ACCESS CONTROL
SSH · User Accounts · PAM · Sudo Privileges
3 CONTROLS
⌄
⚠ ISSUE
Default SSH configuration allows root login, password authentication, all cipher suites (including weak ones), and exposes the default port 22 to automated scanning and brute-force attacks.
🔥 RISK
Unauthorized root access via brute-force, credential stuffing, MITM via weak SSH ciphers, and lateral movement using compromised SSH keys.
📁 FILES & PATHS
/etc/ssh/sshd_config
/etc/ssh/sshd_config.d/99-hardening.conf
~/.ssh/authorized_keys
🔧 FIX — /etc/ssh/sshd_config.d/99-hardening.conf
/etc/ssh/sshd_config.d/99-hardening.conf (drop-in — takes priority)
# ─── Protocol & Port ────────────────────────────────────────── Protocol 2 Port 2222 # Non-standard port (change to your port) ListenAddress 0.0.0.0 # ─── Authentication Controls ────────────────────────────────── PermitRootLogin no # CRITICAL: never allow root SSH PasswordAuthentication no # Keys only — disable passwords ChallengeResponseAuthentication no KbdInteractiveAuthentication no PermitEmptyPasswords no PubkeyAuthentication yes AuthorizedKeysFile .ssh/authorized_keys # ─── Session Limits ─────────────────────────────────────────── MaxAuthTries 3 MaxSessions 4 LoginGraceTime 30 # seconds to complete login ClientAliveInterval 300 # keepalive every 5 min ClientAliveCountMax 2 # disconnect after 10 min idle # ─── Access Restriction ─────────────────────────────────────── AllowUsers deployer sysadm # Explicit user allowlist # AllowGroups sshusers # Or restrict by group # ─── Strong Cryptography Only ───────────────────────────────── KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512 Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com HostKeyAlgorithms ssh-ed25519,rsa-sha2-512,rsa-sha2-256 # ─── Feature Restrictions ───────────────────────────────────── X11Forwarding no AllowAgentForwarding no AllowTcpForwarding no # Disable SSH tunneling PermitTunnel no GatewayPorts no PrintLastLog yes # Show last login on connect # ─── Login Banner ───────────────────────────────────────────── Banner /etc/ssh/banner # /etc/ssh/banner content: "AUTHORIZED ACCESS ONLY. All activity monitored." # ─── Logging ────────────────────────────────────────────────── SyslogFacility AUTHPRIV LogLevel VERBOSE
Shell — Apply and validate
# Test config before restarting (critical!) $ sshd -t # → No output = config is valid # Reload SSH (NOT restart — keeps current sessions alive) $ systemctl reload sshd # RHEL/CentOS $ systemctl reload ssh # Ubuntu/Debian # Regenerate host keys (remove weak DSA/ECDSA keys) $ rm /etc/ssh/ssh_host_dsa_key* /etc/ssh/ssh_host_ecdsa_key* $ ssh-keygen -t ed25519 -f /etc/ssh/ssh_host_ed25519_key -N "" $ ssh-keygen -t rsa -b 4096 -f /etc/ssh/ssh_host_rsa_key -N "" # Moduli hardening — remove weak DH parameters (< 3072 bits) $ awk '$5 >= 3071' /etc/ssh/moduli > /etc/ssh/moduli.safe $ mv /etc/ssh/moduli.safe /etc/ssh/moduli
👥 RESPONSIBLE
Linux/System Admin
🔄 SERVICE RESTART
⟳ systemctl reload sshd
⟳ systemctl reload ssh
✅ VERIFICATION
ssh-audit -p 2222 your-server-ip
→ [info] - algorithm recommendations
→ [pass] - kex: curve25519-sha256
→ [pass] - cipher: chacha20-poly1305@openssh.com
→ [warn] - no warnings (if hardened correctly)
ssh -o PasswordAuthentication=yes user@server
→ Permission denied (publickey). ← passwords blocked ✓
ssh root@server
→ Permission denied (publickey). ← root blocked ✓
nmap -sV -p 22 server-ip
→ 22/tcp filtered ← port 22 should be closed/filtered ✓
📋 VAPT CLOSURE
🔒
Audit Closure
SSH daemon hardened: root login disabled, password authentication disabled (public key only), MaxAuthTries limited to 3, weak cipher suites (CBC, MD5, SHA1) removed, X11/TCP forwarding disabled, non-standard port configured. LoginGraceTime and idle timeout enforced. A legal access banner is displayed. Configuration validated via ssh-audit reporting zero critical findings.⌄
⚠ ISSUE
Default Linux PAM configuration allows weak passwords, no account lockout policy, no password history, and no complexity enforcement. Service accounts often have interactive shells and login capability.
