Original URL: https://trevorsmale.github.io/techblog/post/psc2/

Intro 👋

This week covers more implementation of Secure Technical Implementation Guidelines and we look at LDAP (Light Directory Access Protocol) Installation and Setup. This unit also introduces foundational knowledge on analyzing, configuring, and hardening networking components using tools and frameworks like STIGs, OpenSCAP, and DNS configurations.

`Discussion Post 1`

Preface

There are 401 stigs for RHEL 9. If you filter in your stig viewer for sysctl there are 33 (mostly network focused), ssh - 39, and network - 58. Now there are some overlaps between those, but review them and answer these questions

Question 1. As systems engineers why are we focused on protecting the network portion of our server builds?

Answer

Most attacks come through the network
Misconfigured services can expose critical ports.
Data in transit is vulnerable without proper encryption and access control.
External exposure often increases the attack surface for things like brute-force attempts, malware injection, or unauthorized access.

Question 2. Why is it important to understand all the possible ingress points to our servers that exist?

Answer

Ingress points = potential paths of attack. Unexpected ingress can be exploited.
Zero-trust environments rely on strict control and observability of ingress.
Compliance and auditing require accurate records of what’s accessible.

Question 3. Why is it so important to understand the behaviors of processes that are connecting on those ingress points?

Answer

Security posture depends on visibility
Attackers scan for overlooked vulnerabilities
Automation tools (e.g., Ansible, Terraform) can introduce new ingress points unknowingly during updates.
Incident response is much faster and more effective when engineers understand the network surface.

`Discussion Post 2`

Intro to the scenario[^3]

Read this: https://ciq.com/blog/demystifying-and- troubleshooting-name-resolution-in-rocky-linux/ or similar blogs on DNS and host file configurations.

Question

What is the significance of the nsswitch.conf file?

Answer

The /etc/nsswitch.conf file controls the order in which name resolution methods are use

Question

What are security problems associated with DNS and common exploits? (May have to look into some more blogs or posts for this)

Answer

Core issues with DNS:

Traditional DNS can be spoofed due to a lack of built in verification., Queries and Responses are sent in plaintext making confidentiality an issue., No way to validate the source of the DNS data., Centralized, single point of failure.,

Common Exploits:

Spoofing (False record injection), Flooding (Overwhelming the resolver), Tunneling (Query based Exfiltration), Hijacking (Modifying domain registration data), Typosquatting (Registering similar domains) New phrase for me

Definitions

sysctl Linux interface to modify kernel parameters at runtime for system performance and security.
nsswitch.conf Configuration file controlling the order of name service lookups (e.g., DNS, files, LDAP).
DNS: Domain Name System translates human-readable domain names into IP addresses.
Openscap Open-source framework for automated vulnerability scanning, compliance checking, and security auditing.
CIS Benchmarks Prescriptive security configuration guidelines provided by the Center for Internet Security.
ss/netstat Command-line tools to display network sockets, connections, and statistics on Unix-like systems.
tcpdump Command-line packet analyzer for capturing and inspecting network traffic in real-time.
ngrep Network packet analyzer like grep, allowing pattern matching on network traffic payloads.

Lab 🧪

IP Forwarding

Question

Does this system appear to be set to forward? Why or why not?

Answer

No. All relevant net.ipv4.conf.*.forwarding and net.ipv4.ip_forward values are set to 0.

Martians

Question

What are martians and is this system allowing them?

Answer

Martians are packets with invalid or bogus source/destination addresses. This system is not logging them (log_martians = 0), but whether they’re allowed depends on other rules. Logging is disabled.

Kernel Panic Behavior

Question

How does this system handle kernel panics?

Answer

kernel.panic = 0 means the system won’t auto-reboot on panic. panic_on_oops = 1 indicates it will panic on kernel oops errors. Other panic triggers are mostly disabled.