head	1.49;
access;
symbols;
locks
	reed:1.49;
comment	@# @;


1.49
date	2011.05.01.18.00.13;	author bsdwiki;	state Exp;
branches;
next	1.48;

1.48
date	2011.05.01.17.59.02;	author bsdwiki;	state Exp;
branches;
next	1.47;

1.47
date	2011.05.01.17.27.15;	author bsdwiki;	state Exp;
branches;
next	1.46;

1.46
date	2011.05.01.17.14.52;	author bsdwiki;	state Exp;
branches;
next	1.45;

1.45
date	2011.05.01.17.04.52;	author bsdwiki;	state Exp;
branches;
next	1.44;

1.44
date	2010.07.22.16.07.33;	author bsdwiki;	state Exp;
branches;
next	1.43;

1.43
date	2010.07.22.15.59.13;	author bsdwiki;	state Exp;
branches;
next	1.42;

1.42
date	2010.07.18.16.06.37;	author bsdwiki;	state Exp;
branches;
next	1.41;

1.41
date	2010.07.18.16.04.51;	author bsdwiki;	state Exp;
branches;
next	1.40;

1.40
date	2010.07.18.15.56.15;	author bsdwiki;	state Exp;
branches;
next	1.39;

1.39
date	2010.07.18.15.47.25;	author bsdwiki;	state Exp;
branches;
next	1.38;

1.38
date	2010.07.11.04.06.20;	author bsdwiki;	state Exp;
branches;
next	1.37;

1.37
date	2010.07.10.21.35.07;	author bsdwiki;	state Exp;
branches;
next	1.36;

1.36
date	2010.07.06.18.45.19;	author bsdwiki;	state Exp;
branches;
next	1.35;

1.35
date	2010.07.06.18.38.32;	author bsdwiki;	state Exp;
branches;
next	1.34;

1.34
date	2010.07.06.17.50.43;	author bsdwiki;	state Exp;
branches;
next	1.33;

1.33
date	2010.07.06.17.34.56;	author bsdwiki;	state Exp;
branches;
next	1.32;

1.32
date	2010.07.06.17.23.33;	author bsdwiki;	state Exp;
branches;
next	1.31;

1.31
date	2010.07.06.17.17.13;	author bsdwiki;	state Exp;
branches;
next	1.30;

1.30
date	2010.07.04.15.46.41;	author bsdwiki;	state Exp;
branches;
next	1.29;

1.29
date	2010.07.03.21.48.35;	author bsdwiki;	state Exp;
branches;
next	1.28;

1.28
date	2010.07.03.21.10.56;	author bsdwiki;	state Exp;
branches;
next	1.27;

1.27
date	2010.07.03.20.46.42;	author bsdwiki;	state Exp;
branches;
next	1.26;

1.26
date	2010.07.03.17.26.14;	author bsdwiki;	state Exp;
branches;
next	1.25;

1.25
date	2010.07.03.16.58.34;	author bsdwiki;	state Exp;
branches;
next	1.24;

1.24
date	2010.07.03.16.30.30;	author bsdwiki;	state Exp;
branches;
next	1.23;

1.23
date	2010.07.03.02.57.43;	author bsdwiki;	state Exp;
branches;
next	1.22;

1.22
date	2010.07.03.02.10.58;	author bsdwiki;	state Exp;
branches;
next	1.21;

1.21
date	2010.07.03.02.08.55;	author bsdwiki;	state Exp;
branches;
next	1.20;

1.20
date	2010.07.03.02.05.08;	author bsdwiki;	state Exp;
branches;
next	1.19;

1.19
date	2010.07.03.01.55.35;	author bsdwiki;	state Exp;
branches;
next	1.18;

1.18
date	2010.07.03.00.58.33;	author bsdwiki;	state Exp;
branches;
next	1.17;

1.17
date	2010.06.30.02.13.41;	author bsdwiki;	state Exp;
branches;
next	1.16;

1.16
date	2010.06.30.01.54.42;	author bsdwiki;	state Exp;
branches;
next	1.15;

1.15
date	2010.06.30.01.24.40;	author bsdwiki;	state Exp;
branches;
next	1.14;

1.14
date	2010.06.30.00.19.41;	author bsdwiki;	state Exp;
branches;
next	1.13;

1.13
date	2010.06.20.16.50.40;	author bsdwiki;	state Exp;
branches;
next	1.12;

1.12
date	2010.06.16.02.17.25;	author bsdwiki;	state Exp;
branches;
next	1.11;

1.11
date	2010.06.15.17.43.10;	author bsdwiki;	state Exp;
branches;
next	1.10;

1.10
date	2010.06.15.17.41.45;	author bsdwiki;	state Exp;
branches;
next	1.9;

1.9
date	2010.06.15.17.40.36;	author bsdwiki;	state Exp;
branches;
next	1.8;

1.8
date	2010.06.15.17.38.31;	author bsdwiki;	state Exp;
branches;
next	1.7;

1.7
date	2010.06.06.19.24.24;	author bsdwiki;	state Exp;
branches;
next	1.6;

1.6
date	2010.06.06.17.45.54;	author bsdwiki;	state Exp;
branches;
next	1.5;

1.5
date	2010.06.01.16.33.07;	author bsdwiki;	state Exp;
branches;
next	1.4;

1.4
date	2010.06.01.16.22.05;	author bsdwiki;	state Exp;
branches;
next	1.3;

1.3
date	2010.05.29.20.58.45;	author bsdwiki;	state Exp;
branches;
next	1.2;

1.2
date	2010.05.29.19.33.12;	author bsdwiki;	state Exp;
branches;
next	1.1;

1.1
date	2010.05.29.16.11.16;	author bsdwiki;	state Exp;
branches;
next	;


desc
@From ikiwiki
@


1.49
log
@web commit by dru () at 70.26.38.81:
@
text
@## Security

BSD systems have a long history of attention to detail regarding security, and are often considered the most secure systems in the enterprise. However, security is as much a function of good system administration as it is good code. The BSDP candidate must be able to configure various security features on a BSD system, maintain them over time, and know how to assess the security  of a BSD system.

---------------

###  3.2.1. Raise or lower security level.
Importance: 3.7, Frequency: 1.9, Bloom: K,C,A

**Concept:**

BSD systems have the capability to change their operational security through a facility known as securelevels. The name of the secureleves and their effects vary by BSD system.

BSDP candidates should understand the nature of higher security level environments and should be able to modify the current security level.

**Practical:**

sysctl(8), init(8)

DragonFly BSD, FreeBSD: security(7)

NetBSD: secmodel(9)

OpenBSD: securelevel(7)

**Estimated Time:**

5 minutes to be able to configure the security level of the system according to a specification.

###  3.2.2. Configure system to deny local root logins.

Importance: 4.1, Frequency: 2.0, Bloom: K,C,A

**Concept:** 

Due to the elevated permissions of the root (superuser) account, many security policies disallow the practice of logging in as the root user.

BSDP candidates should be familiar with how BSD systems perform console and serial logins, and should be able to configure the system to deny root logins from these types of devices.

**Practical:**

login(1), login.conf(5), getty(8), gettytab(5), init(8), ttys(5)

DragonFly BSD, FreeBSD, OpenBSD: fbtab(5)

DragonFly BSD, FreeBSD, NetBSD: login.access(5)

**Estimated Time:**

15 minutes to configure the system to deny root logins according to a specification.

###  3.2.3. Configure support for an alternative authentication mechanism.

Importance: 3.5, Frequency: 1.8, Bloom: K,C,A

**Concept:**

BSD systems provide either the Pluggable Authentication Model (PAM) or the  BSD Authentication libraries in order to supplement the traditional Unix authentication model. 

BSDP candidates should understand the authentication framework for their BSD of choice and know how to configure a BSD system to use alternate authentication methods.

**Practical:**

DragonFly BSD, FreeBSD, NetBSD: pam(3), pam.conf(5)

OpenBSD: authenticate(3), bsd_auth(3)

**Estimated Time:**

15 minutes to configure and test alternative authentication according to a specification.

###  3.2.4. Understand how ACLs augment traditional Unix permissions.

Importance: 3.4, Frequency: 2.0, Bloom: K,C

**Concept:**

Some filesystems support Access Control Lists (ACLs). These provide extensions that allow for the use of fine grained discretionary and mandatory access control by the system administrator. 

BSDP candidates should have an understanding of how ACLs extend basic Unix permissions and be able to recognize a correct usage of ACL entries.

