correctly.
3. Remove unneeded programs.
4. Configure SSH in each of your systems to not allow only public key logins.
5. Document and perform hardening configuration changes (e.g. moving services to non-standard ports etc.)

Show Me / Grade Guide

This will require that you both create a video and create pages on your wiki. Please make the home page with links to the other pages on your wiki and upload your video on an appropriate page (e.g. Lab03.5)

1. Demo that Moin is accessible from outside your network directly and that it IS UP-TO-DATE!

2. Talk/Demo through your Documentation in your wiki that shows what systems applications are installed on each of the systems - verify that you know what every one of them is for (by documenting their purpose)!

   1. Hint: You should find those packages on linux that don't have another package that depends on them. (You'll have to look and maybe even do some data manipulation). We should be able to do this with Power Shell for windows too. apt list --installed | grep '\[installed\]' OR dpkg -l gives a nice list, but not any install information Hmmm. For Windows see: https://devblogs.microsoft.com/scripting/use-powershell-to-find-installed-software/

3. Talk/Demo through your Documentation in your wiki that shows what system services are installed on each of the systems - verify that you know what every one of them is for!

   1. Hint = Same as the last one.
4. Talk/Demo through your Documentation in your wiki of the listening ports on each system, what executable is responsible for them and verify that you need each one.
5. Demo that SSH is accessible through public key logins only.

Additional Notes

1. Moin

   1. In installing Moin, to get the commandline "moin account create ..." to work I had to add the following line at line 32 to /usr/local/lib/python2.7/dist-packages/MoinMoin/config/multiconfig.py: sys.path.insert(0, '/usr/local/share/moin')

   2. After this I used # moin account create ... to create an account

   3. Then I cleaned the cache: # moin maint cleancache

   4. Since I did the above by root, I then executed # chown -R www-data.www-data [moin directory]

   5. That was it for moin I logged in and it worked!
2. I set my hostname to ubuntu.dra.local

3. I setup apache2 to use ssl with a 4096 bit key. See: https://websiteforstudents.com/setup-apache2-http-with-self-signed-ssl-tls-certificates-on-ubuntu-16-04-lts-servers/

4. Installed unattended-upgrades on ubuntu and kali. I had to remove mimikatz from kali so that it would update.