🔥 RISK
Password spray attacks against local accounts, privilege escalation via service account compromise, and credential reuse attacks due to no password history enforcement.
🔧 FIX — Password Policy (pwquality + login.defs)
/etc/security/pwquality.conf
# Minimum password length minlen = 14 # Require at least 1 uppercase, 1 lowercase, 1 digit, 1 special ucredit = -1 lcredit = -1 dcredit = -1 ocredit = -1 # Reject passwords containing username usercheck = 1 # Reject dictionary words dictcheck = 1 # Number of characters changed from previous password difok = 8 # Reject easy sequences (123, abc) maxsequence = 3 maxrepeat = 3
/etc/login.defs — Password aging
/etc/pam.d/system-auth — Account lockout (pam_faillock)
/etc/pam.d/password-auth — Password history (pam_pwhistory)
Shell — Disable unnecessary system account shells
👥 RESPONSIBLE
Linux/System AdminSecurity Team
✅ VERIFICATION
faillock --user testuser
→ Shows failed attempts counter
chage -l username
→ Maximum number of days between password change : 90
→ Password expiration warning : 14
passwd -S username
→ username P (password set), locked accounts show L
grep "remember" /etc/pam.d/password-auth
→ pam_pwhistory.so ... remember=24 ✓
📋 VAPT CLOSURE
🔒
Audit Closure
PAM configured with pam_pwquality (14-char minimum, complexity requirements), pam_faillock (5-attempt lockout, 15-min window), and pam_pwhistory (24 passwords remembered). Password aging enforced via /etc/login.defs (90-day max, 14-day warning). Service accounts use /sbin/nologin shell. YESCRYPT password hashing algorithm configured. Unnecessary system accounts removed.⌄
⚠ ISSUE
Overly permissive sudo rules (
ALL=(ALL) NOPASSWD: ALL), users in the wheel/sudo group with unrestricted access, and no sudo logging allow privilege escalation and untraceable admin actions.🔥 RISK
Privilege escalation from unprivileged user to root, lateral movement via sudo misuse, and inability to audit who ran what privileged command when.
🔧 FIX — /etc/sudoers.d/hardening
Run: visudo -f /etc/sudoers.d/hardening
Shell — Audit current sudo rights
👥 RESPONSIBLE
Linux/System Admin
✅ VERIFICATION
sudo -l -U deployer
→ (root) NOPASSWD: /bin/systemctl start *, stop *, restart *
sudo -l -U developer
→ (root) NOPASSWD: /usr/bin/dnf, /usr/bin/apt
cat /var/log/sudo.log | tail -10
→ Apr 21 10:22:01 : deployer : TTY=pts/0 ; PWD=/home/deployer ;
USER=root ; COMMAND=/bin/systemctl restart nginx
📋 VAPT CLOSURE
🔒
Audit Closure
Sudo access follows least-privilege: each user/group has explicit command restrictions, no global NOPASSWD:ALL grants, and a mandatory password for administrative users. Sudo logging (including I/O logging) is enabled to /var/log/sudo.log. requiretty prevents sudo from scripts. env_reset prevents environment injection. All NOPASSWD grants are documented and limited to specific system commands.
MANDATORY ACCESS CONTROL
SELinux (RHEL/CentOS) · AppArmor (Ubuntu/Debian)
2 CONTROLS
⌄
⚠ ISSUE
SELinux is commonly disabled or set to Permissive mode by admins to "fix permission errors" — leaving the kernel-level MAC layer completely inactive. This is one of the most critical misconfigurations on RHEL-based systems.
