diff --git a/00-mini-hack-overview.md b/00-mini-hack-overview.md new file mode 100644 --- /dev/null +++ b/00-mini-hack-overview.md @@ -0,0 +1,172 @@ +# Mini-Hack Quick Start Guide + +## Network Topology + +``` +External Network (172.20.0.0/16) +├── Kali External: 172.20.2 +├── Router External: 172.20..1 +└── Scoring Server: 172.20.1 + +Internal Network (192.168..0/24) +├── Router Internal: 192.168..1 +├── Ubuntu Web Server: 192.168..2 +└── Kali Internal: 192.168..100 +``` + +**Your team number** is randomly assigned on each deployment (e.g., 213, 195, etc.) + +## Objectives (Turn Lights Green) + +1. ✅ Router online - responds to ping on external IP +2. ✅ Web server accessible - HTTP traffic routes through router to internal server +3. ✅ Service running - Apache returns content from internal web server + +## Step-by-Step Checklist + +### 1. Find Your Team Number + +**On Kali External**: +```bash +ip addr show # Look for 172.20.X +# If you see 172.20.2, your team number is 2 +# Check scoreboard at http://172.20.1 for confirmation +``` + +### 2. Configure Router + +**Login to MikroTik** (via ProxMox console or SSH): +```bash +# Default login +admin + + +# Set a password when prompted + +``` + +**Assign IP addresses**: +```bash +# External interface +/ip address add address=172.20..1/16 interface=ether3 + +# Internal interface +/ip address add address=192.168..1/24 interface=ether4 + +# Verify +/ip address print +``` + +**Or use Web GUI**: `http://172.20..1:8080` +- Login: `admin` / `` +- Go to **Quick Set** +- Enter external IP: `172.20..1/16` +- Enter internal IP: `192.168..1/24` +- ✅ **Check "Enable NAT"** (required!) +- Click **Apply Configuration** + +### 3. Configure Ubuntu Web Server + +**Assign static IP**: +```bash +sudo nano /etc/netplan/01-network-manager-all.yaml +``` + +```yaml +network: + version: 2 + ethernets: + ens18: + addresses: + - 192.168..2/24 + routes: + - to: default + via: 192.168..1 +``` + +```bash +sudo netplan apply +ip addr show # Verify IP +ping 192.168..1 # Test router connectivity +``` + +**Start Apache**: +```bash +sudo systemctl restart apache2 +sudo systemctl status apache2 # Should show "active (running)" +``` + +**Test locally**: +```bash +curl http://192.168..2 # Should return HTML +``` + +### 4. Configure Port Forwarding (Router) + +**Web GUI Method** (recommended): +``` +http://172.20..1:8080 +``` + +1. Go to **Quick Set** → **Port Mapping** +2. Click **New** + - Name: `www-tcp` + - Protocol: `TCP` + - Port: `80` + - Forward To: `192.168..2` + - Port: `80` +3. Click **OK** +4. Repeat for UDP: + - Name: `www-udp` + - Protocol: `UDP` + - Port: `80` + - Forward To: `192.168..2` + - Port: `80` + +### 5. Test From External Network + +**On Kali External**: +```bash +ping 172.20..1 # Router should respond +curl http://172.20..1 # Should show web content from internal server +``` + +**Check scoreboard**: `http://172.20.1` + +All lights should be green! + +## Quick Troubleshooting + +| Problem | Check | +|---------|-------| +| Router not pingable | Verify IP on ether3: `/ip address print` | +| Web not accessible | 1. Is Apache running? 2. Did you enable NAT? 3. Port forwarding rules exist? | +| Internal server can't reach router | Check internal IP on ether4, verify gateway in netplan | +| Lights still red | Wait 30 seconds for scoring refresh, check exact IPs match topology | + +## Configuration Files Reference + +**Router**: Web GUI at `http://172.20..1:8080` or CLI via console + +**Ubuntu Web Server**: +- Network: `/etc/netplan/01-network-manager-all.yaml` +- Apache: `sudo systemctl restart apache2` +- Website content: `/var/www/html/` + +**Kali Machines**: For testing only, no configuration needed + +## Common Mistakes + +❌ Forgot to enable NAT on router +❌ Port forwarding only has TCP rule (need UDP too) +❌ Wrong team number in IP addresses +❌ Apache not started on Ubuntu +❌ Netplan syntax error (YAML is whitespace-sensitive) +❌ Router interface names wrong (check with `interface print`) + +## Time-Saving Tips + +1. Use **web GUI for router** - faster than CLI for NAT/port forwarding +2. Copy/paste team number once you know it - avoid typos +3. Test each step before moving on (ping, curl, status checks) +4. If stuck, verify each light's requirement on scoreboard diff --git a/01-services-overview.md b/01-services-overview.md new file mode 100644 --- /dev/null +++ b/01-services-overview.md @@ -0,0 +1,59 @@ +# Linux Services - General Approach + +## Service Configuration Checklist + +When encountering any new service: + +1. **Understand what it does** - Don't rush into clicking buttons. Read documentation first. Even 5 minutes of research saves time later. + +2. **Locate configuration files** - Services usually have config files in `/etc`. Files can be singular or multiple across different locations (main config + user-specific). + +3. **Backup before changes** - Always copy config files before modifying: + ```bash + sudo cp /etc/service/config /etc/service/config.bak + ``` + +4. **Restart after changes** - Most services require restart for changes to take effect: + ```bash + sudo systemctl restart + ``` + Don't restart the entire computer - restart just the service. + +5. **Check service status** - Verify if service is running: + ```bash + systemctl status + ``` + +6. **Dependencies matter** - Some services rely on others. Changing