Computer Security System Investigation

This project aims to provide security evaluation on virtual machine (VM) images provided by Benny Vandergast Inc. It includes the installation procedure, inspection of the security system, and additional security system suggestions.

University
Semester
COMPUTER SECURITY-SYSTEM
INVESTIGATION
Student ID
Student Name
Submission Date
1

Table of Contents
1. Project Aim....................................................................................................................................3
2. Virtual Machine (VM) Image File Installation Procedure.............................................................3
3. Inspection of the Security System..................................................................................................7
4. Inspection Report and Details of the Security System.................................................................15
5. Additional Security System Suggestions.....................................................................................17
References...........................................................................................................................................20
2

1. Project Aim
System Security is a major cause of concern in today’s world. In computing,
a Virtual Machine (VM) is an imitation of a Computer system. They are based on the
computer architecture and provide the functionality/ Characteristics of a physical computer.
“Widgets Inc” is such a firm which provides virtual machine image. Benny Vandergast Inc is
providing VM ware for testing. These virtual machines provided by Benny Vandergast will
be used by the user and same time they will evaluate the system for security purpose, same
will be used no the new web based store. So, here is where we come into the picture. This
whole project and the aim are to provide Security Evaluation on the VM (Virtual Machines)
images provided. Same time we will inspect and test the various security areas of the whole
framework to identify the loop holes and concerns for security. Use of Special Security
Evaluation Tool shall be made for this task. The “Virtual Machine Image” files will be
tested by performing Security evaluation by the following parameters:
 The procedure of investigating the security system.
 The instrument used for the security system investigation procedure.
 The outcome of the above mentioned security system investigation.
 The plan for safe guarding the system against outside attacks.
 The concerns regarding the security related problems.
So, this project shall discuss the above points in detail and same time will try to
analyse it in full detail.
2. Virtual Machine (VM) Image File Installation Procedure
1. On the given Portal, the Virtual Machine (VM) file has to be downloaded.
2. Install the Virtual Machine work station after it has been downloaded.
3. After the installation has been completed, open the Virtual Machine (VM) image file. It
will be displayed as the image below (TechRepublic, 2019),
3

Open the Virtual Machine (VM) image file by clicking on it. It will be illustrated as below
(digitalocean.com, 2019).
After this select the VM (Virtual Machine) image File and click on it. This will open the VM
(Virtual Image) image file. It will be displayed as below (kifarunix.com, 2019),
4

Then, open “Ubuntu”* by clicking the Power on button. It will be displayed as shown in the
below image (TechRepublic, 2019),
Next step is to click on the “Move It” icon to transfer the Virtual Image file to the Virtual
Machine (VM) ware Workstation. It will be illustrated as shown in the below image,
5

6

Once, VM Ubuntu is installed successfully, We are use the “Kali Linux” to crack and
identify the IP Address, user name and Password for provided the VM. By crack the IP
address, user name and password by using the below command on kali linux terminal.
hydra -l admin -P password.txt 192.168.1.1 http-head
This is shown in the below image,
7

After, enter the user name as administrator and password as P@ssw0rd. The user name and
password is hacked because this project is to hack the credentials of Virtual Machine. After,
enter the Ubuntu VM to do the credentials of Virtual Machine by use the below steps,
1. Boot into the recovery mode.
2. Drop to root shell prompt.
3. Remount the root with write access
4. Reset the username and password
5. While entering the new password you might be prompt with Authentication
manipulation error like this:
passwd username
Enter new UNIX password:
Retype new UNIX password:
passwd: Authentication token manipulation error
passwd: password unchanged
The reason this error is that file system is mounted with read access only, so, we can
change and remount the file system. After, reset the password. After the user login, the
Ubuntu virtual machine has following the security issues such as,
 Encrypt data communication issues
 Network services issues
 Security patches
 Backup issues
 Password setting issues
 Open SSL issues
 Malware Issues
 Web server hardening issues
3. Inspection of the Security System
The process for Testing and Inspecting the Security System for a Virtual Machine
(VM) image file is a long procedure in which the basic step is to identify the process and step
by step procedures for Inspection. Security Inspection of a Virtual Machine (VM) image file
is a classified and highly documented procedure. They have to maintain International level
and benchmarks as per the Standard and for which gives the Certification of Security of the
8