**Practical:**

FreeBSD: setfacl(1), getfacl(1), acl(3), getextattr(8), setextattr(8), acl(9), extattr(9), lsextattr(8)

**Estimated Time:**

5 minutes to review a file's ACL entry.

###  3.2.5. Change the flags on sensitive files.

Importance: 3.9, Frequency: 2.3, Bloom: K,C,A

**Concept:**

File flags provide extended attributes that allow the administrator to control certain operations such as making files undeleteable. By setting certain flags, the system administrator can exercise greater control over files than is possible with simple Unix-style permissions.

BSDP candidates should understand the effects of each flag and be able to configure file flags.

**Practical:**

chflags(1), ls(1)

**Estimated Time:**

5 minutes to change file flags according to a specification.

###  3.2.6. Configure SSH to restrict or allow logins.

Importance: 4.3, Frequency: 2.4, Bloom: K,A

**Concept:**

Many security policies require the administrator to deny or permit specific users the ability to login over the network using the SSH protocol.

BSDP candidates should know how to configure sshd(8) to deny or permit specified users or network addresses. In addition, candidates should be familiar with the various  settings available for SSH logins.

**Practical:**

sshd_config(4), sshd(8)

**Estimated Time:**

15 minutes to configure and test SSH logins according to a specification.

###  3.2.7. Configure a Network Intrusion Detection System.

Importance: 3.7, Frequency: 1.8, Bloom: K,C,A

**Concept:**
 
A Network Intrusion Detection System (NIDS) listens to network traffic and raises an alert when certain traffic is detected. 

BSDP candidates should be able to install and configure a NIDS that can watch for and display network traffic.

**Practical:**

software of choice from packages/pkgsrc

**Estimated Time:**

30 minutes to configure, implement, and test a simple NIDS according to a specification.

###  3.2.8. Configure and use sudo.

Importance: 4.0, Frequency: 2.8, Bloom: K,A

**Concept:**

sudo(8) allows a user to run commands as another user .The sudoers(5) file contains details on which users can run specific commands, and under what conditions. sudo(8) is helpful where certain privileged programs must be run by unprivileged users.

BSDP candidates should be familiar with setting up sudo and configuring the sudoers
file to permit programs to be run according to a specification.

**Practical:**

sudo from packages/pkgsrc when not installed by default

sudo(8), sudoers(5), visudo(8)

**Estimated Time:**

15 minutes to create, implement and test a working sudo configuration according to a specification.

###  3.2.9. Download and pply security patches.

Importance: 4.7, Frequency: 3.1, Bloom: K,C,A

**Concept:**

Security advisories are released by a BSD project whenever a flaw or bug is discovered in
supported software.  The technical details of the advisories vary between the projects, but each advisory contains instructions on how to fix the specific problem.

BSDP candidates should be familiar with implementing the instructions within security advisories, including how to download and apply software patches and recompile the affected software.

**Practical:**

make(1), patch(1)

FreeBSD: freebsd-update(8)

NetBSD: cvs(1), build.sh

**Estimated Time:**

10 minutes to perform the instructions within a specified security advisory.

###  3.2.10. Scan and review open ports.

Importance: 4.0, Frequency: 2.8, Bloom: K,A

**Concept:**

Daemons that listen on the network for incoming connections do so by opening a socket on a specific port. While these sockets are actively listening, the ports are considered "open" and ready to serve requests.

BSDP candidates should  be able to use common security tools to scan a local or a remote system for open ports.

**Practical:**

software of choice from packages/pkgsrc

netstat(1)

DragonFly BSD, FreeBSD, NetBSD: sockstat(1)

**Estimated Time:**

15 minutes to scan a host for open ports according to a specification.

###  3.2.11. Generate self-signed certificates.

Importance: 3.7, Frequency: 1.9, Bloom: K,C,A

**Concept:**

Self-signed certificates are useful in software testing and in limited use deployments of
secured systems.  

BSDP candidates should understand the certification deployment framework and be able to configure a Certificate Authority according to a specification. Candidates should then be able to use that Authority to sign certificates.

**Practical:**

openssl(1)

DragonFly BSD, FreeBSD: verify(1), x509(1), CA.pl(1), ca(1), req(1) 

NetBSD:  openssl.cnf(5), openssl_ca(1), and related openssl_*(1) utilities

**Estimated Time:**

45 minutes to set up a Certificate Authority and use that Authority to generate and verify a self-signed certificate according to a specification.

###  3.2.12. Scan a password file for weak passwords.

Importance: 3.6, Frequency: 2.2, Bloom: K,A

**Concept:**

Some security policies require periodic scanning of the password database to ensure that users are complying with the password policy. 

BSDP candidates should be aware of the legal and moral obligations involved in password scanning and, as required by their employment duties, know how to perform both a dictionary and brute force password cracking exercise.

**Practical:**

software of choice from packages/pkgsrc

passwd(5), master.passwd(5)

**Estimated Time:**

20 minutes to configure and review the results from a dictionary scan.

###  3.2.13. Configure kernel to prevent ability to perform network sniffing.

Importance: 3.4, Frequency: 1.5, Bloom: K,A

**Concept:**

The Berkeley Packet Filter (bpf) enables a BSD system to acquire and process packets directly off the network interface and is necessary to perform network packet sniffing on a BSD system.

BSDP candidates should know how to disable the operation of bpf on their BSD system of choice. 

**Practical:**

bpf(4)

**Estimated Time:**

5 minutes to configure a kernel without bpf.

###  3.2.14. Configure a firewall to act as an authentication gateway.

Importance: 3.5, Frequency: 1.6, Bloom: K,C,A

**Concept:**

An authentication gateway is one that permits traffic to pass after a valid authentication mechanism approves the flow.  Once authentication is successful, predetermined rules are applied to the traffic flow.

BSDP candidates should be able to configure an authentication gateway.

**Practical:**

software of choice from packages/pkgsrc

pf(4), pfctl(8), authpf(8), pf.conf(5)

**Estimated Time:**

30 minutes to configure and test an authentication gateway according to a specification.

###  3.2.15. Configure a firewall for greylisting or blacklisting.

Importance: 3.7, Frequency: 2.1, Bloom: K,C,A

**Concept:**

System administrators can configure a firewall to recognize when suspicious traffic occurs and to block the offending network or host temporarily (greylisting) or permanently (blacklisting).

BSDP candidates should be able to configure their BSD firewall of choice to recognize a traffic pattern designated as suspicious and restrict the source temporarily or permanently.

**Practical:**

software of choice from packages/pkgsrc

pf(4), pfctl(8), pf.conf(5)

DragonFly BSD, FreeBSD: ipfw(8)

**Estimated Time:**

20 minutes to configure and test a firewall to greylist or blacklist
traffic according to a specification.

###  3.2.16. Configure a firewall to deny multiple connection attempts from an attacker.

Importance: 4.0, Frequency: 2.4, Bloom: K,C,A

**Concept:**

In the case of multiple connection attempts, network traffic is considered to be malicious when the number of connection attempts exceeds a predetermined threshold.

BSDP candidates should be able to configure their BSD firewall of choice to  deny connection attempts that exceed a connection threshold. 

**Practical:**

pf(4), pfctl(8), pf.conf(5)

DragonFly BSD, FreeBSD: ipfw(8)

**Estimated Time:**

20 minutes to configure and test the denial of connection attempts according to a specification.

###  3.2.17. Configure a firewall with custom packet filtering rules.

Importance: 4.3, Frequency: 2.7, Bloom: K,C,A

**Concept:**

Configuring a firewall to permit and deny traffic is a common
system administration task.  Traffic is often constrained by
security policies that restrict traffic flows to those officially
approved.

BSDP candidates should be able to configure their BSD firewall of choice to
permit and deny traffic based on a specification.

**Practical:**

30 minutes to configure, and test a firewall rule set based on
a specification.

pf(4), pfctl(8), pf.conf(5)

DragonFly BSD, FreeBSD: ipfw(8)

**Estimated Time:**

20 minutes to configure and test firewall rules according to a
specification.

###  3.2.18. Configure TCP wrappers.

Importance: 3.4, Frequency: 1.9, Bloom: K,C,A

**Concept:**

TCP wrappers allows a system administrator to exercise fine grained control over remote access to network services. 

BSDP candidates should understand the capabilities offered by TCP wrappers and be able to configure the system to allow or deny remote users access to specific services.

