Practice lab
Type real Linux commands in the terminal: read an auth log, verify installer hashes and fix file permissions. Lab D scans your own machine, so it stays a download.
Step 2. Lab A: find the brute force
Work in ~/secplus-lab/log and answer:
- Which IP made the brute-force attempts?
- Which account did it log in to?
- How many
Failed passwordentries came from that IP?
cd ~/secplus-lab/log
head auth.log
grep -c 'Failed password' auth.log
grep 'Failed password' auth.log | awk '{print $(NF-3)}' | sort | uniq -c | sort -nr
grep 'Accepted' auth.log
grep 'Invalid user' auth.log | awk '{print $8}' | sort | uniq -c | sort -nrAsk yourself why grep '<attacker IP>' auth.log | wc -l gives a bigger number than your answer to question 3.
Step 3. Lab B: verify the installers
Compare the installers in ~/secplus-lab/downloads with the vendor's published hashes.
cd ~/secplus-lab/downloads
cat vendor_hashes.txt
sha256sum *.exe *.msi *.deb
sha256sum -c vendor_hashes.txtType the name of the file that failed below and select Check. Reset the lab to get a new tampered file.
Then answer: what would you do with the failed file, and what would prove who created the file, not just that it is unchanged?
Step 4. Lab C: find and fix permissions
This time you actually fix things. Work in ~/secplus-lab.
cd ~/secplus-lab
ls -l etc
ls -la home/deploy/.ssh
grep -n 'PermitRootLogin\|PasswordAuthentication' etc/ssh/sshd_config
# Your fixes (work out the right values yourself):
chmod ??? etc/shadow
chmod ??? home/deploy/.ssh/id_rsa
sed -i 's/^PermitRootLogin yes/PermitRootLogin ??/' etc/ssh/sshd_config
# Verify
stat -c '%a %n' etc/shadow home/deploy/.ssh/id_rsa
grep '^PermitRootLogin' etc/ssh/sshd_configScan only machines you own or have written permission to test. Scanning other people's systems without permission is illegal.
Run it on Ubuntu or Kali Linux, a Linux VM, or WSL on Windows (wsl --install in PowerShell, then open Ubuntu). macOS works for most tasks, but use stat -f '%Lp %N' instead of stat -c and replace shuf -n1 with ls | sort -R | head -n1.
Step 1. Build the lab
Download build-lab.sh, then run it. It creates practice files in a secplus-lab folder in your home directory and does not touch your system files.
bash build-lab.shRun it again any time to reset the lab: it deletes and rebuilds ~/secplus-lab. Lab B picks a new tampered file on every build.
Step 5. Lab D: scan your own machine
Install nmap (sudo apt install nmap) and scan only machines you own. Scanning other people's systems without permission is illegal.
nmap localhost
nmap -sV localhost
ss -tlnp # which processes are listening, compare with nmapFor each open port, write the service name, whether it is cleartext or encrypted, and its secure replacement if one exists.