Caution
ALWAYS CHECK YOUR README BEFORE DOING ANYTHING HERE. I AM NOT RESPONSIBLE FOR IF YOU MESS UP YOUR VM.
Important
This was made during CyberPatriot XVII, this could be depricated, could not be, I would not know. I have not checked if this checklist applies correctly or not, and will not be updating accordingly.
Cyberpatriot Specific:
Check for Suspicious Users
Forensic Questions
General Security:
Update Via Commandline
Setup Firewall
SSH Settings
Lock Root Account
Change Login Changes
Audit Setup
Find Suspicious Files
Check for blacklisted programs
I recommend setting up a text file with all the users, and admins. Finding admins that shouldn't be admins will award you points!
There are several examples of what you can have. They can all differ. I will not provide help here.
sudo apt-get update && sudo apt-get upgrade
sudo apt-get ufw && sudo ufw enable
Goes in sshd_config
sudo if grep -qF 'PermitRootLogin' /etc/ssh/sshd_config; then sed -i 's/^.*PermitRootLogin.*$/PermitRootLogin no/' /etc/ssh/sshd_config; else echo 'PermitRootLogin no' >> /etc/ssh/sshd_config; fi
passwd -l root
sudo sed -i 's/PASS_MAX_DAYS.*$/PASS_MAX_DAYS 90/;s/PASS_MIN_DAYS.*$/PASS_MIN_DAYS 10/;s/PASS_WARN_AGE.*$/PASS_WARN_AGE 7/' /etc/login.defs
sudo apt-get install auditd && auditctl -e 1
Music/Video
sudo find /home/ -type f \( -name "*.mp3" -o -name "*.mp4" \)
Unauthorized packages
sudo find /home/ -type f \( -name "*.tar.gz" -o -name "*.tgz" -o -name "*.zip" -o -name "*.deb" \)
Important
Blacklisted Programsnmap zenmap apache2 nginx lighttpd wireshark tcpdump netcat-traditional nikto ophcrack
Command to check:
dppg -l | grep <package>