**Practical:**

inetd(8), inetd.conf(5), hosts_access(5), hosts_options(5)

**Estimated Time:**

20 minutes to configure and test a system to use TCP wrappers according to a specification.

###  3.2.19. Configure a file integrity checking utility.
Importance: 3.5, Frequency: 2.0, Bloom: K,C,A

**Concept:**

BSD systems have integrity checking utilities present in the base system.  These
utilities can be used to produce MD5, SHA, and RIPE hashes of individual files, directories,
or whole filesystems.

BSDP candidates should be able to produce file integrity hash collections and use those hashes to determine if there have been any changes to file content or file attributes.

**Practical:**

software of choice from packages/pkgsrc

mtree(8), cksum(1), stat(1)

**Estimated Time:**

20 minutes to create a hash collection according to a specification and to detect changes to file content or attributes.

###  3.2.20. Configure One-Time Passwords (OTP).

Importance: 3.0, Frequency: 1.5, Bloom: K,C,A

**Concept:**

One Time Passwords (OTP) restrict users from reusing the same password for subsequent authentication.  This significantly reduces the chance that an attacker can gain access by reusing another user's password. OTP utilizes S/KEY (RFC 2289) to secure the password against replay attacks.

BSDP candidates should know how to configure and test OTP.

**Practical:**

*DragonFly BSD, FreeBSD:* opie(4), opiekeys(5), opieaccess(5), opiekey(1), opieinfo(1), opiepasswd(1)

*NetBSD, OpenBSD:* skey(1), skeyaudit(1), skeyinfo(1), skeyinit(1)

**Estimated Time:**

30 minutes to configure and test OTP.

###  3.2.21. Configure a password policy.

Importance: 3.5, Frequency: 1.6, Bloom: K,C,A

**Concept:** NOTE: the wording of this objective was simplified.

Many security policies require require the use of advanced controls on password usage.

Given a specification, BSDP candidates should be able to configure a password policy. Possible specifications include: login backoff delay, number of login attempts, allowable login times, and minimum password length.

**Practical:**

software of choice from packages/pkgsrc

login.conf(5)

DragonFly BSD, FreeBSD: pam_passwdqc(8), pam.conf(5)

**Estimated Time:**

20 minutes to configure a password policy according to a specification.

###  3.2.22. Utilize  daily security checks to monitor system for common security threats.

Importance: 4.3, Frequency: 3.3, Bloom: K,A

**Concept:**

BSD systems provide a set of scripts and programs that perform security monitoring on a periodic basis. The scripts examine files and perform operations to gather relevant security information which is provided to the administrator in a daily email summary.

BSDP candidates should be familiar with the location and use of these monitoring scripts and be able to configure them to be turned on or off. 

**Practical:**

DragonFly BSD, FreeBSD: periodic(8), periodic.conf(5), security(7)

*NetBSD:*  security.conf(5)

*OpenBSD:* security(8)

**Estimated Time:**

15 minutes to attend to the security email and enable or disable monitoring scripts according to a specification.

<font color="#A0A0A0">
###  50. Install and configure a Kerberos server.
Importance: 2.7, Frequency: 1.2, Bloom: K,F,C

**Concept:**  dru@@ is anyone using Kerberos anymore?

@@@@@@jpb: recommend removing this objective : removed and shaded- jpb

**Practical:**

**Estimated Time:**
</font>

###  3.2.23. Configure an IPSec VPN.

Importance: 3.3, Frequency: 1.2, Bloom: K,C,A

**Concept:**

IPSec is a set of protocols- ESP (for Encapsulating Security Payload), AH (for Authentication Header), and IPComp (for IP Payload Compression Protocol)- that provide security services for IP packets. 

BSDP candidates should understand the differences between IPSec transport and tunnel modes. Candidates should also be able to configure an IPSec Virtual Private Network (VPN) in tunnel mode between two networks.

**Practical:**

software of choice from packages/pkgsrc

sysctl(7) or (8), ipsec(4)

DragonFly BSD, FreeBSD: setkey(8), ipsec_set_policy(3)

NetBSD: racoon(8), setkey(8), racoon.conf(5)

OpenBSD: enc(4), pf.conf(5), ipsecctl(8), isakmpd(8)

**Estimated Time:**

45 minutes to configure, setup, and test an IPsec VPN according
to a specification.


###  3.2.24. Configure process accounting or security event auditing.

Importance: 3.9, Frequency: 2.2, Bloom: K,F,C

**Concept:** NOTE: wording modified so applies to all BSDs

BSD systems provide various facilities for determining activity on a system. Process accounting provides statistics on system resources and their allocation among users. Security event auditing, available on FreeBSD only, provides more fine-grained logging of a variety of security-relevant system events, including logins, configuration changes, and file and network access.

BSDP candidates should be familiar with the accounting and auditing capabilities provided by their BSD of choice and be able to configure the system to collect, process, and report on notifications.

**Practical:**

sa(8),  lastcomm(1), acct(5), ac(8), accton(8)

FreeBSD: audit(4), audit_class(5), audit_control(5), audit_event(5), audit_warn(5), auditd(8), audit(8)

**Estimated Time:**

30 minutes to configure accounting or  auditing according to a specification.
@


1.48
log
@web commit by dru () at 70.26.38.81:
@
text
@d291 1
a291 1
###  42. Configure a firewall for greylisting or blacklisting.
@


1.47
log
@web commit by dru () at 70.26.38.81:
@
text
@d271 2
a272 1
###  41. Configure a firewall to act as an authentication gateway.
d277 1
a277 5
An authentication gateway is one that permits traffic to pass after
a valid authentication mechanism approves the flow.  Authentication
can take the form of entering a username and password (which may be
a personal ID + token value).  Once authentication is successful,
predetermined rules are applied to the traffic flow.
d279 1
a279 3
BSDP candidates should be familiar with at least one firewall that
permits predetermined traffic flows upon successful authentication
to the gateway.
d283 3
a285 1
pf(4), pfctl(8), authpf(8)
d289 1
a289 2
30 minutes to configure and test an authentication gateway to allow
predetermined traffic flow according to a specification.
d292 1
d297 1
a297 5
Greylisting and blacklisting refer to the ability of a firewall
to restrict traffic based on a perceived threat to the health
of the network.  Firewall rules permit the firewall to recognize
when suspicious traffic occurs and block the offending network
or host temporarily (greylisting) or permanently (blacklisting).
d299 1
a299 3
BSDP candidates should be able to configure a firewall to recognize
a traffic pattern designated as suspicious and restrict the source
temporarily or permanently according to a specification.
d301 1
a301 1
XXX-HF: s/firewall/mailserver/
d303 1
a303 1
@@@@@@jpb:  no- "firewall" was used intentionally here.
d305 1
a305 1
**Practical:**
d307 1
a307 1
pf(4), pfctl(8), pf.conf(5), ipf(8), ipfw(8)
d314 2
a315 1
###  43. Configure a firewall to disable multiple connection attempts from an attacker.
d320 1
a320 6
Related to the above objective, this objective requires the
system administrator to configure the firewall to block multiple connection
attempts (brute forcing).  In the case of multiple connection attempts,
the actual network traffic is legitimate, but the purpose behind the traffic
is malicious when the number of connection attempts exceeds a predetermined
threshold.
d322 1
a322 4
BSDP candidates should be able to configure a firewall to recognize
connection attempts that exceed a connection threshold as malicious
and block further attempts temporarily or permanently.  Note that this
action should not disable all traffic that does not exceed the threshold.
d324 1
d326 1
a326 1
**Practical:**
d328 1
a328 1
pf(4), pfctl(8), pf.conf(5), ipf(8), ipfw(8)
d332 3
a334 2
30 minutes to configure and test disabling connection attempts
according to a specification. 
a335 1
###  44. Configure a firewall with custom packet filtering rules.
d341 1
a341 1
system administration task.  Traffic is often based on written
d345 2
a346 2
BSDP candidates should be able to configure a firewall to
permit and deny traffic through a firewall based on a specification.
d353 3
a355 1
pf(4), pfctl(8), pf.conf(5), ipf(8), ipfw(8)
d359 1
a359 1
20 minutes to configure and test firewall rules operation according to a
d362 2
a363 1
###  45. Configure TCP wrappers.
d368 1
a368 3
The TCP wrappers capability allows system administrators to exercise fine grained control
over remote access to system software. The capability relies on the use of configuration
files to permit or deny access, as well as the use of the inetd server with appropriate options.
d370 1
a370 3
BSDP candidates should understand the capabilities offered by TCP wrappers and be able
to configure the system to allow or deny remote users access to specific software according
to a specification.
d374 1
a374 1
inetd(8), hosts_access(5), hosts_options(5)
d378 1
a378 1
30 minutes to configure and test a system to use TCP wrappers according to a specification.
d380 1
a380 1
###  46. Configure a file integrity checking utility.
d389 1
a389 4
BSDP candidates should be able to use the listed facilities to produce file integrity
hash collections and use those hashes to determine the nature of any changes to file content
or file attributes (metadata).

