Day 3 Capstone
Linux
This section uses the Alma VM. Windows Terminal on your Windows VM has a saved session for this machine. Remember that you may need to use the sudo command to receive root privileges for some of your commands. The student user has sudo permissions.
Permissions
There is one file somewhere under the /usr directory which has “world execute” as its only permission flag. What is the full path to this file? Include all slashes, directory names and the filename. Remember that Linux filenames are case-sensitive!
Hints
You can use the find command to locate files.
Remember to use the -perm flag and specify the starting directory of /usr
sudo find /usr -perm 001 should give you the file path.
File Contents
What is the complete content of the file you found in the question above? The last character of your answer should be an exclamation point.
Hints
Which command lets you view the contents of a file?
Use this command to “concatenate” the file to the screen.
Simply use cat and the filename obtained in the question above. Use sudo if you need higher privileges.
OS Version
What is the release number of the Linux distribution running on this host? Your answer will be two numbers separated by dots, like this: x.y.
Hints
Alma no longer uses the lsb_release command
There's a file in the /etc directory with information about the OS release
There's a VERSION_ID property in the file with just the version number
Services
The Alma host has an SMTP server listening on TCP port 25. What IPv4 address is the SMTP service on the ALMA host listening on?
Hints
Is there a command to view listening ports?
Listening ports will have a state of LISTEN.
Ports assigned to an IPv4 address will have a proto of tcp. IPv6 will have a proto value of tcp6.
TCP Ports
What is the lowest TCP port number listening on any interface on this system? Your answer should be a number.
Hints
What command lets you view listening ports?
Use the flags for numeric output and to show only TCP ports.
Kernel Settings
What is the numeric setting for address space layout randomization (ASLR) on the Alma host? Your answer will be an integer.
Hints
The setting for ASLR is called randomize_va_space.
It's in the kernel settings.
sysctl is useful for querying kernel settings, and the /proc/sys/ pseudo-filesystem also contains the settings.
Failed Logons
What IP address was the source for the earliest failed logon attempt for the user named “trip” in the /var/log/secure.CTF file?
Hints
This file is an archived version of a secure log, which tracks things like authentication events.
grep is a good tool for searching logs.
IP addresses are included in many entries in the log.
Systemd Services
How many systemd unit files with “.service” in their name are currently in the “enabled” state?
Hints
The systemctl command can list all unit files.
The flag for that is list-unit-files
Using grep on the output would let you find only lines with “.service” and “enabled” on them.
NFS
How many file systems are being exported by this host via NFS?
Hints
Is there a command to view exported file systems?
You could also view the configuration file for NFS exports.
The command sudo exportfs will show you the currently exported file systems.
NFS Permissions
What subnet is allowed to mount the NFS exports from this host? Your answer should be in the form of a network address and subnet mask in “slash” notation, i.e. 1.2.3.4/16
Hints
The answer is in the output from the previous question.
Each entry in the “/etc/exports” file can have at least one network definition to allow access to that share.
The correct answer starts with "10" and ends with "/24"
Permissions - SUID
One file in the /usr/lib directory has the SUID bit set. What is the full path of the file?
Hints
You'll need to "find" the file in the /usr/lib directory.
Remember that SUID has a value of 4, and SGID has a value of 2.
Be careful using the "-perm" flag to find the file! Don't do an exact match.
File Ownership
What is the name of the group which owns the /var/log/lastlog file?
Hints
The ls command lists files and information about them.
You'll need to do a long listing.
Long listings use the -l flag.
Octal Permissions
What is the three-digit octal representation of the permissions on the /var/log/lastlog file? Your answer will be a three-digit integer.
Hints
The ls command lists files and information about them.
You'll need to do a long listing and add up the values.
The stat command also returns permission information.
Auditd
How many auditd rules are operating on the Alma VM? Your answer should be an integer.
Hints
You'll need to list the active rules on the system.
There is a command which is used to control auditd that will be useful.
It's called auditctl.
User Account Defaults
What is the default maximum password age in days which will be applied to new accounts created on the Alma VM? Your answer will be an integer.
Hints
While the maximum password age for existing users is in /etc/shadow, the default settings for new users are stored elsewhere.
There is a file in the /etc directory with default values for new login accounts.
It has a value called PASS_MAX_DAYS.
Local Groups
How many total groups are there on the Alma VM? Your answer will be an integer.
Hints
There's a file in the /etc directory with the information you need.
Its name is obvious when you think of it.
The word count (wc) command is good for counting lines in a file.
User Accounts
One of the users on the Alma Linux server has some suspicious settings in the /etc/passwd file. What is the username with the unusual settings?
Hints
Look at all the columns in the passwd file.
Pay special attention to the user ID column.
Is there a user with a repeated user ID?
Look for users with an id equal to zero.
Password Hashes
What is the password hash of the account identified in the question above? Enter the entire hash and salt. It will start with "6" and end at the next colon. Do not enter any of the colons from the shadow file.
Hints
The hash is the second column in the shadow file.
It ends with the characters "adZ1"
Be sure to leave off any colons or password settings from the shadow file.