an image

КУРС GL550 - Enterprise Linux Security Administration


Този технически курс фокусира върху повишаване сигурността на машините работещи с Линукс. Курса покрива : създаване на firewall, правила за създаване на сигурни пароли и проверка на интегритета на файловете. Курса разглежда технологии за подобрение на сигурността, катоKerberos и SELinux. Специално внимание се обръща на сигурността на най-често използваните услуги. На края на курса, курсистите ще разбират потенциалните рискове за сигурността и как да проверяват и отстраняват рисковете за пробив в сигурността, както и да планират и инсталират услуги с повишена сигурност.

ИНФОРМАЦИЯ
an image

16 модула

Практически упражнения

5 дневен курс

сертифициран лектор

ИЗИСКВАНИЯ
an image

Този курс е предназначен за опитни Линуск системни администратори. Курсисте трябва да е преминал:GL120 "Linux Fundamentals", GL250 "Enterprise Linux Systems Administration", GL275 "Enterprise Linux Network Services" или да има опит покриващ тези курсове.

1.Security Concepts
1.Basic Security Principles
2.Linux Default Install
3.Installer Firewall Options
4.Post-Install Firewall
5.Minimization - Discovery
6.Service Discovery
7.Hardening
8.Security Concepts

Lab Tasks
1.Removing Packages Using RPM
2.Firewall Configuration
3.Process Discovery
4.Operation of the setuid() and capset() System Calls
5. Operation of the chroot() System Call
2.Scanning, Probing, and Mapping Vulnerabilities
1.The Security Environment
2.Stealth Reconnaissance
3.The WHOIS database
4.Interrogating DNS
5.Discovering Available Hosts and Apps
6.Reconnaissance with SNMP
7.Discovery of RPC Services
8.Enumerating NFS Shares
9.Nessus Insecurity Scanner
10.Configuring OpenVAS

Lab Tasks 1.NMAP
2.OpenVAS
3.Advanced NMAP Options
3.Password Security and PAM
1.Unix Passwords
2.Password Aging
3.Auditing Passwords
4.PAM Implementation, Management, and Control Statements
5.PAM Modules
6.pam_unix.so
7.pam_cracklib.so
8.pam_pwcheck.so
9.pam_env.so
10.pam_xauth.so
11.pam_tally.so
12.pam_wheel.so
13.pam_limits.so
14.pam_nologin.so
15.pam_deny.so
16.pam_securetty.so
17.pam_time.so
18.pam_access.so
19.pam_listfile.so
20.pam_lastlog.so
21.pam_warn.so
22.pam_console.so
23.pam_resmgr.so
24.pam_devperm.so

Lab Tasks
1.John the Ripper
2.Cracklib
3.Using pam_listfile to Implement Arbitrary ACLs
4.Using pam_limits to Restrict Simultaneous Logins
5.Using pam_nologin to Restrict Logins
6.Using pam_access to Restrict Logins
7.su & pam
4.Secure Network Time Protocol (NTP)
1.The Importance of Time
2.Time Measurements
3.Terms and Definitions
4.Synchronization Methods
5.NTP Evolution
6.Time Server Hierarchy
7.Operational Modes
8.NTP Clients
9.Configuring NTP Clients and Servers
10.Securing NTP
11.NTP Packet Integrity
12.Useful NTP Commands

Lab Tasks
1.Configuring and Securing NTP
2.Peering NTP With Multiple Systems
5.Kerberos Concepts
1.Common Security Problems
2.Account Proliferation
3.The Kerberos Solution
4.Kerberos History, Implementations, and Concepts
5.Kerberos Principals, Safeguards, and Components
6.Authentication Process
7.Identification Types
8.Logging In
9.Gaining and Using Privileges
6.Kerberos Components
1.Kerberos Components
2.KDC
3.Kerberos Principal Review
4.Kerberized Services Review
5.Kerberized Clients
6.KDC Server Daemons
7.Configuration Files
8.Utilities Overview
9.Kerberos SysV Init Scripts
7.Implementing Kerberos
1.Plan Topology
2.Plan Implementation
3.Kerberos 5 Client Software
4.Kerberos 5 Server Software
5.Synchronize Clocks
6.Creating and Configuring the Master KDC
7.KDC Logging
8.Kerberos Realm Defaults
9.Specifying [realms]
10.Specifying [domain_realm]
11.Allow Administrative Access
12.Create KDC Databases and Administrators
13.Install Keys for Services
14.Start Services
15.Add Host Principals
16.Add Common Service Principals
17.Configure Slave KDCs
18.Create Principals for Slaves
19.Define Slaves as KDCs
20.Copy Configuration to Slaves
21.Install Principals on Slaves
22.Synchronization of Database
23.Propagate Data to Slaves
24.Create Stash on Slaves
25.Start Slave Daemons
26.Client Configuration
27.Install krb5.conf on Clients
28.Client PAM Configuration
29.Install Client Host Keys