d393 1
a393 1
mtree(8), dgst(1), cksum(1)
d395 1
d399 3
a401 2
20 minutes to create a hash collection, and use that hash collection to detect any
changes to file content or attributes.
a402 1
###  47. Configure One-Time Passwords (OTP).
d407 1
a407 5
Setting up a BSD system to use One Time Passwords (OTP) restricts users from reusing
the same password for subsequent authentication.  The idea is that once a particular password
is used, it is never reused.  This significantly reduces the chance that an
attacker can gain access by sniffing passwords off the network, or looking over someone's shoulder.
OTP utilizes S/KEY (RFC 2289) to secure the password against replay attacks.
d409 1
a409 4
BSDP candidates should know how to configure and test a user account to use OTP.


**NOTE:** *S/KEY* is a trademark of Bellcore (now Telcordia).
d413 1
a413 1
*DragonFlyBSD and FreeBSD:* opie(4), opiekeys(5), opieaccess(5), opiekey(1), opieinfo(1), opiepasswd(1)
d415 1
a415 1
*NetBSD and OpenBSD:* skey(1), skeyaudit(1), skeyinfo(1), skeyinit(1).  skey(5)- OpenBSD only.
d417 1
d419 1
a419 1
**Estimated Time:**
d421 1
a421 1
30 minutes to configure and test a user account to use OTP
a422 1
###  48. Configure login.conf or PAM for improving password security.
d425 1
a425 6
**Concept:**


dru@@: is the word "new" needed in objective?

@@@@@@jpb: word "new" removed.
d427 1
d429 1
a429 3
Given a set of specifications, BSDP candidates should be able to configure a password policy using login.conf on any BSD or PAM on FreeBSD and DragonFlyBSD. Possible specifications include: login backoff delay, number of login tries, allowable login times, and minimum password length.

XXX-HF: s/login.conf or PAM/the system/ ?
d433 1
a433 1
FreeBSD and DragonFlyBSD: pam_passwdqc(8), pam.conf(5)
d437 2
d441 3
a443 1
20 minutes
d445 1
a445 2
###  49. Utilize  daily security checks to monitor system for common security threats.
Importance: 4.3, Frequency: 3.3, Bloom: K, A
d449 1
a449 4
BSD systems contain a set of scripts and programs that perform security monitoring
on a periodic basis.  The scripts examine files and perform operations to gather
relevant security related information which is displayed for the administrator in
a daily, easy to read email summary.
d451 1
a451 6
BSDP candidates should be familiar with the location and use of these monitoring
scripts and be able to configure them to be turned on or off.  

dru@@ this is very vague, what are we asking about, reading daily security output?

@@@@@@jpb: fixed
d455 1
a455 1
*FreeBSD and DragonFlyBSD:* period(8), periodic.conf(5)
a460 1

d463 1
a463 1
15 minutes to attend to daily email and enable or disable monitoring scripts according to a specification.
a470 1

a472 1

d478 1
d480 1
a480 2
###  51. Configure an IPSec VPN.
Importance: 3.3, Frequency: 1.2, Bloom: K,F,C
d484 1
a484 9
IPsec is a set of protocols, ESP (for Encapsulating Security Payload), 
AH (for Authentication Header), and IPComp (for
IP Payload Compression Protocol) that provide security services for IP
datagrams.  AH both authenticates and guarantees the integrity of an IP
packet by attaching a cryptographic checksum computed using one-way hash
functions.  ESP, in addition, prevents unauthorized parties from reading
the payload of an IP packet by also encrypting it.  IPComp tries to
increase communication performance by compressing IP payload, thus reduc-
ing the amount of data sent.
d486 1
a486 2
IPsec operates in one of two modes: transport
mode or tunnel mode.
d488 1
a488 4
* **Transport mode** is used to protect peer-to-peer communication between end nodes.
* **Tunnel mode** encapsulates IP packets within
other IP packets and is designed for security gateways such as VPN end-
points.
d490 1
a490 4
BSDP candidates should understand the differences between IPSec in 
transport and tunnel mode. Candidates should
also be able to configure an IPSec VPN (tunnel mode) between
two networks according to a set of specifications.
d492 1
d494 1
a494 4
**Practical:**

*FreeBSD:* 
setkey(8), ipsec_set_policy(3), ipsec(4), crypto(4), sysctl(8)
d496 1
a496 2
*OpenBSD:* 
openssl(1), enc(4), ipsec(4), pf.conf(5), ipsecctl(8), isakmpd(8), sysctl(8)
d498 1
d503 2
a504 1
to a set of specifications.
d506 1
a507 1
###  52. Configure security event auditing.
d510 1
a510 13
**Concept:**


Note: Security auditing is a feature of FreeBSD only.

Auditd permits the collection and processing of
audit notifications from the kernel.  

BSDP candidates should be familiar with kernel auditing
capabilities on FreeBSD and be able to configure
the system to collect, process, and report on audit
notifications from the kernel according to a set
of specifications.
d512 1
d514 1
d518 1
d520 1
a520 5
audit(4), audit_class(5), audit_control(5),
audit_event(5), audit_warn(5), auditd(8),
audit(8)


d524 1
a524 3
20 minutes to configure kernel auditing according to a specification.


@


1.46
log
@web commit by dru () at 70.26.38.81:
@
text
@d52 1
a52 1
###  32.3. Configure support for an alternative authentication mechanism.
d72 1
a72 1
###  32.4. Understand how ACLs augment traditional Unix permissions.
a107 1

d144 3
a146 2
###  35. Install (if needed), configure, and use sudo.
Importance: 4.0, Frequency: 2.8, Bloom: K
d150 1
a150 4
Sudo(8) allows a user to run commands as another user (or the root user) as specified
in the "sudoers" file.  Sudoers contains the details of which users can run which commands,
and under what conditions.  Sudo is extremely helpful where certain privileged programs
must be run by unprivileged users.
d152 2
a153 2
BSDP candidates should be familiar with setting up sudo, and configuring the sudoers
file to permit programs to be run according to a set of specifications.
d155 1
d157 1
a157 1
**Practical:**
d159 1
a159 1
sudo(8), sudoers(5), visudo(8), su(1)
d163 1
a163 1
15 minutes to create, implement and test a working sudo configuration according to specifications.
d165 1
a166 1
###  36. Apply security patches.
d171 2
a172 3
Security advisories are released by each BSD project whenever a flaw or bug is discovered in
supported software.  The technical details of the advisories vary between the projects, but all
projects contain instructions on how to fix the specific problem.
d174 1
a174 3
BSDP candidates should be familiar with security advisories for all of the BSD projects. In particular,
candidates should know how to download and apply software patches, recompile the software, and update
the affected binaries.
d178 1
a178 1
Software advisories can be found at:
d180 1
a180 1
*Freebsd:* http://security.freebsd.org/advisories   (see also the main page at www.freebsd.org)
d182 1
a182 3
*DragonflyBSD:* http://www.dragonflybsd.org  Note that formal security advisories show up
on the users@@ mailing list.  However, the Digest page (http://www.shiningsilence.com/dbsdlog/)
often has notification of security advisories.
d184 1
a184 3
*NetBSD:* http://www.netbsd.org/support/security/

*OpenBSD:* http://www.openbsd.org/security.html
d186 1
d188 1
a188 3
**Estimated Time:**

30 minutes to be able to download an advisory, update the software, and test the results.
d190 1
a190 2
###  37. Scan a network to review open ports.
Importance: 4.0, Frequency: 2.8, Bloom: K
d194 1
a194 4
Systems daemons (such as web, FTP, DNS, and sshd servers) that listen to the network
for incoming connections do so by opening a socket on a specific port.
While these sockets are actively listening, the ports are considered "open" and
ready to serve requests.
d196 1
a196 1
BSDP candidates should understand:
d198 1
a198 3
* how applications open and close ports
* how to configure common services to use specific ports
* how to determine if a remote system has a specific port open for TCP or UDP traffic
d200 1
a200 4
Candidates should also be able to use common BSD tools to scan a remote system
for open ports.

