Linux Services and Configuration exercise

 1.	Start a Command terminal from application search menu
 2.	Make it a root terminal via:  sudo bash
You were not asked to enter your password, this is a security issue to be examined later

 3.	Get information about specific commands using “man COMMANDNAME” or “info COMMANDNAME”
◦	Example: man  ss
◦	Example: info  ss
Note: when using man and info, you can more up and down with the arrow keys, enter moves down one line, space move down a page at a time

 4.	special keys to use when a command has control of windows input and output
◦	Kill the process holding control of the terminal window: <ctrl>c
◦	Place the process holding control of terminal window in background: <ctrl>z  →  bg<return> 
◦	Place the process put in background back in control of terminal window:  fg<return> 
◦	Try:
▪	more /etc/inetd.conf →  <return><return> → <ctrl>c → <return>
▪	more /etc/inetd.conf →  <return><return> → <ctrl>z → bg<return> → ls<return> → fg → <return>

 5.	Linux is a pipelining operating system, meaning output from one command can be provided as input to a second command. The ‘|’  is used to make the connection.
◦	List all the configuration files/directories found in /etc via:  ls -l  /etc  |  less

 6.	Do the minimum fix on software install process
◦	In the app search window type: update → Software &Up…
◦	Place checks by “Canonical-supported free …”  and  “Community-maintained ….”  → close → close

 7.	Use log files to try an identify software that was installed that you might want to remove from the system
◦	In root terminal expand any compressed install log files:  gunzip  /var/log/apt/*.gz
◦	Look for installed programs:  grep   -i   "Commandline"   /var/log/apt/history.log* |grep -vi debug
Note: The output from above provides the names of packages you might want to remove.  You need to research each package and see if they make sense being on the system based on the VM scenario. 
◦	Remove packages via:  apt remove PACKAGENAME
▪	Example:  apt remove --purge lcrack

 8.	Forensic question 4 says there is a file named server.crt on the system.  
◦	Find the file in a root terminal by seaching for the filename across the full filesystem:
     find / -name "server.crt"
◦	Two files are returned, see if they are same by comparing the content of the files:  
       diff  /etc/openvpn/server/easy-rsa/pki/issued/server.crt  /etc/openvpn/server/server.crt 
Note: Nothing returned means they have no differences and so contain the same content (same file).
 9.	Forensic question 4 mentions keyid so take a chance and search for this string in the file detected above:
grep -B 3 keyid /etc/openvpn/server/server.crt 
Note: The -B in previous command means show 3 lines before match, along with match.  This is useful if there were multiple matches on keyid.  If needed you chould change 3 to change the number of lines displayed.
Answer the forensic question

 10.	Forensic question 5 wants information associate with the openVPN tunnel interface. 
◦	Show all network interfaces in terminal window:   ip a
◦	I prefer the ifconfig command so try it:  ifconfig
◦	It’s not installed so install it:  apt install net-tools
◦	If it couldn’t find the package so make sure package information is up to date:  apt update
◦	Try installing ifconfig again:  apt install net-tools
◦	Try the command:  ifconfig
◦	You can also look at the configuration file: less  /etc/openvpn/server/server.conf
Note: “ip a” showed CIRD notation for the IP while ifconfig showed netmask notation
◦	Answer the forensic question

 11.	Services that listen on a network ports are one way hackers remotely access a machine.  A couple of tools will provide the detaills on what ports are open
◦	In a root terminal:  netstat -lntup    
lntup means display all TCP and UDP listening ports with the process doing the listening.  Do not translate port numbers to service names.
◦	Alternatively you can try:  ss -lntup
Note the port number after Local Address is the port that is open.  Netstat is the old tool, ss is installed by default.  Net-tools needs to be installed to have access to netstat.  
◦	From the VM scenario readme critial services should give an indication of which of these needs to stay.  Port 53 is for DNS and while it will not be mentioned as a critical service it probably shouldn’t be stopped/removed.  Port 68 is associated with DHCP and is how the VM receive an IP address.  It also should probably NOT be removed.

 12.	In most cases any legitimate service listening on a port should be associated with an installed package.  So do the following to determine what the executable file is and what package it is associated with:

◦	The output of the ss command in step 11 provided a record for proftp.   Find the Process Identifier (pid) on this record 
▪	Find the excutable file tied to this process, PID is replaced with the process identifier (pid) number:
       ls -l /proc/PID/exe 
▪	The previous provides ...exe -> PATH_OF_FILE.  Figure out what package this file belongs to:
    dpkg  -S  PATH_OF_FILE          
    For this exercise you should have:  dpkg -S /usr//sbin/proftpd
▪	The above identifies proftpd-basic as the package that contains this file.  
▪	Most services start via the systemctl program, see if this is how proftp started:
     systemctl  status  |  grep  proftp
Note output from the previous indicates this is how the service starts, notice the record that ends with .service
▪	You can stop the service via a “systemctrl stop SERVICE_NAME” so in this case:
systemctl stop proftpd.service
▪	Check the service status again:
systemctl status proftpd.service
		No output indicates it’s not running
▪	Verify that it’s no longer listening on a port:  ss -lntup  |  grep proftp
No output indicates it’s not listening.
▪	Start the service again with “systemctl start SERVICE_NAME”, so in this case
      systemctl  start proftpd.service
▪	Check the service status again:
systemctl status proftpd.service
▪	Verify that it’s listening on a port again:  ss -lntup  |  grep proftp
▪	Disable the service so it doesn’t start on reboot with “systemctl  disable SERVICE_NAME” so in this case:   systemctl disable proftpd.service
▪	If you need to re-enable the service use “systemctl  enable SERVICE_NAME” so in this case:
       systemctl enable proftpd.service
▪	If you determine you want to fully remove the service from the system then use  “apt remove –purge PACKAGENAME”:   apt remove –purge proftpd-basic
▪	If you loose points and need to re-install then “apt install PACKAGENAME”
▪	Check your score as you should receive points for removing this service/package

