Skip to content

Final Project

Analyze and harden the vulnerabilities of a computing system that you want to secure

The requirements for the Final Project is pretty broad, we are supposed to analyze and harden the vulnerabilities of a computing system that we want to secure. So, first thing to do is perform an analysis of a computing system, then harden that system. Like I said there is not much more that is required other than we have been asked to try to use as many of the lessons learned throughout the course.

FabFutures CyberOS

A reproducible Linux Mint security hardening toolkit.

Analyze

My idea is to analyze a clean installation of the latest stable release of Linux Mint running with the default settings inside a virtual machine. No additional software or configuration changes will be made before the analysis. The project will follow a spiral development process. A minimal hardening toolkit will be completed first. Additional security improvements will be implemented as time allows.

Pre-installed software

Pre-installed software

  • How many packages come pre-installed?

  • Which packages are unnecessary?

  • Are there packages that increase the attack surface?

  • Are packages installed for convenience rather than security?

Automatically running services

Automatically running services

  • What services start automatically?

    • Are they all needed?

    • Are they listening on the network?

  • Do these services pose a risk?

Open ports

Open ports

  • What ports are open?

    • Why are they open?
    • Should they be closed?

  • What is the risk of open ports?

Firewall

Firewall

  • Is ufw enabled?

  • What firewall rules exist?

  • What risk exists if it remains disabled?

SSH

SSH

  • Is SSH installed?
    • Is password authentication enabled?
    • How is root login?
Encryption

Encryption

  • Is the disk encrypted?

  • Are home folders encrypted?

  • Can users easily encrypt files?

CPU Vulnerabilities

CPU Vulnerabilities

  • What CPU vulnerabilities affect this system?

  • Which mitigations are enabled?

  • Are kernel mitigations active?

Automatic Updates

Automatic Updates

  • Are security updates installed automatically?
User Accounts

User Accounts

  • Who can log in?

  • Who has sudo priviledges?

AppArmot

AppArmor

  • Is AppArmor enabled?
    • Which profiles are enabled?
Boot Security

Boot Security

  • Does the OS have secure boot?
Human Security

Human Security

  • Can you make a weak password?

  • Can I accidentally disable the firewall?

  • Can I store passwords in /Documents?

  • How can I know if my system is secure?

The goal of the analysis is to establish a security baseline that can be compared against the hardened system to objectively measure the effect of each security improvement.

I would like to perform as many of these checks as I have time for so I have a baseline before moving on to hardening the system.

Harden

Pre-installed Software

Pre-installed software

  • Remove unnecessary packages.

  • Install security-related tools.

  • (Install FabFutures class recommended packages)

Automatically running services

Automatically running services

  • Turn off all unnecessary services that start automatically.
Open Ports

Open ports

  • Close all ports that do not need to be open.
Firewall

Firewall

  • Enable ufw and create firewall rules.
SSH

SSH

  • If SSH is installed, disable root login, require public-key authentication, and limit login attempts.
Encryption

Encryption

  • Recommend full-disk encryption during installation.

  • Add a helper script for encrypting files with GPG to make it easy for users to encrypt files.

CPU Velnerabilities

CPU Vulnerabilities

  • Add a script that reports CPU vulnerabilities and mitigation status.
Automatic Updates

Automatic Updates

  • Turn on automatic security updates.
User Accounts

User Accounts

  • Review user accounts and sudo privileges to ensure they follow the principle of least privilege.
AppArmor

AppArmor

  • Review the default AppArmor configuration and improve it where appropriate.
Boot Security

Boot Security

  • Verify whether Secure Boot is enabled and document its status.
Human Security

Human Security

  • Create a security health report.

  • Warn if automatic updates are disabled.

  • Warn if the firewall is disabled.

  • Warn if disk encryption is missing.

  • Warn if weak passwords are detected.

  • Make encryption easy to use.

Validation

Validation

After hardening, the system will be analyzed again using the same methods as the baseline analysis. The results will be compared to verify that the attack surface has been reduced and that the implemented security improvements are functioning as intended.

Possible validation methods include:

  • Number of installed packages

  • Number of enabled startup services

  • Comparing listening ports

  • Firewall status

  • Security audit results (e.g. Lynis)

  • CPU vulnerability status

Deliverables

Deliverables

The primary deliverable will be a collection of scripts that allow users to reproduce the analysis and hardening process on their own Linux Mint installations. The scripts will automate as much of the configuration as practical while documenting the security improvements that are applied.

If time permits, I will also create a bootable FabFutures CyberOS ISO containing the hardened system and preconfigured security settings.

  • Documentation of the analysis process

  • Hardening scripts

  • Before-and-after comparison results

  • Validation report

  • (Optional) Bootable FabFutures CyberOS ISO