one may require restarting dependent services. + +## Service Management Commands + +Check service status (no sudo needed): +```bash +systemctl status +``` + +Start a service: +```bash +sudo systemctl start +``` + +Stop a service: +```bash +sudo systemctl stop +``` + +Restart a service: +```bash +sudo systemctl restart +``` + +Enable service to start on boot: +```bash +sudo systemctl enable +``` + +Check if service is enabled: +```bash +systemctl is-enabled +``` diff --git a/02-apache-web-service.md b/02-apache-web-service.md new file mode 100644 --- /dev/null +++ b/02-apache-web-service.md @@ -0,0 +1,78 @@ +# Apache Web Service + +## Service Name +- `apache2` (Ubuntu/Debian) +- `httpd` (CentOS/RHEL) + +## Check Service Status +```bash +systemctl status apache2 # Ubuntu +systemctl status httpd # CentOS +``` + +## Configuration Locations + +Main config: `/etc/apache2/` (Ubuntu) or `/etc/httpd/` (CentOS) + +Key files: +- `/etc/apache2/apache2.conf` - Main configuration +- `/etc/apache2/sites-available/` - Available site configs +- `/etc/apache2/sites-enabled/` - Active site configs (usually symlinks) + +## Default Site Configuration + +File: `/etc/apache2/sites-available/000-default.conf` + +Key directives: +```apache + + DocumentRoot /var/www/html + # ... other settings + +``` + +- **Listen port**: Default is `*:80` (any IP, port 80) +- **DocumentRoot**: `/var/www/html` - where website files live + +## Website File Location + +Website files go in: `/var/www/html` + +Default file: `index.html` (or `index.php`) + +The web server automatically serves `index.html` when you visit the root URL. + +## Start/Restart Service + +```bash +sudo systemctl start apache2 +sudo systemctl restart apache2 +``` + +## Creating Website Content + +Make directories: +```bash +sudo mkdir /var/www/html/newfolder +``` + +Create files: +```bash +sudo touch /var/www/html/newfile.html +``` + +**Permission Requirements**: Web server needs read permissions to serve files. + +## Security Considerations + +- Don't put sensitive files (like `/etc/shadow`) in `/var/www/html` +- Check permissions - files need to be readable by web server +- Backup config files before making changes +- The website displays actual files from the server's filesystem + +## Common Issues + +1. **Service not starting**: Check config file syntax +2. **Can't access website**: Verify service is running, check IP/port +3. **404 errors**: Check DocumentRoot path and file permissions +4. **Permission denied**: Files need world-readable permissions for web server access diff --git a/03-ssh-service.md b/03-ssh-service.md new file mode 100644 --- /dev/null +++ b/03-ssh-service.md @@ -0,0 +1,164 @@ +# SSH Service + +## Service Name +- `ssh` or `sshd` (works on most distributions) + +## Check Service Status +```bash +systemctl status ssh +systemctl status sshd # Also works +``` + +## Configuration Location + +Main directory: `/etc/ssh/` + +Key files: +- `/etc/ssh/sshd_config` - Server configuration (most important) +- `/etc/ssh/ssh_config` - Client configuration +- `/etc/ssh/ssh_host_*_key` - Server private keys (multiple algorithms) +- `/etc/ssh/ssh_host_*_key.pub` - Server public keys + +## Important sshd_config Options + +```bash +Port 22 # Default SSH port +ListenAddress 0.0.0.0 # Listen on all IPs (or specify one) +PermitRootLogin prohibit-password # Or "yes" or "no" +``` + +### Port +Default is 22. Can change to non-standard port for security. + +### ListenAddress +- `0.0.0.0` = listen on all IP addresses +- Or specify a single IP to restrict access + +### PermitRootLogin +- `no` - root cannot SSH in at all +- `yes` - root can SSH in with password +- `prohibit-password` - root must use key authentication + +## Connecting to SSH Server + +Basic syntax: +```bash +ssh username@ip_address +ssh username@hostname.com +``` + +Example: +```bash +ssh sandbox@192.168.1.100 +``` + +First connection prompts to accept server's fingerprint (say yes). + +## Host Keys (Server-Side) + +SSH server has multiple key pairs in `/etc/ssh/`: +- RSA keys: `ssh_host_rsa_key` and `ssh_host_rsa_key.pub` +- ECDSA keys: `ssh_host_ecdsa_key` and `ssh_host_ecdsa_key.pub` +- ED25519 keys: `ssh_host_ed25519_key` and `ssh_host_ed25519_key.pub` + +These are **asymmetric key pairs**: +- Private key stays on server (read-only to root) +- Public key shared with clients +- Data encrypted with one key only decrypts with the other + +## Regenerating Host Keys + +If keys are compromised (or cloned VMs have identical keys): + +```bash +sudo ssh-keygen -t ecdsa -f /etc/ssh/ssh_host_ecdsa_key +``` + +Options: +- `-t ecdsa` - key type (also: rsa, ed25519) +- `-f /path/to/key` - where to save +- Will prompt to overwrite existing key +- Can add passphrase or leave blank + +## Client-Side Known Hosts + +Location: `~/.ssh/known_hosts` + +Contains public keys of servers you've connected to before. + +If server key changes, you'll get a warning. To fix: +```bash +# Remove old entry for that IP +ssh-keygen -R 192.168.1.100 + +# Or delete the entire file and re-accept connections +rm ~/.ssh/known_hosts +``` + +## Passwordless Authentication + +Allows login without password using key pairs. + +**Setup process:** + +1. Generate key pair on client (or server acting as admin): +```bash +ssh-keygen -t ecdsa -f ~/id_bob_key +``` + +2. Create `.ssh` directory for user: +```bash +sudo mkdir /home/bob/.ssh +sudo chmod 700 /home/bob/.ssh +sudo chown bob:bob /home/bob/.ssh +``` + +3. Copy public key to authorized_keys: +```bash +sudo cp id_bob_key.pub /home/bob/.ssh/authorized_keys +sudo chmod 644 /home/bob/.ssh/authorized_keys +sudo chown bob:bob /home/bob/.ssh/authorized_keys +``` + +4. Transfer private key to client using SCP: +```bash +scp sandbox@192.168.1.100:/path/to/id_bob_key . +``` + +5. Connect using the key: +```bash +ssh -i id_bob_key bob@192.168.1.100 +``` + +**Critical permissions:** +- `.ssh/` directory: `700` (drwx------) +- `authorized_keys` file: `644` (-rw-r--r--) +- Private keys: `600` (-rw-------) +- Public keys: `644` (-rw-r--r--) + +## SCP (Secure Copy) + +Copy files over SSH: + +```bash +# Copy from remote to local +scp user@remote:/path/to/file . + +# Copy from local to remote +scp localfile user@remote:/path/ + +# Use sudo on remote side +sudo scp user@remote:/root/file . +``` + +## Exit SSH Session + +```bash +exit +``` + +## Restart After Config Changes + +```bash +sudo systemctl restart ssh +``` diff --git a/04-network-configuration.md b/04-network-configuration.md new file mode 100644 --- /dev/null +++ b/04-network-configuration.md @@ -0,0 +1,137 @@ +# Network Configuration by Distribution + +## Viewing Current Configuration + +Show IP addresses: +```bash +ip a +# or +ip addr show +``` + +Show specific interface: +```bash +ip a show eth0 +``` + +## Kali/Debian - /etc/network/interfaces + +**File**: `/etc/network/interfaces` + +Basic static configuration: +```bash +auto eth0 +iface eth0 inet static + address 172.20.118.100 + netmask 255.255.255.0 + gateway 172.20.118.1 +``` + +**Key components:** +- `auto eth0` - Bring up interface automatically on boot +- `iface eth0 inet static` - Configure static IP (not DHCP) +- `address` - IP address +- `netmask` - Subnet mask +- `gateway` - Default gateway (router) + +**Restart networking:** +```bash +sudo systemctl restart networking +# or +sudo ifdown eth0 && sudo ifup eth0 +``` + +## CentOS/RHEL - ifcfg Files + +**Directory**: `/etc/sysconfig/network-scripts/` + +**Files**: One per interface (e.g., `ifcfg-eth0`, `ifcfg-eth1`) + +Example `ifcfg-eth0`: +```bash +DEVICE=eth0 +BOOTPROTO=static +ONBOOT=yes +IPADDR=172.20.118.1 +NETMASK=255.255.255.0 +GATEWAY=172.20.118.254 +``` + +**Key settings:** +- `DEVICE` - Interface name +- `BOOTPROTO` - `static` or `dhcp` +- `ONBOOT` - `yes` to auto-start on boot +- `IPADDR` - IP address +- `NETMASK` - Subnet mask +- `GATEWAY` - Default gateway + +**Restart networking:** +```bash +sudo systemctl restart network +# or per-interface: +sudo ifdown eth0 && sudo ifup eth0 +``` + +## Ubuntu - Netplan (YAML) + +**Directory**: `/etc/netplan/` + +**File**: Usually `01-network-manager-all.yaml` (or similar `.yaml` file) + +**IMPORTANT**: YAML is whitespace-sensitive. Use 2-space indentation consistently. + +Example configuration: +```yaml +network: + version: 2 + renderer: NetworkManager + ethernets: + ens18: + addresses: + - 192.168.195.2/24 + gateway4: 192.168.195.1 +``` + +**Key elements:** +- `ethernets:` - Section for ethernet interfaces +- `ens18:` - Interface name (not eth0 on modern Ubuntu) +- `addresses:` - List of IPs (note the dash and `/24` CIDR notation) +- `gateway4:` - Default gateway for IPv4 + +**Apply changes:** +```bash +sudo netplan apply +``` + +**Test configuration (doesn't persist):** +```bash +sudo netplan try +``` + +**CIDR notation:** `/24` equals `255.255.255.0` + +## Temporary IP Configuration + +Set IP temporarily (lost on reboot): +```bash +sudo ip addr add 192.168.1.100/24 dev eth0 +``` + +Flush (remove) all IPs from interface: +```bash +sudo ip addr flush dev eth0 +``` + +## Common Network Issues + +1. **Wrong interface name**: Check with `ip a` first +2. **Typo in config file**: Double-check spelling and syntax +3. **Forgotten gateway**: Can't reach beyond local network +4. **Netplan spacing**: YAML requires exact indentation +5. **Wrong subnet**: Devices must be on same subnet to communicate + +## Interface Naming + +- **Old style**: `eth0`, `eth1`, `lo` (loopback) +- **New style**: `ens18`, `enp0s3`, etc. (Ubuntu/modern systems) +- Always check actual names with `ip a` before configuring diff --git a/05-dns-rsync-cron.md b/05-dns-rsync-cron.md new file mode 100644 --- /dev/null +++ b/05-dns-rsync-cron.md @@ -0,0 +1,210 @@ +# DNS, Rsync, and Cron Services + +## DNS Service (BIND) + +### Service Name +- `named` (most distributions) + +### Configuration Location +- Ubuntu: `/etc/bind/` +- CentOS: May be in different location + +### Check Service +```bash +systemctl status named +``` + +### Basic Concept +DNS translates domain names to IP addresses (forward lookup) and IP addresses to domain names (reverse lookup). + +**Forward lookup**: `example.com` → `192.168.1.100` +**Reverse lookup**: `192.168.1.100` → `example.com` + +### Key Files (Bind) +- `named.conf` - Main configuration +- Zone files - Define DNS records for domains + +**This is a complex service** - requires understanding of: +- Zone files +- DNS record types (A, PTR, CNAME, MX, etc.) +- Forward vs reverse zones +- DNS hierarchy + +--- + +## Rsync - File Synchronization/Backup + +### Basic Syntax +```bash +rsync [options] source destination +``` + +### Common Options +```bash +-a # Archive mode (preserves permissions, timestamps, etc.) +-v # Verbose (show what's