wk2 security

Question 1

What is authentication

Answer 1

The process by which a ysstem verifies the identity of a user who wishes to access it. In the context of CPhulk, this primarily relates to detected authentication attempts incoming to the server via one of the monitored services or via PAM authentication

Question 2

PAM

Answer 2

An acronym that, for our purposes at least, stands for Pluggable Authentication Module. On the system, this module handles the majority of standard authentiation attempts coming into the server, whether being called by another PAM-integrated 3rdparty-service, or for general system authentication. cphulk requests information from PAM to determine if a login attempt is a brute force attacke

Question 3

What tools might you use to help protect against a denial of service attack?

Answer 3

firewalls such as CSF with LFD

apache’s mod_evasive or mod_qos modules for apache-specific attacks

Question 4

What tool might you use to help protect against a brute force attack?

Answer 4

cPHulk Brute Force Protection - monitors incoming authentication attempts and applies rules as necessary

Question 5

What services does cPHulk monitor

Answer 5

SSH, FTP, IMAP, POP3, SMTP, any 3rd party services that authenticate using PAM

Question 6

Default duration for username-based protection lockout?

Answer 6

5 min

Question 7

Default duration for IP-based protection lockout?

Answer 7

15 min

Question 8

Script to disable cphulk?

Answer 8

/scripts/restartsrv_cphulkd stop

Question 9

There are five phases of an HTTP transaction in ModSecurity that can be used to intercept, inspect, or change behavior.

Answer 9

1. Request Header
2. Request Body
3. Response Header
4. Response Body
5. Logging

Question 10

What’s the syntax for a secrule definition

Answer 10

The SecRule directive instructs the server on where to look (using a variable), what to look for (using an operator), and what to do if it finds a match (action). SecRule definitions follow a standard format, using variables, operators, and an optional action, all contained on a single line:

SecRule Variables Operator [Action]

Show above: Basic syntax of a SecRule definition, indicating by the brackets that the “Action” value is optional,

Question 11

What is owasp

Answer 11

s an independent, online project that focuses on making web application security tools, knowledge, and methods freely available to the general internet