**Practical:**
d202 1
a202 1
ifconfig(8), telnet(1), netstat(1), sh(1)
d204 1
a204 2
In addition, there are packages that specialize in port scanning such as **nmap**
and **hping3**.
d208 1
a208 1
15 minutes to scan a remote host for open ports according to a specification.
d210 1
a211 1
###  38. Generate self-signed certificates.
d217 1
a217 2
secured systems.  While not a 'Best Practice' for production use, they are very useful
in certain environments.
d219 1
a219 5
Self-signed certificates require the system administrator to set up a Certificate Authority, then
use that Authority to sign incoming certificate requests.  BSDP candidates should understand
the certification deployment framework, and be able to configure a Certificate Authority
according to a specification.  Candidates should then be able to use that Authority to
sign certificates according to a related specification.
d223 1
a223 2
*FreeBSD and DragonFlyBSD*: 
openssl(1), verify(1), x509(1), CA.pl(1), ca(1), req(1) 
d225 1
a225 6
*NetBSD:*
openssl(1),  openssl.cnf(5), openssl_ca(1) and all related openssl_*(1) utilities.

*OpenBSD:*
All certificate operations are available within openssl(1).  They are structured
as "command" options to the openssl(1) application.
d227 1
d231 1
a231 2
45 minutes to set up a certificate authority, and use that authority to generate and verify a self-signed
certificate.
d233 1
a233 1
**Note:** it is not necessary to deploy the certificate for network services (i.e. web or mail) usage.
d235 1
d237 1
a237 2
###  39. Scan a password file for weak passwords.
Importance: 3.6, Frequency: 2.2, Bloom: K
d239 1
a239 1
**Concept:**
d241 1
a241 1
Some security policies require periodic scanning of the password database to ensure that users are complying with the password policy. BSDP candidates should be aware of the legal and moral obligations involved in password scanning and, as required by their employment duties, know how to perform both a dictionary and brute force password cracking exercise.
d245 3
a247 2
There are packages that specialize in password cracking such as **john** and  **crack**.
It is also possible to create a script to check passwords against a "frequently used passwords" list.
d251 3
a253 2
30 minutes to configure a password cracker utility and receive the results from a dictionary scan
or create a simple script to decrypt a password from a list of passwords.
a254 1
###  40. Configure kernel to prevent ability to perform network sniffing.
d259 1
a259 10
The Berkeley Packet Filter (BPF) enables a BSD system to acquire and
process packets directly off the network interface (a.k.a. packet sniffing).

BSDP candidates should know how to disable the operation
of the BPF device in a live kernel, and how to configure and
recompile the kernel so that the BPF device is not available. 

XXX-HF Do all BSDs have such a kernel option?

@@@@@@-jbp: yes
d261 1
d265 1
a265 6
*All:* bpf(4)

*DragonFlyBSD and FreeBSD*: config(9), kernconf(5), kldload(8), kldunload(8), kldstat(8),


*NetBSD and OpenBSD:* lkm(4), modload(8), modunload(8), modstat(8), options(4)
d269 1
a269 2
15 minutes to disable bpf processing in the kernel and disable the
option in the kernel configuration files.
@


1.45
log
@web commit by dru () at 70.26.38.81:
@
text
@d7 1
a7 1
###  28. Raise or lower security level.
d12 1
a12 5
BSD systems have the capability to change their level of security through a facility
known as "secure levels".  Changing the secure level value of a BSD system is
handled by modifying a kernel sysctl variable- kern.securelevel.  Changing this value
to a higher value (making the system more secure) is possible, but lowering the value
(making the system less secure) is not possible while the system is running.
d14 1
a14 2
The differences between the BSD systems on the effects of setting the secure level
higher vary somewhat, but all systems adhere to the following general progression.
d16 1
a16 8
Increasing the security level to 'secure mode':
- Disables writes to /dev/mem, and /dev/kmem.
- Disables ability to write to raw disks of mounted file systems
- Kernel modules may not be loaded or unloaded

Increasing the security level to 'highly secure mode':
- Disables kernel time changes greater than one second
- Disables writing to disk devices whether mounted or not
d18 1
a18 1
There is an additional level ("Network secure mode") for DragonFly BSD, and FreeBSD.
d20 1
a20 3
BSDP candidates should understand the nature of higher security level environments
and should be able to configure the security level to a higher value, enabling
conditions such as those described above.
d22 1
d24 1
a24 3
**Practical:**

sysctl(8), init(8), chflags(1), secmodel_bsd44(9) (NetBSD only)
d30 2
a31 1
###  29. Configure system to deny root logins.
d36 1
a36 3
This objective focuses on how to adequately secure the console and attached
serial devices from root login.  A separate objective deals with securing
logins over the network via ssh (see below).
d38 1
a38 3
BSDP candidates should be familiar with how BSD systems perform console and serial logins,
and should be able to configure the system to deny root logins from these types of devices
according to a specification.
d40 1
a40 3
XXX-HF unclear: from where - serial console, system console, telnet, ssh, ftp, ...?

@@@@@@-jpb: cleared up
d42 1
d44 1
a44 1
**Practical:**
d46 1
a46 1
login(1), login.access(5), login.conf(5), fbtab(5), getty(8), gettytab(5), init(8)
d52 1
a53 1
###  30. Configure PAM to support an alternative authentication mechanism.
d58 3
a60 5
Pluggable Authentication Modules (PAM) support multiple authentication-related
operations.  These operations constitute a PAM transaction and may consist of
any of the following facilities: authentication, account management, session management,
and password management.  BSDP candidates should understand the basic PAM
framework, and know how to configure PAM to use alternate authentication.
d64 1
a64 1
pam(3), pam.conf(5)
d66 1
a66 1
**Note:** It is not necessary to perform any application programming using PAM modules.
d70 1
a70 1
15 minutes to configure and test alternative authentication using PAM according to a specification.
d72 1
d74 1
a74 2
###  31. Configure ACLs to augment traditional Unix permissions.
Importance: 3.4, Frequency: 2.0, Bloom: K,C,A
d78 1
a78 10
FreeBSD supports a set of commands to manipulate Access Control Lists (ACLs) compatible
with POSIX.1e and POSIX.2c.  These commands allow for the use of fine grained discretionary and mandatory
access control by the system administrator.  These ACLs allow for much better control
of access to files than do the standard Unix permissions.  Note that not all filesystems
contain support for the use of ACLs.

BSDP candidates should have a thorough understanding of basic Unix permissions, and a
solid knowledge of the basics of the ACL framework provided for both discretionary and mandatory access control.
In addition, candidates should be able to configure ACLs for fine grained access to
files on a filesystem with ACL support according to a set of specifications. 
d80 1
a80 5
As of the date of these objectives, only FreeBSD and DragonFlyBSD support ACLs.

XXX-HF: not all BSDs have ACLs. 

@@dru: this objective will need an alternate question/lab with equal weighting
d84 1
a84 1
setfacl(1), mount(8), getfacl(1), acl(3), getextattr(8), setextattr(8), acl(9), extattr(9), lsextattr(8)
d88 3
a90 2
30 minutes to mount an ACL aware filesystem, configure, and tests both discretionary and  mandatory access
controls according to a set of specifications.
a91 1
###  32. Change the flags on sensitive files.
d96 1
a96 5
File flags are extended attributes of files (or filesystems) that allow the
administrator to control certain operations such as making files
undeleteable, immutable, or undumpable (via dump(8)).  By setting
various flags, the system administrator can exercise greater control
over the files than is possible with simple Unix-style permissions.
d98 1
a98 2
BSDP candidates should understand the various flags for each BSD system,
and be able to configure flags for files according to a set of specifications.
d102 1
a102 1
chflags(1), chflags(2), ls(1), stat(2)
d109 3
a111 2
###  33. Configure SSH to restrict logins.
Importance: 4.3, Frequency: 2.4, Bloom: K
d115 1
a115 3
Logging in as the root user on a BSD system is possible via several different methods-
using the console, a serial device (serial console), or a pty device.
This objective focuses on denying a root login over the network via ssh.
d117 1
a117 3
BSDP candidates should know how to configure sshd to deny logins by the root user.
In addition, candidates should be familiar with the various alternative settings
available for login by the root user.
d121 1
a121 1
sshd_config(4), sshd(8), 
d125 1
a125 1
15 minutes to configure and test denial of root login via ssh to a remote host.
d127 1
a128 1
###  34. Configure a Network Intrusion Detection System.
d133 1
a133 8
In simplest terms, a "Network Intrusion Detection System (NIDS)
listens to network traffic and raises an alert when certain traffic
is detected.  While commercial versions cost thousands of dollars,
it is not necessary to spend such sums just to be notified of incoming
packets that match certain patterns.  Common BSD tools such as tcpdump(1)
enable the administrator to examine network traffic that matches
a bpf filter pattern (see tcpdump(1) for examples).

