Hey guys and welcome back to another skill. So in this skill right here what we're going
to be focusing on is the concept of security and we will get to look at some security tools
which we can use as well as some security resources we can utilize to find out information
relating to security and then finally we will look at something called VPNs and how
we can actually configure our own VPN. So with that said how about we roll up our sleeves
and get started. Now the very first thing I want to talk to you about are some of the
tools that we have available to us. Now the tools which I want to highlight should be
familiar to you by now. The very first tool we have to be aware of is one called IP tables.
Now you may recall that IP tables was what we use to ultimately implement a firewall.
This is going to allow us to control particular traffic paths meaning we could either permit
or deny particular traffic based on its destination. That could be a destination IP address or
a destination IP address and port. That could also be dependent on a source address meaning
a source IP or a source port. We could have a combination of rules based on sources and
destinations as well as targeting particular protocols particular ports so on so forth.
Really what we want to be remembering for this portion of the exam is that IP tables
is going to allow us to control that traffic by implementing firewalls. Now the very next
thing we want to look at is maybe an unusual one because you don't associate it with security
in any type of way usually and that is Telnet. Now you may recall when we talked about SSH
we learned that Telnet was really the precursor to SSH in a way. It allowed us to have remote
access but the big thing with Telnet was that it was unencrypted. But one thing about Telnet
that is very very useful is that it can allow us to easily test connectivity so we're not really
going to be using Telnet to transport any type of sensitive data absolutely not. But if we want to
maybe say test if our email server is reachable over a particular port and accessible well Telnet
can be used to facilitate that basic test connection so really just for testing accessibility
and availability Telnet can be a useful tool and that's kind of limited respect. Now the next
thing we have is something called NC this is Netcat. Netcat really is the type of Swiss Army
knife of network utilities it can do so so much. With Netcat we can ultimately test particular
ports we can test particular protocols we can open up sockets and channels and ultimately
generate connections between machines using this particular utility so we do want to understand
what Netcat is what it can be used for these are the primary purposes. Now we also want to be aware
of Nmap. Nmap is one of the favorite tools of hackers worldwide it is primarily going to be used
as a port scanner although it can be used to actually perform some type of vulnerability scanning
i.e. you can run Nmap against your own local server probing for vulnerabilities testing for
open ports. Now other tools we have to be aware of one is called OpenVas. OpenVas is another
vulnerability scanner so this is great to use let's maybe say you have some out of date software on
your system maybe say you're using some type of insecure cipher suite on your cryptography whatever
it may be. OpenVas can be used to ultimately detect and alert you to these issues and provide
you a way to really harden and tighten up your security posture. Now another tool we have to
be aware of is one called Snort. Snort is very very popular in the enterprise world. Now Snort
is not a vulnerability scanner it is from the family of tools known as an intrusion detection system
so the main difference here between so now a vulnerability scanner is something you could run
on your own system to probe and test for weaknesses, weaknesses that could otherwise be exploited by
someone else whereas an IDS an intrusion detection system that is going to actually catch anyone who
is proactively trying to breach your system. So really a vulnerability scanner is something you
would use yourself on your own system to test for particular weaknesses whereas the IDS is actually
going to scan and monitor for incoming connections that could be malicious i.e someone who actually
is trying to exploit a vulnerability in your system and actively breach the perimeter. So really
OpenVas that is the vulnerability scanner you want to be aware of whereas Snort is the IDS you want
to be aware of one other IDS you want to know is one called Fail2Ban. Now what Fail2Ban does really
it's going to ultimately ban IP addresses and the way you actually ban these particular IP
addresses is you specify them in the form of a log file. Now if that log file happens to contain a
particular IP address then if someone tries to connect in to your system from that IP address
which you identify as malicious Fail2Ban is going to ultimately jail them so they're not going to
be able to make that connection. So let's quickly look at the installation of Fail2Ban if we just
just maximize this and the way we can install Fail2Ban is we can say sudo apt install and it's
just fail2ban and it would be helpful if I could actually type not just mysqlpd that should be apt
not aot of course there we go and type in the passwords hit enter just say yes to install the
software and the installation should complete. So now once that is done one thing we want to
be aware of is a particular location of our primary configuration file for Fail2Ban this is going to be
our jail configuration file so if we go into the exit directory you should now have a new directory
called fail2ban if we go in here and do an ls we can see here we have this jail.conf file so what I
can do here is if I just go into jail.conf this is the primary file which you can use to control
fail2ban so we can control things such as the band time i.e how long we want to actually ban
a particular connection we can also specify the number of retries oh sorry about that we can also
specify the number of maximum retries before a failure is going to be initiated so let's just
maybe say we happen to have as we can see here five attempts if someone makes five different
attempts to log into the system that are bad and are rejected say for example they're trying to do a
brute force attack trying different credentials that host is going to be banned from initiating a
connection at all so this can be a way we can actually stop and prohibit any type of brute force
attacks on our system but really if we stroll through this entire configuration file we have a
bunch of different things we can choose again the main thing we want to be aware of is the utility
of what fail2ban can do and the location of that particular configuration file jail.conf within the
etsy fail2ban directory now one thing I should actually just note just for the purposes of the
examination we probably want to be aware of is this option here ignore ip this is actually
commented out meaning that it is not active right now if we actually uncomment this what we can do
is provide a list of ip addresses to never ban this is in effect allowing us to implement a
waitlist so really those are the main tools that we have to be aware of from our point of view of
security now what we want to look at are some of the basic security resources that we have to be
aware of for the purposes of the lpik2 examination and well that's what we'll be looking at in the
very next nuggets I hope this has been informative for you I'd like to thank you for viewing