Red Hat Security: Linux in Physical, Virtual, and Cloud

Bookmark this page
P123456789101112
PreviousNext

Lab: Managing Security and Risk

Performance Checklist

In this lab, you will run various commands to identify all security notices related to this system. You will assess the severity of the notices and update the system to eliminate any critical threats to the security of the system.

Outcomes

You should be able to:

  • Identify all critical, important, and moderate security notices.

  • Update the system to eliminate potential critical security vulnerabilities.

Verify that the workstation and servera systems are started.

Log in to workstation as student using student as the password. On workstation, run lab securityrisk-review setup to verify that the environment is ready. 

[student@workstation ~]$ lab securityrisk-review setup

  1. Identify all critical, important, and moderate security notices on servera.

    1. Log in to servera as student. A password is not required. 

      [student@workstation ~]$ ssh student@servera
[student@servera ~]$

    2. Use the sudo -i command to change to the root user. Use student as the password. 

      [student@servera ~]$ sudo -i
[sudo] password for student: student
[root@servera ~]#

    3. List all security notices. 

      [root@servera ~]# yum updateinfo --security
Loaded plugins: enabled_repos_upload, langpacks, package_upload, product-id, search-disabled-repos, subscription-manager
...output omitted...
Updates Information Summary: updates
    8 Security notice(s)
        1 Critical Security notice(s)
        5 Important Security notice(s)
        2 Moderate Security notice(s)
updateinfo summary done
Uploading Enabled Repositories Report
Loaded plugins: langpacks, product-id, subscription-manager
[root@servera ~]#

  2. Determine how many security-related packages are available for this machine.

    Of the 8 security notices identified for this machine, 11 packages are related to security, out of 56 available updates. 

    [root@servera ~]# yum --security list updates
...output omitted...
11 package(s) needed for security, out of 56 available
Updated Packages
dhclient.x86_64           12:4.2.5-68.el7_5.1 rhel-7-server-rpms
dhcp-common.x86_64        12:4.2.5-68.el7_5.1 rhel-7-server-rpms
dhcp-libs.x86_64          12:4.2.5-68.el7_5.1 rhel-7-server-rpms
gnupg2.x86_64             2.0.22-5.el7_5      rhel-7-server-rpms
kernel.x86_64             3.10.0-862.9.1.el7  rhel-7-server-rpms
kernel-tools.x86_64       3.10.0-862.9.1.el7  rhel-7-server-rpms
kernel-tools-libs.x86_64  3.10.0-862.9.1.el7  rhel-7-server-rpms
procps-ng.x86_64          3.3.10-17.el7_5.2   rhel-7-server-rpms
python.x86_64             2.7.5-69.el7_5      rhel-7-server-rpms
python-libs.x86_64        2.7.5-69.el7_5      rhel-7-server-rpms
python-perf.x86_64        3.10.0-862.9.1.el7  rhel-7-server-rpms
Uploading Enabled Repositories Report
Loaded plugins: langpacks, product-id, subscription-manager
[root@servera ~]#

  3. Identify any RHSAs that are unique, considered critical, and available as updates for your machine. 

    [root@servera ~]# yum updateinfo list updates | grep Critical
RHSA-2018:1453 Critical/Sec.  dhclient-12:4.2.5-68.el7_5.1.x86_64
RHSA-2018:1453 Critical/Sec.  dhcp-common-12:4.2.5-68.el7_5.1.x86_64
RHSA-2018:1453 Critical/Sec.  dhcp-libs-12:4.2.5-68.el7_5.1.x86_64

    There is one RHSA that meets the criteria: RHSA-2018:1453.

  4. View the synopsis of the critical RHSA to validate its content.

    Read through the Description and Security Fix(es) sections of RHSA-2018:1453 to better understand this advisory and subsequent CVE. Log the CVE code so that you can use it later to update only the packages related to this RHSA. 

    [root@servera ~]# yum updateinfo RHSA-2018:1453
...output omitted...
===============================================================================
  Critical: dhcp security update
===============================================================================
  Update ID : RHSA-2018:1453
    Release : 0
       Type : security
     Status : final
     Issued : 2018-05-15 12:14:45 UTC
    Updated : 2018-05-15 12:15:00 UTC       Bugs : 1567974 - CVE-2018-1111 dhcp: Command injection vulnerability in the DHCP client NetworkManager integration script
       CVEs : CVE-2018-1111
Description : The Dynamic Host Configuration Protocol (DHCP) is a protocol
            : that allows individual devices on an IP network to
            : get their own network configuration information,
            : including an IP address, a subnet mask, and a
            : broadcast address. The dhcp packages provide a
            : relay agent and ISC DHCP service required to
            : enable and administer DHCP on a network.
            :
            : Security Fix(es):
            :
            : * A command injection flaw was found in the
            :   NetworkManager integration script included in
            :   the DHCP client packages in Red Hat Enterprise
            :   Linux. A malicious DHCP server, or an attacker
            :   on the local network able to spoof DHCP
            :   responses, could use this flaw to execute
            :   arbitrary commands with root privileges on
            :   systems using NetworkManager and configured to
            :   obtain network configuration using the DHCP
            :   protocol. (CVE-2018-1111)
            :
            : Red Hat would like to thank Felix Wilhelm (Google
            : Security Team) for reporting this issue.
   Severity : Critical
updateinfo info done
Uploading Enabled Repositories Report
Loaded plugins: langpacks, product-id, subscription-manager
[root@servera ~]#

  5. Use YUM and the CVE code to list the packages required to update this system. 

    [root@servera ~]# yum updateinfo list --cve CVE-2018-1111
...output omitted...
RHSA-2018:1453 Critical/Sec. dhclient-12:4.2.5-68.el7_5.1.x86_64
RHSA-2018:1453 Critical/Sec. dhcp-common-12:4.2.5-68.el7_5.1.x86_64
RHSA-2018:1453 Critical/Sec. dhcp-libs-12:4.2.5-68.el7_5.1.x86_64
updateinfo list done
Uploading Enabled Repositories Report
Loaded plugins: langpacks, product-id, subscription-manager
[root@servera ~]#

    The machine needs three package updates to resolve CVE-2018-1111.