computer. Ubuntu 18.04 is the Virtual Machine (VM) Image file that will be used for this
procedure. These whole security standards will assure that the final product is Safe and has
undergone a quality checklist for security standards. While doing the inspection and testing of
the files, evaluation will be made for additional security arrangements and also for the
changes and modifications required in the security package. It should be noted that the
Inspection shall be also used for securing the operating system and safe security of the same
system for operation (linux-audit.com, 2019). A very powerful and widely used method for
securing the system is by using the encrypted files and also encrypting the disk. This not only
will protect the system but also keep the storage disks and devices connected to them secured
from possible attacks. Updating and keeping the software to the latest versions helps in
keeping the data protected, stored safely and also encrypt it in a proper method. This also
helps in reducing the possible potential attacks on the system. Hardening of the system is one
of the most important processes when the software is being installed. Also the process has to
be repeated after the installation has been completed. This will overall help in efficient
working of the system.
Similar to all the Linux distributions, even Ubuntu supports the Microsoft version of
Unified Extensible Firmware Interface (UEFI) Secure Boot. Ubuntu, along with every Linux
distribution is very secure. In fact, Linux is secure by default. Passwords are needed in order
to gain ‘root’ access to perform any change to the system, such as installing software. For
working on the Optimal and perfect levels, like every software and system, Ubuntu Desktops,
Laptops, Servers etc. need to be configured for security related updates and protection. A
middle path has to be taken, especially for Linux system in relation to the Security,
Performance, Safety and Functionality (Boelen, 2019).
System hardening
“Hardening of System” is a basic method to verify a framework by decreasing its
helplessness that actually is larger as the framework performs various tasks and has the
capability. In general, a solitary capacity framework ins basic level can be assumed as highly
secure in constrast to the multipurpose one. This process is best applicable when the “Linux”
programing software is being installed. This can be modified, adjusted, added, and removed
etc. so as to make the security concerns at the minimum. Sectors that are most vulnerable will
be addressed first during the process of hardening of the system. Incase Linux has already
been installed in the system, than an option will be reinstalling the software and at the same
time taking the appropriate Hardening measures for securing the system (Kalsi, n.d.).
Use strong passwords
9

As the basic security step for any System that is exposed to the outside world,
“Password” plays a very important role. Once the process of installation has been completed
and the hardening of the system is simultaneously done, a User account will be created. Now,
this User account should have a strong and secured password which will be difficult to crack
or be vulnerable to attacks. Also, this account will be part of the Administrative group and
more reason for a secured password.
Now using the “Ubuntu” software for System security and same time hardening the
system, the following steps will be performed (Boelen, 2019),
Use disk encryption
All the following work together- Security, encryption and privacy. Using the
encryption method, the users could take advanced steps for increasing the OS's privacy and
security. Attacks by outsiders are a dynamic force which keeps on changing. Hence the
security system won’t be able to protect all the time. But the idea is to minimize such attacks
by keeping data at rest. Without a decryption key, Ubuntu cannot be accessed at startup.
Despite being a tedious task, Ubuntu encryption is an easy method and it benefits all the
features which are existing in an OS. Even if the System or the Data disk gets stolen, it will
10

be difficult for the person to crack the stored data without proper decryption software
(cisofy.com, 2019).
Automatic Security Updates
Linux server should be update on time-to-time, which involves security updates. On a
daily basis, the Linux Distributions such as Ubuntu releases its updates. This daily updates or
even frequent updates can be a tedious and sometimes a forgetful task. So, that’s why there is
an option of “Install security updates automatically”, which shall make it very convenient
and easy for the user for the update (Boelen, 2019).
11

The System on the server has to be configures as per the user requirement. This will
be done once the installation process has been completed. As the configuration of the entire
system is underway, there are chances of possible attacks. And this will be the weakest time
and the system most vulnerable to these attacks. Keeping this important thing in mind is very
important especially during configuration and system updates on the server (tecmint.com,
2019).
Software updates
System software is an automatic process (most likely option to be selected by the user
during the procedure). Although there is always an option to manual select the software
update option, it is preferable to use the auto option.
Accounts
Ubuntu Single Sign On account could also be used for authenticating to desktop
applications. Accounts have to be created and made for using the Server and accessing the
data on it. This can be critical for system administration work. Users can easily access the
servers while using the system directly by SCP (Secure Copy) and by SSH (Secure Shell).
SCP (Secure Copy) denotes a command line tool which is used for copying or transferring
12

