Franske ITC-2480 Lab 12 - Revision history

BenFranske at 20:06, 3 December 2021

2021-12-03T20:06:00Z

BenFranske: /* Monitoring Services and Graphing System Statistics with Zabbix */

2020-12-17T18:16:04Z

Monitoring Services and Graphing System Statistics with Zabbix

← Older revision		Revision as of 18:16, 17 December 2020
Line 29:		Line 29:

	== Monitoring Services and Graphing System Statistics with Zabbix==		== Monitoring Services and Graphing System Statistics with Zabbix==
	# ~~Install~~ the ~~following~~ packages ~~on your system~~: zabbix~~-server-~~mysql ~~zabbix-frontend-php zabbix-agent~~		# Download and install the Zabbix 5.0 LTS Server, Frontend, and agent packages for Debian 10 with MySQL and Apache using [https://www.zabbix.com/download?zabbix=5.0&os_distribution=debian&os_version=10_buster&db=mysql&ws=apache these instructions on the Zabbix site]
	# Create a database, a user, and schema following the instructions in the ~~''/usr/share/doc/zabbix-server-mysql/README.Debian'' MySQL/MariaDB backend README file~~.		# Create a database, a user, and schema following the instructions on the same website.
	#* NOTE: These instructions use the MySQL/MariaDB command line, if you prefer you can create the same database, user, and schema using the Webmin software but you'll have to translate the command line instructions into the actions required in Webmin.		#* NOTE: These instructions use the MySQL/MariaDB command line, if you prefer you can create the same database, user, and schema using the Webmin software but you'll have to translate the command line instructions into the actions required in Webmin.
	# Edit the server configuration file ''/etc/zabbix/zabbix_server.conf'' to include the correct database ~~name, username and~~ password used when you setup the database above.		# Edit the server configuration file ''/etc/zabbix/zabbix_server.conf'' to include the correct database password used when you setup the database above.
	# ~~Note that~~ the ~~README~~ file ~~may contain instructions to edit the~~ ''/etc/~~default~~/~~zabbix-server~~'' ~~file~~. ~~This is no longer required and will~~ be ~~removed from newer versions of the Debian Zabbix README instructions~~.		# Edit the server configuration file ''/etc/zabbix/apache.conf'' to include the correct timezone. [https://www.php.net/manual/en/timezones.php A list of valid PHP timezones can be found here.]
	# ~~Start~~ the server with the '''~~service~~ zabbix-server ~~start~~''' command.		# Restart the server with the '''systemctl restart zabbix-server zabbix-agent apache2''' command.
	# ~~Make~~ the ~~Apache and PHP configuration changes outlined in~~ the '~~'/usr/share/doc/zabbix-frontend-php/README.Debian~~'' ~~frontend user interface README file to~~ enable ~~the Zabbix web application.~~		# Set the server to start automatically when the system starts up with the '''systemctl enable zabbix-server zabbix-agent apache2''' command.
	~~#* NOTE: You can set the timezone in the ''/etc/apache2/conf~~-~~available/~~zabbix-~~frontend-php.conf'~~' ~~file instead of in your~~ ''~~php.ini'' file. See the example timezone line which is commented out in the file~~.		# Access the Zabbix web application at http://yourserver/zabbix/ and complete the setup wizard. [https://www.zabbix.com/documentation/5.0/manual/installation/frontend Detailed instructions for completing the setup wizard can be found here on the Zabbix site.]
	# Access the Zabbix web application at http://yourserver/zabbix/ and complete the setup wizard.
	# At the end of the setup wizard you may need to download a ''zabbix.conf.php'' and save it to ''/etc/zabbix/zabbix.conf.php'' on your system.		# At the end of the setup wizard you may need to download a ''zabbix.conf.php'' and save it to ''/etc/zabbix/zabbix.conf.php'' on your system.
	# Login to http://yourserver/zabbix/ (where yourserver is the IP address or DNS name for your system) with the username and password found in the ~~above frontend README file~~.		# Login to http://yourserver/zabbix/ (where yourserver is the IP address or DNS name for your system) with the username and password found [https://www.zabbix.com/documentation/5.0/manual/quickstart/login on the Zabbix site login instructions].
	# Enable monitoring of your Zabbix server host (''Configuration'' -> ''Hosts'')		# Enable monitoring of your Zabbix server host (''Configuration'' -> ''Hosts'')
			#* NOTE: [https://www.zabbix.com/documentation/5.0/manual The Zabbix manual] may be helpful in completing these monitoring setup tasks.
	# Add the templates to the host appropriate for the services we are running on the server (HTTP, IMAP, MySQL, SMTP, SSH)		# Add the templates to the host appropriate for the services we are running on the server (HTTP, IMAP, MySQL, SMTP, SSH)
	# Explore some of the data available through Zabbix such as various graphs (''Monitoring'' -> ''Graphs''), Latest Data (''Monitoring'' -> ''Latest Data''), Screens (''Monitoring'' -> ''Screens''), and Events (''Monitoring'' -> ''Events'')		# Explore some of the data available through Zabbix such as various graphs (''Monitoring'' -> ''Graphs''), Latest Data (''Monitoring'' -> ''Latest Data''), Screens (''Monitoring'' -> ''Screens''), and Events (''Monitoring'' -> ''Events'')
Line 47:		Line 47:
	#* NOTE: Most services will not instantaneously show as down, the templates for the service probably check it once per minute or less so you may need to leave things down for a bit to see it in the Web UI.		#* NOTE: Most services will not instantaneously show as down, the templates for the service probably check it once per minute or less so you may need to leave things down for a bit to see it in the Web UI.
	# If you have additional time see if you can get email notifications of failed services working (see ''Administration'' -> ''Media Types'' -> ''Email and Configuration'' -> ''Actions'')		# If you have additional time see if you can get email notifications of failed services working (see ''Administration'' -> ''Media Types'' -> ''Email and Configuration'' -> ''Actions'')
	~~#* Note: The Zabbix manual at https://www.zabbix.com/documentation/3.0/manual may be helpful as well.~~