🔥 RISK
Without SELinux, a compromised process (nginx, Apache, MySQL) has full filesystem and network access as its user. SELinux enforcing contains compromised processes to their policy-defined boundaries even if the application is fully exploited.
🔧 FIX — Enable SELinux Enforcing
/etc/selinux/config
Shell — Enable enforcing without reboot (runtime)
Shell — Key SELinux boolean security settings
👥 RESPONSIBLE
Linux/System AdminSecurity Team
🔄 REQUIRED
⟳ Reboot if switching from disabled
✅ VERIFICATION
getenforce
→ Enforcing
sestatus
→ SELinux status: enabled
→ SELinuxfs mount: /sys/fs/selinux
→ SELinux mount point: /sys/fs/selinux
→ Loaded policy name: targeted
→ Current mode: enforcing
→ Mode from config file: enforcing
cat /etc/selinux/config | grep ^SELINUX=
→ SELINUX=enforcing
ausearch -m avc -ts today | wc -l
→ Low number = good (review any denials)
📋 VAPT CLOSURE
🔒
Audit Closure
SELinux is confirmed in Enforcing mode (targeted policy) via both getenforce output and persistent /etc/selinux/config configuration. File contexts are correctly labeled for all application directories. Dangerous SELinux booleans (httpd_execmem, deny_ptrace=on) are configured. AVC denials are reviewed and resolved via proper context labeling rather than policy disabling. No setenforce 0 or disabled entries in configuration files.⌄
⚠ ISSUE
AppArmor profiles may be in complain mode (logs but doesn't enforce), or key service profiles may not exist at all. Like SELinux, AppArmor is often left inactive after troubleshooting.
🔥 RISK
Without AppArmor, compromised applications (nginx, MySQL, Docker) have unrestricted filesystem and capability access. AppArmor confines exploited services to their defined permission profile.
🔧 FIX — Enable AppArmor & enforce profiles
Shell — Install, enable, and enforce all profiles
/etc/apparmor.d/local/nginx — Custom nginx restrictions
👥 RESPONSIBLE
Linux/System Admin
✅ VERIFICATION
aa-status | head -20
→ apparmor module is loaded.
→ 47 profiles are loaded.
→ 47 profiles are in enforce mode.
→ 0 profiles are in complain mode.
systemctl is-active apparmor
→ active
cat /sys/module/apparmor/parameters/enabled
→ Y
📋 VAPT CLOSURE
🔒
Audit Closure
AppArmor is active and loaded (aa-status confirms module loaded). All service profiles are in enforce mode — 0 profiles in complain mode. Key services (nginx, MySQL, sshd) have individual enforced profiles. AppArmor is persistent across reboots via GRUB configuration. Profile denials are logged to /var/log/syslog and monitored via auditd integration.
ANTIVIRUS / EDR / MALWARE DETECTION
MDATP (Microsoft Defender) · ClamAV · Rootkit Detection
3 CONTROLS
⌄
⚠ ISSUE
Linux servers often lack enterprise-grade EDR (Endpoint Detection & Response). Traditional antivirus is insufficient against fileless attacks, process injection, and lateral movement. MDATP on Linux provides real-time protection, behavioral analytics, and integration with Microsoft Sentinel.
🔥 RISK
Undetected malware, cryptominers, webshells, and backdoors running on Linux servers without EDR visibility. Fileless attacks and process injection invisible to traditional scanners.
