linuxexpert-practice-labs/labs/lpic-3-303/332-1-host-hardening/README.md

LPIC-3 332.1: Host hardening

File capabilities, USBGuard, an SSH certificate authority for host and user certificates with a revocation list, and a small chroot jail.

Before you start

The lab creates the user certuser (password Lab-Pass-1), with no authorized_keys, for tasks 4 and 5. Keep the SSH CA and the user key in /root/sshca, with the file names the tasks give. You change sshd's configuration in tasks 3 to 5: keep a second session open while you do, and check with sshd -t before you reload. Your own logins don't change.

The chapter's GRUB password, polkit, ASLR, systemd sandboxing and CPU vulnerability steps are for looking around; try them, but they aren't graded here.

Tasks

1. Copy the Python interpreter (the real file, not a link) to /usr/local/bin/lab-python, and give the copy the file capability that lets an ordinary user bind ports below 1024 with it. Check that python3 still can't.
2. Install USBGuard, generate a policy that allows the devices attached now as /etc/usbguard/rules.conf (mode 600), and run the daemon, enabled at boot. Try blocking and allowing a device again.
3. Make an SSH CA, /root/sshca/ca (with ca.pub), and give sshd a host certificate for its ED25519 host key, signed by the CA for the name localhost, so that a client that trusts only the CA (@cert-authority localhost ... in its known-hosts file) connects without a prompt.
4. Make sshd trust the CA for user certificates. Make a key pair /root/sshca/user for certuser, sign a one-hour certificate for it (user-cert.pub, principal certuser), and log in as certuser with it.
5. Revoke /root/sshca/user.pub with a key revocation list, /etc/ssh/revoked.krl, that sshd uses, so that login is refused. Other certificates from the CA must still work.
6. Build a chroot jail in /srv/jail with /bin/bash and /bin/ls and the libraries they need, so that chroot /srv/jail /bin/bash -c 'ls /bin' works.

Hints

• readlink -f "$(command -v python3)"; setcap cap_net_bind_service=ep, getcap. Test as an ordinary user: sudo -u nobody /usr/local/bin/lab-python -c 'import socket; socket.socket().bind(("127.0.0.1", 80))'. capsh --decode, /proc/self/status.
• usbguard generate-policy, systemctl enable --now usbguard, usbguard list-devices, usbguard block-device, usbguard allow-device; each device's authorized file under /sys/bus/usb/devices.
• ssh-keygen -t ed25519 -f ca; ssh-keygen -s ca -I ID -h -n localhost -V +52w /etc/ssh/ssh_host_ed25519_key.pub; HostCertificate in a file in /etc/ssh/sshd_config.d/; ssh-keyscan -c localhost.
• TrustedUserCAKeys; ssh-keygen -s ca -I ID -n certuser -V +1h user.pub, ssh-keygen -L -f user-cert.pub; ssh -i /root/sshca/user certuser@localhost.
• ssh-keygen -k -f revoked.krl user.pub, ssh-keygen -Q -f revoked.krl user.pub; RevokedKeys.
• cp --parents, ldd, cp -L.