Startseite

GL550

Kurstitel: 

Enterprise Linux Security Administration

Untertitel: 

Linux Server sicher betreiben

Beschreibung: 

In diesem Kurs dreht sich alles um Security. Linux bietet viele Möglichkeiten um ein System abzusichern. Grundlegende Sicherheitsaspekte wie packet filtering, password policies und file integrity checking werden behandelt. Erfahren Sie wie mit Kerberos oder SELinux die Sicherheit weiter erhöht wird. Besondere Beachtung wird der Absicherung von beliebten und gebräuchlichen network services geschenkt. Am Ende des Kurses sind Sie sich über die potentiellen Gefahren und Angreifer bewusst, wisssen wie Sie ein Linux-System auf Sicherheitslücken prüfen und beheben können, sodass sicherer Betrieb garantiert ist. Die Kursunterlagen sind von hoher Qualität und für Red Hat Enterprise Linux / CentOS, SuSE Linux Enterprise und Ubuntu geschrieben.

Zielgruppe: 

Systemadministratoren und Security-Spezialisten.

Kursziel: 

Sie lernen die aktuellen Sicherheitsprobleme im IT-Bereich kennen und wissen, wie Sie ihre Linux-Server und Workstations dagegen schützen können. Instandhaltung und Monitoring der Sicherheit, sowie das Umgehen mit Sicherheitslücken im System sind Ihnen nach dem Kurs geläufig.

Vorkenntnisse: 

Gute Kenntnisse im Umgang und Administration mit Linux. Kurse "Entrprise Linux Fundamentals" und "Enterprise Linux System Administration" oder gleichwertige Kenntnisse.

