linuxexpert-practice-labs/labs/linux-plus/5-4-2-service-and-crypto-issues/README.md

Linux+ 5.4.2: Service, certificate and cipher problems

A service exposed to the network, a certificate for the wrong name, a key exchange that can't be agreed, and a broken package repository.

Before you start

The peer, at 10.99.0.2 (name peer), stands in for another machine: scan this VM, 10.99.0.1, from there (sudo ip netns exec lepeer bash; install nmap on this VM). The lab has set up a few broken things:

• a service, metrics-exporter, configured in /etc/metrics-exporter.conf;
• a TLS test server, le-lab-tls, on port 8443, with its files in /etc/le-lab/tls/: the lab's own CA (ca.crt, ca.key) and the server's certificate and key (server.crt, server.key);
• something in the SSH client's configuration;
• on the RHEL family, a package repository.

Write answers to the files in /root/lab-answers/.

Tasks

1. Find what's exposed on this VM, and compare with what the peer sees. One service listens on all addresses but is only meant for local monitoring tools: write its TCP port to /root/lab-answers/1, and make it listen on 127.0.0.1 only.
2. curl --cacert /etc/le-lab/tls/ca.crt --resolve lab.example.test:8443:127.0.0.1 https://lab.example.test:8443/ fails. Write curl's exit code and the reason to /root/lab-answers/2. Then issue the server a new certificate for lab.example.test, signed by the lab's CA, and restart le-lab-tls, so the command works.
3. ssh localhost fails before it even asks how to log in. Find the setting that causes it, write the file it's in to /root/lab-answers/3, and fix it. Try the chapter's TLS 1.0 test against www.kernel.org too.
4. RHEL family: dnf makecache fails. Find the repository that breaks it, write its ID to /root/lab-answers/4, and disable or remove it.

Hints

• ss -tulpn; from the peer, nmap -sV 10.99.0.1; systemctl cat.
• curl -v; openssl x509 -noout -subject -ext subjectAltName; openssl req -new, openssl x509 -req -CA -CAkey -CAcreateserial -extfile with subjectAltName=DNS:....
• ssh -v localhost, ssh -G localhost | grep kex, /etc/ssh/ssh_config.d/.
• dnf repolist, /etc/yum.repos.d/, enabled=0 or dnf config-manager setopt ID.enabled=0.