linuxexpert-practice-labs/labs/lpic-1/110-1-security-administration

LPIC-1 110.1: Security administration tasks

Setuid files, open ports and their processes, user limits, a narrow sudo rule, and a locked account.

Before you start

The lab creates users tess and locky (password Lab-Pass-1) and a service labweb. It runs a program that listens on a TCP port, which task 2 finds. The peer, at 10.99.0.2 (name peer), stands in for another VM: get a shell there with sudo ip netns exec lepeer bash. If a firewall runs here, the lab lets the peer through it, so a scan sees every port.

Tasks

1. List every setuid and setgid file on the root filesystem into /root/lab-answers/1-before. Copy /usr/bin/bash to /usr/local/bin/testbash, set the setuid bit on the copy, list again into /root/lab-answers/1-after, and diff the two lists. Then delete the copy.
2. Scan this VM from the peer with nmap (scan 10.99.0.1), and match each open TCP port to a process with ss -tlnp and fuser. Write one line per open port to /root/lab-answers/2: the port number and the process name, such as 22 sshd.
3. Give tess a hard limit of 50 processes (nproc) in /etc/security/limits.conf or a file in /etc/security/limits.d/, log in as tess, and check ulimit -u.
4. Give tess permission to run systemctl restart labweb with sudo, and nothing else. Check with sudo -l as tess, and try another command.
5. Lock locky's password with passwd -l, check passwd -S, and try to log in as locky (for example with su - locky as tess). Then read the attempt with lastb or journalctl.

Hints

• find / -xdev -perm /6000 -type f; chmod u+s; diff.
• nmap is a package of its own; it runs in the peer with sudo ip netns exec lepeer nmap 10.99.0.1. ss -tlnp, fuser -n tcp PORT, ps -p PID -o comm=.
• tess hard nproc 50; su - tess, ulimit -Hu.
• A file in /etc/sudoers.d/ checked with visudo -cf; the full path of systemctl (command -v systemctl); sudo -l -U tess.
• passwd -S locky; journalctl -t su or journalctl --since -10min.