Born2beRoot

This project focus on understanding how a Virtual Machine works, setting up an SSH server using Debian or CentOS, following strict rules.

Subjects

Here are some important topics you should search for the project, basically understand what you use.

• Virtual Machine
• Debian vs CentOS
• SELinux and DNF vs AppArmor
• APT vs Aptitude
• Password Policy
• Sudo
• LVM
• SSH
• UFW
• Cron

VM Setup

• Create a VM with your chosen distro, in VirtualBox or UTM
• Choose amount of RAM
• Create a virtual hard disk, VDI, dynamically allocated
• Choose amount of storage
• Choose Bridge Adapter mode in Network Settings
• Install ISO from chosen system, without graphical interface
• Setup hostname login42
• Setup root password following PDF's policy
• Setup user login
• Setup user password following PDF's policy
• Setup the partitions using encrypted LVM accordingly to mandatory or bonus
• Install only SSH server and standard system utilities
• Setup GRUB to start the disk

Rules Setup

Sudo

• Install Sudo

• Add your user to sudo group

• Create user42 group

• Add your user to user42 group

• Edit /etc/sudoers.d/<file>

    Defaults	passwd_tries=3
    Defaults	badpass_message="<custom-message>"
    Defaults	iolog_dir="/var/log/sudo"
    Defaults	logfile="/var/log/sudo/<file>"
    Defaults	log_input,log_output
    Defaults	requiretty
    Defaults	secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin"
  

SSH

• Edit /etc/ssh/sshd_config

    #Port 22
    Port 4242
    #PermitRootLogin prohibit-password
    PermitRootLogin no
  

UFW

• Install UFW
• Enable UFW
• Allow port 4242

Network

• Edit /etc/network/interfaces

    iface enp0s3 inet dhcp
    iface enp0s3 inet static
  

• Edit /etc/network/interfaces.d/<file>

    iface enp0s3 inet static
    address <vm-ip>
    netmask <vm-netmask>
    gateway <vm-gateway>
  

Password Policy

• Install libpam

• Edit /etc/pam.d/common-password

    password	requisite	pam_pwquality.so retry=3 minlen=10 ucredit=-1 dcredit=-1 maxrepeat=3 reject_username difok=7 enforce_for_root
  

• Edit /etc/login.defs

    ENV_SUBPATH add /snap/bin
    PASS_MAX_DAYS 30
    PASS_MIN_DAYS 2
    PASS_WARN_AGE 7
  

• OBS: Take a look at chage command

Cron

• Create monitoring.sh in root

• Edit crontab -e

    */10 * * * * /bin/sleep $(last --time-format iso reboot | head -1 | awk -F ":" '{printf ("\%d", $2\%10*60+$3)}') && /root/monitoring.sh
  

• OBS: My monitoring.sh needs net-tools and sysstat packages

Remote Conection

• In your host machine: ssh <user>@<vm-ip> -p 4242

Useful Commands

	groupadd <new group> (create group)
	groupdel <group> (delete group)
	useradd <username> (create user)
	userdel <username> (delete user)
	passwd <username> (create password)
	adduser <username> <group> (add user to group)
	deluser <username> <group> (remove user from a group)
	groups <username> (get groups that user are in)
	hostnamectl set-hostname <new hostname>
	service ssh status
	ufw enable
	ufw allow <port>
	ufw status
	ufw status numbered
	ufw delete <number>
	chage -M 30 <username>
	chage -m 2 <username>
	chage -W 7 <username>
	chage -l <username>
	crontab -l
	lsblk
	ss -tunlp
	ifconfig