the files, from one host to the other. It makes use of similar security mechanism such as
SSH program (community.time4vps.com, 2019).
Related risks to user accounts
Every system however secured and strong it maybe, it always requires a restart
(reboot). But we have found that there are some systems that have been continuously running
and working without any stop. This way the said system becomes vulnerable to exploits
already rooted inside the system. These may be local or may be from the outside. The actual
user should know what the fault or default patch is to understand the problem. Here the role
of System Hardening becomes vital and important. All the systems are therefore suggested to
perform the task of System Hardening. These shall eradicate such defaults and problem areas
which arise in the system (greghub.com, 2019).
Open SSH security and Hardening
On Linux systems, for system administration SSH is a well-known protocol. SSH is
essential to server management. Most of the Linux based systems have this protocol and are
running on them. The unaltered configuration is the default setting. Hardening of the Linux
System is one of the way to reduce potential attacks on the system. After editing the
configuration file you should test that it is valid before reloading the service. Always check
the status of the SSH before deployment. Always a well-documented approach to the
securing of the system helps in making things simple. Configuration test of the SSH will help
in making sure and identifying the Functioning and Non-Functioning of the system.
Encrypting all traffic provides extra security from network sniffing and other attacks and it is
available for multiple platforms (Raggi, Thomas and Vugt, 2011).
We can also implement SSH port forwarding to provide protection to data which
would otherwise be transferred insecurely. SSH server is widely used for server
authentication. It’s very secure but we can still do some tweaks to make it more secure. It
goes very well as a security platform on Ubuntu Security and compliments it to make the
system secured and fairly safe to potential attacks.
The key features in the setting up of SSH security includes the following,
 Use a different port than 22 (the default port)
 Use Protocol SSH 2 only
 Disable direct root login
 Use public keys instead of passwords
 Enable two-factor authentication
 Disable Empty Passwords
13

 Use strong passwords and passphrase for SSH users/keys
 Configure Idle Timeout Interval
 Disable port forwarding
 Make changes to remote system
 Use of X11 forwarding
 Restrict SSH logins to specific IP addresses
System Security of Ubuntu is started by first hardening the software and all the related
and connected applications to the main software in use. Regular and timely scans and updates
are always required to keep the system in the top order. One of the primary tools for SSH
security is “Lynis”, which is a tool used for auditing and it tests and collects all the security
related information from the Unix-based systems. It can be used easily, and instantly the
security report is provided to the Linux Security.
It will work on the system files which have been configured throughout the network.
In Ubuntu, it is easy to do the installation of Lynis, with the help of Ubuntu Software Center.
Using Keys for administrator is the best way to keep the security at the optimum level. This
not only helps in keeping the security good but also helps when managing multiple systems.
A Private and a Public key are used when working on a system. On the remote system, the
public key is configured, while the private keys will remain a secret. Always keep in mind
what key is being used and not mixing the two keys or exchanging the keys. The users who
manage central system, or running Linux (or UNIX based system) may utilize ssh-keygen. If
you wish to help the new versions of the OS, it is recommended to utilize the new key format
Ed25519. If not, the key called as RSA can be used.
Hardening of compliers and development tools
The attacker or the hacker is always looking at the vulnerable spots in a system. It is
basically looking for gateways. Compiler translates the computer code which is written in a
programming language into another programming language, should thus undergo hardening
process before it is installed in the system. Installation and uninstallation of these can help in
reducing the vulnerable attacks.
.Web server hardening
“Web Server Hardening” is the process of enhancing server security through a variety
of means which results in a much more secure server operating environment. This is due to
the advanced security measures that are put in place during the server hardening process.
“SSL” (Secure Sockets Layer) and “TLS” (Transport Layer Security) are the standard
technology for keeping an internet connection secure and safeguarding any sensitive data that
14