🔧 FIX — Install MDATP on RHEL/Ubuntu
Shell — RHEL 8/9 Installation
Shell — Ubuntu 22.04 Installation
Shell — Configure MDATP for security hardening
/etc/opt/microsoft/mdatp/managed/mdatp_managed.json — Hardened policy
👥 RESPONSIBLE
Linux/System AdminSecurity Team
🔄 SERVICE
⟳ systemctl enable --now mdatp
✅ VERIFICATION
mdatp health --field healthy
→ true
mdatp health --field real_time_protection_enabled
→ true
mdatp health --field definition_status
→ up_to_date
# Test EICAR test file (harmless antivirus test)
echo 'X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*' > /tmp/eicar.txt
→ mdatp threat list should show EICAR detected and quarantined within seconds
mdatp threat list
→ EICAR: quarantined ✓
📋 VAPT CLOSURE
🔒
Audit Closure
Microsoft Defender for Endpoint (MDATP) is installed and onboarded to the Microsoft 365 Defender portal. Real-time protection, behavior monitoring, cloud protection, and automatic sample submission are enabled. Definition status is up-to-date. EICAR test file detection confirms AV engine is functional. The server appears in the Defender portal under the LinuxServers device group. Managed policy JSON enforces PUA blocking and archive scanning.⌄
⚠ ISSUE
Without antivirus, malicious files (webshells, malware, trojans) can be uploaded to the server and remain undetected. ClamAV provides free, open-source malware scanning with automated signature updates.
🔥 RISK
PHP webshells uploaded via vulnerable file upload endpoints remain active indefinitely without AV scanning, enabling persistent attacker access after initial exploitation.
🔧 FIX — Install & Configure ClamAV
Shell — Install and configure ClamAV
/usr/local/bin/clam-daily-scan.sh — Automated scan with alerting
👥 RESPONSIBLE
Linux/System Admin
✅ VERIFICATION
freshclam --version
→ ClamAV x.y.z ... Daily: version 27xxx
echo 'X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*' > /tmp/eicar_test.txt && clamscan /tmp/eicar_test.txt
→ /tmp/eicar_test.txt: Win.Test.EICAR_HDB-1 FOUND
→ Infected files: 1 ✓
systemctl status clamav-freshclam
→ Active: active (running)
📋 VAPT CLOSURE
🔒
Audit Closure
ClamAV antivirus is installed with clamav-freshclam auto-update service running (definitions updated daily). A daily automated scan covers /var/www, /home, /tmp, and /var/tmp — infected files are moved to quarantine and security team is notified via email. EICAR test confirms detection is functional. Definitions are current as verified by freshclam.⌄
⚠ ISSUE
Rootkits install as kernel modules or replace system binaries to hide processes, files, and network connections from the operating system. Traditional file scans miss them because they operate below the OS level.
🔥 RISK
Persistent attacker presence invisible to standard tools — ps, netstat, ls show clean results while the rootkit hides malicious processes, network connections, and files from the administrator.
🔧 FIX — Install and schedule rkhunter + chkrootkit
Shell — rkhunter setup
👥 RESPONSIBLE
Linux/System AdminSecurity Team
📋 VAPT CLOSURE
🔒
Audit Closure
rkhunter and chkrootkit are installed with a file properties database baseline built on a known-clean system. Daily automated scans are scheduled via cron at 4 AM with warning reports emailed to the security team. Signatures are updated before each scan. Both tools report no rootkits, backdoors, or suspicious kernel modules on the current system.
NETWORK SECURITY
Firewall · Fail2ban · Kernel Network Hardening
3 CONTROLS
⌄
⚠ ISSUE
Default firewall state on many Linux systems is either disabled or set to accept all traffic. Exposed management ports (MySQL 3306, Redis 6379, internal APIs) are publicly reachable, creating direct attack surfaces.
🔥 RISK
Direct exploitation of database/cache services with no authentication bypass (Redis AUTH bypass, MySQL anonymous access, internal API enumeration) and port scanning exposing server's complete service landscape.
🔧 FIX — firewalld (RHEL/CentOS) Hardening
Shell — firewalld configuration
Shell — ufw (Ubuntu) Hardening
/etc/sysconfig/nftables.conf — Advanced nftables ruleset
👥 RESPONSIBLE
Linux/System AdminNetwork Admin
✅ VERIFICATION
firewall-cmd --list-all
→ target: DROP
→ ports: 2222/tcp 80/tcp 443/tcp
→ (no 3306, 6379, or other internal ports)
nmap -sS -p 1-65535 your-server-ip
→ PORT STATE SERVICE
→ 80/tcp open http
→ 443/tcp open https
→ 2222/tcp open EtherNetIP-1
→ All other ports: filtered/closed ✓
nc -zv your-server-ip 3306
→ Connection refused ✓ (MySQL not exposed)
📋 VAPT CLOSURE
🔒
Audit Closure
Firewall is active (firewalld/ufw/nftables) with default-deny inbound policy. Only ports 80, 443, and custom SSH port are accessible externally. Database (3306), cache (6379), and internal API ports are restricted to specific source IPs. SSH connections are rate-limited. Port scan confirms only approved services are reachable. Firewall rules are persistent across reboots.⌄
⚠ ISSUE
Without fail2ban, brute-force attacks against SSH, web applications, FTP, and SMTP can run indefinitely — making thousands of attempts per hour without any automated response or IP blocking.
