For Teachers · Back to the Module · Print with your browser's Print command.

P17 Teacher Answer Key: Kernel, Filesystem and Boot Hardening

Teacher Answer Key (about 35 minutes, Practitioner level)

Name: ______________________ Class: __________ Date: __________

Read first: P1

Learning Objectives

• [ ] Explain what the main kernel hardening parameters protect against and where their values live.
• [ ] Explain why temporary, home and log directories are mounted separately with nodev, nosuid and noexec.
• [ ] Audit SUID programs, unowned files, sticky bits, cron access lists and the default umask.
• [ ] Explain how a boot loader password, Secure Boot, module restrictions and file integrity monitoring work together.

Key Terms

Write each definition in your own words.

• Sysctl: The kernel's run-time settings, each one a file under /proc/sys; the sysctl command reads and writes them and /etc/sysctl.d makes a value permanent.
• Mount Option: A flag applied when a filesystem is mounted, such as nodev, nosuid or noexec, that limits what files on it may do.
• Sticky Bit: A permission on shared directories such as /tmp that stops users deleting each other's files.
• SUID: Set-user-ID: a file permission that makes a program run with its owner's privileges, often root.
• Umask: The permission bits removed from every new file a process creates; 027 keeps new files unreadable to other users, 022 does not.
• Secure Boot: A UEFI firmware feature that refuses to run boot loaders and kernels that are not signed by a trusted key.
• Kernel Module: A piece of kernel code loaded at run time, such as a driver or filesystem; loading one gives full control of the kernel, so loading is restricted on hardened systems.
• File Integrity Monitoring: Recording hashes, permissions and owners of important files as a baseline and comparing against it on a schedule to detect unexpected changes.
• Core Dump: A file holding a crashed program's memory, written for debugging; it can contain passwords and keys the program held.
• Hardening: Reducing a system's attack surface and weaknesses through configuration.

Lab Tasks

Use only the simulated lab or a machine your teacher has authorised.

1. Run: openvapt demo --only HOST-KRN- --out p15 and read the evidence line of each failed kernel parameter; find its hardened value in internal/lab/fixtures_kernel_fs_boot.go.
2. Run: openvapt explain HOST-FS-016 and compare the baseline list in the source with the SUID programs on a test machine you own: find /usr/bin /usr/sbin -perm /6000 -type f
3. Run: openvapt demo --only HOST-BOOT- and explain, for each finding, what an attacker with console access could do before the fix.
4. On a test machine you own: findmnt -no TARGET,OPTIONS /tmp /var/tmp /dev/shm /home and decide which options are missing.

Self-Check Questions

1. Where does OpenVAPT read kernel parameter values from?

• [ ] a) The output of the sysctl command
• [x] b) Files under /proc/sys
• [ ] c) /etc/sysctl.conf
• [ ] d) The kernel boot log from dmesg
• Answer: b. Reading /proc/sys shows the value the kernel enforces now, without running a command.

1. What does the noexec mount option on /tmp prevent?

• [ ] a) Creating files in /tmp
• [x] b) Running programs stored in /tmp
• [ ] c) Reading other users' files in /tmp
• [ ] d) Deleting other users' files in /tmp
• Answer: b. Downloaded tools cannot be executed from a noexec filesystem.

1. A file is owned by uid 1003, which is not in /etc/passwd. What is the risk?

• [ ] a) The file cannot be opened by anyone
• [x] b) The next account created with uid 1003 inherits it
• [ ] c) The kernel deletes it at reboot
• [ ] d) Root automatically takes ownership of it
• Answer: b. Ownership is numeric; a new account with that id silently owns old files.

1. Why does a GRUB password matter on a server in a locked room?

• [ ] a) It encrypts the disk
• [x] b) Console and virtual console access still allows editing the boot command line
• [ ] c) It is required by Secure Boot
• [ ] d) It makes the server boot faster
• Answer: b. Anyone with console or out-of-band management access can otherwise boot to a root shell.

1. AIDE is installed but no timer or cron job runs it. Does the integrity check pass?

• [ ] a) Yes, the tool is present
• [x] b) No, a baseline that is never compared protects nothing
• [ ] c) Only if prelink is absent
• [ ] d) Yes, if it came from a signed package
• Answer: b. The check wants the tool and a scheduled comparison.

Reflection

Which finding from this module would matter most on a server you are responsible for, and why?

________________________________________________________________

Sources

• Linux kernel documentation, /proc/sys/kernel: https://docs.kernel.org/admin-guide/sysctl/kernel.html
• Kernel Self Protection Project, Recommended Settings: https://kspp.github.io/Recommended_Settings
• NIST SP 800-123, Guide to General Server Security: https://csrc.nist.gov/pubs/sp/800/123/final
• GNU GRUB Manual, Security: https://www.gnu.org/software/grub/manual/grub/html_node/Security.html
• AIDE, Advanced Intrusion Detection Environment: https://aide.github.io/

Adapted from the OpenVAPT Academy (openvapt.com), built by AI Cybersecurity Engineers, used under the OpenVAPT Source-Available Licence 1.3. Free teaching use under TEACHING.md. Please cite OpenVAPT: see CITING.md or openvapt.com/cite.html. OpenVAPT is not affiliated with, and is not endorsed by, this institution or any third party named in this material. Pre-release versions may be wrong or unstable. Use at your own risk. If you adapt this material, say where you changed it.