being copied) +-z # Compress during transfer +-r # Recursive (copy directories) +-h # Human-readable output +--delete # Delete files in dest that don't exist in source +``` + +### Local Backup Example +```bash +rsync -av /home/user/stuff/ /home/user/backups/ +``` + +**Note the trailing slash** on source - affects behavior: +- `/source/` - copy contents of source +- `/source` - copy source directory itself + +### Remote Backup via SSH +```bash +rsync -avz /local/path/ user@remote:/remote/path/ +``` + +### Consistency vs. Accumulation + +**Consistency** (mirror - deletes old files): +```bash +rsync -av --delete /source/ /backup/ +``` + +**Accumulation** (keeps all files): +```bash +rsync -av /source/ /backup/ +``` + +### Check Installed +```bash +rsync --version +# or just run rsync to see options +``` + +--- + +## Cron - Task Automation + +### Service Name +- `cron` (Ubuntu/Debian) +- `crond` (CentOS/RHEL) + +### Check Service +```bash +systemctl status cron +systemctl status crond # CentOS +``` + +### Edit Crontab +```bash +crontab -e # Edit current user's crontab +``` + +First time will ask which editor (nano recommended for beginners). + +### Crontab Syntax + +Five time fields + command: +``` +* * * * * command +│ │ │ │ │ +│ │ │ │ └─ Day of week (0-7, 0/7 = Sunday) +│ │ │ └─── Month (1-12) +│ │ └───── Day of month (1-31) +│ └─────── Hour (0-23) +└───────── Minute (0-59) +``` + +**Asterisk (*) means "every"** + +### Examples + +Every minute: +```bash +* * * * * /path/to/command +``` + +Every 5 minutes: +```bash +*/5 * * * * /path/to/command +``` + +Every day at 2:30 AM: +```bash +30 2 * * * /path/to/command +``` + +Every Monday at 5:00 PM: +```bash +0 17 * * 1 /path/to/command +``` + +First day of every month at midnight: +```bash +0 0 1 * * /path/to/command +``` + +### Automated Backup Example + +Run rsync backup every night at 2 AM: +```bash +0 2 * * * rsync -av --delete /var/www/html/ /backups/website/ +``` + +### Redirect Output + +Send output to file: +```bash +* * * * * /path/to/command > /path/to/logfile.txt +``` + +Append to file: +```bash +* * * * * /path/to/command >> /path/to/logfile.txt +``` + +Suppress output: +```bash +* * * * * /path/to/command > /dev/null 2>&1 +``` + +### View Crontab +```bash +crontab -l # List current user's crontab +``` + +### Remove Crontab +```bash +crontab -r # Remove current user's crontab +``` + +### System-Wide Cron + +User-specific: Managed via `crontab -e` + +System-wide cron directories: +- `/etc/cron.daily/` - Scripts run daily +- `/etc/cron.hourly/` - Scripts run hourly +- `/etc/cron.weekly/` - Scripts run weekly +- `/etc/cron.monthly/` - Scripts run monthly + +Place executable scripts in these directories for automatic execution. + +### Important Notes + +1. Cron uses absolute paths - always specify full path to commands +2. Cron runs in minimal environment - may need to set PATH, etc. +3. Test commands manually first before adding to cron +4. Cron jobs run as the user who owns the crontab +5. `sudo crontab -e` edits root's crontab (for privileged tasks) + +### Combining Rsync + Cron + +Automated nightly backups: +```bash +# In crontab -e: +0 2 * * * rsync -avz /var/www/html/ /backups/website/ +0 3 * * * rsync -avz /etc/ /backups/configs/ +``` + +This creates automated, scheduled backups without manual intervention. diff --git a/06-ufw-firewall.md b/06-ufw-firewall.md new file mode 100644 --- /dev/null +++ b/06-ufw-firewall.md @@ -0,0 +1,183 @@ +# UFW Firewall Configuration + +## Overview +UFW (Uncomplicated Firewall) sits on top of iptables and provides a more user-friendly interface for managing firewall rules on Ubuntu systems. + +## Distribution Differences + +| Distribution | Firewall Tool | +|--------------|---------------| +| Ubuntu | UFW (built-in) | +| Kali | iptables (UFW not installed by default) | +| CentOS/RHEL | firewall-cmd (firewalld) | + +## Basic Commands + +### Check Status +```bash +sudo ufw status # Basic status +sudo ufw status verbose # Detailed status with default policies +sudo ufw status numbered # Show rule numbers +``` + +### Enable/Disable +```bash +sudo ufw enable # Turn on firewall (persists after reboot) +sudo ufw disable # Turn off firewall +``` + +## Default Policies +When you enable UFW, default behavior is: +- **Incoming**: DENY (block all incoming traffic by default) +- **Outgoing**: ALLOW (allow all outgoing traffic) +- **Routed**: DENY (no routing/forwarding) + +This means services won't be accessible until you explicitly allow them. + +## Creating Rules + +### Allow Rules - By Service Name +```bash +sudo ufw allow ssh # Allow SSH (port 22, IPv4 and IPv6) +sudo ufw allow http # Allow HTTP (port 80) +sudo ufw allow https # Allow HTTPS (port 443) +``` + +### Allow Rules - By Port +```bash +sudo ufw allow 22/tcp # Allow TCP port 22 +sudo ufw allow 80/tcp # Allow TCP port 80 +sudo ufw allow 53/udp # Allow UDP port 53 (DNS) +``` + +### Allow Rules - By IP Address +```bash +sudo ufw allow from 192.168.1.100 # Allow all traffic from specific IP +sudo ufw allow from 192.168.1.0/24 # Allow from entire subnet +``` + +### Deny Rules +```bash +sudo ufw deny from 192.168.195.0/24 # Block entire subnet +sudo ufw deny 23/tcp # Block telnet +``` + +## Rule Processing Order + +**Critical**: UFW processes rules in the order they were added. + +```bash +# Example 1 - This works (allow processed