anchor.diff:  
   == Overview
   
  -Working individually, you will run an "inside-out" vulnerability scan and a simple "outside-in" scan on the servers.  The testing will be performed by downloading two vulnerability scanners and running them on your servers.
  +Working individually, you will run an "inside-out" vulnerability scan and a simple "outside-in" penetration scan on a virtual machine.  The testing will be performed by downloading two vulnerability scanners and running them on your servers.
   
   You will research the results and recommend at least one fix that can be implemented in the Vagrantfile and associated cookbook and/or shell script for building the server.
   
  -You will write (with instructor assistance) a fix as a shell script to be pulled into the Calavera repository.
  +You will fix at least two vulnerabilities and participate in group and class discussion about how this relates to the broader topics of governance, risk, and compliance.
  +
   
   === Getting started
   
  
positive.code: http://www.sonatype.org/nexus/2015/11/13/did-you-wake-up-to-an-alert-about-the-java-deserialization-vulnerability
  
  http://continuousdelivery.com/2013/08/risk-management-theatre/
  
  
  == Fixes
  https://help.ubuntu.com/lts/serverguide/NTP.html
  
  == Lynis
  Extra credit. Lynis is another option, but it doesn't find as much as OpenSCAP.
  
  The overall instructions are here:
  
  https://cisofy.com/documentation/lynis/get-started
  
  This scan is run internally on the server, as a script or application that reviews the server's configuration in painstaking detail. It will generate hundreds of findings. You should pick one or two and research them and figure out if there is an easy fix.
  
  Start by logging into your assigned server. You should be in `/home/vagrant`. Go
  
  ....
  vagrant@manos1:~$ mkdir lab-10
  vagrant@manos1:~$ cd lab-10/
  vagrant@manos1:~/lab-10$ git clone https://github.com/CISOfy/lynis
  vagrant@manos1:~/lab-10$ cd lynis
  ....
  
  We use the git option so that we have the latest version.
  
  You can now go to:
  
  https://cisofy.com/documentation/lynis/get-started/#first-run
  
  You need to call lynis using the `./lynis` approach, since its path is not in your $PATH variable. Try following the instructions, which have interesting inconsistencies with what will happen.
  
  In particular you will see:
  
  `WARNING: output may be incomplete or inaccurate, you should run this program as super-user.`
  
  Hit Ctrl-C to abort. What do you need to do? Do it. [See hint #1 below if you are completely stumped, but you should know this by now. It's likely to be on a test.]
  
  Now you are getting a different error, not reflected in the instructions either. The error gives you all that you need to fix it. [See hint #2 below.]
  
  Fixed? Now you should be able to run the first scan as the lynis directions suggest.
  
  === Hints
  
  Hint #1: Run it as `sudo`
  
  Hint #2: `sudo chown -R root:root ../lynis` - you NEED to understand this -
  `
  
negative.code: 
  ....
  
  Let's fix the legal banner issue (for both /etc/issue and /etc/issue.net). See:
  
  * http://askubuntu.com/questions/420375/how-to-add-legal-banner-in-etc-issue-and-etc-issue-net-in-ubuntu
  * http://csrc.nist.gov/publications/nistbul/csl93-03.txt
  
  Between these two resources you should be able to fix the issue. If you have questions, post them to Slack. When you have fixed the issue, run the scan again and confirm the banner is no longer an issue.
  
  === System hardening
  
  