🔒AP Cybersecurity
1. The following sources all come from the same device (hostname: mx01.local, IP address 10.10.5.50) and were captured during a routine risk assessment. Use them to answer parts A through E.
Source 1 — Device Firewall Settings
Rule Number | Action | Source | Destination | Direction | Port Number | Protocol |
|---|---|---|---|---|---|---|
1 | Allow | ALL | 10.10.5.50 | Inbound | 25 | SMTP |
2 | Allow | ALL | 10.10.5.50 | Inbound | 993 | IMAPS |
3 | Allow | 10.10.5.0/24 | 10.10.5.50 | Inbound | 22 | SSH |
4 | Allow | 10.10.5.50 | ALL | Outbound | 53 | DNS |
5 | Allow | 10.10.5.50 | ALL | Outbound | 80 | HTTP |
6 | Allow | 10.10.5.50 | ALL | Outbound | 443 | HTTPS |
7 | Allow | 10.10.5.50 | ALL | Outbound | 25 | SMTP |
8 | Deny | ALL | ALL | Inbound | ALL | ALL |
Source 2 — /home/sysadmin/.bash_history
sudo tail -n 10 /home/sysadmin/.bash_history
1 sudo systemctl status postfix
2 sudo systemctl restart postfix
3 cd /etc/postfix
4 ls -la
5 nano main.cf
6 postmap /etc/postfix/virtual
7 systemctl reload postfix
8 ping -c 4 8.8.8.8
9 apt update
10 apt upgrade -ySource 3 — /var/log/auth.log
sudo tail -n 15 /var/log/auth.log
1 Oct 14 08:12:01 mx01 CRON[4121]: pam_unix(cron:session): session opened for user root
2 Oct 14 08:12:01 mx01 CRON[4121]: pam_unix(cron:session): session closed for user root
3 Oct 14 08:15:22 mx01 vsftpd[5102]: Failed login for invalid user admin from 198.51.100.73 port 21 ftp
4 Oct 14 08:15:23 mx01 vsftpd[5104]: Failed login for invalid user root from 198.51.100.73 port 21 ftp
5 Oct 14 08:15:24 mx01 vsftpd[5106]: Failed login for invalid user administrator from 198.51.100.73 port 21 ftp
6 Oct 14 08:15:24 mx01 vsftpd[5108]: Failed login for invalid user user from 198.51.100.73 port 21 ftp
7 Oct 14 08:15:25 mx01 vsftpd[5110]: Failed login for invalid user test from 198.51.100.73 port 21 ftp
8 Oct 14 08:15:26 mx01 vsftpd[5112]: Failed login for invalid user guest from 198.51.100.73 port 21 ftp
9 Oct 14 08:15:27 mx01 vsftpd[5114]: Failed login for invalid user info from 198.51.100.73 port 21 ftp
10 Oct 14 08:15:28 mx01 vsftpd[5116]: Failed login for invalid user webmaster from 198.51.100.73 port 21 ftp
11 Oct 14 08:15:28 mx01 vsftpd[5118]: Failed login for invalid user mail from 198.51.100.73 port 21 ftp
12 Oct 14 08:15:29 mx01 vsftpd[5120]: Failed login for invalid user postmaster from 198.51.100.73 port 21 ftp
13 Oct 14 08:18:40 mx01 kernel: [12456.789] [UFW BLOCK] IN=eth0 OUT= MAC=00:1a:2b:3c:4d:5e SRC=192.0.2.15 DST=10.10.5.50 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=12345 DF PROTO=TCP SPT=54321 DPT=110 WINDOW=65535 RES=0x00 SYN URGP=0
14 Oct 14 08:20:05 mx01 sshd[5201]: Accepted publickey for sysadmin from 10.10.5.15 port 49152 ssh2
15 Oct 14 08:20:05 mx01 sshd[5201]: pam_unix(sshd:session): session opened for user sysadminSource 4 — /var/log/syslog
sudo grep "UFW BLOCK" /var/log/syslog | tail -n 9
1 Oct 14 09:01:10 mx01 kernel: [15001.102] [UFW BLOCK] IN=eth0 OUT= MAC=... SRC=203.0.113.42 DST=10.10.5.50 LEN=60 TOS=0x00 PREC=0x00 TTL=52 ID=4111 DF PROTO=TCP SPT=38192 DPT=21 WINDOW=1024 RES=0x00 SYN URGP=0
2 Oct 14 09:01:10 mx01 kernel: [15001.105] [UFW BLOCK] IN=eth0 OUT= MAC=... SRC=203.0.113.42 DST=10.10.5.50 LEN=60 TOS=0x00 PREC=0x00 TTL=52 ID=4112 DF PROTO=TCP SPT=38192 DPT=22 WINDOW=1024 RES=0x00 SYN URGP=0
3 Oct 14 09:01:10 mx01 kernel: [15001.108] [UFW BLOCK] IN=eth0 OUT= MAC=... SRC=203.0.113.42 DST=10.10.5.50 LEN=60 TOS=0x00 PREC=0x00 TTL=52 ID=4113 DF PROTO=TCP SPT=38192 DPT=23 WINDOW=1024 RES=0x00 SYN URGP=0
4 Oct 14 09:01:11 mx01 kernel: [15001.115] [UFW BLOCK] IN=eth0 OUT= MAC=... SRC=203.0.113.42 DST=10.10.5.50 LEN=60 TOS=0x00 PREC=0x00 TTL=52 ID=4114 DF PROTO=TCP SPT=38192 DPT=80 WINDOW=1024 RES=0x00 SYN URGP=0
5 Oct 14 09:01:11 mx01 kernel: [15001.120] [UFW BLOCK] IN=eth0 OUT= MAC=... SRC=203.0.113.42 DST=10.10.5.50 LEN=60 TOS=0x00 PREC=0x00 TTL=52 ID=4115 DF PROTO=TCP SPT=38192 DPT=110 WINDOW=1024 RES=0x00 SYN URGP=0