d135 1
a135 10
BSDP candidates should be able to construct a simple NIDS that can
watch for and display network traffic based on:

* common network protocols such as TCP, UDP, ICMP,
* common application protocols such as DNS, HTTP, FTP, and TELNET.
* text strings in the packet data payload
* packet flags

**Note:** It is not necessary to configure any defensive actions
such as blocking or blackhole-ing traffic.
d139 1
a139 5
*FreeBSD, DragonFlyBSD,NetBSD:* tcpdump(1)
*OpenBSD:* tcpdump(8)

grep(1), pcap-filter(7)

d143 1
a143 2
30 minutes to configure, implement, and test a simple NIDS according to a set of specifications.

@


1.44
log
@web commit by jpb () at 64.101.230.132: content updates and minor edits
@
text
@d3 1
a3 2
BSD systems have a long history of attention to detail regarding security.
The BSDP candidate must be able to configure various security features on a BSD system.
@


1.43
log
@web commit by jpb () at 64.101.230.132: content updates and minor edits
@
text
@a517 1

d535 3
a537 3
is used it is never reused.  This significantly reduces the chance that an
attacker can gain access by guessing passwords.  OTP utilizes S/KEY (RFC 2289) to secure
the password against replay attacks.
d566 1
a566 1
Given a set of specifications, BSDP candidates should be able to configure a password policy using login.conf on any BSD or PAM on FreeBSD and DragonFly BSD. Possible specifications include: login backoff delay, number of login tries, allowable login times, and minimum password length.
d572 1
a572 1
FreeBSD and DragonFly BSD: pam_passwdqc(8), pam.conf(5)
d610 1
a610 1

d617 2
a618 1
@@@@@@jpb: recommend removing this objective
d623 2
a630 1

a654 1

a656 1

@


1.42
log
@web commit by jpb () at 98.180.198.168: minor edits
@
text
@d3 1
a3 1
BSD systems have a long history of attention to detail for security.
d14 1
a14 1
popularly known as "secure levels".  Changing the secure level value of a BSD system is
d44 1
a44 1
5 minutes to be able to configure the security level of the system
d47 1
a47 1
Importance: 4.1, Frequency: 2.0, Bloom: K
d92 1
a92 1
15 minutes to configure and test alternative authentication using PAM
d135 1
a135 1
over the files than is possible with simple unix-style permissions.
d146 1
a146 1
5 minutes to change file flags according to a set of specifications.
d180 1
a180 1
packets that match certain patterns.  Common BSD tools such as tcpdump(8)
d182 1
a182 1
a bpf filter pattern (see tcpdump for examples).
d285 4
a288 1
ifconfig(8), telnet(1), netstat(1), @@@@@@, sh(1)
d340 2
a341 1
john, crack
d345 2
a346 1
15 minutes to configure the password cracker utility and receive the results from a dictionary scan
d349 1
a349 1
Importance: 3.4, Frequency: 1.5, Bloom: K
d420 2
@


1.41
log
@web commit by jpb () at 98.180.198.168: Note: This objective was modified during the July 18, 2010 SME session.
@
text
@d595 1
d597 1
a597 1
*NetBSD and OpenBSD:* security(8), security.conf(5)
@


1.40
log
@web commit by jpb () at 98.180.198.168: Note: This objective was modified during the July 18, 2010 SME session.
@
text
@d575 1
a575 1
Importance: 4.3, Frequency: 3.3, Bloom: @@@@@@
d582 1
a582 1
a daily, easy to read email summary
d593 1
a593 1
Shell scripting, particularly Bourne shell (/bin/sh) scripting; periodic(5)@@@@@@, cron(8), crontab(5)
d596 2
d601 1
a601 2
15 minutes to be able to configure or modify monitoring scripts 

@


1.39
log
@web commit by jpb () at 98.180.198.168: Note: This objective was modified during the July 18, 2010 SME session.
@
text
@d582 1
a582 1
an easy to read summary. 
d585 1
a585 2
scripts and be able to configure them to be turned on or off.  Candidates should
also be able to modify the scripts to add new monitoring capabilities.
a588 2
@@@@@@jpb: reworded

@


1.38
log
@web commit by jpb () at 98.180.198.168: content update
@
text
@d574 1
a574 1
###  49. Monitor system for common security threats.
d590 2
@


1.37
log
@web commit by jpb () at 98.180.198.168: minor edits
@
text
@d549 1
a549 1
###  48. Configure login.conf or PAM for improving new password security.
d552 7
a558 1
**Concept:** dru@@: is the word "new" needed in objective?
d577 14
a590 1
**Concept:** dru@@ this is very vague, what are we asking about, reading daily security output?
d594 4
d600 4
d609 3
@


1.36
log
@web commit by dru () at 67.70.104.84:
@
text
@d663 3
@


1.35
log
@web commit by dru () at 67.70.104.84:
@
text
@d554 1
a554 1
Given a set of specifications, BSDP candidates should be able to configure a password policy using login.conf on any BSD or PAM on FreeBSD and DragonFly BSD. Possible specifications include: login backoff delay, number of login tries, login times, minimum password length, 
d571 1
a571 1
**Concept:**
d578 1
a578 1
Importance: 2.7, Frequency: 1.2, Bloom: @@@@@@
d580 1
a580 1
**Concept:**
d587 1
a587 1
Importance: 3.3, Frequency: 1.2, Bloom: @@@@@@
d634 1
a634 1
Importance: 3.9, Frequency: 2.2, Bloom: @@@@@@
@


1.34
log
@web commit by dru () at 67.70.104.84:
@
text
@d552 3
a554 1
**Concept:**
d560 4
d566 2
@


1.33
log
@web commit by dru () at 67.70.104.84:
@
text
@d344 1
a344 1
Importance: 3.4, Frequency: 1.5, Bloom: @@@@@@
d375 1
a375 1
Importance: 3.5, Frequency: 1.6, Bloom: @@@@@@
d399 1
a399 1
Importance: 3.7, Frequency: 2.1, Bloom: @@@@@@
d425 1
a425 1
Importance: 4.0, Frequency: 2.4, Bloom: @@@@@@
d452 1
a452 1
Importance: 4.3, Frequency: 2.7, Bloom: @@@@@@
d477 1
a477 1
Importance: 3.4, Frequency: 1.9, Bloom: @@@@@@
d498 1
a498 1
Importance: 3.5, Frequency: 2.0, Bloom: @@@@@@
d523 1
a523 1
Importance: 3.0, Frequency: 1.5, Bloom: @@@@@@
d550 1
a550 1
Importance: 3.5, Frequency: 1.6, Bloom: @@@@@@
@


1.32
log
@web commit by dru () at 67.70.104.84:
@
text
@d333 2
d337 2
d341 2
@


1.31
log
@web commit by dru () at 67.70.104.84:
@
text
@d9 1
a9 1
Importance: 3.7, Frequency: 1.9, Bloom: KCA
d44 1
a44 1
20 minutes to be able to configure the security level of the system
d47 1
a47 1
Importance: 4.1, Frequency: 2.0, Bloom: @@@@@@
d49 1
a49 1
**Concept:**
a58 1

d74 1
a74 1
Importance: 3.5, Frequency: 1.8, Bloom: @@@@@@
d96 1
a96 1
Importance: 3.4, Frequency: 2.0, Bloom: @@@@@@
d115 2
d127 1
a127 1
Importance: 3.9, Frequency: 2.3, Bloom: @@@@@@
d150 1
a150 1
Importance: 4.3, Frequency: 2.4, Bloom: @@@@@@
d172 1
a172 1
Importance: 3.7, Frequency: 1.8, Bloom: @@@@@@
d210 1
a210 1
Importance: 4.0, Frequency: 2.8, Bloom: @@@@@@
d233 1
a233 1
Importance: 4.7, Frequency: 3.1, Bloom: @@@@@@
d265 1
a265 1
Importance: 4.0, Frequency: 2.8, Bloom: @@@@@@
d293 1
a293 1
Importance: 3.7, Frequency: 1.9, Bloom: @@@@@@
d329 1
a329 1
Importance: 3.6, Frequency: 2.2, Bloom: @@@@@@
@