first) +sudo ufw allow from 192.168.195.100 +sudo ufw deny from 192.168.195.0/24 +# Result: .100 is allowed, rest of subnet blocked + +# Example 2 - This doesn't work as intended (deny processed first) +sudo ufw deny from 192.168.195.0/24 +sudo ufw allow from 192.168.195.100 +# Result: .100 is also blocked (caught by first deny rule) +``` + +## Deleting Rules + +### By Rule Number +```bash +sudo ufw status numbered # See rule numbers +sudo ufw delete 4 # Delete rule #4 +``` + +**Warning**: After deleting a rule, all rules are renumbered. Delete one at a time and re-check numbers. + +### By Specification +```bash +sudo ufw delete allow ssh +sudo ufw delete allow from 192.168.1.100 +``` + +## IPv6 Considerations + +Many UFW commands automatically create both IPv4 and IPv6 rules: + +```bash +sudo ufw allow ssh +# Creates BOTH: +# - Port 22 (IPv4) +# - Port 22 (IPv6) +``` + +**Security Tip**: If you're not using IPv6, consider deleting those rules to reduce attack surface: +```bash +sudo ufw status numbered +sudo ufw delete 4 # Delete the IPv6 rule +``` + +## Before/After Rules + +UFW has built-in rules that process **before** and **after** your user-defined rules. These are stored in: +- `/etc/ufw/before.rules` - Processed before user rules +- `/etc/ufw/after.rules` - Processed after user rules + +Example before-rules: +- Allow DHCP client (so you can get an IP) +- Allow established connections +- Allow loopback traffic + +You can edit these files if needed, but typically user rules are sufficient. + +## Common Service Configurations + +### SSH Server +```bash +sudo ufw allow ssh +# or +sudo ufw allow 22/tcp +``` + +### Web Server (Apache/Nginx) +```bash +sudo ufw allow http +sudo ufw allow https +# or +sudo ufw allow 80/tcp +sudo ufw allow 443/tcp +``` + +### DNS Server +```bash +sudo ufw allow 53/tcp +sudo ufw allow 53/udp +``` + +## Competition Tips + +1. **Start by enabling it**: `sudo ufw enable` - even basic defaults improve security +2. **Allow services incrementally**: Only open ports for services you're actually running +3. **Check after each change**: `sudo ufw status verbose` +4. **Don't lock yourself out**: If configuring SSH remotely, make sure you allow SSH before enabling the firewall +5. **Monitor conflicts**: If a service stops working after enabling UFW, you likely forgot to allow its port + +## Troubleshooting + +### Service not accessible after enabling firewall +```bash +sudo ufw status numbered # Check if port is allowed +sudo ufw allow /tcp # Add the missing rule +``` + +### Locked out of SSH +- If you have console access: `sudo ufw allow ssh` then `sudo ufw enable` +- Always add SSH rule before enabling firewall on remote systems + +### Rule not working as expected +- Check rule order with `sudo ufw status numbered` +- More specific rules should come before general deny rules +- Remember: first match wins + +## Integration with System Services + +UFW rules persist across reboots once enabled. The firewall starts automatically on boot if you've run `sudo ufw enable`. + +To disable automatic start: +```bash +sudo ufw disable +``` diff --git a/07-active-connection-defense.md b/07-active-connection-defense.md new file mode 100644 --- /dev/null +++ b/07-active-connection-defense.md @@ -0,0 +1,293 @@ +# Active Connection Defense + +## Overview +Monitoring and managing active network connections is critical during competitions. This guide covers tools for identifying who's connected to your system and how to terminate malicious connections. + +## Core Monitoring Tools + +### netstat - Network Statistics + +**Most useful form**: +```bash +sudo netstat -tunap +``` + +**Breakdown**: +- `-t` = TCP connections +- `-u` = UDP connections +- `-n` = Show numeric ports (22 instead of "ssh") +- `-a` = Show listening and established connections +- `-p` = Show process IDs (requires sudo) + +**Output columns**: +``` +Proto Local Address Foreign Address State PID/Program +tcp 192.168.195.100:22 192.168.195.2:51736 ESTABLISHED 265408/sshd +``` + +**Common filters**: +```bash +netstat -tunap | grep ESTABLISHED # Only active connections +netstat -tunap | grep :22 # Only SSH connections +netstat -tunap | less # Scroll through output +``` + +### ss - Socket Statistics + +Modern replacement for netstat. Similar syntax: + +```bash +ss # Basic output (lots of info) +ss | grep ESTAB # Only established connections +ss -tunap # Same flags as netstat +``` + +**Advantage**: ss is installed on more modern systems by default. + +### w - Who is logged in + +```bash +w +``` + +**Shows**: +- Username +- From where (IP address or `:0` for local console) +- Login time +- What they're doing + +**Example output**: +``` +USER FROM WHAT +sandbox :0 -bash +bob 192.168.195.2 -bash +jenny 192.168.195.2 -bash +``` + +**Key indicator**: +- `:0` = Local console (physically at the machine) +- IP address = Remote connection (SSH, etc.) + +## Finding Process Information + +### top - Interactive Process Viewer + +```bash +top +``` + +- Shows CPU/memory usage +- Lists running processes +- Press `q` to quit + +### htop - Enhanced Process Viewer + +```bash +htop # If installed (not always available) +``` + +More colorful and interactive than `top`. + +### ps - Process Status + +```bash +ps aux # All processes, all users +ps aux | grep ssh # Find SSH processes +``` + +## Killing Connections + +### Kill by Process ID (PID) + +1. **Find the PID**: +```bash +sudo netstat -tunap +# Example output shows PID 265465 for jenny's SSH connection +``` + +2. **Kill the process**: +```bash +sudo kill 265465 +``` + +**From the user's perspective**: Connection closes immediately +``` +Connection to 192.168.195.100 closed by remote host. +``` + +### Kill by Username (pkill) + +```bash +sudo pkill -kill -u jenny # Kill all processes for user jenny +sudo pkill -kill -u bob # Kill all processes for user bob +``` + +**Warning**: This kills ALL processes for that user, including: +- Active SSH sessions +- Running programs +- Background jobs + +### Kill Signal Types + +```bash +sudo kill PID # SIGTERM (graceful shutdown, default) +sudo kill -9 PID # SIGKILL (force kill immediately) +sudo pkill -kill -u user # -kill = SIGKILL +``` + +## Competition Workflow + +### Active Defense Pattern + +1. **Someone monitors connections**: +```bash +# Run periodically or in a loop +sudo netstat -tunap +``` + +2. **Identify suspicious connections**: +- Unknown IP addresses +- Unexpected users logged in +- Unusual ports + +3. **Kill immediately**: +```bash +sudo pkill -kill -u +# or +sudo kill +``` + +4. **Someone else hardens the system**: +- Change passwords +- Disable accounts +- Configure firewall +- Close unnecessary services + +### Example Monitoring Script + +```bash +#!/bin/bash +# Quick connection checker +while true; do + clear + echo "=== Active SSH Connections ===" + sudo netstat -tunap | grep :22 | grep ESTABLISHED + sleep 5 +done +``` + +## Common Scenarios + +### Scenario 1: Unknown SSH Connection + +```bash +# See who's connected +w + +# Find their process ID +sudo netstat -tunap | grep ESTABLISHED + +# Kill by PID +sudo kill 265465 +``` + +### Scenario 2: Brute Force Attempts + +```bash +# See all connection attempts +sudo netstat -tunap | grep :22 + +# Check auth logs +sudo tail -f /var/log/auth.log + +# Block the source IP with firewall +sudo ufw deny from +``` + +### Scenario 3: Multiple Sessions from Same User + +```bash +# Kill all sessions for a user +sudo pkill -kill -u jenny + +# Disable the account +sudo passwd -l jenny # Lock password +sudo usermod -s /bin/false jenny # Disable shell +``` + +## Warnings and Gotchas + +### Don't Kill Yourself + +```bash +# BAD - if you're logged in as sandbox: +sudo pkill -kill -u sandbox +# This kills YOUR session too! +``` + +**Better approach**: Kill by specific PID if you're using the same username. + +### Don't Kill Teammates + +- Check with team before killing connections +- Look at FROM addresses to identify internal vs external +- Local (`:0`) connections are usually teammates at the console + +### Shared Accounts + +If red team is using the same account as you: +- Kill by PID (specific to their connection) +- Don't kill by username (you'll disconnect yourself) + +## Process Information Fields + +**Understanding PID in netstat**: +```bash +sudo netstat -tunap +``` + +Output: +``` +PID/Program name +265408/sshd: sandbox +265465/sshd: jenny +``` + +- PID: Process ID (unique number) +- Program: Which service (sshd, apache2, etc.) +- User context: Which user owns the process + +## Monitoring vs. Hardening + +**Active monitoring** (short-term): +- Running netstat/ss repeatedly +- Killing suspicious connections as they appear +- Playing "whack-a-mole" + +**Hardening** (long-term): +- Change passwords +- Disable unused accounts +- Configure firewall rules +- Close unnecessary services +- Update vulnerable software + +**Best practice**: Use monitoring to buy time while someone else hardens the system. You can't watch connections for 6 hours straight. + +## Tool Availability + +| Tool | Typical Availability | +|------|---------------------| +| netstat | Most systems (may need `net-tools` package) | +| ss | Modern systems (usually pre-installed) | +| w | All Unix/Linux systems | +| top | All Unix/Linux systems | +| htop | Optional (install with apt/yum) | +| ps | All Unix/Linux systems | + +**If netstat is missing**: +```bash +sudo apt install net-tools # Debian/Ubuntu +sudo yum install net-tools # CentOS/RHEL +``` + +Or just use `ss` instead. diff --git a/08-mikrotik-router.md b/08-mikrotik-router.md new file mode 100644 --- /dev/null +++ b/08-mikrotik-router.md @@ -0,0 +1,294 @@ +# MikroTik Router Configuration + +## Overview +Starting 2025, the NCAE competition replaced CentOS routers with MikroTik routers. MikroTik provides both a CLI and web GUI for configuration. + +## Why MikroTik? +- CentOS is end-of-life +- MikroTik is a commercial router OS used in real networks +- Provides both CLI and web interface +- More intuitive than raw iptables + +## Access Methods + +### CLI Access (Console/Terminal) +- Through ProxMox VNC console +- Direct terminal access +- No browser required + +### Web GUI Access +``` +http://:8080 +``` + +**Example**: `http://172.20.213.1:8080` (from external side) + +**Port 8080** is the management interface, not the standard web port. + +## Initial Login + +### Default Credentials +- **Username**: `admin` +- **Password**: (blank - just press Enter) + +### First Login +1. Login with blank password +2. System will prompt you to set a new password +3. **IMPORTANT**: Choose a strong password for competition + - For testing/practice: can use something simple like `password` + - For competition: red team will own