BenFranske: /* Monitoring Services and Graphing System Statistics with Zabbix */

2018-03-30T07:44:23Z

Monitoring Services and Graphing System Statistics with Zabbix

← Older revision		Revision as of 07:44, 30 March 2018
Line 47:		Line 47:
	#* NOTE: Most services will not instantaneously show as down, the templates for the service probably check it once per minute or less so you may need to leave things down for a bit to see it in the Web UI.		#* NOTE: Most services will not instantaneously show as down, the templates for the service probably check it once per minute or less so you may need to leave things down for a bit to see it in the Web UI.
	# If you have additional time see if you can get email notifications of failed services working (see ''Administration'' -> ''Media Types'' -> ''Email and Configuration'' -> ''Actions'')		# If you have additional time see if you can get email notifications of failed services working (see ''Administration'' -> ''Media Types'' -> ''Email and Configuration'' -> ''Actions'')
	#* Note: The Zabbix manual at https://www.zabbix.com/documentation/2.4/manual may be helpful as well.		#* Note: The Zabbix manual at https://www.zabbix.com/documentation/3.0/manual may be helpful as well.

BenFranske: /* Monitoring Services and Graphing System Statistics with Zabbix */

2018-03-30T06:42:56Z

Monitoring Services and Graphing System Statistics with Zabbix

← Older revision		Revision as of 06:42, 30 March 2018
Line 30:		Line 30:
	== Monitoring Services and Graphing System Statistics with Zabbix==		== Monitoring Services and Graphing System Statistics with Zabbix==
	# Install the following packages on your system: zabbix-server-mysql zabbix-frontend-php zabbix-agent		# Install the following packages on your system: zabbix-server-mysql zabbix-frontend-php zabbix-agent
	# Create a database, a user, and schema following the instructions in the ''/usr/share/doc/zabbix-server-mysql/README.Debian'' README file.		# Create a database, a user, and schema following the instructions in the ''/usr/share/doc/zabbix-server-mysql/README.Debian'' MySQL/MariaDB backend README file.
	#* NOTE: These instructions use the MySQL/MariaDB command line, if you prefer you can create the same database, user, and schema using the Webmin software but you'll have to translate the command line instructions into the actions required in Webmin.		#* NOTE: These instructions use the MySQL/MariaDB command line, if you prefer you can create the same database, user, and schema using the Webmin software but you'll have to translate the command line instructions into the actions required in Webmin.
	# Edit the server configuration file ''/etc/zabbix/zabbix_server.conf'' to include the correct database name, username and password used when you setup the database above.		# Edit the server configuration file ''/etc/zabbix/zabbix_server.conf'' to include the correct database name, username and password used when you setup the database above.
	# ~~Edit~~ the ''/etc/default/zabbix-server'' file ~~to allow~~ the ~~server to start and then start~~ the server with the '''service zabbix-server ~~--full-restart~~''' command.		# Note that the README file may contain instructions to edit the ''/etc/default/zabbix-server'' file. This is no longer required and will be removed from newer versions of the Debian Zabbix README instructions.
	# Make the Apache and PHP configuration changes outlined in the ''/usr/share/doc/zabbix-frontend-php/README.Debian'' file to enable the Zabbix web application		# Start the server with the '''service zabbix-server start''' command.
