anchor.diff:  
   * The Change will then be confirmed as having fixed the Problem, which will then be closed out.
   
  -=== Testers
  -If you are a lab tester, be sure to remove git, libopenscap, and
  -
  -`sudo apt-get remove ntp`
  -`rm -rf lab-10` on both caraxx and the main server.
   
   == Tools
   The following tools were evaluated as part of developing this lab.
  
positive.code: 
  * Understand a "vulnerability" and how it can be detected
  * Understand how a vulnerability may be fixed or remediated
  * Understand the role of the NIST Common Vulnerability database
  
  == Overview
  
  Working in pairs or 3s, you will run an "inside-out" vulnerability scan and a simple "outside-in" scan on the servers. (By splitting up, more students can be hands-on with the lab.) The testing will be performed by downloading two vulnerability scanners and running them on your servers.
  
  You will research the results and recommend at least one fix that can be implemented in the Vagrantfile and associated cookbook and/or shell script for building the server.
  
  You will write (with instructor assistance) a fix as a shell script to be pulled into the Calavera repository.
  
  === Getting started
  Your public1-4 pipelines are still operational. Refer back to previous labs (`su publicxx, cd ~/Calavera`).
  
  We are going to focus on caraxx and espinaxx since hackers would likely try to exploit these servers first. Why? Because these two environments contain production code. This gives your team 2 servers to work with.
  
  First, do
  
   vagrant status
  
  If needed, restart the virtual servers by doing "vagrant up" on:
  
  * espinaxx
  * caraxx
  
  Via X, you should be able to see Artifactory:
  
  10.xx.0.12:8081/artifactory
  
  and your Tomcat application:
  
  10.xx.0.15:8080/MainServlet
  
  If you cannot, let the instructor know.
  
  === System hardening scan
  
  Now, let's install OpenSCAP on caraxx and see what it finds.
  
  NOTE: OpenSCAP is still very Red Hat-centric. However, there is an (outdated) Github project covering Ubuntu vulnerabilities that will suffice for education purposes.
  
  ....
  public1@courseSrv:~/Calavera$ vagrant ssh cara1
  Welcome to Ubuntu 14.04.3 LTS (GNU/Linux 3.19.0-25-generic x86_64)
  
   * Documentation:  https://help.ubuntu.com/
  Last login: Sat Apr 16 00:22:20 2016 from 10.0.2.2
  
  vagrant@caraxx:~$ mkdir lab-10
  vagrant@caraxx:~$ cd lab-10/
  vagrant@caraxx:~/lab-10$ sudo apt-get install libopenscap8  -y  # install OpenSCAP
  vagrant@caraxx:~/lab-10$ sudo apt-get install git -y
  vagrant@caraxx:~/lab-10$ git clone https://github.com/GovReady/ubuntu-scap.git
  vagrant@caraxx:~/lab-10$ cd ubuntu-scap
  vagrant@caraxx:~/ubuntu-scap$ sudo ./run_tests.sh
  ....
  
  NOTE: Normally we would not like to see git on a production server, but it's convenient for this lab.
  
  OpenSCAP will return a large number of vulnerabilities. Some of them can be easily remediated. Others would be more difficult. You can easily research them using Google.
  
  The `run_test.sh` script creates an HTML vulnerability scan report in the current working directory called `results.html`. An easy way to view this report is to install a text-based web browser:
  
    sudo apt-get install lynx-cur -y
  
  Then, you can view the report in your terminal window by running the command:
  
    lynx results.html
  
  Scroll through the report. Click on the following link:
  
  ....
  Specify a Remote NTP Server          fail
  ....
  
  What is NTP and why is its absence a problem? Research as a team. We will discuss in class.
  
  Fixing is easy. Go:
  
  `vagrant@cara1:~/lab-10$ sudo apt-get install ntp`
  
  and run
  
  `vagrant@cara1:~/ubuntu-scap$ sudo ./run_tests.sh`
  
  again. You should see:
  
  ....
  Title   Specify a Remote NTP Server
  Rule    xccdf_org.ssgproject.content_rule_ntpd_specify_remote_server
  Ident   CCE-27098-3
  Result  pass
  ....
  
  Note the *pass* result. Hey, we fixed a vulnerability!
  
  Now for the hard part. Find another vulnerability you can fix. To use class time most efficiently, you should post the vulnerabilities you are researching to Slack. Don't start on something someone else is doing.
  
  Obviously, you should coordinate your research within your team as well, dividing up search results to review so you can more quickly identify if this vulnerability can easily be fixed.
  
  We will pause class and discuss interesting cases.
  
  Be prepared to share you results, positive or negative. If you fix a vulnerability, be sure to document the steps so they could be scripted.
  
  When you have fixed your SCAP vulnerability, read http://www.sonatype.org/nexus/2015/11/13/did-you-wake-up-to-an-alert-about-the-java-deserialization-vulnerability and discuss with your team. What is the National Vulnerability Database? Be prepared to discuss in class.
  
  === Web vulnerability testing scan
  
  
negative.code: Go:
  
  ....
  wget https://github.com/zaproxy/zaproxy/releases/download/2.5.0/ZAP_2.5.0_Linux.tar.gz
  tar -xvf ZAP_2.5.0_Linux.tar.gz
  
  cd ZAP_2.5.0/
  ./zap.sh -cmd -quickurl http://10.xx.0.15:8080/MainServlet
  ....
  
  