Assignment on Linux 5

Mini Project #5
Account & Host Security (Chapters 15)

Part #1 – Secure User Accounts
Create a new user called luke with the following parameters:
Home Directory = /home/starwars
Primary Group = skywalker
Password = lucas
Add luke to the group that will give elevated root permissions
Verify that this change worked by switching luke account and conducting the following:
Create a new file called newfile.txt and enter the following in the file
Enter command(s) used to create luke
Enter command used to add luke to the group for elevated permissions
With luke account delete the following users (if they exist):
lebron, kawhi, candance, and kyrie

Part #2 – Network Scan and Open File
Run a report that will scan the network for open ports
Your Host, www.pgcc.edu, and www.umd.edu
Send all outputs to a file called networkscan.txt in Ubuntu’s home directory
Run the command that will display all open files currently running with the following specifications:
Only report open files for [Your User Account or Root] that related to the shell
Send all outputs to a file called openfiles.txt

SSL Cert for Website
Run the command to check the status of apache2
Run the following command to ensure that apache2 is binded to port 80
sudo netstat -plutn | grep :80
Run an update for all apt packages
Enable the SSL Module for Apache by running the following command:
sudo a2enmod ssl
After you have enabled the module restart the Apache2 service; ensure that Apache2 is back up and running

SSL Cert for Website
Make a new directory in /etc/apache2 called ssl
Create your ssl key and certification by running the following command:
sudo openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/apache2/ssl/apache.key -out /etc/apache2/ssl/apache.crt

Country Name (2 letter code) [AU]:US
State or Province Name (full name) [Some-State]:Maryland
Locality Name (eg, city) []:Largo
Organization Name (eg, company) [Internet Widgits Pty Ltd]:INT2761
Organizational Unit Name (eg, section) []:Linux II
Common Name (e.g. server FQDN or YOUR name) []:int2761
Email Address []:[email protected]

SSL Cert for Website
openssl: This is the basic command line tool provided by OpenSSL to create and manage certificates, keys, signing requests, etc.
req: This specifies a subcommand for X.509 certificate signing request (CSR) management. X.509 is a public key infrastructure standard that SSL adheres to for its key and certificate management. Since we are wanting to create a new X.509 certificate, this is what we want.
-x509: This option specifies that we want to make a self-signed certificate file instead of generating a certificate request.
-nodes: This option tells OpenSSL that we do not wish to secure our key file with a passphrase. Having a password protected key file would get in the way of Apache starting automatically as we would have to enter the password every time the service restarts.
-days 365: This specifies that the certificate we are creating will be valid for one year.
-newkey rsa:2048: This option will create the certificate request and a new private key at the same time. This is necessary since we didn’t create a private key in advance. The rsa:2048 tells OpenSSL to generate an RSA key that is 2048 bits long.
-keyout: This parameter names the output file for the private key file that is being created.
-out: This option names the output file for the certificate that we are generating.

SSL Cert for Website
Edit the following file:
/etc/apache2/sites-available/default-ssl.conf
Locate the following lines and change them to appear as follows:
SSLCertificateFile /etc/apache2/ssl/apache.crt
SSLCertificateKeyFile /etc/apache2/ssl/apache.key
Activate the SSL virtual host by running the following command:
sudo a2ensite default-ssl.conf
Restart the apache2 service
Check that your cert worked by typing https://[your IP addres] in a web browser
NOTE: Ignore the warning and proceed to the website and then click on the ‘lock’ symbol and display your cert (our cert is self signed and not authorized by a CA)