	# Access the Zabbix web application at http://~~yourserveripaddressordnsname~~/zabbix/ and complete the setup wizard.		# Make the Apache and PHP configuration changes outlined in the ''/usr/share/doc/zabbix-frontend-php/README.Debian'' frontend user interface README file to enable the Zabbix web application.
	# Login to http://yourserver/zabbix/ (where yourserver is the IP address or DNS name for your system) with the username and password found in the above README file.		#* NOTE: You can set the timezone in the ''/etc/apache2/conf-available/zabbix-frontend-php.conf'' file instead of in your ''php.ini'' file. See the example timezone line which is commented out in the file.
			# Access the Zabbix web application at http://yourserver/zabbix/ and complete the setup wizard.
			# At the end of the setup wizard you may need to download a ''zabbix.conf.php'' and save it to ''/etc/zabbix/zabbix.conf.php'' on your system.
			# Login to http://yourserver/zabbix/ (where yourserver is the IP address or DNS name for your system) with the username and password found in the above frontend README file.
	# Enable monitoring of your Zabbix server host (''Configuration'' -> ''Hosts'')		# Enable monitoring of your Zabbix server host (''Configuration'' -> ''Hosts'')
	# Add the templates appropriate for the services we are running on the server (HTTP, IMAP, MySQL, SMTP, SSH)		# Add the templates to the host appropriate for the services we are running on the server (HTTP, IMAP, MySQL, SMTP, SSH)
	# Explore some of the data available through Zabbix such as various graphs (''Monitoring'' -> ''Graphs''), Latest Data (''Monitoring'' -> ''Latest Data''), Screens (''Monitoring'' -> ''Screens''), and Events (''Monitoring'' -> ''Events'')		# Explore some of the data available through Zabbix such as various graphs (''Monitoring'' -> ''Graphs''), Latest Data (''Monitoring'' -> ''Latest Data''), Screens (''Monitoring'' -> ''Screens''), and Events (''Monitoring'' -> ''Events'')
	# Try temporarily stopping some of the services on your system (to simulate a problem) such as the Postfix SMTP server, ''courier-imap'' server, etc. using the command line '''service''' command.		# Try temporarily stopping some of the services on your system (to simulate a problem) such as the Postfix SMTP server, ''courier-imap'' server, etc. using the command line '''service''' command.
	# Re-check the data in Zabbix with the services turned off, are you alerted of the problems? Make sure to turn the services back on when you're done.		# Re-check the data in Zabbix with the services turned off, are you alerted of the problems? Make sure to turn the services back on when you're done.
			#* NOTE: Most services will not instantaneously show as down, the templates for the service probably check it once per minute or less so you may need to leave things down for a bit to see it in the Web UI.
	# If you have additional time see if you can get email notifications of failed services working (see ''Administration'' -> ''Media Types'' -> ''Email and Configuration'' -> ''Actions'')		# If you have additional time see if you can get email notifications of failed services working (see ''Administration'' -> ''Media Types'' -> ''Email and Configuration'' -> ''Actions'')
	#* Note: The Zabbix manual at https://www.zabbix.com/documentation/2.4/manual may be helpful as well.		#* Note: The Zabbix manual at https://www.zabbix.com/documentation/2.4/manual may be helpful as well.

BenFranske: /* Scanning ports using nmap */

2018-03-30T04:52:11Z

Scanning ports using nmap

← Older revision		Revision as of 04:52, 30 March 2018
Line 16:		Line 16:

