- [Instructor] We're in our web01 proxy.
As our main interface to the public network,
the proxy is a key point
to monitor remote access to our systems.
A good way to do this is by using the Linux iptables tool.
It isn't installed by defaulting Kali Purple,
so will install it.
sudo su.
And we'll get to root session
and we'll do our work from the root folder,
and we'll apt install iptables.
We can add a rule to generate a log
for each new connection attempted,
whether it was successful or not.
However, changes to iptables are ephemeral
and need to be reloaded on a reboot,
so we'll create a service to do that.
In addition, we have Suricata running on the proxy
and it can generate a lot of logs.
So to avoid bulking out our storage,
we'll clean them each time we reboot.
We can do that by truncating them.
Firstly, we'll create a small Python script, nano check.py,
and we'll import the operating system library, os.system,
and we'll truncate -s 0 /var/log/*
and any errors we'll send to /dev/null.
Okay.
And similarly for our audit logs
os.system("truncate -s 0 /var/log/audit/* 2>/dev/null").
And then ("truncate -s 0 /var/log/suricata/eve.json").
And then we'll add our firewall rule,
which we do with the iptables command,
"iptables -a input p tcp -m",
and we're looking for our state
and the state we're looking for is a new connection,
and when we find one, we log.
Okay.
And we'll save that.
We now need to create a service to run this
and we'll do that nano /etc/systemd/system/check.service.
And in here we have a unit, Description=Bootup Tasks,
After=network.target.
The service, Type is simple, the user is root,
and ExecStart=/usr/bin/python3,
and what we're going to execute is /root/check.py.
And we'll say it's WantedBy=multi-user.target.
They're just the standard service definition.
Control + X.
And then we'll enable it with systemctl enable check
and we can run that now.
Okay.
For app01, we'll add some enhanced SSH logging
using an SSH feature known as force command.
As we're going to be making changes to SSH,
we'll do this from the console.
I've already created a small bash script,
so let's have a look at it.
sudo nano usr/local/bin/logssh.
In the script, we're checking that the ssh connection
includes a command and then we're using logger to copy it
with the ssh prefix to sys log.
We're then executing the command.
Okay, we'll set the access,
sudo chmod 755 /usr/local/bin/logssh.
We now need to update SSH's configuration,
which we do with sudo nano /etc/ssh/sshd_config.
And at the bottom of the configuration file,
we'll add the line ForceCommand /usr/local/bin/logssh
and save that.
And we'll sudo systemctl restart sshd.
The final enhancement we'll make
is to install Sysmon into Windows
to generate additional logs.
We'll open a privileged admin power shell, runner's admin.
And we'll get https://github.com
/SwiftOnSecurity/sysmon-config
/raw/master/sysmonconfig-export.xml
- Outfile sysmon.xml.
We'll update the SYSMON EVENT 10 entry.
We can use that using notepad.
And EVENT ID 10 in between the process access
process not access tags,
we'll remove the comment and put in
C:\Windows\system32\lssas.exe,
in order to get all the security system logs,
and /TargetImage>.
And we'll save that.
And we'll now get download.sysinternals.com/files/Sysmon.zip
- Outfile sysmon.zip.
And we'll expand our archive,
.\sysmon.zip -DestinationPath dot, where we are.
And we'll run .\Sysmon64.exe
and install using sysmon.xml configuration file
and we'll accept the EULA,
and we'll specify hashes md5.sha256 -n -l.
Okay, and we've got Sysmon running.
Okay, and we can now check system services on appO2,
and we find we have Sysmon64 running
and it's set to automatic startup.
We've now set up some examples of enhanced logging
on web01, app01, and appO2.
This will help with our monitoring of access attempts
and attack activity.