Domain 3 capstone -- secure, verify, and prove a host

capstone · 90 min · Objective 3.6

Task

Bring the whole Security domain together on one machine. Starting from a default install, apply access control, authentication, mandatory access control, cryptography and integrity monitoring, and produce evidence for each that a reviewer could check without trusting your word. This is the domain's exit exam: every control must be demonstrated, not merely configured.

Steps

  1. Access control. Create an operators group with a narrow sudo policy under /etc/sudoers.d/, validated with visudo -c, and prove that a command outside the grant is refused and that no granted command offers a shell escape.
  2. Authentication. Move SSH to keys only, disable root login, and add a PAM lockout with unlock_time set. Prove password login is refused and a locked account recovers on its own.
  3. Mandatory access control. Confirm SELinux is Enforcing, place content in a non-standard location, and label it correctly with semanage fcontext plus restorecon so it serves. Prove a mislabelled file is refused.
  4. Cryptography. Put application data on a LUKS volume with a backed-up header, and terminate a service over TLS 1.2/1.3 only with a matching certificate and key. Prove an old protocol is refused and the chain is complete.
  5. Integrity. Build an AIDE baseline before exposing the machine, store it off-host, and prove it catches a tampered binary that survives an on-host aide --update.
  6. Exposure. Audit listening services with ss -tlnp, close or bind-local anything that should not face the network, and confirm from the second machine.
  7. Benchmark. Scan with OpenSCAP before and after, read one remediation before applying it, and show the score improved.
  8. Write a one-page evidence summary: for each control, the command a reviewer runs and the output that proves it.

Verify

visudo -c
sshd -T | grep -Ei 'passwordauthentication no|permitrootlogin no'
getenforce                                   # Enforcing
cryptsetup status <mapped-volume> | grep -i cipher
openssl s_client -connect localhost:443 -tls1_1 </dev/null 2>&1 | grep -qi 'handshake failure' && echo "weak TLS refused"
ss -tlnp | grep -v '127.0.0.1\|::1' | grep LISTEN
oscap xccdf eval --profile "$PROFILE" --results after.xml "$DS" | grep -i score

The capstone is passed only when every line above produces the expected result AND your evidence summary lets a reviewer reproduce each one. A control you configured but cannot demonstrate does not count -- that is the discipline the whole domain has been building toward.

Notes

The evidence summary is the real deliverable. Anyone can set PermitRootLogin no; the skill the domain teaches is proving it holds, from outside, with a command whose output settles the question. If you cannot produce that command for a control, you have not finished the control.