is being sent between two systems, preventing criminals from reading and modifying any
information transferred, including potential personal details. Both SSL & TLS have to be
optimized in the Linux system by hardening the server and keeping the security as well as
speed to its highest value.
Choose Certificates from Proven Sources
Initially, from the reputable services get certificates specialized in online security.
Optimize the TLS Handshake
A “three-way” handshake is basically used by the usual TCP connection, for establishing a
secure connection, and assumes everything to go well.
Enabling the Persistent Connections
The persistent connection lets various requests in just a single connection. In general,
new SSL connections might be required if one wants to visit a secure site more than one
times in just few minutes. Using persistent connection, only one time the SSL connection can
be initiated, which discards the requirement of extra handshakes.
Use a CDN
The CDNs are influenced by websites to improvise the speed of page load. This
benefits to deploy and helps the CDN to improve the performances of SSL/TLS. Take care of
the steps that are listed in the above paragraph like optimizing the TLS handshake by
connecting the users to the closest physical server, and enable a persistent connection with
the main host.
Using the latest versions of SSL as well as TLS should always be followed. The
reason behind this is that the old versions will be highly vulnerable to the always developing
viruses and bugs.
There should be distinguish as to what is the priority i.e. Performance of the overall
system or the Security System for the platform/ Server. Regular and frequent tests conducted
on authorized sites for the SSL/TLS should be conducted. Identify the areas where
Performance is more important than Security and same way where Security becomes priority
to Performance. Use the inbuilt addition tools like auditing for the System Security checks in
the Linux System.
4. Inspection Report and Details of the Security System
Software which is used on the Linux Platform for Security related is Lynis. It helps
the security professionals and the system administrators to scan the system and helps with
15

security defenses and results in system hardening. It works well with Ubuntu and
compliments the system (Boelen, 2019).
Installation of Lynis
The methods to install “Lynis” software are by Source code, downloading the file and
then copying the binary on the system. Another option is by using the package manager. It’s a
very straight forward way to install “Lyris”.
To install the Lynis on Ubuntu 18.04, enter the below command (Rajput, 2019),
Sudo apt-get installs lynis
The output for the above steps is given in the below image.
16

The Installation will be completed and “Lynis” will be ready to audit the Security status if the
Linus System. It will offer suggestions that show you how you can go about hardening the system
yourself. To find the shortcomings in the whole system by using “Lynis”, proceed as below,
17

When the Lynis scan comes an end, a report will be displayed which shows the
findings, location of various linked files and hardening index.
5. Additional Security System Suggestions
Suggestions are given by the Audit Report as to how further the Security of the overall system
can be improved upon this can include the following,
 PHP vulnerabilities
 Pacemaker Vulnerabilities
 Libxslt vulnerability
 Wget vulnerabilities
 system vulnerability
Following are the steps to be taken to further Secure the Linux System/ Server:
1. Keep your System Up-to-date at regular and timely schedule
Updating at scheduled times and pre-planned timings for keeping the Ubuntu System
up-to-date for all the possible threats (linuxconfig.org, 2019).
2. Firewall – UFW
A firewall is a system designed to prevent unauthorized access to or from a private
network. You can implement a firewall in either hardware or software form, or a combination
of both. Firewalls prevent unauthorized internet users, traffic, and access to outside entry
from accessing private networks
If use the firewall, it is used to block the unwanted inbound traffic and it provides the
highly effective security layer for our system. It provides the information to prevent the
18

intrusions and network mapping. It is allow only the traffic user need and rejected everything
else. The most common firewall applications are listed in below
- For securing the Layer 7, the well-known best option is Imperva’s cloud-based
web application firewall. It secures the web applications from all types of
application-layer attacks, along with the OWASP Top 10.
- Indusface Total Application Security is a mix of web application firewall,
scanning, and monitoring services. It help to detect the threats in the application
layer, along with OWASP Top 10 and zero-day vulnerabilities and secures from
any kind of exploits.
3. Shared Memory in Secured Environment
In an attack, the shared memory could be utilized against a running service.
Modify /etc/fstab for making it highly secure.
Open the Terminal Window, then the following must be entered:
sudo vi /etc/fstab
4. Harden the SSH access
 The most effective method of securing the SSH includes utilizing the public/private
key based login. See the SSH/OpenSSH/Keys.
 When the password authentication is required to be used, the simplest method is to
secure the SSH, for disabling the root login and the change SSH port to something
else, from a standard port 22.
 A new SSH user must be created prior to disabling the root login and make ensure
that the user belongs to the admin group.
 if you change the SSH port keep the port number below 1024 as these are
priviledged ports that can only be opened by root or processes running as root.
 If you change the SSH port also open the new port you have chosen on the firewall
and close port 22.
5. Network facing issues should be removed.
Networks which are facing issues for the services should be isolated or better be removed
from the overall System. This will help in overall performance of the entire network and
system. Also, this will lead to fewer chances of Security threats. The process which can be
implemented for this may include,
 Determine the running services like TCP and UDP
 Determine the which services to remove
 Uninstall the listening services.
19