  6. Use YUM and the CVE code to update the system with the necessary packages that provide the security fixes. 

    [root@servera ~]# yum update --cve CVE-2018-1111
...output omitted...
3 package(s) needed (+0 related) for security, out of 56 available
Resolving Dependencies
--> Running transaction check
---> Package dhclient.x86_64 12:4.2.5-68.el7 will be updated
---> Package dhclient.x86_64 12:4.2.5-68.el7_5.1 will be an update
---> Package dhcp-common.x86_64 12:4.2.5-68.el7 will be updated
---> Package dhcp-common.x86_64 12:4.2.5-68.el7_5.1 will be an update
---> Package dhcp-libs.x86_64 12:4.2.5-68.el7 will be updated
---> Package dhcp-libs.x86_64 12:4.2.5-68.el7_5.1 will be an update
--> Finished Dependency Resolution

Dependencies Resolved

=================================================================
 Package     Arch   Version             Repository          Size
=================================================================
Updating:
 dhclient    x86_64 12:4.2.5-68.el7_5.1 rhel-7-server-rpms 284 k
 dhcp-common x86_64 12:4.2.5-68.el7_5.1 rhel-7-server-rpms 175 k
 dhcp-libs   x86_64 12:4.2.5-68.el7_5.1 rhel-7-server-rpms 131 k

Transaction Summary
=================================================================
Upgrade  3 Packages

Total download size: 590 k
Is this ok [y/d/N]: y
Downloading packages:
Delta RPMs disabled because /usr/bin/applydeltarpm not installed.
(1/3): dhcp-common-4.2.5-68.el7_5.1.x86_64.rpm | 175 kB  00:00:01
(2/3): dhclient-4.2.5-68.el7_5.1.x86_64.rpm    | 284 kB  00:00:02
(3/3): dhcp-libs-4.2.5-68.el7_5.1.x86_64.rpm   | 131 kB  00:00:00
-----------------------------------------------------------------
Total                                 215 kB/s | 590 kB  00:00:02
Running transaction check
Running transaction test
Transaction test succeeded
Running transaction
  Updating   : 12:dhcp-libs-4.2.5-68.el7_5.1.x86_64    1/6
  Updating   : 12:dhcp-common-4.2.5-68.el7_5.1.x86_64  2/6
  Updating   : 12:dhclient-4.2.5-68.el7_5.1.x86_64     3/6
  Cleanup    : 12:dhclient-4.2.5-68.el7.x86_64         4/6
  Cleanup    : 12:dhcp-common-4.2.5-68.el7.x86_64      5/6
  Cleanup    : 12:dhcp-libs-4.2.5-68.el7.x86_64        6/6
Uploading Package Profile
  Verifying  : 12:dhcp-common-4.2.5-68.el7_5.1.x86_64  1/6
  Verifying  : 12:dhclient-4.2.5-68.el7_5.1.x86_64     2/6
  Verifying  : 12:dhcp-libs-4.2.5-68.el7_5.1.x86_64    3/6
  Verifying  : 12:dhcp-libs-4.2.5-68.el7.x86_64        4/6
  Verifying  : 12:dhclient-4.2.5-68.el7.x86_64         5/6
  Verifying  : 12:dhcp-common-4.2.5-68.el7.x86_64      6/6

Updated:
  dhclient.x86_64 12:4.2.5-68.el7_5.1
  dhcp-common.x86_64 12:4.2.5-68.el7_5.1
  dhcp-libs.x86_64 12:4.2.5-68.el7_5.1

Complete!
Uploading Enabled Repositories Report
Loaded plugins: langpacks, product-id, subscription-manager
[root@servera ~]#

  7. List the security notices again to confirm that there are no longer any critical security notices listed.

    There should now only be seven total security notices with none of them listed as critical notices. 

    [root@servera ~]# yum updateinfo --security
Loaded plugins: enabled_repos_upload, langpacks, package_upload, product-id, search-disabled-repos, subscription-manager
...output omitted...
Updates Information Summary: updates
    7 Security notice(s)
        5 Important Security notice(s)
        2 Moderate Security notice(s)
updateinfo summary done
Uploading Enabled Repositories Report
Loaded plugins: langpacks, product-id, subscription-manager
[root@servera ~]#

  8. Log out from servera. 

    [root@servera ~]# logout
[student@servera ~]$ logout
[student@workstation ~]$

Evaluation

On workstation, run the lab securityrisk-review grade command to confirm success of this exercise. 

[student@workstation ~]$ lab securityrisk-review grade

Cleanup

On workstation, run the lab securityrisk-review cleanup script to clean up this exercise. 

[student@workstation ~]$ lab securityrisk-review cleanup

This concludes the lab.

PreviousNext
Revision: rh415-7.5-813735c