6 Oct 14 09:01:11 mx01 kernel: [15001.125] [UFW BLOCK] IN=eth0 OUT= MAC=... SRC=203.0.113.42 DST=10.10.5.50 LEN=60 TOS=0x00 PREC=0x00 TTL=52 ID=4116 DF PROTO=TCP SPT=38192 DPT=143 WINDOW=1024 RES=0x00 SYN URGP=0
7 Oct 14 09:01:12 mx01 kernel: [15001.130] [UFW BLOCK] IN=eth0 OUT= MAC=... SRC=203.0.113.42 DST=10.10.5.50 LEN=60 TOS=0x00 PREC=0x00 TTL=52 ID=4117 DF PROTO=TCP SPT=38192 DPT=443 WINDOW=1024 RES=0x00 SYN URGP=0
8 Oct 14 09:01:12 mx01 kernel: [15001.135] [UFW BLOCK] IN=eth0 OUT= MAC=... SRC=203.0.113.42 DST=10.10.5.50 LEN=60 TOS=0x00 PREC=0x00 TTL=52 ID=4118 DF PROTO=TCP SPT=38192 DPT=3306 WINDOW=1024 RES=0x00 SYN URGP=0
9 Oct 14 09:01:12 mx01 kernel: [15001.140] [UFW BLOCK] IN=eth0 OUT= MAC=... SRC=203.0.113.42 DST=10.10.5.50 LEN=60 TOS=0x00 PREC=0x00 TTL=52 ID=4119 DF PROTO=TCP SPT=38192 DPT=3389 WINDOW=1024 RES=0x00 SYN URGP=0Source 5 — ls -l /etc/postfix
ls -l /etc/postfix
-rw-r--r-- 1 root root 1450 Oct 10 09:15 aliases
-rw-r--r-- 1 root root 12288 Oct 10 09:16 aliases.db
-rw-r--r-- 1 root root 28456 Oct 12 14:30 main.cf
-rw-r--r-- 1 root root 6120 Oct 10 09:15 master.cf
-rw-rw-r-- 1 root mailadmin 256 Oct 13 11:05 sasl_passwd
-rw-r--r-- 1 root root 12288 Oct 13 11:06 sasl_passwd.db
-rw-r--r-- 1 root root 340 Oct 10 09:15 virtualSource 6 — Acceptable Use Policy
Keep operating systems and mail server software updated with the latest security patches.
Use strong, unique passwords for all administrative and service accounts.
Remote SSH access from authorized administrative subnets (10.10.5.0/24).
Approved monitoring and logging agents.
Storing unencrypted credentials in world-readable files.
Disabling host-based firewalls or modifying rules without change approval.
Installing unauthorized software or running unnecessary services (e.g., FTP, Telnet).
Consider the policy for the device in Source 6.
Explain how one part of the policy helps protect the device.
Explain how one rule in the current policy could be modified to make the device more secure. Include a specific example in your response.
In the authorization log (Source 3), there is evidence of a password attack in rows 3–12.
Describe the evidence in the log file that indicates a password attack. Include specific entries from the log file in your response.
Identify the IP address of the adversary.
Consider the file listing for the device in Source 5.
Explain how the permission settings for the sasl_passwd file determine the level of access for that file for the owner, group, and all other users on the system.
Other than removing all permissions from all users, describe one way the permission settings for the sasl_passwd file could be configured to restrict access for some users on the device.
Using the explanation from part C (ii), write one or more chmod commands that set the permissions described.
Consider the firewall settings and logs from the device.
Explain how one connection attempt on the device was blocked by the device’s firewall. Include evidence from a log file in your response.
Other than allowing all traffic for all services, describe a modification to one firewall rule that would allow the connection attempt identified in part D (i).
Other than allowing the connection attempt identified in part D (i), describe one impact of your modification from part D (ii) on incoming or outgoing network traffic on the device.
Apart from the password attack identified in part B, there is evidence of another attack on the device in Source 4.
Determine the type of attack evidenced in the log file.
Describe specific information in the log file that indicates the attack named in part E (i).
Describe one way an automated system could halt this type of attack in real time.
This attack could be mitigated by an automated system, such as a firewall, IDS, IPS, or AI. Identify a different countermeasure that could mitigate, prevent, or deter the attack.
00:00