	== Scanning ports using nmap ==		== Scanning ports using nmap ==
	# The '''nmap''' Network Mapper utility is a very powerful security scanning utility available on Linux. Before we begin this section of the lab it is important to remember that scanning a system is often seen as an attack against the system and should not be done unless you are the administrator of both the system that you are scanning from and the system you are scanning or have the explicit permission of the system administrator of those systems! In some areas people have been legally charged and prosecuted for scanning of systems which they are not authorized to do. You have been warned!		# The '''nmap''' Network Mapper utility is a very powerful security scanning utility available on Linux. While '''netstat''' uses information from the Linux kernel about what ports and connections are in use by what processes '''nmap''' actively probes and tests ports on your system or another system to determine whether the port is open or not as well as additional information about the port in some cases.
			#* NOTE: Before we begin this section of the lab it is important to remember that scanning a system is often seen as an attack against the system and should not be done unless you are the administrator of both the system that you are scanning from and the system you are scanning or have the explicit permission of the system administrator of those systems! In some areas people have been legally charged and prosecuted for scanning of systems which they are not authorized to do. You have been warned!
	# Unlike '''netstat''', '''nmap''' is not part of the default Debian installation so you will need to install the ''nmap'' package before proceeding.		# Unlike '''netstat''', '''nmap''' is not part of the default Debian installation so you will need to install the ''nmap'' package before proceeding.
	# '''nmap''' is complex and powerful. Entire [http://nmap.org/book/toc.html books] and [http://nmap.org/book/man.html extensive documentation] are available which you may want to reference but we'll only be exploring some of the more basic features in this introduction.		# '''nmap''' is complex and powerful. Entire [http://nmap.org/book/toc.html books] and [http://nmap.org/book/man.html extensive documentation] are available which you may want to reference but we'll only be exploring some of the more basic features in this introduction.
Line 26:		Line 27:
	# Remember that in our case these systems are secure from the outside world because we have an upstream firewall which you have bypassed by connecting to our VPN and these systems are using unroutable private IPv4 addresses.		# Remember that in our case these systems are secure from the outside world because we have an upstream firewall which you have bypassed by connecting to our VPN and these systems are using unroutable private IPv4 addresses.
	# '''nmap''' also supports scanning IPv6 addresses. Note that a running service is not necessarily listening on both IPv4 and IPv6 addresses just because you have them both active on your machine. Figure out how to scan IPv6 addresses with '''nmap''' and try scanning both an IPv4 and IPv6 address of your machine and compare the results. Use the same type of address (i.e. both IPv4 and Ipv6 addresses should be the localhost addresses or should both be outside addresses) Are the same services open on both IPv4 and IPv6 on your system?		# '''nmap''' also supports scanning IPv6 addresses. Note that a running service is not necessarily listening on both IPv4 and IPv6 addresses just because you have them both active on your machine. Figure out how to scan IPv6 addresses with '''nmap''' and try scanning both an IPv4 and IPv6 address of your machine and compare the results. Use the same type of address (i.e. both IPv4 and Ipv6 addresses should be the localhost addresses or should both be outside addresses) Are the same services open on both IPv4 and IPv6 on your system?

	== Monitoring Services and Graphing System Statistics with Zabbix==		== Monitoring Services and Graphing System Statistics with Zabbix==
	# Install the following packages on your system: zabbix-server-mysql zabbix-frontend-php zabbix-agent		# Install the following packages on your system: zabbix-server-mysql zabbix-frontend-php zabbix-agent

BenFranske: /* Monitoring connections with netstat */

2018-03-30T04:50:03Z

Monitoring connections with netstat

← Older revision		Revision as of 04:50, 30 March 2018
Line 11:		Line 11:
	# Run the '''sudo netstat -natup''' command on your system and observe the output.		# Run the '''sudo netstat -natup''' command on your system and observe the output.
	# Try to identify what the purpose of each open port on your system is. Note, there are many online guides to common uses for ports.		# Try to identify what the purpose of each open port on your system is. Note, there are many online guides to common uses for ports.
	# Use the '''sudo ps aux''' command to match the PID (process ID) numbers of open ports shown in '''netstat -natup''' with specific processes on your system.		# Use the '''sudo ps aux''' command (along with '''grep''') to match the PID (process ID) numbers of open ports shown in '''netstat -natup''' with specific processes on your system.
	# Connect to the IP address or domain name of your system through your web browser and re-run the '''netstat -natup''' command to see the TCP session established by your browser to download the website.		# Connect to the IP address or domain name of your system through your web browser and re-run the '''netstat -natup''' command to see the TCP session established by your browser to download the website.
	# You'll find that there are a number of ports open on your system. Some of these we have opened to provide a specific service such as SMTP, DNS, Webserver, etc. but some such as the sunrpc port are open simply by default on a fresh install. There are a number of different strategies you can use to secure your system including disabling a service, binding it to an internal-only IP address, or blocking access with a firewall rule. If your firewall is setup with an implicit (or explicit) reject any rule at the bottom of the input chain and you have not specifically opened a port it should not be accessible from other systems. How can we test that though? The '''netstat''' utility is useful at making a list of ports somehow open on the system but it does not show us how those ports react if someone outside actually tries to connect.		# You'll find that there are a number of ports open on your system. Some of these we have opened to provide a specific service such as SMTP, DNS, Webserver, etc. but some such as the sunrpc port are open simply by default on a fresh install. There are a number of different strategies you can use to secure your system including disabling a service, binding it to an internal-only IP address, or blocking access with a firewall rule. If your firewall is setup with an implicit (or explicit) reject any rule at the bottom of the input chain and you have not specifically opened a port it should not be accessible from other systems. How can we test that though? The '''netstat''' utility is useful at making a list of ports somehow open on the system but it does not show us how those ports react if someone outside actually tries to connect.