Finally we have Safely Secured the entire “Ubuntu” system for all possible threats ,
viruses, malware, spyware, bugs etc.
20

References
Boelen, M. (2019). Audit Installed Compilers and Their Packages. [online] Linux Audit.
Available at: https://linux-audit.com/audit-installed-compilers-and-their-packages/ [Accessed
25 Apr. 2019].
Boelen, M. (2019). OpenSSH security and hardening. [online] Linux Audit. Available at:
https://linux-audit.com/audit-and-harden-your-ssh-configuration/ [Accessed 25 Apr. 2019].
Boelen, M. (2019). Optimize SSL/TLS for Maximum Security and Speed. [online] Linux
Audit. Available at: https://linux-audit.com/optimize-ssl-tls-for-maximum-security-and-
speed/ [Accessed 25 Apr. 2019].
Boelen, M. (2019). Ubuntu system hardening guide for desktops and servers. [online] Linux
Audit. Available at: https://linux-audit.com/ubuntu-server-hardening-guide-quick-and-secure/
[Accessed 25 Apr. 2019].
cisofy.com. (2019). Lynis - Security auditing tool for Linux, macOS, and Unix .... [online]
Available at: https://cisofy.com/lynis/ [Accessed 2019].
community.time4vps.com. (2019). Lynis and ClamAV installation -
community.time4vps.com. [online] Available at:
https://community.time4vps.com/discussion/125/lynis-and-clamav-installation [Accessed
2019].
digitalocean.com. (2019). How to Perform Security Audits With Lynis on Ubuntu 16.04 ....
[online] Available at: https://www.digitalocean.com/community/tutorials/how-to-perform-
security-audits-with-lynis-on-ubuntu-16-04 [Accessed 2019].
greghub.com. (2019). Lynis Installation and Usage Guide - GregHub. [online] Available at:
https://greghub.com/feed/lynis-installation-and-usage-guide/ [Accessed 2019].
Kalsi, T. (n.d.). Practical Linux security cookbook.
kifarunix.com. (2019). How to Perform System Security Auditing with Lynis on .... [online]
Available at: https://kifarunix.com/how-to-perform-system-security-auditing-with-lynis-on-
ubuntu-18-04/ [Accessed 2019].
21

linux-audit.com. (2019). Installation of Lynis on Arch Linux systems - Linux Audit. [online]
Available at: https://linux-audit.com/installation-of-lynis-on-arch-linux-systems/ [Accessed
2019].
linuxconfig.org. (2019). Scan Your System For Vulnerabilities With Lynis .... [online]
Available at: https://linuxconfig.org/scan-your-system-for-vulnerabilities-with-lynis
[Accessed 2019].
Raggi, E., Thomas, K. and Vugt, S. (2011). Beginning Ubuntu Linux. Berkeley, CA: Apress.
Rajput, S. (2019). Lynis – Automated Security Auditing tool for Linux Servers. [online]
Linuxtechi.com. Available at: https://www.linuxtechi.com/lynis-security-auditing-tool-linux-
servers/ [Accessed 25 Apr. 2019].
TechRepublic. (2019). How to harden Ubuntu Server 16.04 security in five steps. [online]
Available at: https://www.techrepublic.com/article/how-to-harden-ubuntu-server-16-04-
security-in-five-steps/ [Accessed 25 Apr. 2019].
TechRepublic. (2019). How to secure your Ubuntu 18.04 Desktop installation with
Uncomplicated Firewall. [online] Available at: https://www.techrepublic.com/article/how-to-
secure-your-ubuntu-18-04-desktop-installation-in-one-easy-step/ [Accessed 25 Apr. 2019].
tecmint.com. (2019). Lynis 2.5.5 Released - Security Auditing and Scanning Tool .... [online]
Available at: https://www.tecmint.com/linux-security-auditing-and-scanning-with-lynis-tool/
[Accessed 2019].
22