Kursdetails
Preis (CHF): 
3650
Dauer (Tage): 
5

Inhalt

  1. Security Concepts
    1. Basic Security Principles

    2. Linux Default Install

    3. Installer Firewall Options

    4. Post-Install Firewall

    5. Minimization - Discovery

    6. Service Discovery

    7. Hardening

    8. Security Concepts

    Lab Tasks

    1. Removing Packages Using RPM

    2. Firewall Configuration

    3. Process Discovery

    4. Operation of the setuid() and capset() System Calls

    5. Operation of the chroot() System Call

  2. Scanning, Probing, and Mapping Vulnerabilities
    1. The Security Environment

    2. Stealth Reconnaissance

    3. The WHOIS database

    4. Interrogating DNS

    5. Discovering Available Hosts and Apps

    6. Reconnaissance with SNMP

    7. Discovery of RPC Services

    8. Enumerating NFS Shares

    9. Nessus Insecurity Scanner

    10. Configuring OpenVAS

    Lab Tasks

    1. NMAP

    2. OpenVAS

    3. Advanced NMAP Options

  3. Password Security and PAM
    1. Unix Passwords

    2. Password Aging

    3. Auditing Passwords

    4. PAM Implementation, Management, and Control Statements

    5. PAM Modules

    6. pam_unix.so

    7. pam_cracklib.so

    8. pam_pwcheck.so

    9. pam_env.so

    10. pam_xauth.so

    11. pam_tally.so

    12. pam_wheel.so

    13. pam_limits.so

    14. pam_nologin.so

    15. pam_deny.so

    16. pam_securetty.so

    17. pam_time.so

    18. pam_access.so

    19. pam_listfile.so

    20. pam_lastlog.so

    21. pam_warn.so

    22. pam_console.so

    23. pam_resmgr.so

    24. pam_devperm.so

    Lab Tasks

    1. John the Ripper

    2. Cracklib

    3. Using pam_listfile to Implement Arbitrary ACLs

    4. Using pam_limits to Restrict Simultaneous Logins

    5. Using pam_nologin to Restrict Logins

    6. Using pam_access to Restrict Logins

    7. su & pam

  4. Secure Network Time Protocol (NTP)
    1. The Importance of Time

    2. Time Measurements

    3. Terms and Definitions

    4. Synchronization Methods

    5. NTP Evolution

    6. Time Server Hierarchy

    7. Operational Modes

    8. NTP Clients

    9. Configuring NTP Clients and Servers

    10. Securing NTP

    11. NTP Packet Integrity

    12. Useful NTP Commands

    Lab Tasks

    1. Configuring and Securing NTP

    2. Peering NTP With Multiple Systems

  5. Kerberos Concepts
    1. Common Security Problems

    2. Account Proliferation

    3. The Kerberos Solution

    4. Kerberos History, Implementations, and Concepts

    5. Kerberos Principals, Safeguards, and Components

    6. Authentication Process

    7. Identification Types

    8. Logging In

    9. Gaining and Using Privileges

  6. Kerberos Components
    1. Kerberos Components

    2. KDC

    3. Kerberos Principal Review

    4. Kerberized Services Review

    5. Kerberized Clients

    6. KDC Server Daemons

    7. Configuration Files

    8. Utilities Overview

    9. Kerberos SysV Init Scripts

  7. Implementing Kerberos
    1. Plan Topology

    2. Plan Implementation

    3. Kerberos 5 Client Software

    4. Kerberos 5 Server Software

    5. Synchronize Clocks

    6. Creating and Configuring the Master KDC

    7. KDC Logging

    8. Kerberos Realm Defaults

    9. Specifying [realms]

    10. Specifying [domain_realm]

    11. Allow Administrative Access

    12. Create KDC Databases and Administrators

    13. Install Keys for Services

    14. Start Services

    15. Add Host Principals

    16. Add Common Service Principals

    17. Configure Slave KDCs

    18. Create Principals for Slaves

    19. Define Slaves as KDCs

    20. Copy Configuration to Slaves

    21. Install Principals on Slaves

    22. Synchronization of Database

    23. Propagate Data to Slaves

    24. Create Stash on Slaves

    25. Start Slave Daemons

    26. Client Configuration

    27. Install krb5.conf on Clients

    28. Client PAM Configuration

    29. Install Client Host Keys

    Lab Tasks

    1. Implementing Kerberos

  8. Administrating and Using Kerberos
    1. Administrative Tasks

    2. Key Tables

    3. Managing Keytabs

    4. Principals

    5. Managing Principals

    6. Principal Policy

    7. Viewing Principals

    8. Managing Policies

    9. Overall Goals for Users

    10. Signing Into Kerberos

    11. Ticket types

    12. Viewing Tickets

    13. Removing Tickets

    14. Passwords

    15. Changing Passwords

    16. Giving Others Access

    17. Using Kerberized Services

    18. Kerberized FTP

    19. Enabling Kerberized Services

    20. OpenSSH and Kerberos

    Lab Tasks

    1. Using Kerberized Clients

    2. Forwarding Kerberos Tickets

    3. OpenSSH with Kerberos

  9. Securing The Filesystem
    1. Filesystem Mount Options

    2. NFS Properties

    3. NFS Export Option

    4. NFSv4 and GSSAPI Auth

    5. Implementing NFSv4

    6. File Encryption with GPG and OpenSSL

    7. Linux Unified Key Setup (LUKS)

    Lab Tasks

    1. Securing Filesystems

    2. Securing NFS

    3. Implementing NFSv4

    4. File Encryption With GPG

    5. File Encryption With OpenSSL

    6. LUKS-on-disk format Encrypted Filesystem

  10. AIDE
    1. Host Intrusion Detection

    2. Using RPM as an HIDS

    3. Introduction to AIDE

    4. Concepts of AIDE

    5. AIDE Installation

    6. AIDE Policies

    7. AIDE Usage

    Lab Tasks

    1. File Integrity Checking with RPM

    2. File Integrity Checking with AIDE

  11. Securing APACHE
    1. Apache Overview

    2. Default Configuration

    3. Configuring CGI

    4. Turning Off Unneeded modules

    5. Configuration Delegation and Scope

    6. ACL by IP Address

    7. HTTP User Authentication

    8. Standard Auth Modules

    9. HTTP Digest Authentication

    10. Authentication via SQL, LDAP, and Kerberos

    11. Scrubbing HTTP Headers

    12. Metering HTTP Bandwidth

    Lab Tasks

    1. Hardening Apache by Minimizing Loaded Modules

    2. Scrubbing Apache & PHP version headers

    3. Protecting Web Content

    4. Using the suexec mechanism

    5. Enabling SSO in Apache with mod_auth_kerb

  12. Securing PostgreSQL
    1. PostgreSQL Overview and Default Configuration

    2. Configuring SSL

    3. Client Authentication Basics

    4. Authentication Methods

    5. Advanced Authentication

    6. Ident-based Authentication

    Lab Tasks

    1. Configure PostgreSQL

    2. PostgreSQL with SSL

    3. PostgreSQL with Kerberos Authentication

    4. Securing PostgreSQL with Web Based Applications

  13. Securing Email Systems
    1. SMTP Overview

    2. SMTP Implementations

    3. Selecting an MTA

    4. Security Considerations

    5. Postfix Overview

    6. Chrooting Postfix

    7. Connections and Relays

    8. SMTP AUTH & StartTLS/SSL

    9. Secure Cyrus IMAP Config

    10. Using GSSAPI/Kerberos Auth

    Lab Tasks

    1. Configuring Postfix

    2. Postfix Network Configuration

    3. Postfix In a Chrooted Environment

    4. Postfix SMTP AUTH Configuration

    5. Postfix STARTTLS Configuration

    6. Configuring Cyrus IMAP

    7. Kerberos with Postfix and Cyrus

  14. SELinux Concepts
    1. DAC vs. MAC

    2. Shortcomings of Traditional Unix Security

    3. SELinux Goals, Evolution, and Modes

    4. Gathering Information

    5. SELinux Virtual Filesystem

    6. SELinux Contexts

    7. Managing Contexts

    8. SELinux Troubleshooting

    Lab Tasks

    1. Exploring SELinux Modes

    2. SELinux Contexts in Action

  15. SELinux Policy
    1. The SELinux Policy

    2. Choosing a Policy

    3. Policy Layout

    4. Tuning and Adapting Policy

    5. Booleans

    6. Managing Booleans

    7. Managing File Contexts

    8. Managing Port Contexts

    9. Managing SELinux graphically

    10. Examining Policy

    Lab Tasks

    1. Managing SELinux Booleans [RHEL]

    2. Creating Policy with Audit2allow [RHEL]

    3. Creating & Compiling Policy from Source [RHEL]

  16. Accountability with Kernel auditd
    1. Accountability and Auditing

    2. Simple Audit Tools

    3. Kernel-Level Auditing

    4. Configuring the Audit Daemon

    5. Controlling Kernel Audit System

    6. Creating Audit Rules

    7. Searching Audit Logs

    8. Generating Audit Log Reports

    9. Audit Log Analysis

    Lab Tasks

    1. Auditing Login/Logout

    2. Auditing File Access

    3. Auditing Command Execution

X
Gebe Deine Email Adresse ein.
Gebe das Passwort ein welches zu Deiner Email gehört.
Laden