1.30
log
@web commit by jpb () at 98.180.198.168: content update
@
text
@d9 1
a9 1
Importance: 3.7, Frequency: 1.9, Bloom: @@@@@@
@


1.29
log
@web commit by jpb () at 98.180.198.168: content update
@
text
@d474 8
d484 2
d488 2
d520 11
d533 5
d540 2
@


1.28
log
@web commit by jpb () at 98.180.198.168: content update
@
text
@d341 7
d350 3
d355 7
d364 3
@


1.27
log
@web commit by jpb () at 98.180.198.168: content update
@
text
@d402 13
d417 2
d421 3
d429 8
d439 5
d446 3
@


1.26
log
@web commit by jpb () at 98.180.198.168:
@
text
@d352 5
d358 3
d364 2
d368 3
d376 10
d390 2
d394 3
@


1.25
log
@web commit by jpb () at 98.180.198.168: content update
@
text
@d352 2
@


1.24
log
@web commit by jpb () at 98.180.198.168: content update
@
text
@d250 3
a252 1
*DragonflyBSD:* http://www.dragonflybsd.org/
d315 2
a316 2
All certificate operations are available within openssl(1).  Tney are structured
as "commands" to the openssl(1) application.
d322 3
a324 1
certificate.  **Note:** it is not necessary to deploy the certificate for network services (i.e. web or mail) usage.
@


1.23
log
@web commit by jpb () at 98.180.198.168: content update
@
text
@d112 2
d193 1
a193 1
such as blocking or blackholing traffic.
d219 1
a219 1
file to permit programs to be run according to a set of specifications. 
d236 8
d246 11
d259 2
d294 10
d306 11
d319 4
@


1.22
log
@web commit by jpb () at 98.180.198.168: formatting
@
text
@d347 10
d359 3
d364 3
@


1.21
log
@web commit by jpb () at 98.180.198.168: content update
@
text
@d184 5
a188 4
*common network protocols such as TCP, UDP, ICMP,
*common application protocols such as DNS, HTTP, FTP, and TELNET.
*text strings in the packet data payload
*packet flags
d249 4
a252 3
*how applications open and close ports
*how to configure common services to use specific ports
*how to determine if a remote system has a specific port open for TCP or UDP traffic
@


1.20
log
@web commit by jpb () at 98.180.198.168: content update
@
text
@d59 6
a158 5

XXX-HF unclear: from where - serial console, system console, telnet, ssh, ftp, ...?

@@@@@@-jpb: cleared up

d184 4
a187 4
* common network protocols such as TCP, UDP, ICMP,
* common application protocols such as DNS, HTTP, FTP, and TELNET.
* text strings in the packet data payload
* packet flags
d248 3
a250 3
* how applications open and close ports
* how to configure common services to use specific ports
* how to determine if a remote system has a specific port open for TCP or UDP traffic
@


1.19
log
@web commit by jpb () at 98.180.198.168: content update
@
text
@d51 3
a53 9
Logging in as the root user on a BSD system is possible via several different methods-
using the console, a serial device (serial console), or a pty device.
This objective focuses on denying a root login over the network via ssh.  It is assumed
that BSDP candidates already know how to adequately secure the console and attached
serial devices from root login.

BSDP candidates should know how to configure sshd to deny logins by the root user.
In addition, candidates should be familiar with the various alternative settings
available for login by the root user.
d55 3
a57 4

XXX-HF unclear: from where - serial console, system console, telnet, ssh, ftp, ...?

@@@@@@-jpb: cleared up
d61 1
a61 1
sshd_config(4), sshd(8), 
d65 2
a66 1
15 minutes to configure and test denial of root login via ssh to a remote host.
d145 13
d160 2
d164 3
@


1.18
log
@web commit by jpb () at 98.180.198.168: content update
@
text
@d63 1
d79 6
d87 4
d93 3
d101 11
d116 2
d120 3
@


1.17
log
@web commit by jpb () at 98.180.198.168:
@
text
@d52 9
a60 2
using the console, a serial device (serial console), a pty device, 
Some methods us@@@@@@
d63 1
d65 1
d67 1
a67 1
**Practical:**
d71 2
@


1.16
log
@web commit by jpb () at 98.180.198.168: content update
@
text
@@


1.15
log
@web commit by jpb () at 98.180.198.168: content update
@
text
@a57 3



d156 9
d167 2
d171 3
d188 13
d203 2
d207 3
@


1.14
log
@web commit by jpb () at 98.180.198.168: content update
@
text
@d51 1
a51 1
Loggin in as the root user on a BSD system is possible via several different methods-
d53 1
a53 1
Some methods us
d90 9
d101 2
d105 3
d121 19
d143 6
d151 3
@


1.13
log
@web commit by jpb () at 98.180.198.168: bloom tags
@
text
@d267 26
d295 8
d305 4
d314 14
d330 7
@


1.12
log
@web commit by jpb () at 98.180.198.168:
@
text
@d9 1
a9 1
Importance: 3.7, Frequency: 1.9t
d47 1
a47 1
Importance: 4.1, Frequency: 2.0
d66 1
a66 1
Importance: 3.5, Frequency: 1.8
d75 1
a75 1
Importance: 3.4, Frequency: 2.0
d86 1
a86 1
Importance: 3.9, Frequency: 2.3
d95 1
a95 1
Importance: 4.3, Frequency: 2.4
d104 1
a104 1
Importance: 3.7, Frequency: 1.8
d113 1
a113 1
Importance: 4.0, Frequency: 2.8
d122 1
a122 1
Importance: 4.7, Frequency: 3.1
d131 1
a131 1
Importance: 4.0, Frequency: 2.8
d140 1
a140 1
Importance: 3.7, Frequency: 1.9
d149 1
a149 1
Importance: 3.6, Frequency: 2.2
d158 1
a158 1
Importance: 3.4, Frequency: 1.5
d169 1
a169 1
Importance: 3.5, Frequency: 1.6
d178 1
a178 1
Importance: 3.7, Frequency: 2.1
d189 1
a189 1
Importance: 4.0, Frequency: 2.4
d198 1
a198 1
Importance: 4.3, Frequency: 2.7
d207 1
a207 1
Importance: 3.4, Frequency: 1.9
d216 1
a216 1
Importance: 3.5, Frequency: 2.0
d225 1
a225 1
Importance: 3.0, Frequency: 1.5
d234 1
a234 1
Importance: 3.5, Frequency: 1.6
d245 1
a245 1
Importance: 4.3, Frequency: 3.3
d254 1
a254 1
Importance: 2.7, Frequency: 1.2
d263 1
a263 1
Importance: 3.3, Frequency: 1.2
d272 1
a272 1
Importance: 3.9, Frequency: 2.2
@


1.11
log
@web commit by hubertf () at 94.16.0.16: 48
@
text
@d9 1
a9 1
Importance: 3.7, Frequency: 1.9
d13 25
d40 2
d44 2
d51 4
d57 4
@


1.10
log
@web commit by hubertf () at 94.16.0.16: 42
@
text
@d201 2
@


1.9
log
@web commit by hubertf () at 94.16.0.16: #40
@
text
@d145 2
@


1.8
log
@web commit by hubertf () at 94.16.0.16: more comments
@
text
@d125 2
@


1.7
log
@web commit by jpb () at 98.180.198.168: Update import. and freq.
@
text
@d22 2
d42 2
@