 13.	It looks like the printer daemon cupsd is up and running on it’s standard port 631.   What executable is running as cupsd?   Use  ls -l /proc/PID/exe 
◦	Hmm it’s not cups, its perl, which is a scripting language 
◦	Look at forensic question 3.  It mentions perl
◦	Another good way to find out how a process stated running is to use “ps  -aufx”  so try:
   ps -aufx  | grep -v grep  | grep -B 4  cupsd
The ps command with aufx arguments gives a tree structure of how processes start.  The grep -v grep command removes the grep process from this output.  The grep -B 4 cupsd matches on cupsd and shows 4 lines before the matching record.
◦	The previous out shows that this cupsd process is started via cron, the task scheduler.  Cron starts a shell that runs /usr/sbin/cupsd. 
◦	What package does this file belong to?  dpkg  -S /usr/sbin/cupsd 
No match so it doesn’t belong to a package, so someone just placed the file on the system
◦	Check what type of file it is using the file command “file  FILE_PATH” :  file /usr/sbin/cupsd
◦	It’s identified as a Perl files, which is a text files, so just look at the file:  less /usr/sbin/cupsd
◦	Answer the forensic question
◦	There are multiple ways cron jobs get started.  The following gives one set of options for starting cron jobs:   ls -R /etc/cron*
This output shows 4 directories that contain files for starting cron jobs and one individual file.
◦	Search all of these files for an indication of cupsd:  grep -R cupsd  /etc/cron*
The -R in the ls and grep command means recursively go through all directories and their files
◦	What file type is /etc/crontab, try:  file  /etc/crontab
◦	An text file so you can edit via:  gedit /etc/crontab
◦	# at the start of a line indicates a comment, so place a # at the start of the line with cupsd
◦	Save the file.  The line indicates cupsd script is to be restarted every 2 minutes.  Now that it’s been commended out it shouldn’t restart once the running cupds process is killed.
◦	The file is our suspected backdoor and so it shouldn’t be left on the system.  Intially just move it to the home directory via :  mv /usr/sbin/cupsd  ~/
◦	As you in a root terminal this will move the file to the directory /root/, check via:  ls /root
◦	The cupsd program is still running and we need to kill it.  So first find it’s process id:  
ps -efw | grep -v grep  | grep cupsd   
The second column has the process id (PID)
◦	Kill the process, replacing PID with the process id:   kill -9 PID
◦	Verify it is no longer running:   ps -efw | grep -v grep  | grep cupsd   
◦	This should give points

 14.	Inetd is a super server on linux.  That is it provides networking capabilities for a lot of other applications then passes the data to those applications.  Like most application it has a configuration file under the /etc/ directory
◦	display the file:   cat /etc/inetd.conf
◦	In linux lines that start with a # are normally comment lines that don’t providing configuration information.  Remove any line that starts with # from the output:   grep -v  "^#" /etc/inetd.conf
◦	This output includes a bunch of blank lines, also remove them:  grep -v  "^#" /etc/inetd.conf | grep “\S”
◦	There are two lines left that provide configuration information for inetd.  The first field indicates the port the service listens on.  Get the port numbers using these names:
grep “daytime\|kerberos\s”  /etc/services
		The grep matches daytime or kerberos followed by a whitespace (\s).  
		So we have the correct two ports as in the ss -lntp  output.
◦	You stop inetd from listening to these ports by putting a # at the front of the two lines in the configuration file.  So edit and save the file, adding the # character:   gedit  /etc/inetd.conf
◦	Find the service file used to start inetd:  systemctl status |grep -v grep | grep inetd
◦	Restart the inetd service:  systemctl  restart inetd.service
◦	Verify we no longer have listeners on port 13 and 88:  ss -ltnp
◦	There is still a step to be done.  When inetd received communications on port 88 it started the process listed at the end of the associated line in the configuration file.  Look at that line again:
grep kerberos /etc/inetd.conf
◦	The file /bin/kerberos runs when connections are made to port 88.  What package provided this file: 
dpkg  -S  /bin/kerberos
◦	No package, check it’s file type via:  file /bin/kerberose
◦	It’s an binary executable.  If you want you can look at all the text strings found in the file doing:
strings  /bin/kerberos  | less
◦	It doesn’t belong to a package so lets move it for now:  mv  /etc/kerberose   ~/
◦	You should check your score.

 15.	At this point you’ve cleaned up the services that shouldn’t be on the system.  When you start a terminal and then make it a root terminal via  “sudo bash”  you should notice that it doesn’t ask you to enter a password to run the bash command as administrator.  This is a security issue.  Sudo has configuration files.  Something in the configuration files is allowing this to happen.  See if you can fix it so you get prompted for a password.

 16.	See if you can solve forensic question 2.  Ask if you need help.
 17.	See if you can solve forensic question 1.  Ask if you need help.