Ubuntu
Common tasks for hardening Ubuntu.
Remove unauthorized users
How do I find this problem?
One of the first things you should do when starting an image during a competition is check the README file on the desktop. The README shows the authorized Administrators and Users for the image. These are the only users that should have accounts. All others should be removed.
How do I solve this problem?
Click the Settings icon on the top right-hand corner.
From this menu, select “System Settings…”, then “User Accounts”. Click on “Unlock” and enter the password for the administrator from the README. Click on Authenticate. As an Administrator, you will have root access. Click on the account to be removed and then select the minus sign in the bottom left of the window to delete the account. When prompted to keep the user’s files, select Delete Files. Make sure to write down the name of the user you deleted. Remember, removing some unauthorized users may not be scored checks. This is part of the competition.
Why is fixing this problem important?
Computer access should be limited to just those who need to use it to complete their tasks. By leaving these user accounts on the image, unauthorized individuals may be able to log on to the computer and make changes that could affect the safety and security of legitimate user
Downgrade administrator to standard user
How do I find this problem?
In the README file on the desktop, you will see Authorized Administrators and Users for the image and the account type for each user.
How do I solve this problem?
Click the Settings icon on the top right-hand corner. From this menu, select System Settings…, then User Accounts. Click on “Unlock” and enter the administrator password, then Authenticate. Click on the user and change the Account Type from Administrator to Standard.
Why is fixing this problem important?
Ensuring account types are set correctly is very important. A Standard user given Administrator permissions can accidentally or purposefully cause significant damage to a system because they would have access to all files on the system, not just their own.
Change insecure password for user
How do I find this problem?
The README file lists the Authorized Administrators and Users with their passwords for this image. Check if any other Administrator passwords are insecure.
How do I solve this problem?
Click the Settings icon on the top right-hand corner. From this menu, select System Settings…, then User Accounts. Click on “Unlock” and enter the administrator password, which will give you root access. Click on the user. You can change the password for a user by clicking the field to the right of “Password.” For information on strong passwords, see Unit Four on the Dashboard. IMPORTANT: Make sure you write down the new passwords, especially any Administrator passwords, so you do not potentially lock yourself out of the image. Close the User Accounts window when finished.
Why is fixing this problem important?
Having a weak password on a user account makes it extremely vulnerable to attacks by outside individuals. With a weak password, an attacker can more easily gain access to a user’s files. Strong passwords make it much more likely that only the authorized user of the account can access it.
Enable Uncomplicated Firewall (UFW) protection
How do I find this problem?
Bring up the run dialog by typing Alt+F2. Type gufw (Graphical Uncomplicated Firewall), and press Enter. Type the administrator password, then Authenticate to launch gufw. In the Firewall window you can see that the Status is set to OFF.
How do I solve this problem?
Inside the Firewall window, click the slider next to OFF. You should see the status turn ON and the shield turn green and red.
Why is fixing this problem important?
Enabling and properly configuring a firewall is critical to ensuring that you are only allowing known, authorized traffic in and out of your computer.
Disable or remove Samba service
How do I find this problem?
Bring up a Terminal (Ctrl+Alt+T). Type service --status-all and press Enter.
How do I solve this problem?
If you do not already have a Terminal open, bring up a Terminal (Ctrl+Alt+T). Type sudo apt-get remove samba and press Enter. Type the administrator password, and press Enter. Type “Y” for Yes, then Enter to continue to remove samba.
Why is fixing this problem important?
Disabling unnecessary services can limit your attack surface. The less services an adversary has to attack and potentially exploit, the lower your risk. Adversaries may attack known or unknown vulnerabilities in services to obtain information, escalate privileges, or gain unauthorized access.
Automatically check for system updates daily
How do I find this problem?
Keeping your operating system and software updated is a good cybersecurity practice in general.
How do I solve this problem?
Click the Settings icon on the top right-hand corner. From this menu, select System Settings…, then Software & Updates. Next, select the Updates tab. Change the “Automatically check for updates” from “Never” to “Daily.” You will be prompted for the administrator password, then select Authenticate to make the change.
Why is fixing this problem important?
Setting Ubuntu to check for updates on a daily basis ensures you will not miss any critical patches.
Install updates from important security updates
How do I find this problem?
Keeping your operating system and software up to date is a good cybersecurity practice in general.
How do I solve this problem?
Under “Install updates from,” check the boxes for Important security updates and Recommended updates. Click Close and the Reload. Click the Search your computer in the upper left corner on the Launcher (under the word Terminal). Type update and then select Software Updater. Click Install Now. You will be asked for your password again before the updates are installed. Restart the image by selecting Settings, Shutdown, then the Restart button to complete the updates.
Note: Occasionally Software Updater will inform you that it failed to download package files. If you see this message, your best course of action is to try again. Installing updates is important to security; however, on this specific image you receive no points for installing updates, therefore you may safely skip using the Software Updater on this image if desired.
Why is fixing this problem important?
Adversaries can more easily compromise your system if software is present that has known security vulnerabilities. Ensuring software is up to date removes known security vulnerabilities.
Enable Firefox pop-up blocker
How do I find this problem?
The README file notes that Firefox should be the default web browser on the computer. Settings on a browser should always be updated and configured with secure settings.
How do I solve this problem?
Open FireFox → Click on the three lines on the top right of the browser → Select the menu button on the top right to enter Preferences → Select the Content tab on the left-hand side of the window → Check the box next to Block pop-up windows.
Why is fixing this problem important?
As the default web browser used, the security settings should be configured to mitigate browser-based vulnerabilities. The pop-up blocker should be enabled to block windows automatically opened by the original accessed site. These pop-ups are typically used for advertisements, which may present an opportunity for social engineering and unauthorized downloads.
Remove Prohibited software
How do I solve this problem?
Bring up a Terminal (Ctrl+Alt+T). Type sudo apt-get remove nameofthesoftware and press Enter. Type the administrator password, and press Enter. Type Y for Yes, then Enter to continue to remove the software.
Why is fixing this problem important?
This software is a violation of the company’s security policies. Installing applications such as network mappers and vulnerability scanners will allow authorized users and potential attackers easier access to information about your network.
Update software
When you can’t find a program to update software, type this in a terminal.
sudo apt-get update
sudo apt-get upgrade