Hardening SSH
After the latest troubles, Bianchi Stationery wants a sturdier SSH. The server holds the configuration in use and, somewhere, the one recommended by the vendor. Compare them: how many settings are too weak? The right number points to the audit report to decode.
Lab 4 of 6 in the Blue Team / Defense path. If you get stuck you have 3 hints, from the vaguest to the most precise: they cost 0, 40 and 110 XP.
What you learn
Objectives complete themselves while you work in the terminal; each one is worth experience points:
- Read the configuration in use (sshd_config) (60 XP)
- Find the recommended configuration with find (100 XP)
- Compare the two configurations with diff (150 XP)
- Decode the report with the right number (100 XP)
Topics: defense, hardening, ssh, diff.
Commands you will use
The terminal is simulated and understands about forty Linux commands. In this lab you will mostly need these:
cat: prints the contents of a file: the most direct way to read configurations, notes and logs.find: searches for files by name, type or permissions across a whole folder tree; in an audit it turns up keys, forgotten copies and programs with dangerous permissions.diff: compares two files line by line and shows the differences, for example between a configuration and the recommended one.grep: finds the lines that contain a word, even across whole folders with -r. It is the main tool for analysing text and logs.wc: counts lines, words and characters: it tells you how big a file is before you open it.base64: encodes and decodes Base64, the format that turns bytes into text. It protects nothing: it can be undone without a key.|: the vertical bar | chains commands: the output of the first becomes the input of the next, so small tools form a complete analysis.
The simulated environment
You work in a simulated Linux shell, in the home folder of the user runner: invented files and folders, no network target.
Besides the home folder there is a complete simulated system, with configuration files, logs, users and permissions to examine.
The defensive lesson
Once the lab is solved, the write-up explains what went wrong and how to protect yourself:
Many SSH attacks succeed because of settings left at convenient values: direct root login, passwords instead of keys, empty passwords, too many attempts per connection. Comparing the configuration in use with the recommended one (diff) is the quickest way to see what is weak. SSH hardening: PermitRootLogin no, keys only (PasswordAuthentication no), a low MaxAuthTries, no needless forwarding; and next to it an automatic ban on attempts (fail2ban). After every change reload sshd while keeping a spare session open.
Before and after this lab
To unlock it you must have solved:
- Reading an access log (Blue Team / Defense, easy)
- Finding files (Linux Fundamentals, medium)
After this lab you can move on to:
- Closing the unneeded ports (Blue Team / Defense, medium)
The Blue Team / Defense path
Blue Team / Defense is the path of those who protect. You read access logs, count failed attempts to find out who is forcing a login, rebuild the timeline of an incident, compare an SSH configuration with the recommended one, shut down unnecessary services and handle incident response in four steps: detect, contain, clean up, document. The commands are the same as in the other paths, but used through the eyes of someone who must understand what happened and stop it from happening again.