🔥 RISK
Credential brute-force success via unthrottled login attempts. A typical 8-character password can be brute-forced at 10k attempts/minute without fail2ban protection.
🔧 FIX — /etc/fail2ban/jail.local
/etc/fail2ban/jail.local — Comprehensive jail config
Shell — Deploy and test
👥 RESPONSIBLE
Linux/System Admin
✅ VERIFICATION
fail2ban-client status
→ Number of jail: 5
→ Jail list: sshd, nginx-http-auth, nginx-limit-req, nginx-botsearch, pam-generic
fail2ban-client status sshd
→ Filter: File list, Currently failed: 0, Total failed: X
→ Actions: Currently banned: X, Total banned: X
iptables -L f2b-sshd -n --line-numbers
→ Lists currently banned IPs ✓
📋 VAPT CLOSURE
🔒
Audit Closure
Fail2ban is active with 5 configured jails covering SSH, Nginx HTTP auth, Nginx rate limiting, bot detection, and PAM authentication. SSH jail enforces a 24-hour ban after 3 failed attempts within 10 minutes. Admin IPs are whitelisted to prevent accidental lockout. Email alerts are configured for ban events. fail2ban-client status confirms all jails are active and running.⌄
⚠ ISSUE
Default Linux kernel network parameters leave the system vulnerable to IP spoofing, ICMP redirect attacks, SYN flood DDoS, and source routing. Kernel core dump settings may also expose sensitive memory.
🔥 RISK
IP spoofing enabling traffic hijacking, ICMP redirect attacks rerouting packets, SYN flood exhausting connection tables (DoS), and kernel core dumps exposing cryptographic keys and passwords in memory.
🔧 FIX — /etc/sysctl.d/99-security.conf
/etc/sysctl.d/99-security.conf
Shell — Apply sysctl settings
👥 RESPONSIBLE
Linux/System Admin
✅ VERIFICATION
sysctl net.ipv4.tcp_syncookies net.ipv4.conf.all.rp_filter kernel.randomize_va_space kernel.dmesg_restrict
→ net.ipv4.tcp_syncookies = 1
→ net.ipv4.conf.all.rp_filter = 1
→ kernel.randomize_va_space = 2
→ kernel.dmesg_restrict = 1
sysctl net.ipv4.conf.all.accept_redirects net.ipv4.conf.all.send_redirects
→ net.ipv4.conf.all.accept_redirects = 0
→ net.ipv4.conf.all.send_redirects = 0
📋 VAPT CLOSURE
🔒
Audit Closure
Kernel network parameters are hardened via /etc/sysctl.d/99-security.conf: SYN cookies enabled (DoS protection), ICMP redirect acceptance disabled, IP source routing disabled, reverse path filtering enabled, IP forwarding disabled, martian packet logging enabled. Kernel security: ASLR at level 2, dmesg restricted to root, kernel pointers hidden, ptrace restricted to parent process. Settings persist across reboots via drop-in sysctl configuration.
AUDIT & FILE INTEGRITY
auditd · AIDE File Integrity · Lynis Security Audit
3 CONTROLS
⌄
⚠ ISSUE
Without auditd, there is no kernel-level tracking of privileged command execution, file access to sensitive locations, user authentication events, or system call abuse. Post-incident forensics is impossible.
🔥 RISK
Undetected unauthorized access, inability to reconstruct attack timelines, compliance failures (PCI-DSS, ISO 27001), and incomplete forensic evidence for incident response.
