Lesson 6.14: Capstone 2: proving the rebuilt server is better
An incident isn't closed when the server is rebuilt; it's closed when the new server is shown not to have the old weaknesses and to record the next attack better. In the lab ci02 replaces the compromised runner from the hardened image. In one pass you check auditing and its lock, the docker group, SSH authentication, the kernel's boot options and lockdown, kernel hardening settings and package integrity, and seal an acceptance record that the incident ticket can link to.
20 min
You will learn to
- Verify audit coverage and immutability
- Verify privileged group membership
- Verify SSH effective configuration
- Verify boot options, lockdown and kernel settings
- Seal an acceptance record
Key terms
- Acceptance check
- Verifying a system against agreed requirements before it goes into service.
- Running state vs configuration
- What the system does now (auditctl -l, sshd -T, /proc/cmdline) versus what files say.
- Lessons learned
- The changes an incident leads to beyond the affected machine.
- Golden image
- The hardened, versioned base image new servers are built from.
← User-space rootkits and package verification · All lessons · Verifying upstream releases with GnuPG →