BenFranske: /* Monitoring connections with netstat */

2018-03-30T04:49:41Z

Monitoring connections with netstat

← Older revision		Revision as of 04:49, 30 March 2018
Line 11:		Line 11:
	# Run the '''sudo netstat -natup''' command on your system and observe the output.		# Run the '''sudo netstat -natup''' command on your system and observe the output.
	# Try to identify what the purpose of each open port on your system is. Note, there are many online guides to common uses for ports.		# Try to identify what the purpose of each open port on your system is. Note, there are many online guides to common uses for ports.
			# Use the '''sudo ps aux''' command to match the PID (process ID) numbers of open ports shown in '''netstat -natup''' with specific processes on your system.
			# Connect to the IP address or domain name of your system through your web browser and re-run the '''netstat -natup''' command to see the TCP session established by your browser to download the website.
	# You'll find that there are a number of ports open on your system. Some of these we have opened to provide a specific service such as SMTP, DNS, Webserver, etc. but some such as the sunrpc port are open simply by default on a fresh install. There are a number of different strategies you can use to secure your system including disabling a service, binding it to an internal-only IP address, or blocking access with a firewall rule. If your firewall is setup with an implicit (or explicit) reject any rule at the bottom of the input chain and you have not specifically opened a port it should not be accessible from other systems. How can we test that though? The '''netstat''' utility is useful at making a list of ports somehow open on the system but it does not show us how those ports react if someone outside actually tries to connect.		# You'll find that there are a number of ports open on your system. Some of these we have opened to provide a specific service such as SMTP, DNS, Webserver, etc. but some such as the sunrpc port are open simply by default on a fresh install. There are a number of different strategies you can use to secure your system including disabling a service, binding it to an internal-only IP address, or blocking access with a firewall rule. If your firewall is setup with an implicit (or explicit) reject any rule at the bottom of the input chain and you have not specifically opened a port it should not be accessible from other systems. How can we test that though? The '''netstat''' utility is useful at making a list of ports somehow open on the system but it does not show us how those ports react if someone outside actually tries to connect.

BenFranske at 04:09, 30 March 2018

2018-03-30T04:09:32Z

BenFranske: /* Monitoring connections with netstat */

2016-12-07T05:31:17Z

Monitoring connections with netstat

← Older revision		Revision as of 05:31, 7 December 2016
Line 8:		Line 8:
	== Monitoring connections with netstat ==		== Monitoring connections with netstat ==
	# One common activity you would want to do when evaluating the security of a system is to find out what ports the system is accepting connections on. For this reason most operating systems have some kind of utility to display active network connections and open ports, Linux is no exception. The netstat utility can show you currently active network connections as well as open ports on your local system.		# One common activity you would want to do when evaluating the security of a system is to find out what ports the system is accepting connections on. For this reason most operating systems have some kind of utility to display active network connections and open ports, Linux is no exception. The netstat utility can show you currently active network connections as well as open ports on your local system.
	# Take a look at the man page for the netstat command. Specifically, figure out what the -n -a -t and -u options do.		# Take a look at the man page for the netstat command. Specifically, figure out what the -n -a -t -p and -u options do.
	# Run the '''netstat -~~natu~~''' command on your system and observe the output.		# Run the '''sudo netstat -natup''' command on your system and observe the output.
	# Try to identify what the purpose of each open port on your system is. Note, there are many online guides to common uses for ports.		# Try to identify what the purpose of each open port on your system is. Note, there are many online guides to common uses for ports.
	# You'll find that there are a number of ports open on your system. Some of these we have opened to provide a specific service such as SMTP, DNS, Webserver, etc. but some such as the sunrpc port are open simply by default on a fresh install. There are a number of different strategies you can use to secure your system including disabling a service, binding it to an internal-only IP address, or blocking access with a firewall rule. If your firewall is setup with an implicit (or explicit) reject any rule at the bottom of the input chain and you have not specifically opened a port it should not be accessible from other systems. How can we test that though? The netstat utility is useful at making a list of ports somehow open on the system but it does not show us how those ports react if someone outside actually tries to connect.		# You'll find that there are a number of ports open on your system. Some of these we have opened to provide a specific service such as SMTP, DNS, Webserver, etc. but some such as the sunrpc port are open simply by default on a fresh install. There are a number of different strategies you can use to secure your system including disabling a service, binding it to an internal-only IP address, or blocking access with a firewall rule. If your firewall is setup with an implicit (or explicit) reject any rule at the bottom of the input chain and you have not specifically opened a port it should not be accessible from other systems. How can we test that though? The netstat utility is useful at making a list of ports somehow open on the system but it does not show us how those ports react if someone outside actually tries to connect.

