"Although firewalls stop most Internet-based attacks, they cannot stop all outside attackes, and they are even less effective for attacks from within a corporation. The bottom line is that some atacks inevitably will reach victim hosts within the firm." [Corporate Computer and Network Security, Raymond Panko, Prentice-Hall, 2004, pg. 216.]

In this asssignment, you will gain some experience in hardening Windows and Linux computers. This will include ensuring that unnecessary services are turned off, managing users and groups, managing access permissions, and inspecting the computer logs.

You are going to be connecting to our SAIL (Security and Assurance of Information Lab) Lab through a VPN tunnel. You will also be using a program called RealVNC (http://www.realvnc.com/) that will allow you to remotely connect and control another computer.

Pre-assignment:

1. review the following documents about securing Windows hosts:
   • Securing Windows Computers and Networks
   • Improve Windows Servers Security
   • Tips for Securing Windows 2000 Server
   • Windows Security Check List
   • Windows 2000 Installation Security Check List
   • LAB 5: Securing Windows 2000
   • LAB 5a: Securing Windows using Baseline
   • Microsoft Security Guidance Center
   • Microsoft Security Summit
   • Microsoft Security Guidance Kit v1.0, English
2. Create a new standard user with your first initial and last name as the username (e.g. wsummers) on either Sail1, Sail2, or Sail3 (Windows host)
   • Add your user to the PowerUser Group
3. review the following documents about securing Linux hosts:
   • Securing Linux/Unix Computers and Networks
   • Lab 9 – Securing Linux Systems
   • Lab 10 – Troubleshooting Linux and Apache Systems
   • Secure Linux
   • Open BSD
   • Free BSD
4. You will need to connect to Sail6-10 and then to the Linux virtual machine on Sail6-10 with ssh (secure shell). If you have not already downloaded a ssh client, you can get putty
   Instructions for use of putty is found at Secure Telnet and FTP using Putty
5. Log into either Sail6, Sail7, Sail8, Sail9, or Sail10 (Windows XP) using the account you were given in the Lab Discussion Group in WebCT. You can log into the Linux virtual machine running through Virtual PC (10.0.3.x2 where x is the Sail number) by one of the following three methods (usernames and passwords are the same as with the Windows XP admin accounts):
• Run putty to connect to the Linux virtual machine using ssh with the apppropriate IP address.
• To use the GUI in the virtual machine, you can do the following:
  1. Connect using putty as above.
  2. Run vncserver from the Linux command line (Note down the number (y) after the RedHat-Sailx: (these are sequential numbers depending on the number of sessions running)
  3. From the Windows XP desktop (native), run the Vncviewer and connect to 10.0.3.x2:y)
• Find the Virtual PC icon on the Windows XP desktop (native) and connect to the RH Linux Service that is running. Although this is the easiest, there are problems with the GUI working properly.
6. Explore the systems

Assignment - PART I: Windows

1. Host Hardening, Installation, and Patching
   1. Log onto the Windows computer with your account
   2. Which computer are you logged into for this assignment?
   3. Identify the lastest Service Pack installed on the computer. How did you find it?
   4. Does this computer need "patch updating"? How would you apply the updates?
2. Turning Off Unnecessary Services
1. Log onto the Windows computer with your account and find the list of Services in the Computer Management MMC
2. Is the Computer Browser service running? What does it do?
3. Is the Telnet service running? What does it do?
4. Is the Windows Firewall service running? What does it do?
5. Is the Remote Assistance service running? What does it do? What dependencies does this service have?
6. How would you turn services on or off?
7. Run netstat -a from the command line. What services are running?
8. (Run netstat -h to find other options for netstat)
9. How else can you find out what programs are running in Windows?
10. You discover a process running that is not listed in Services or in the Task Manager. How would you kill(terminate) the process?
11. Briefly discuss these three ways to determine what services/programs are running in Windows.
3. Managing Users and Groups
1. Log onto the Windows computer with your account and find the list of Users and Groups in the Computer Management MMC
2. Check to make sure that the Guest account is disabled
3. Is the Administrator account enabled? What Groups is the Administrator account in?
4. What groups is your account in? Add yourself to the BackUp Operators group.
5. What are the permissions on your userid's folder? If Everyone has permission, remove it.
4. Event Logging
1. Log onto the Windows computer with your account and find the Event Logs in the Computer Management MMC
2. Discuss the differences between the three event logs in Windows
5. Log off the Windows computer

Assignment - PART II: Linux

1. Log onto the Linux computer with your account
2. find the list of services running by typing ps aux | more
3. find the list of services that you are running by typing ps aux | grep username where username is your username
4. Run netstat -a | more from the command line.
5. (Run netstat -h to find other options for netstat)
6. How would you kill(terminate) a process?
7. Briefly discuss these two ways to determine what services/programs are running in Linux.

1. Log onto the Linux computer with your account and find the list of users and groups in /etc/passwd and /etc/group.
2. Note that the passwords are not displayed in passwd. They are stored in /etc/shadow. You need to switch to the root account to view the encrypted passwords in /etc/shadow [This is done by typing su at the command prompt and then entered the administrator password.]
3. What accounts are in the group netsecurity?
4. What groups is your account in?
5. What are the permissions on your userid's /home folder?

1. Log onto the Linux computer with your account
2. Find out who else is on the computer using who and finger [log file /var/run/utmp]
3. Use last to track who has logged in and out of the system [log file /var/log/wtmp] - When was the system last rebooted?
4. Log in as root and view /var/log/secure to track access and authentication information

1. Switch to the root account
2. View the access_log file in /etc/httpd/logs
3. View the error_log file in /etc/httpd/logs
4. /etc/httpd/conf contains the configuration file httpd.conf for Apache

Post-assignment: Answer the following questions -

• Compare your experiences in securing Windows and Linux.