you with weak passwords + +### License Prompt +- Will ask if you want to view license +- Can say "no" unless interested + +## Basic CLI Commands + +### Check IP Addresses +```bash +/ip address print +``` + +Shows all configured IP addresses on all interfaces. + +### Check Interfaces (Hardware) +```bash +interface print +``` + +Shows network adapters: +- `ether3` = First interface (usually external) +- `ether4` = Second interface (usually internal) +- Names may vary depending on hardware/cloning + +### Assign an IP Address +```bash +/ip address add address=172.20.213.1/16 interface=ether3 +``` + +**Breakdown**: +- `address=` - IP and subnet mask in CIDR notation +- `interface=` - Which network adapter (ether3, ether4, etc.) + +**Example for internal side**: +```bash +/ip address add address=192.168.213.1/24 interface=ether4 +``` + +### Test Connectivity +```bash +/ping 172.20.2 +/ping 192.168.213.2 +``` + +**Keyboard shortcuts**: +- Up/Down arrows = Command history +- Ctrl+C = Stop ping + +### Check Configuration +Use the print command for any section: +```bash +/ip address print +/ip route print +/ip firewall nat print +``` + +## Web GUI Configuration + +### Accessing the GUI + +From external network: +``` +http://172.20.213.1:8080 +``` + +Login: `admin` / `` + +### GUI Navigation + +**Top-right buttons**: +- **Quick Set** - Main configuration page (most common tasks) +- **Advanced** - Detailed/expert settings +- **Terminal** - CLI access from web browser + +**Most tasks can be done from Quick Set.** + +### Quick Set Configuration + +**Scrolling tips**: +- Mouse wheel only works when cursor is in the CENTER of the page +- If scrolling doesn't work, move mouse to the left side +- Scroll bar appears in the middle column + +#### Internet/External Configuration + +**Gateway** (where traffic goes to reach internet): +``` +172.20.1.1 # Or whatever your competition topology specifies +``` + +**DNS Servers**: +- Click the `+` button to add DNS servers +- Add all DNS servers from your topology document + +#### LAN/Internal Configuration + +Should show your configured internal IP: +``` +192.168.213.1/24 +``` + +#### Critical Checkboxes + +✅ **Bridge LAN Ports** - Check this +- Allows multiple LAN ports to work as one network + +✅ **Enable NAT** - Check this +- **Network Address Translation** +- Allows internal 192.168.x.x addresses to route through external 172.20.x.x +- **Required for routing to work** + +#### Apply Changes + +Click **Apply Configuration** button at bottom. + +Changes apply immediately - you'll see a "Saved" notification in the bottom-right. + +### Port Forwarding (Port Mapping) + +**Purpose**: Route external traffic to internal servers + +**Example**: Route external HTTP requests to internal web server + +1. Click **Port Mapping** (in Quick Set view) + +2. Click **New** button + +3. Configure the rule: + +**TCP Rule**: +``` +Name: www-tcp +Protocol: TCP +Port: 80 +Forward To: 192.168.213.2 +Port: 80 +``` + +**UDP Rule**: +``` +Name: www-udp +Protocol: UDP +Port: 80 +Forward To: 192.168.213.2 +Port: 80 +``` + +4. Click **OK** to save each rule + +### Testing Port Forwarding + +From external machine: +``` +http://172.20.213.1 +``` + +Should display website hosted on 192.168.213.2 (internal server). + +## Mini-Hack Context + +### External Network +``` +Network: 172.20.0.0/16 +Router IP: 172.20.213.1 (example team 213) +Kali External: 172.20.2 +``` + +### Internal Network +``` +Network: 192.168.213.0/24 (team number in 3rd octet) +Router IP: 192.168.213.1 +Web Server: 192.168.213.2 +Kali Internal: 192.168.213.100 +``` + +### Required Configuration + +1. **Assign external IP**: `172.20..1/16` to ether3 +2. **Assign internal IP**: `192.168..1/24` to ether4 +3. **Enable NAT** in Quick Set +4. **Port forward 80** (TCP & UDP) to internal web server at `.2` + +## Common Issues + +### Can't access web GUI +- Verify router IP is correct +- Must use port 8080: `http://:8080` +- Check you're on the same network as router + +### Port forwarding not working +- Did you enable NAT? (checkbox in Quick Set) +- Did you create BOTH TCP and UDP rules? +- Verify internal server is actually running the service +- Check internal server IP is correct + +### Changes not saving +- Look for "Saved" notification bottom-right +- If using Quick Set, click "Apply Configuration" +- Changes are immediate (no reboot needed) + +## CLI vs Web GUI + +**Use CLI for**: +- Quick IP configuration +- Checking current status +- When GUI is not accessible + +**Use Web GUI for**: +- Port forwarding / NAT rules +- Complex firewall rules +- Overview of configuration +- When you want visual confirmation + +Both methods work and changes sync between them. + +## Advanced Topics (Beyond Basics) + +**Firewall Rules** - More complex than just port forwarding +- Can create allow/deny rules +- Similar concept to UFW but different syntax + +**DHCP Server** - Assign IPs to internal network automatically +- Not needed for mini-hack (static IPs used) + +**Routing Tables** - Custom routes +- Can add static routes for complex topologies + +**VLANs** - Virtual network segmentation +- Competition may use in advanced scenarios + +These are covered in MikroTik documentation but not required for basic mini-hack completion. + +## Competition Day Checklist + +1. ✅ Login and set a **strong** password +2. ✅ Assign external IP