1.6
log
@web commit by jpb () at 98.180.198.168: Resort as original JTA
@
text
@d9 1
a9 1
Importance: @@@@@@I, Frequency: @@@@@@F
d18 1
a18 1
Importance: @@@@@@I, Frequency: @@@@@@F
d27 1
a27 1
Importance: @@@@@@I, Frequency: @@@@@@F
d36 1
a36 1
Importance: @@@@@@I, Frequency: @@@@@@F
d45 1
a45 1
Importance: @@@@@@I, Frequency: @@@@@@F
d54 1
a54 1
Importance: @@@@@@I, Frequency: @@@@@@F
d63 1
a63 1
Importance: @@@@@@I, Frequency: @@@@@@F
d72 1
a72 1
Importance: @@@@@@I, Frequency: @@@@@@F
d81 1
a81 1
Importance: @@@@@@I, Frequency: @@@@@@F
d90 1
a90 1
Importance: @@@@@@I, Frequency: @@@@@@F
d99 1
a99 1
Importance: @@@@@@I, Frequency: @@@@@@F
d108 1
a108 1
Importance: @@@@@@I, Frequency: @@@@@@F
d117 1
a117 1
Importance: @@@@@@I, Frequency: @@@@@@F
d126 1
a126 1
Importance: @@@@@@I, Frequency: @@@@@@F
d135 1
a135 1
Importance: @@@@@@I, Frequency: @@@@@@F
d144 1
a144 1
Importance: @@@@@@I, Frequency: @@@@@@F
d153 1
a153 1
Importance: @@@@@@I, Frequency: @@@@@@F
d162 1
a162 1
Importance: @@@@@@I, Frequency: @@@@@@F
d171 1
a171 1
Importance: @@@@@@I, Frequency: @@@@@@F
d180 1
a180 1
Importance: @@@@@@I, Frequency: @@@@@@F
d189 1
a189 1
Importance: @@@@@@I, Frequency: @@@@@@F
d198 1
a198 1
Importance: @@@@@@I, Frequency: @@@@@@F
d207 1
a207 1
Importance: @@@@@@I, Frequency: @@@@@@F
d216 1
a216 1
Importance: @@@@@@I, Frequency: @@@@@@F
d225 1
a225 1
Importance: @@@@@@I, Frequency: @@@@@@F
@


1.5
log
@web commit by jpb () at 64.101.230.132:
@
text
@d8 2
a9 3

### Apply security patches.
Importance: 4.7, Frequency: 3.1
a14 2


d17 2
a18 2
### Monitor system for common security threats.
Importance: 4.3, Frequency: 3.3
a23 2


d26 2
a27 2
### Configure a firewall with custom packet filtering rules.
Importance: 4.3, Frequency: 2.7
a32 2


d35 2
a36 4


### Generate a key and configure the system to use it for SSH authentication.
Importance: 4.3, Frequency: 2.4
a41 2


d44 2
a45 4


### Configure SSH to restrict logins.
Importance: 4.3, Frequency: 2.4
a50 2


d53 2
a54 2
### Configure system to deny root logins.
Importance: 4.1, Frequency: 2.0
a59 2


d62 2
a63 2
### Install (if needed), configure, and use sudo.
Importance: 4.0, Frequency: 2.8
a68 2


d71 2
a72 2
### Scan a network to review open ports.
Importance: 4.0, Frequency: 2.8
a77 2


d80 2
a81 2
### Configure a firewall to disable multiple connection attempts from an attacker.
Importance: 4.0, Frequency: 2.4
a86 2


d89 2
a90 2
### Change the flags on sensitive files.
Importance: 3.9, Frequency: 2.3
a95 2


d98 2
a99 2
### Configure security event auditing.
Importance: 3.9, Frequency: 2.2
a104 2


d107 2
a108 2
### Configure a firewall for greylisting or blacklisting.
Importance: 3.7, Frequency: 2.1
a113 2


d116 2
a117 2
### Raise or lower security level.
Importance: 3.7, Frequency: 1.9
a122 2


d125 2
a126 2
### Generate self-signed certificates.
Importance: 3.7, Frequency: 1.9
a131 2


d134 2
a135 2
### Configure a Network Intrusion Detection System.
Importance: 3.7, Frequency: 1.8
a140 2


d143 2
a144 2
### Scan a password file for weak passwords.
Importance: 3.6, Frequency: 2.2
a149 2


d152 2
a153 2
### Configure a file integrity checking utility.
Importance: 3.5, Frequency: 2.0
a158 2


d161 2
a162 2
### Configure PAM to support an alternative authentication mechanism.
Importance: 3.5, Frequency: 1.8
a167 2


d170 2
a171 2
### Configure a firewall to act as an authentication gateway.
Importance: 3.5, Frequency: 1.6
a176 2


d179 2
a180 2
### Configure login.conf or PAM for improving new password security.
Importance: 3.5, Frequency: 1.6
a185 2


d188 2
a189 2
### Configure ACLs to augment traditional Unix permissions.
Importance: 3.4, Frequency: 2.0
a194 2


d197 2
a198 2
### Configure TCP wrappers.
Importance: 3.4, Frequency: 1.9
a203 2


d206 2
a207 2
### Configure kernel to prevent ability to perform network sniffing.
Importance: 3.4, Frequency: 1.5
a212 2


d215 2
a216 2
### Configure an IPSec VPN.
Importance: 3.3, Frequency: 1.2
a221 13


**Estimated Time:**

### Configure One-Time Passwords (OTP).
Importance: 3.0, Frequency: 1.5

**Concept:**

**Practical:**



d224 2
a225 2
### Install and configure a Kerberos server.
Importance: 2.7, Frequency: 1.2
a230 2


a232 3



@


1.4
log
@web commit by jpb () at 64.101.230.132:
@
text
@d12 1
a12 1
Concept:
d14 1
a14 1
Practical:
d18 1
a18 1
Estimated Time:
d23 1
a23 1
Concept:
d25 1
a25 1
Practical:
d29 1
a29 1
Estimated Time:
d34 1
a34 1
Concept:
d36 1
a36 1
Practical:
d40 1
a40 1
Estimated Time:
d47 1
a47 1
Concept:
d49 1
a49 1
Practical:
d53 1
a53 1
Estimated Time:
d60 1
a60 1
Concept:
d62 1
a62 1
Practical:
d66 1
a66 1
Estimated Time:
d71 1
a71 1
Concept:
d73 1
a73 1
Practical:
d77 1
a77 1
Estimated Time:
d82 1
a82 1
Concept:
d84 1
a84 1
Practical:
d88 1
a88 1
Estimated Time:
d93 1
a93 1
Concept:
d95 1
a95 1
Practical:
d99 1
a99 1
Estimated Time:
d104 1
a104 1
Concept:
d106 1
a106 1
Practical:
d110 1
a110 1
Estimated Time:
d115 1
a115 1
Concept:
d117 1
a117 1
Practical:
d121 1
a121 1
Estimated Time:
d126 1
a126 1
Concept:
d128 1
a128 1
Practical:
d132 1
a132 1
Estimated Time:
d137 1
a137 1
Concept:
d139 1
a139 1
Practical:
d143 1
a143 1
Estimated Time:
d148 1
a148 1
Concept:
d150 1
a150 1
Practical:
d154 1
a154 1
Estimated Time:
d159 1
a159 1
Concept:
d161 1
a161 1
Practical:
d165 1
a165 1
Estimated Time:
d170 1
a170 1
Concept:
d172 1
a172 1
Practical:
d176 1
a176 1
Estimated Time:
d181 1
a181 1
Concept:
d183 1
a183 1
Practical:
d187 1
a187 1
Estimated Time:
d192 1
a192 1
Concept:
d194 1
a194 1
Practical:
d198 1
a198 1
Estimated Time:
d203 1
a203 1
Concept:
d205 1
a205 1
Practical:
d209 1
a209 1
Estimated Time:
d214 1
a214 1
Concept:
d216 1
a216 1
Practical:
d220 1
a220 1
Estimated Time:
d225 1
a225 1
Concept:
d227 1
a227 1
Practical:
d231 1
a231 1
Estimated Time:
d236 1
a236 1
Concept:
d238 1
a238 1
Practical:
d242 1
a242 1
Estimated Time:
d247 1
a247 1
Concept:
d249 1
a249 1
Practical:
d253 1
a253 1
Estimated Time:
d258 1
a258 1
Concept:
d260 1
a260 1
Practical:
d264 1
a264 1
Estimated Time:
d269 1
a269 1
Concept:
d271 1
a271 1
Practical:
d275 1
a275 1
Estimated Time:
d280 1
a280 1
Concept:
d282 1
a282 1
Practical:
d286 1
a286 1
Estimated Time:
d291 1
a291 1
Concept:
d293 1
a293 1
Practical:
d297 1
a297 1
Estimated Time:
@


1.3
log
@web commit by jpb () at 98.180.198.168:
@
text
@d6 2
@


1.2
log
@web commit by jpb () at 98.180.198.168: Edit introduction header.
@
text
@d40 15
@


1.1
log
@web commit by jpb () at 98.180.198.168:
@
text
@d3 3
@