BenFranske: /* Monitoring Services and Graphing System Statistics with Zabbix */

2016-04-14T06:15:19Z

Monitoring Services and Graphing System Statistics with Zabbix

← Older revision		Revision as of 06:15, 14 April 2016
Line 39:		Line 39:
	# Re-check the data in Zabbix with the services turned off, are you alerted of the problems? Make sure to turn the services back on when you're done.		# Re-check the data in Zabbix with the services turned off, are you alerted of the problems? Make sure to turn the services back on when you're done.
	# If you have additional time see if you can get email notifications of failed services working (see Administration -> Media Types -> Email and Configuration -> Actions)		# If you have additional time see if you can get email notifications of failed services working (see Administration -> Media Types -> Email and Configuration -> Actions)
	# Note: The Zabbix manual at https://www.zabbix.com/documentation/2.4/manual may be helpful as well.		#* Note: The Zabbix manual at https://www.zabbix.com/documentation/2.4/manual may be helpful as well.

← Older revision		Revision as of 04:09, 30 March 2018
Line 8:		Line 8:
	== Monitoring connections with netstat ==		== Monitoring connections with netstat ==
	# One common activity you would want to do when evaluating the security of a system is to find out what ports the system is accepting connections on. For this reason most operating systems have some kind of utility to display active network connections and open ports, Linux is no exception. The netstat utility can show you currently active network connections as well as open ports on your local system.		# One common activity you would want to do when evaluating the security of a system is to find out what ports the system is accepting connections on. For this reason most operating systems have some kind of utility to display active network connections and open ports, Linux is no exception. The netstat utility can show you currently active network connections as well as open ports on your local system.
	# Take a look at the man page for the netstat command. Specifically, figure out what the -n -a -t -p and -u options do.		# Take a look at the man page for the '''netstat''' command. Specifically, figure out what the ''-n -a -t -p'' and ''-u'' options do.
	# Run the '''sudo netstat -natup''' command on your system and observe the output.		# Run the '''sudo netstat -natup''' command on your system and observe the output.
	# Try to identify what the purpose of each open port on your system is. Note, there are many online guides to common uses for ports.		# Try to identify what the purpose of each open port on your system is. Note, there are many online guides to common uses for ports.
	# You'll find that there are a number of ports open on your system. Some of these we have opened to provide a specific service such as SMTP, DNS, Webserver, etc. but some such as the sunrpc port are open simply by default on a fresh install. There are a number of different strategies you can use to secure your system including disabling a service, binding it to an internal-only IP address, or blocking access with a firewall rule. If your firewall is setup with an implicit (or explicit) reject any rule at the bottom of the input chain and you have not specifically opened a port it should not be accessible from other systems. How can we test that though? The netstat utility is useful at making a list of ports somehow open on the system but it does not show us how those ports react if someone outside actually tries to connect.		# You'll find that there are a number of ports open on your system. Some of these we have opened to provide a specific service such as SMTP, DNS, Webserver, etc. but some such as the sunrpc port are open simply by default on a fresh install. There are a number of different strategies you can use to secure your system including disabling a service, binding it to an internal-only IP address, or blocking access with a firewall rule. If your firewall is setup with an implicit (or explicit) reject any rule at the bottom of the input chain and you have not specifically opened a port it should not be accessible from other systems. How can we test that though? The '''netstat''' utility is useful at making a list of ports somehow open on the system but it does not show us how those ports react if someone outside actually tries to connect.