address to ether3 +3. ✅ Assign internal IP address to ether4 +4. ✅ Configure gateway (from topology doc) +5. ✅ Add DNS servers (from topology doc) +6. ✅ Enable NAT checkbox +7. ✅ Create port forwarding rules for required services +8. ✅ Test connectivity from external network + +## Resources + +**Official Documentation**: +- [MikroTik Wiki](https://wiki.mikrotik.com/) +- [Getting Started Guide](https://wiki.mikrotik.com/wiki/Manual:First_time_startup) + +**Search Tips**: +- "mikrotik quick set" +- "mikrotik port forwarding" +- "mikrotik NAT configuration" + +Most common tasks are well-documented with examples. diff --git a/README.md b/README.md new file mode 100644 --- /dev/null +++ b/README.md @@ -0,0 +1,129 @@ +# Linux Service Configuration Writeups + +Quick reference guides for configuring services in Linux competitions. Assumes basic Linux knowledge (filesystem navigation, systemctl, ssh, etc.). + +## Writeups + +0. **[Mini-Hack Quick Start](00-mini-hack-overview.md)** - Complete mini-hack walkthrough checklist +1. **[Services Overview](01-services-overview.md)** - General approach to any service +2. **[Apache Web Service](02-apache-web-service.md)** - HTTP/HTTPS server configuration +3. **[SSH Service](03-ssh-service.md)** - Remote access, keys, security +4. **[Network Configuration](04-network-configuration.md)** - Static IPs across different distros +5. **[DNS, Rsync, Cron](05-dns-rsync-cron.md)** - Name resolution and automated backups +6. **[UFW Firewall](06-ufw-firewall.md)** - Ubuntu firewall configuration +7. **[Active Connection Defense](07-active-connection-defense.md)** - Monitor and kill malicious connections +8. **[MikroTik Router](08-mikrotik-router.md)** - Router configuration (2025 competition) + +## Service-Specific Quick Reference + +### Apache Service Names +```bash +apache2 # Ubuntu/Debian/Kali +httpd # CentOS/RHEL +``` + +### Network Configuration Files + +| Distribution | Config Location | +|--------------|----------------| +| Kali/Debian | `/etc/network/interfaces` | +| Ubuntu | `/etc/netplan/*.yaml` | +| CentOS/RHEL | `/etc/sysconfig/network-scripts/ifcfg-*` | + +### SSH Key Permissions +```bash +chmod 700 ~/.ssh/ +chmod 600 ~/.ssh/id_rsa # Private key +chmod 644 ~/.ssh/id_rsa.pub # Public key +chmod 644 ~/.ssh/authorized_keys +``` + +Regenerate host keys on cloned VMs: +```bash +sudo ssh-keygen -A +sudo systemctl restart sshd +``` + +### UFW Firewall +```bash +sudo ufw enable +sudo ufw allow ssh +sudo ufw allow http +sudo ufw allow from 192.168.1.100 # Specific IP +sudo ufw deny from 192.168.1.0/24 # Entire subnet +sudo ufw status numbered # See rule numbers +sudo ufw delete 4 # Delete rule by number +``` + +### Active Connection Monitoring +```bash +sudo netstat -tunap # All connections with PIDs +sudo netstat -tunap | grep ESTABLISHED # Only active +w # Who is logged in +sudo kill # Kill by process ID +sudo pkill -kill -u username # Kill all user processes +``` + +### MikroTik Router +**CLI**: +```bash +/ip address print +/ip address add address=192.168.1.1/24 interface=ether3 +/ping 192.168.1.2 +interface print +``` + +**Web GUI**: `http://:8080` +Default login: `admin` / (blank password) + +### Rsync + Cron +**Rsync common patterns**: +```bash +rsync -av source/ dest/ # Basic sync +rsync -av --delete source/ dest/ # Mirror (delete extra files in dest) +rsync -avz local/ user@host:remote/ # Remote backup (z=compress) +rsync -av --exclude='*.log' source/ dest/ # Exclude files +rsync -av source/ dest/ --dry-run # Test without changes +``` + +**Cron syntax**: `minute hour day month weekday command` +``` +0 2 * * * /path/to/backup.sh # Daily at 2 AM +*/15 * * * * /path/to/script.sh # Every 15 minutes +0 */6 * * * rsync -av /data/ /backup/ # Every 6 hours +``` + +## Distribution Differences + +| Feature | Ubuntu | Kali | CentOS/RHEL | +|---------|--------|------|-------------| +| Apache service | `apache2` | `apache2` | `httpd` | +| Network config | netplan YAML | interfaces | ifcfg-* scripts | +| Firewall | UFW | iptables | firewall-cmd | +| Cron service | `cron` | `cron` | `crond` | + +**Router (2025)**: All distributions use MikroTik (replaces CentOS router) + +## Competition Tips + +1. **Network config varies by distro** - check which one first +2. **SSH keys**: Regenerate on cloned VMs, fix permissions (700/.ssh, 600/private) +3. **Enable firewall early** - UFW even with defaults improves security +4. **Monitor active connections** - assign someone to watch `netstat -tunap` +5. **Router (2025)**: MikroTik web GUI on port 8080, must enable NAT checkbox +6. **Port forwarding**: Create both TCP and UDP rules for most services +7. **Kill by PID not username** if you share accounts with red team +8. **Backup configs before changes** - especially network configs (can lock yourself out) + +## Critical Configuration Locations + +| Service | Config File(s) | +|---------|---------------| +| SSH | `/etc/ssh/sshd_config` | +| Apache (Ubuntu) | `/etc/apache2/apache2.conf`, `/etc/apache2/sites-available/` | +| Apache (CentOS) | `/etc/httpd/conf/httpd.conf`, `/etc/httpd/conf.d/` | +| Network (Kali) | `/etc/network/interfaces` | +| Network (Ubuntu) | `/etc/netplan/*.yaml` | +| Network (CentOS) | `/etc/sysconfig/network-scripts/ifcfg-*` | +| DNS resolution | `/etc/resolv.conf` | +| Cron jobs | `crontab -e` (per-user), `/etc/crontab` (system-wide) |