🔧 FIX — Comprehensive audit rules
/etc/audit/rules.d/99-hardening.rules
Shell — Apply and query auditd
👥 RESPONSIBLE
Linux/System AdminSecurity Team
📋 VAPT CLOSURE
🔒
Audit Closure
Linux Audit Framework (auditd) is active with comprehensive rules covering authentication failures, sudo/su usage, SUID program execution, system file modifications (/etc/passwd, /etc/shadow, /etc/sudoers), kernel module loading, cron changes, and time modification. Rules use key labels for easy post-incident searching. Log buffer is 8192 to prevent event drops. Auditd service is enabled and persistent. aureport --summary produces clean summary.⌄
⚠ ISSUE
Attackers who gain access often modify system binaries (ls, ps, netstat) to hide their presence, or inject backdoors into existing executables. Without a file integrity baseline, these modifications go undetected.
🔥 RISK
Silent binary modification for persistence — a replaced /usr/bin/sudo or /bin/login can capture all passwords while appearing legitimate. AIDE detects any unauthorized modification to monitored files.
🔧 FIX — Install AIDE and create baseline
Shell — AIDE setup
/etc/aide.conf — Key monitoring rules
Shell — Daily AIDE check via cron with email
👥 RESPONSIBLE
Linux/System AdminSecurity Team
📋 VAPT CLOSURE
🔒
Audit Closure
AIDE (Advanced Intrusion Detection Environment) is installed with a baseline database initialized on the verified-clean system state. Monitored paths include all system binaries, /etc configuration files, /boot, and the web root. SHA-512 checksums and extended attribute checks are enabled. Daily automated checks run at 5 AM with full reports emailed to the security team. AIDE database is stored separately from the monitored filesystem.⌄
⚠ ISSUE
Without regular security auditing, hardening regressions (e.g., an update re-enabling a disabled service) go undetected. Lynis provides an automated, comprehensive security audit with a hardening score and prioritized findings.
🔥 RISK
Security baseline drift — package updates, configuration changes, or new software installations can silently revert hardening settings. Regular Lynis scans provide a measurable hardening index (target: >80/100).
🔧 FIX — Install and automate Lynis
Shell — Lynis installation and scanning
👥 RESPONSIBLE
Linux/System AdminSecurity Team
✅ VERIFICATION
lynis show hardening
→ Hardening index : 87
→ Tests performed : 261
→ Plugins enabled : 2
grep "Hardening index" /var/log/lynis/lynis.log | tail -1
→ Hardening index : 87 [████████████████████░░░]
📋 VAPT CLOSURE
🔒
Audit Closure
Lynis security audit tool is installed and a baseline scan has been completed. Hardening index is ≥80 (target threshold). All Critical and High findings from the Lynis report have been remediated. Weekly automated scans are scheduled to detect configuration drift. A custom profile excludes documented false positives. Scan results are retained for 90 days for trend analysis.
INFRASTRUCTURE SECURITY
Auto Updates · LUKS Disk Encryption · Log Management · NTP Security
4 CONTROLS
⌄
⚠ ISSUE
Servers running outdated packages with known CVEs are the primary target of exploit kits and automated attack campaigns. The average time-to-exploit for a critical CVE is now measured in hours after public disclosure.
🔥 RISK
Exploitation of known, patched vulnerabilities (e.g., Log4Shell, Shellshock, Heartbleed) months or years after patches are available due to manual update neglect.
🔧 FIX — Auto security updates (RHEL + Ubuntu)
Shell — RHEL/CentOS: dnf-automatic
/etc/dnf/automatic.conf — Security-only updates
Shell — Enable and start
👥 RESPONSIBLE
Linux/System AdminDevOps
📋 VAPT CLOSURE
🔒
Audit Closure
Automatic security-only updates are configured via dnf-automatic (RHEL) or unattended-upgrades (Ubuntu). Updates apply daily with security team email notification. Automatic reboots are disabled — kernel updates requiring reboot are flagged for manual scheduling during a maintenance window. All currently installed packages are at their latest security-patched versions (verified via dnf check-update --security / apt-get --just-print upgrade).⌄
⚠ ISSUE
Unencrypted disks can be removed from a server (physical or cloud snapshot) and mounted on an attacker's system to read all data — including /etc/shadow password hashes, database files, SSL private keys, and application secrets.
