For Teachers · Back to the Module · Print with your browser's Print command.

P17 Worksheet: Kernel, Filesystem and Boot Hardening

Student Worksheet (about 35 minutes, Practitioner level)

Name: ______________________ Class: __________ Date: __________

Read first: P1

Learning Objectives

• [ ] Explain what the main kernel hardening parameters protect against and where their values live.
• [ ] Explain why temporary, home and log directories are mounted separately with nodev, nosuid and noexec.
• [ ] Audit SUID programs, unowned files, sticky bits, cron access lists and the default umask.
• [ ] Explain how a boot loader password, Secure Boot, module restrictions and file integrity monitoring work together.

Key Terms

Write each definition in your own words.

• Sysctl: ______________________________________________
• Mount Option: ______________________________________________
• Sticky Bit: ______________________________________________
• SUID: ______________________________________________
• Umask: ______________________________________________
• Secure Boot: ______________________________________________
• Kernel Module: ______________________________________________
• File Integrity Monitoring: ______________________________________________
• Core Dump: ______________________________________________
• Hardening: ______________________________________________

Lab Tasks

Use only the simulated lab or a machine your teacher has authorised.

1. Run: openvapt demo --only HOST-KRN- --out p15 and read the evidence line of each failed kernel parameter; find its hardened value in internal/lab/fixtures_kernel_fs_boot.go.
2. Run: openvapt explain HOST-FS-016 and compare the baseline list in the source with the SUID programs on a test machine you own: find /usr/bin /usr/sbin -perm /6000 -type f
3. Run: openvapt demo --only HOST-BOOT- and explain, for each finding, what an attacker with console access could do before the fix.
4. On a test machine you own: findmnt -no TARGET,OPTIONS /tmp /var/tmp /dev/shm /home and decide which options are missing.

Self-Check Questions

1. Where does OpenVAPT read kernel parameter values from?

• [ ] a) The output of the sysctl command
• [ ] b) Files under /proc/sys
• [ ] c) /etc/sysctl.conf
• [ ] d) The kernel boot log from dmesg

1. What does the noexec mount option on /tmp prevent?

• [ ] a) Creating files in /tmp
• [ ] b) Running programs stored in /tmp
• [ ] c) Reading other users' files in /tmp
• [ ] d) Deleting other users' files in /tmp

1. A file is owned by uid 1003, which is not in /etc/passwd. What is the risk?

• [ ] a) The file cannot be opened by anyone
• [ ] b) The next account created with uid 1003 inherits it
• [ ] c) The kernel deletes it at reboot
• [ ] d) Root automatically takes ownership of it

1. Why does a GRUB password matter on a server in a locked room?

• [ ] a) It encrypts the disk
• [ ] b) Console and virtual console access still allows editing the boot command line
• [ ] c) It is required by Secure Boot
• [ ] d) It makes the server boot faster

1. AIDE is installed but no timer or cron job runs it. Does the integrity check pass?

• [ ] a) Yes, the tool is present
• [ ] b) No, a baseline that is never compared protects nothing
• [ ] c) Only if prelink is absent
• [ ] d) Yes, if it came from a signed package

Reflection

Which finding from this module would matter most on a server you are responsible for, and why?

________________________________________________________________

Sources

• Linux kernel documentation, /proc/sys/kernel: https://docs.kernel.org/admin-guide/sysctl/kernel.html
• Kernel Self Protection Project, Recommended Settings: https://kspp.github.io/Recommended_Settings
• NIST SP 800-123, Guide to General Server Security: https://csrc.nist.gov/pubs/sp/800/123/final
• GNU GRUB Manual, Security: https://www.gnu.org/software/grub/manual/grub/html_node/Security.html
• AIDE, Advanced Intrusion Detection Environment: https://aide.github.io/

Adapted from the OpenVAPT Academy (openvapt.com), built by AI Cybersecurity Engineers, used under the OpenVAPT Source-Available Licence 1.3. Free teaching use under TEACHING.md. Please cite OpenVAPT: see CITING.md or openvapt.com/cite.html. OpenVAPT is not affiliated with, and is not endorsed by, this institution or any third party named in this material. Pre-release versions may be wrong or unstable. Use at your own risk. If you adapt this material, say where you changed it.