Securing Linux and Unix Training
Securing Linux and Unix Training Course Hands-on
Securing Linux and Unix Training course provides in-depth coverage of Linux and Unix security issues that includes specific configuration guidance and practical, real-world examples, tips, and tricks. We examine how to mitigate or eliminate general problems that apply to all Unix-like operating systems, including vulnerabilities in the password authentication system, file system, virtual memory system, and applications that commonly run on Linux and Unix.
The Securing Linux and Unix Training course will teach you the skills to use freely available tools to handle security issues, including SSH, AIDE, sudo, lsof, and many others. SANS’ practical approach uses hand-on exercises every day to ensure that you will be to use these tools as soon as you return to work. We will also put these tools to work in a special section that covers simple forensic techniques for investigating compromised systems.
• Significantly reduce the number of vulnerabilities in the average Linux/Unix system by disabling unnecessary services.
• Protect your systems from buffer overflows, denial-of-service, and physical access attacks by leveraging OS configuration settings.
• Configure host-based firewalls to block attacks from outside.
• Deploy SSH to protect administrative sessions, and leverage SSH functionality to securely automate routine administrative tasks.
• Use sudo to control and monitor administrative access.
• Create a centralized logging infrastructure with Syslog-NG, and deploy log monitoring tools to scan for significant events
• Use SELinux to effectively isolate compromised applications from harming other system services.
• Securely configure common Internet-facing applications such as Apache and BIND.
• Investigate compromised Linux/Unix systems with Sleuthkit, lsof, and other open-source tools.
• Understand attacker rootkits and how to detect them with AIDE and rkhunter/chkrootkit.
With onsite Training, courses can be scheduled on a date that is convenient for you, and because they can be scheduled at your location, you don’t incur travel costs and students won’t be away from home. Onsite classes can also be tailored to meet your needs. You might shorten a 5-day class into a 3-day class, or combine portions of several related courses into a single course, or have the instructor vary the emphasis of topics depending on your staff’s and site’s requirements.
1. Hardening Linux/Unix Systems, Part 1
Memory Attacks and Overflows
Stack and Heap Overflows
Format String Attacks
Minimization vs. Patching
systemd vs init
Session Hijacking Exploits
The Argument For Encryption
IP Tables and Other Alternatives
Simple Single-Host Firewalls
Managing and Automating Rule Updates
2. Hardening Linux/Unix Systems, Part 2
Rootkits and Malicious Software
Backdoors and Rootkits
chkrootkit and rkhunter
File Integrity Assessment
Overview of AIDE
Physical Attacks and Defenses
Single User Mode Security
Boot Loader Passwords
User Access Controls
Password Threats and Defenses
User Access Controls
Root Access Control With Sudo
Features and Common Uses
Known Issues and Work-Arounds
Kernel Tuning For Security
System Resource Limits
Restricting Core Files
3. Hardening Linux/Unix Systems, Part 3
Automating Tasks With SSH
Why and How
Public Key Authentication
ssh-agent and Agent Forwarding
AIDE Via SSH
Tools and Scripts
Linux/Unix Logging Overview
Reverse Tunneling Issues
Centralized Logging With Syslog-NG
Why You Care
Hints and Hacks for Tunneling Log Data
Log Analysis Tools and Strategies
4. Application Security, Part 1
chroot() for Application Security
What is chroot()?
How Do You chroot()?
Known Security Issues
The SCP-Only Shell
What It Is and How It Works
Configuring chroot() directory
Automounter Hacks for Large-Scale Deployments
Overview of Functionality
Navigation and Command Interface
Troubleshooting Common Issues
SELinux and the Reference Policy
Tools and Prerequisites
Creating and Loading an Initial Policy
Testing and Refining Your Policy
Deploying Policy Files
5. Application Security, Part 2
Common Security Issues
Configuration for Security
Running BIND chroot()ed
Generating Keys and Signing Zones
Secure Directory Configuration
Web Application Firewalls with mod_security
Introduction to Common Configurations
Dependencies and Prerequisites
Installation and Debugging
6. Digital Forensics for Linux/Unix
The Sleuth Kit
lsof and Other Critical OS Commands
Forensic Preparation and Best Practices
Basic Forensic Principles
Importance of Policy
Building a Desktop Analysis Laboratory
Incident Response and Evidence Acquisition
Incident Response Process
Vital Investigation Tools
Taking a Live System Snapshot
Creating Bit Images
File System Basics
MAC Times and Timeline Analysis
Recovering Deleted Files
Searching Unallocated Space
Critical Elements of a Report
Whether you are looking for general information or have a specific question, we want to help
Request More Information