	== Scanning ports using nmap ==		== Scanning ports using nmap ==
	# The nmap Network Mapper utility is a very powerful security scanning utility available on Linux. Before we begin this section of the lab it is important to remember that scanning a system is often seen as an attack against the system and should not be done unless you are the administrator of both the system that you are scanning from and the system you are scanning or have the explicit permission of the system administrator of those systems! In some areas people have been legally charged and prosecuted for scanning of systems which they are not authorized to do. You have been warned!		# The '''nmap''' Network Mapper utility is a very powerful security scanning utility available on Linux. Before we begin this section of the lab it is important to remember that scanning a system is often seen as an attack against the system and should not be done unless you are the administrator of both the system that you are scanning from and the system you are scanning or have the explicit permission of the system administrator of those systems! In some areas people have been legally charged and prosecuted for scanning of systems which they are not authorized to do. You have been warned!
	# Unlike netstat, nmap is not part of the default Debian installation so you will need to install the nmap package before proceeding.		# Unlike '''netstat''', '''nmap''' is not part of the default Debian installation so you will need to install the ''nmap'' package before proceeding.
	# nmap is complex and powerful. Entire [http://nmap.org/book/toc.html books] and [http://nmap.org/book/man.html extensive documentation] are available which you may want to reference but we'll only be exploring some of the more basic features in this introduction.		# '''nmap''' is complex and powerful. Entire [http://nmap.org/book/toc.html books] and [http://nmap.org/book/man.html extensive documentation] are available which you may want to reference but we'll only be exploring some of the more basic features in this introduction.
	# nmap provides a system on the Internet which they allow you to scan for testing purposes so let's try a verbose scan (which gives additional diagnostic detail using the '''nmap -v scanme.nmap.org''' command.		# '''nmap''' provides a system on the Internet which they allow you to scan for testing purposes so let's try a verbose scan (which gives additional diagnostic detail using the '''nmap -v scanme.nmap.org''' command.
	# Review the output and then run the same command without the -v verbose option and compare the output you receive.		# Review the output and then run the same command without the ''-v'' verbose option and compare the output you receive.
	# When scanning your own system there are a few different ways to go about it. You could either scan the localhost address 127.0.0.1 or the actual outside IP address of your system. You could also setup a separate system or VM and do the scanning from that system. In each case you might see somewhat different results, can you guess why?		# When scanning your own system there are a few different ways to go about it. You could either scan the localhost address 127.0.0.1 or the actual outside IP address of your system. You could also setup a separate system or VM and do the scanning from that system. In each case you might see somewhat different results, can you guess why?
	# The answer is related to how you have firewall rules setup and what addresses you have services bound to. For example by default on Debian systems mySQL ~~connections~~ only listens for connections on the localhost address (127.0.0.1) and not on outside interfaces. Try running the '''nmap 127.0.0.1''' command and then compare output with the '''nmap <your outside ip address here>''' command. Do you see some network services listening only on the localhost address. These services are not accessible from outside your computer even though the ports are open and you would see them as open with netstat. This shows us some of the additional value of using nmap.		# The answer is related to how you have firewall rules setup and what addresses you have services bound to. For example by default on Debian systems the mySQL/MariaDB server daemon only listens for connections on the localhost address (127.0.0.1) and not on outside interfaces. Try running the '''nmap 127.0.0.1''' command and then compare output with the '''nmap <your outside ip address here>''' command. Do you see some network services listening only on the localhost address. These services are not accessible from outside your computer even though the ports are open and you would see them as open with '''netstat'''. This shows us some of the additional value of using '''nmap'''.
	# The most realistic use of nmap though is to scan like an attacker would using a system outside of the one you're testing. Use nmap to scan a partner's IP address and take a look at some of the nmap documentation to try a few different types scans on that system. If you would like you can also try scanning the entire ITC-2480 subnet (172.17.50.0/24) if you want to try some subnet scanning capabilities.		# The most realistic use of '''nmap''' though is to scan like an attacker would using a system outside of the one you're testing. Use '''nmap''' to scan a partner's IP address in the class and take a look at some of the '''nmap''' documentation to try a few different types scans on that system. If you would like you can also try scanning the entire ITC-2480 subnet (172.17.50.0/24) if you want to try some subnet scanning capabilities.
	# Remember that in our case these systems are secure from the outside world because we have an upstream firewall which you have bypassed by connecting to our VPN and these systems are using unroutable private IPv4 addresses.		# Remember that in our case these systems are secure from the outside world because we have an upstream firewall which you have bypassed by connecting to our VPN and these systems are using unroutable private IPv4 addresses.