Lab Tasks
1.Implementing Kerberos
8.Administrating and Using Kerberos
1.Administrative Tasks
2.Key Tables
3.Managing Keytabs
4.Principals
5.Managing Principals
6.Principal Policy
7.Viewing Principals
8.Managing Policies
9.Overall Goals for Users
10.Signing Into Kerberos
11.Ticket types
12.Viewing Tickets
13.Removing Tickets
14.Passwords
15.Changing Passwords
16.Giving Others Access
17.Using Kerberized Services
18.Kerberized FTP
19.Enabling Kerberized Services
20.OpenSSH and Kerberos

Lab Tasks
1.Using Kerberized Clients
2.Forwarding Kerberos Tickets
3.OpenSSH with Kerberos
9.Securing The Filesystem
1.Filesystem Mount Options
2.NFS Properties
3.NFS Export Option
4.NFSv4 and GSSAPI Auth
5.Implementing NFSv4
6.File Encryption with GPG and OpenSSL
7.Linux Unified Key Setup (LUKS)

Lab Tasks
1.Securing Filesystems
2.Securing NFS
3.Implementing NFSv4
4.File Encryption With GPG
5.File Encryption With OpenSSL
6.LUKS-on-disk format Encrypted Filesystem
10.AIDE
1.Host Intrusion Detection
2.Using RPM as an HIDS
3.Introduction to AIDE
4.Concepts of AIDE
5.AIDE Installation
6.AIDE Policies
7.AIDE Usage

Lab Tasks
1.File Integrity Checking with RPM
2.File Integrity Checking with AIDE
11.Securing APACHE
1.Apache Overview
2.Default Configuration
3.Configuring CGI
4.Turning Off Unneeded modules
5.Configuration Delegation and Scope
6.ACL by IP Address
7.HTTP User Authentication
8.Standard Auth Modules
9.HTTP Digest Authentication
10.Authentication via SQL, LDAP, and Kerberos
11.Scrubbing HTTP Headers
12.Metering HTTP Bandwidth

Lab Tasks
1.Hardening Apache by Minimizing Loaded Modules
2.Scrubbing Apache & PHP version headers
3.Protecting Web Content
4.Using the suexec mechanism
5.Enabling SSO in Apache with mod_auth_kerb
12.Securing PostgreSQL
1.PostgreSQL Overview and Default Configuration
2.Configuring SSL
3.Client Authentication Basics
4.Authentication Methods
5.Advanced Authentication
6.Ident-based Authentication

Lab Tasks
1.Configure PostgreSQL
2.PostgreSQL with SSL
3.PostgreSQL with Kerberos Authentication
4.Securing PostgreSQL with Web Based Applications
13.Securing Email Systems
1.SMTP Overview
2.SMTP Implementations
3.Selecting an MTA
4.Security Considerations
5.Postfix Overview
6.Chrooting Postfix
7.Connections and Relays
8.SMTP AUTH & StartTLS/SSL
9.Secure Cyrus IMAP Config
10.Using GSSAPI/Kerberos Auth

Lab Tasks
1.Configuring Postfix
2.Postfix Network Configuration
3.Postfix In a Chrooted Environment
4.Postfix SMTP AUTH Configuration
5.Postfix STARTTLS Configuration
6.Configuring Cyrus IMAP
7.Kerberos with Postfix and Cyrus
14.SELinux Concepts
1.DAC vs. MAC
2.Shortcomings of Traditional Unix Security
3.SELinux Goals, Evolution, and Modes
4.Gathering Information
5.SELinux Virtual Filesystem
6.SELinux Contexts
7.Managing Contexts
8.SELinux Troubleshooting

Lab Tasks
1.Exploring SELinux Modes
2.SELinux Contexts in Action
15.SELinux Policy
1.The SELinux Policy
2.Choosing a Policy
3.Policy Layout
4.Tuning and Adapting Policy
5.Booleans
6.Managing Booleans
7.Managing File Contexts
8.Managing Port Contexts
9.Managing SELinux graphically
10.Examining Policy

Lab Tasks
1.Managing SELinux Booleans [RHEL]
2.Creating Policy with Audit2allow [RHEL]
3.Creating & Compiling Policy from Source [RHEL]
16.Accountability with Kernel auditd
1.Accountability and Auditing
2.Simple Audit Tools
3.Kernel-Level Auditing
4.Configuring the Audit Daemon
5.Controlling Kernel Audit System
6.Creating Audit Rules
7.Searching Audit Logs
8.Generating Audit Log Reports
9.Audit Log Analysis

Lab Tasks
1.Auditing Login/Logout
2.Auditing File Access
3.Auditing Command Execution
Дистрибуции

Red Hat Enterprise Linux 7
Аудитория
Системни Архитекти. Напреднали Линукс системни администратори с поне 3 години опит. Специалисти по сигурността.
КОНТАКТИ
an image
Global IT Solutions
гр. София 1606
бул. Ген. Тотлебен 53-55
Email: office@gits.bg

Тел.: +359 888 522 643
+359 878 522 643
website: www.gits.bg