🔥 RISK
Complete data theft via physical disk theft or cloud snapshot, offline password cracking of /etc/shadow via direct disk access, and private key extraction bypassing all OS-level access controls.
🔧 FIX — LUKS2 encryption for data partitions
Shell — Encrypt a data partition with LUKS2
👥 RESPONSIBLE
Linux/System Admin
✅ VERIFICATION
cryptsetup status data_encrypted
→ /dev/mapper/data_encrypted is active and is in use.
→ type: LUKS2
→ cipher: aes-xts-plain64
→ keysize: 512 bits
→ device: /dev/sdX1
cryptsetup luksDump /dev/sdX1 | grep -E "Version|Cipher|Key size"
→ Version: 2
→ Cipher name: aes
→ Key size: 512 bits
📋 VAPT CLOSURE
🔒
Audit Closure
Data partitions are encrypted with LUKS2 using AES-256-XTS cipher with Argon2id key derivation (5000ms iteration time). cryptsetup luksDump confirms LUKS2 version, correct cipher, and 512-bit key size. LUKS header backup is stored offsite in a secure location. A recovery key slot is documented and secured in the organization's password vault. Disk encryption protects data-at-rest against physical theft and snapshot attacks.⌄
⚠ ISSUE
Logs stored only on the server being attacked are easily tampered with by an attacker who has gained access. Default log rotation may delete logs before they are reviewed. No central log aggregation means correlation across servers is impossible.
🔥 RISK
Post-incident forensics blocked by log deletion or tampering, compliance failures (PCI-DSS Req 10, ISO 27001 A.12.4), and inability to detect attacks spanning multiple systems without centralized logs.
🔧 FIX — rsyslog forwarding + journald persistence
/etc/systemd/journald.conf — Persistent journal storage
/etc/rsyslog.d/99-forward.conf — Forward to central SIEM
/etc/logrotate.d/custom — Log retention policy
👥 RESPONSIBLE
Linux/System AdminSecurity Team
📋 VAPT CLOSURE
🔒
Audit Closure
systemd-journald is configured with persistent storage (survives reboots) and 90-day retention. All logs are forwarded via TLS-encrypted rsyslog to the central SIEM. Local log rotation retains 90 days of compressed logs. Log integrity is protected by the central forwarding — an attacker who compromises the server cannot delete or modify already-forwarded logs. logrotate confirms 90-day rotation policy is active.⌄
⚠ ISSUE
Incorrect system time causes TLS certificate validation failures, Kerberos authentication errors, log timestamp corruption (making forensics impossible), and enables replay attacks. NTP traffic can also be abused for DDoS amplification.
🔥 RISK
Time drift invalidates TLS certificates causing service outages, log timestamps become unreliable for forensics, and NTP reflection attacks when monlist is enabled (amplification factor 200x-700x).
🔧 FIX — Chrony with security hardening
/etc/chrony.conf — Secure NTP configuration
Shell — Enable and verify
👥 RESPONSIBLE
Linux/System Admin
✅ VERIFICATION
chronyc tracking
→ Reference ID : X.X.X.X (pool.ntp.org)
→ Stratum : 3
→ System time : 0.000012345 seconds fast of NTP time
→ Last offset : -0.000000100 seconds
→ RMS offset : 0.000027000 seconds
timedatectl status
→ NTP service: active
→ NTP synchronized: yes
→ System clock synchronized: yes
📋 VAPT CLOSURE
🔒
Audit Closure
Chrony replaces ntpd/systemd-timesyncd as the sole NTP daemon. External NTP queries are blocked at the firewall (server acts as client only, not server). chronyc tracking confirms successful synchronization with sub-millisecond accuracy. System time is verified as correct and NTP-synchronized via timedatectl. Accurate timestamps ensure log integrity and forensic reliability across all audit trails.