# Salus practice lab: build-lab.sh instructions

> **Warning:** Scan only machines you own or have written permission to test. Scanning other people's systems without permission is illegal.

Run it on Ubuntu or Kali Linux, a Linux VM, or WSL on Windows (`wsl --install` in PowerShell, then open Ubuntu). macOS works for most tasks, but use `stat -f '%Lp %N'` instead of `stat -c` and replace `shuf -n1` with `ls | sort -R | head -n1`.

## Step 1. Build the lab

Download `build-lab.sh`, then run it. It creates practice files in a `secplus-lab` folder in your home directory and does not touch your system files.

```bash
bash build-lab.sh
```

Run it again any time to reset the lab: it deletes and rebuilds `~/secplus-lab`. Lab B picks a new tampered file on every build.

## Step 2. Lab A: find the brute force

Work in `~/secplus-lab/log` and answer:

1. Which IP made the brute-force attempts?
2. Which account did it log in to?
3. How many `Failed password` entries came from that IP?

```bash
cd ~/secplus-lab/log
head auth.log
grep -c 'Failed password' auth.log
grep 'Failed password' auth.log | awk '{print $(NF-3)}' | sort | uniq -c | sort -nr
grep 'Accepted' auth.log
grep 'Invalid user' auth.log | awk '{print $8}' | sort | uniq -c | sort -nr
```

Ask yourself why `grep '<attacker IP>' auth.log | wc -l` gives a bigger number than your answer to question 3.

## Step 3. Lab B: verify the installers

Compare the installers in `~/secplus-lab/downloads` with the vendor's published hashes.

```bash
cd ~/secplus-lab/downloads
cat vendor_hashes.txt
sha256sum *.exe *.msi *.deb
sha256sum -c vendor_hashes.txt
cat ~/secplus-lab/.answer-lab-b    # check your answer
```

Then answer: what would you do with the failed file, and what would prove who created the file, not just that it is unchanged?

## Step 4. Lab C: find and fix permissions

This time you actually fix things. Work in `~/secplus-lab`.

```bash
cd ~/secplus-lab
ls -l etc
ls -la home/deploy/.ssh
grep -n 'PermitRootLogin\|PasswordAuthentication' etc/ssh/sshd_config

# Your fixes (work out the right values yourself):
chmod ??? etc/shadow
chmod ??? home/deploy/.ssh/id_rsa
sed -i 's/^PermitRootLogin yes/PermitRootLogin ??/' etc/ssh/sshd_config

# Verify
stat -c '%a %n' etc/shadow home/deploy/.ssh/id_rsa
grep '^PermitRootLogin' etc/ssh/sshd_config
```

## Step 5. Lab D: scan your own machine

Install nmap (`sudo apt install nmap`) and scan only machines you own. Scanning other people's systems without permission is illegal.

```bash
nmap localhost
nmap -sV localhost
ss -tlnp        # which processes are listening, compare with nmap
```

For each open port, write the service name, whether it is cleartext or encrypted, and its secure replacement if one exists.