Technical configuration auditing
Using CIS Benchmarks and secure configuration standards you audit Linux servers, databases and network services with tools such as Lynis and OpenSCAP and turn the results into an evidenced compliance report.
Level 301 · 15 lessons · 12 practice labs
Lessons
Benchmarks
- Security baselines and CIS Benchmarks
- SCAP, XCCDF and OVAL
- Manual and automated checks
- Quick task: read a benchmark item and check it by hand
Auditing with tools
- Auditing a server with Lynis
- Profile scanning with OpenSCAP
- Auditing the SSH configuration
- Auditing database configuration
- Quick task: compare the scores of two servers
From results to compliance
- False findings and exception records
- Remediation and rescanning
- Monitoring configuration drift
- Quick task: fix five findings and prove it
Report
- The compliance report and evidence archive
- Capstone: a baseline audit of a three-server environment
Practice labs
- Check a benchmark item by hand: Run the audit command of one security benchmark item on the lab server and record pass or fail.
- Audit ten items by hand: Audit ten benchmark items on file permissions, services and kernel settings by hand and produce a results table.
- Read XCCDF and OVAL content: In a rule file, find the severity, check logic and fix text of a given rule and explain them in plain language.
- Audit a server with Lynis: Run a Lynis audit on the lab server and record the hardening index and the first five warnings.
- A profile scan with OpenSCAP: Scan the lab server with the chosen profile, generate the report and summarise failed rules by severity.
- Compare the scores of two servers: Compare the scan results of two lab servers and report the rules failing on only one and the likely reason.
- Audit the SSH configuration: Audit the lab server's SSH service settings against an eight-item checklist.
- Audit the database configuration: Audit remote admin login, default accounts, encrypted connections and logging on the lab database and write the findings.
- Separate false findings from exceptions: Sort ten failed scan results into real findings, false findings and approved exceptions and write a record for each exception.
- Fix five findings and prove it: Fix five findings on the lab server and save the rescan result together with the earlier one as evidence.
- Catch the configuration drift: Compare two scan results taken a week apart and find the degraded settings and what changed them in the logs.
- The compliance report and evidence archive: From the scan results of three servers, prepare a report with scores, open findings and exceptions plus a hashed evidence archive.
About this course
Using CIS Benchmarks and secure configuration standards you audit Linux servers, databases and network services with tools such as Lynis and OpenSCAP and turn the results into an evidenced compliance report.
What you will learn
- Benchmarks
- Auditing with tools
- From results to compliance
- Report
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.