	# nmap also supports scanning IPv6 addresses. Note that a running service is not necessarily listening on both IPv4 and IPv6 addresses just because you have them both active on your machine. Figure out how to scan IPv6 addresses with nmap and try scanning both an IPv4 and IPv6 address on your machine and compare the results. Use the same type of address (i.e. both IPv4 and Ipv6 addresses should be the localhost addresses or should both be outside addresses) Are the same services open on both IPv4 and IPv6 on your system?		# '''nmap''' also supports scanning IPv6 addresses. Note that a running service is not necessarily listening on both IPv4 and IPv6 addresses just because you have them both active on your machine. Figure out how to scan IPv6 addresses with '''nmap''' and try scanning both an IPv4 and IPv6 address of your machine and compare the results. Use the same type of address (i.e. both IPv4 and Ipv6 addresses should be the localhost addresses or should both be outside addresses) Are the same services open on both IPv4 and IPv6 on your system?
	== Monitoring Services and Graphing System Statistics with Zabbix==		== Monitoring Services and Graphing System Statistics with Zabbix==
	# Install the following packages on your system: zabbix-server-mysql zabbix-frontend-php zabbix-agent		# Install the following packages on your system: zabbix-server-mysql zabbix-frontend-php zabbix-agent
	# Create a database, a user, and schema following the instructions in the /usr/share/doc/zabbix-server-mysql/README.Debian		# Create a database, a user, and schema following the instructions in the ''/usr/share/doc/zabbix-server-mysql/README.Debian'' README file.
	#* NOTE: These instructions use the MySQL command line, if you prefer you can create the same database, user, and schema using the Webmin software but you'll have to translate the command line instructions into the actions required in Webmin.		#* NOTE: These instructions use the MySQL/MariaDB command line, if you prefer you can create the same database, user, and schema using the Webmin software but you'll have to translate the command line instructions into the actions required in Webmin.
	# Edit the server configuration file /etc/zabbix/zabbix_server.conf to include the correct database name, username and password used when you setup the database above.		# Edit the server configuration file ''/etc/zabbix/zabbix_server.conf'' to include the correct database name, username and password used when you setup the database above.
	# Edit the /etc/default/zabbix-server file to allow the server to start and then start the server with the '''service zabbix-server --full-restart''' command.		# Edit the ''/etc/default/zabbix-server'' file to allow the server to start and then start the server with the '''service zabbix-server --full-restart''' command.
	# Make the Apache and PHP configuration changes outlined in the /usr/share/doc/zabbix-frontend-php/README.Debian file to enable the Zabbix web application		# Make the Apache and PHP configuration changes outlined in the ''/usr/share/doc/zabbix-frontend-php/README.Debian'' file to enable the Zabbix web application
	# Access the Zabbix web application at http://~~yourserver~~/zabbix/ and complete the setup wizard.		# Access the Zabbix web application at http://yourserveripaddressordnsname/zabbix/ and complete the setup wizard.
	# Login to http://yourserver/zabbix/ (where yourserver is the IP address or DNS name for your system) with the username and password found in the above README file.		# Login to http://yourserver/zabbix/ (where yourserver is the IP address or DNS name for your system) with the username and password found in the above README file.
	# Enable monitoring of your Zabbix server host (Configuration -> Hosts)		# Enable monitoring of your Zabbix server host (''Configuration'' -> ''Hosts'')
	# Add the templates appropriate for the services we are running on the server (HTTP, IMAP, MySQL~~, POP~~, SMTP, SSH)		# Add the templates appropriate for the services we are running on the server (HTTP, IMAP, MySQL, SMTP, SSH)
	# Explore some of the data available through Zabbix such as various graphs (Monitoring -> Graphs), Latest Data (Monitoring -> Latest Data), Screens (Monitoring -> Screens), and Events (Monitoring -> Events)		# Explore some of the data available through Zabbix such as various graphs (''Monitoring'' -> ''Graphs''), Latest Data (''Monitoring'' -> ''Latest Data''), Screens (''Monitoring'' -> ''Screens''), and Events (''Monitoring'' -> ''Events'')
	# Try temporarily stopping some of the services on your system (to simulate a problem) such as the Postfix SMTP server, courier-imap ~~server, courier-pop3~~ server, etc. using the command line '''service''' command.		# Try temporarily stopping some of the services on your system (to simulate a problem) such as the Postfix SMTP server, ''courier-imap'' server, etc. using the command line '''service''' command.
	# Re-check the data in Zabbix with the services turned off, are you alerted of the problems? Make sure to turn the services back on when you're done.		# Re-check the data in Zabbix with the services turned off, are you alerted of the problems? Make sure to turn the services back on when you're done.
	# If you have additional time see if you can get email notifications of failed services working (see Administration -> Media Types -> Email and Configuration -> Actions)		# If you have additional time see if you can get email notifications of failed services working (see ''Administration'' -> ''Media Types'' -> ''Email and Configuration'' -> ''Actions'')
	#* Note: The Zabbix manual at https://www.zabbix.com/documentation/2.4/manual may be helpful as well.		#* Note: The Zabbix manual at https://www.zabbix.com/documentation/2.4/manual may be helpful as well.