212.4 Security tasks

Introduction

Security administration is a cycle: learn about risk, identify exposure, reduce it, detect abuse, and verify recovery. Tools are useful only when authorization and response procedures are clear.

What you should be able to do after this lesson:

• Follow trusted vulnerability and distribution advisories.
• Inventory listening services and versions.
• Use port and vulnerability scanners with authorization.
• Apply and verify security updates.
• Explain network and host intrusion-detection roles.
• Configure basic fail2ban behavior.

Big Idea: Turn an Alert into a Verified Exposure

A vulnerability identifier or scanner finding is not yet a remediation plan. Follow this chain:

trusted alert -> affected product and version -> reachable exposure
-> compensating controls -> tested fix -> verification and monitoring

Distribution packages often backport fixes without adopting the newest upstream version string, so use vendor advisories rather than version comparison alone.

Advisories and Inventory

Monitor vendor security channels, distribution advisories, CERT organizations, and maintained vulnerability databases. Historical sources such as Bugtraq may appear in exam material; current operational work should rely on maintained vendor and coordination channels. Map an advisory to the package version actually installed; distribution backports may fix a vulnerability without using the upstream version number.

ss -tulpn
rpm -qa
dpkg-query -W

Authorized Scanning

nmap -sV -p- server.example.test
nc -vz server.example.test 22

Scanning can trigger alerts or disrupt fragile systems. Define scope, timing, source addresses, and ownership before testing.

OpenVAS or related vulnerability scanners compare observed software and configuration with known issues. Treat findings as leads that require validation, not automatic proof of compromise.

telnet and nc can open simple plaintext TCP sessions for protocol observation, while nmap performs structured discovery and scanning. Never send credentials through telnet to an untrusted or production service; its exam relevance is diagnostic awareness, not secure remote administration.

Patch Management

1. Identify affected assets and exposure.
2. Review vendor remediation and urgency.
3. Test the update and rollback path.
4. Back up required data and configuration.
5. Deploy in controlled groups.
6. Verify package version, service health, and effective fix.

Restart services or reboot when old vulnerable code remains loaded.

Intrusion Detection

• A network IDS such as Snort examines traffic visible at its sensor.
• A host IDS examines files, logs, processes, or local events.
• Signature detection recognizes known patterns.
• Anomaly detection looks for deviation from expected behavior.

Detection without maintained rules, time synchronization, log retention, and a response owner produces noise rather than security.

fail2ban

fail2ban reads logs and temporarily blocks sources matching repeated failure patterns.

fail2ban-client status
fail2ban-client status sshd

It reduces simple repeated attacks but does not fix weak passwords or vulnerable services. Ensure administrators cannot be permanently locked out and understand which firewall backend is active.

Incident Discipline

When compromise is suspected:

• preserve volatile and log evidence
• record times and actions
• isolate according to the incident plan
• avoid destroying evidence with unnecessary cleanup
• rotate exposed credentials from a trusted system
• rebuild when integrity cannot be established

Guided Practice: Validate One Finding

Choose an authorized lab service and define scope before scanning:

ss -ltnup
nmap -sV -p <port> <lab-host>
nc -vz <lab-host> <port>

Compare three views:

• process and bind address on the host
• firewall policy and counters
• scan result from the client network

Find the package that owns the listening binary and compare its exact distribution release with the vendor advisory. Apply a lab update, restart the affected process if required, and repeat both package and network verification.

Troubleshooting Scenario

A scanner labels an HTTP service vulnerable from its banner version, but the distribution advisory says the installed package includes a backported fix. Package changelog and vendor status confirm remediation.

Document the vendor evidence and scanner limitation rather than replacing the package with an unsupported upstream build. If uncertainty remains, validate behavior with a safe vendor-approved check.

Exam Focus

• Know trusted advisory sources, CERT coordination, and historical Bugtraq awareness.
• Use telnet, nc, and nmap only within authorized scope.
• Recognize OpenVAS, Snort, host/network IDS roles, and fail2ban limitations.
• Patching includes loaded-process restart and verification, not only package installation.

Recap

• Match advisories to installed, distribution-maintained packages.
• Scan only with explicit authorization.
• Patching includes verification and process restart.
• IDS and fail2ban support, but do not replace, secure configuration and incident response.