From 80b8874bc01a7b735fd167dd165a4fb9e538d9a5 Mon Sep 17 00:00:00 2001 From: Eric Iniguez <43428465+colonEndBracket@users.noreply.github.com> Date: Sat, 27 Mar 2021 14:25:15 -0500 Subject: [PATCH 1/2] corrected typo at 'ocredit' of pamcracklib guide --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 19e1981..1832a66 100644 --- a/README.md +++ b/README.md @@ -63,7 +63,7 @@ To edit files, run `gedit`, a graphical editor akin to notepad; `nano`, a simple 1. Add `minlen=8` to the end of the line that has `pam_unix.so` in it. 1. Add `remember=5` to the end of the line that has `pam_unix.so` in it. 1. Locate the line that has pam.cracklib.so in it. If you cannot find that line, install cracklib with `sudo apt-get install libpam-cracklib`. - 1. Add `ucredit=-1 lcredit=-1 dcredit=-1 ocredit=-` to the end of that line. + 1. Add `ucredit=-1 lcredit=-1 dcredit=-1 ocredit=-1` to the end of that line. 3. Implement an account lockout policy. 1. Open `/etc/pam.d/common-auth`. 2. Add `deny=5 unlock_time=1800` to the end of the line with `pam_tally2.so` in it. From 19f5063dca7c726d5f286557a14ec90f905ef215 Mon Sep 17 00:00:00 2001 From: Eric Iniguez <43428465+colonEndBracket@users.noreply.github.com> Date: Sat, 27 Mar 2021 14:50:31 -0500 Subject: [PATCH 2/2] using netstat instead of ss and suggesting sudo -s --- README.md | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/README.md b/README.md index 1832a66..f750af1 100644 --- a/README.md +++ b/README.md @@ -12,6 +12,8 @@ When the order of steps does not matter, bullet points have been used instead of To edit files, run `gedit`, a graphical editor akin to notepad; `nano`, a simple command-line editor; or `vim`, a powerful but less intuitive command-line editor. Note that vim may need to be installed with `apt-get install vim`. +If you don't want to type sudo every time, you can switch to the root user with `sudo -s` + ## Checklist 1. Read the readme @@ -76,10 +78,9 @@ To edit files, run `gedit`, a graphical editor akin to notepad; `nano`, a simple In the GUI set Update Manager->Settings->Updates->Check for updates:->Daily. 1. Secure ports - 1. `sudo ss -ln` - 1. If a port has `127.0.0.1:$port` in its line, that means it's connected to loopback and isn't exposed. Otherwise, there should only be ports which are specified in the readme open (but there probably will be tons more). - 1. For each open port which should be closed: - 1. `sudo lsof -i :$port` + 1. `sudo netstat -ntulp` + 4. If a port has `127.0.0.1:$port` in its line, that means it's connected to loopback and isn't exposed. Otherwise, there should only be ports which are specified in the readme open (but there probably will be tons more). + 5. For each open port which should be closed: 1. Copy the program which is listening on the port. `whereis $program` 1. Copy where the program is (if there is more than one location, just copy the first one). @@ -87,7 +88,7 @@ To edit files, run `gedit`, a graphical editor akin to notepad; `nano`, a simple 1. This shows which package provides the file (If there is no package, that means you can probably delete it with `rm $location; killall -9 $program`). `sudo apt-get purge $package` 1. Check to make sure you aren't accidentally removing critical packages before hitting "y". - 1. `sudo ss -l` to make sure the port actually closed. + 1. `sudo netstat -ntulp` to make sure the port actually closed. 1. Secure network 1. Enable the firewall