◇ OpenCyber Academy
Technologist · Chapter 12 · English

Chapter 12 — Configuration baselines on Linux

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 12 — Configuration baselines on Linux

Lesson map

Lesson 12 published. Map, example, EX034.

flowchart TD
  N0["Learning outcomes"]
  N1["12.1 Why SSH matters"]
  N2["12.2 The baseline"]
  N3["Lab — Comparing servers to the baseline"]
  N4["12.3 Reading the result"]
  N5["12.4 Fixing safely"]
  N6["Beyond SSH"]
  N7["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX034"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["12.1 Why SSH matters"]
  N2["12.2 The baseline"]
  N3["Lab — Comparing servers to the baseline"]
  N4["12.3 Reading the result"]
  N5["12.4 Fixing safely"]
  N6["Beyond SSH"]
  N7["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX034"]

[Learning outcomes]
    |
    v
[12.1 Why SSH matters]
    |
    v
[12.2 The baseline]
    |
    v
[Lab — Comparing servers to the baseline]
    |
    v
[12.3 Reading the result]
    |
    v
[12.4 Fixing safely]
    |
    v
[Beyond SSH]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX034]

Learning outcomes

You will (1) define an SSH baseline; (2) compare servers; (3) plan fixes.

12.1 Why SSH matters

Linux servers are administered remotely over SSH. Its settings decide who can sign in and how. The CIS Benchmarks for Linux distributions recommend, among other things, disallowing direct root sign-in, using keys instead of passwords, disabling X11 forwarding where unneeded and limiting authentication attempts.

At the trust, SSH is how Dev and the outside company's engineers administer the four Linux servers, including mis01 with the pupil records. A server that allows root to sign in directly with a password can be attacked by simply guessing that one password, while keys and named accounts leave a trace of which person did what.

12.2 The baseline

Tomás and Dev agree a four-item baseline for the trust's Linux servers, drawn from the CIS Benchmark: PermitRootLogin no, PasswordAuthentication no, X11Forwarding no, MaxAuthTries 4. They keep it short so it can be checked often.

Each item is a single line in the SSH server configuration, which makes it easy to read on each server and easy to compare in a script. Root sign-in is closed because Dev uses named accounts and sudo; passwords are closed because everyone has keys; X11 forwarding is unused; and four attempts give room for one or two typing mistakes.

Lab — Comparing servers to the baseline

"""Compare synthetic SSH server settings on four Linux servers with an agreed baseline (stdlib only)."""
base = {"PermitRootLogin": "no", "PasswordAuthentication": "no", "X11Forwarding": "no", "MaxAuthTries": "4"}
servers = {
 "web01": {"PermitRootLogin": "no", "PasswordAuthentication": "no", "X11Forwarding": "no", "MaxAuthTries": "4"},
 "files01": {"PermitRootLogin": "yes", "PasswordAuthentication": "no", "X11Forwarding": "no", "MaxAuthTries": "6"},
 "mis01": {"PermitRootLogin": "no", "PasswordAuthentication": "yes", "X11Forwarding": "yes", "MaxAuthTries": "4"},
 "print01": {"PermitRootLogin": "no", "PasswordAuthentication": "no", "X11Forwarding": "no", "MaxAuthTries": "4"}}
total = 0
for s, cfg in servers.items():
    bad = [k for k in base if cfg.get(k) != base[k]]; total += len(bad)
    print(f"{s:8} deviations {len(bad)} {bad}")
print("servers compliant:", sum(1 for c in servers.values() if all(c.get(k) == v for k, v in base.items())), "of", len(servers), "| deviations", total)

Run with python3 lab_sshcfg.py. Verified output:

web01    deviations 0 []
files01  deviations 2 ['PermitRootLogin', 'MaxAuthTries']
mis01    deviations 2 ['PasswordAuthentication', 'X11Forwarding']
print01  deviations 0 []
servers compliant: 2 of 4 | deviations 4

12.3 Reading the result

Two of four servers comply. files01 allows root sign-in and more attempts; mis01 allows passwords and X11 forwarding. These match what Dev suspected: both servers were set up by different people at different times.

Neither server is wrong on purpose: files01's settings look like the distribution's old defaults, and mis01's password sign-in was probably left open for the outside company during installation. Because mis01 holds pupil records, its password sign-in is the more serious of the four deviations and the first one Dev plans to fix.

12.4 Fixing safely

Before disabling password sign-in on mis01, Dev confirms that everyone who needs access has a working key, keeps an existing session open while testing a new one, and records the change. This avoids locking himself out.

Dev changes one server at a time and reruns the lab script afterwards to confirm that only the intended setting moved. The open session is the rollback: if the new setting blocks sign-in, he can revert it from the session he kept. He also tells the outside company the date in advance, so nobody tries to sign in with a password that afternoon.

Beyond SSH

SSH is one part of a Linux baseline. The CIS Benchmark also covers file permissions on sensitive files, unused filesystems, time synchronisation, audit logging and password rules for local accounts. Tomás lists five more items for a second round once the SSH changes settle, keeping each round small enough to check.

He also notes that automating the baseline with a configuration management tool would stop drift, but the trust lacks time to introduce one this year, so the weekly check script fills that role.

Worked example

After changes, the lab rerun shows all four servers compliant with zero deviations.

Synthetic case. Configurations are synthetic.

Errors and limits

Changing SSH settings without testing a second session can lock out the administrator.

Exercises

Synthesis

A short agreed baseline makes Linux server settings checkable and fixable.

Continue studying — chapter 12 of 30

← Chapter 11 (draft) · Course chapter index · Chapter 13 (draft) →