anchor.diff:  
   * Understand a "vulnerability" and how it can be detected
   * Understand how a vulnerability may be fixed or remediated
  -* Understand the role of the NIST Common Vulnerability database
   
   == Overview
   
  -Working in pairs or 3s, you will run an "inside-out" vulnerability scan and a simple "outside-in" scan on the servers. (By splitting up, more students can be hands-on with the lab.) The testing will be performed by downloading two vulnerability scanners and running them on your servers.
  +Working individually, you will run an "inside-out" vulnerability scan and a simple "outside-in" scan on the servers.  The testing will be performed by downloading two vulnerability scanners and running them on your servers.
   
   You will research the results and recommend at least one fix that can be implemented in the Vagrantfile and associated cookbook and/or shell script for building the server.
   
   You will write (with instructor assistance) a fix as a shell script to be pulled into the Calavera repository.
   
   === Getting started
  -Your public1-4 pipelines are still operational. Refer back to previous labs (`su publicxx, cd ~/Calavera`).
  -
  -We are going to focus on caraxx and espinaxx since hackers would likely try to exploit these servers first. Why? Because these two environments contain production code. This gives your team 2 servers to work with.
  -
  -First, do
  -
  - vagrant status
  -
  -If needed, restart the virtual servers by doing "vagrant up" on:
  -
  -* espinaxx
  -* caraxx
  -
  -Via X, you should be able to see Artifactory:
  -
  -10.xx.0.12:8081/artifactory
  -
  -and your Tomcat application:
  -
  -10.xx.0.15:8080/MainServlet
  -
  -If you cannot, let the instructor know.
  -
  -=== System hardening scan
  -
  -Now, let's install OpenSCAP on caraxx and see what it finds.
  -
  -NOTE: OpenSCAP is still very Red Hat-centric. However, there is an (outdated) Github project covering Ubuntu vulnerabilities that will suffice for education purposes.
  -
  -....
  -public1@courseSrv:~/Calavera$ vagrant ssh cara1
  -Welcome to Ubuntu 14.04.3 LTS (GNU/Linux 3.19.0-25-generic x86_64)
  -
  - * Documentation:  https://help.ubuntu.com/
  -Last login: Sat Apr 16 00:22:20 2016 from 10.0.2.2
  -
  -vagrant@caraxx:~$ mkdir lab-10
  -vagrant@caraxx:~$ cd lab-10/
  -vagrant@caraxx:~/lab-10$ sudo apt-get install libopenscap8  -y  # install OpenSCAP
  -vagrant@caraxx:~/lab-10$ sudo apt-get install git -y
  -vagrant@caraxx:~/lab-10$ git clone https://github.com/GovReady/ubuntu-scap.git
  -vagrant@caraxx:~/lab-10$ cd ubuntu-scap
  -vagrant@caraxx:~/ubuntu-scap$ sudo ./run_tests.sh
  -....
  -
  -NOTE: Normally we would not like to see git on a production server, but it's convenient for this lab.
  -
  -OpenSCAP will return a large number of vulnerabilities. Some of them can be easily remediated. Others would be more difficult. You can easily research them using Google.
  -
  -The `run_test.sh` script creates an HTML vulnerability scan report in the current working directory called `results.html`. An easy way to view this report is to install a text-based web browser:
  -
  -  sudo apt-get install lynx-cur -y
  -
  -Then, you can view the report in your terminal window by running the command:
  -
  -  lynx results.html
  -
  -Scroll through the report. Click on the following link:
  -
  -....
  -Specify a Remote NTP Server          fail
  -....
  -
  -What is NTP and why is its absence a problem? Research as a team. We will discuss in class.
  -
  -Fixing is easy. Go:
  -
  -`vagrant@cara1:~/lab-10$ sudo apt-get install ntp`
  -
  -and run
  -
  -`vagrant@cara1:~/ubuntu-scap$ sudo ./run_tests.sh`
  -
  -again. You should see:
  -
  -....
  -Title   Specify a Remote NTP Server
  -Rule    xccdf_org.ssgproject.content_rule_ntpd_specify_remote_server
  -Ident   CCE-27098-3
  -Result  pass
  -....
  -
  -Note the *pass* result. Hey, we fixed a vulnerability!
  +
  +Go to your home directory.
  +
  + cd
  +
  +You should still have a vagrant directory. Go:
  +
  + cd vagrant
  + vagrant up
  +
  +If this doesn't work, go back to https://github.com/dm-academy/aitm-labs/blob/master/Lab-02/02-tech-lab.adoc[Lab 2] and follow the Section 1 instructions just up through getting the simple Vagrant machine running (do not continue to section 2 in that lab.)
  +
  +Now, install Lynis. The overall instructions are here:
  +
  +https://cisofy.com/documentation/lynis/get-started
  +
  +You should download using the git approach.
  +
  +This scan is run internally on the server, as a script or application that reviews the server's configuration in painstaking detail. It will generate hundreds of findings. You should pick one or two and research them and figure out if there is an easy fix.
  +
  +Start by logging into your personal server. You should be in `/home/vagrant`. Go
  +
  +
  +
  +https://cisofy.com/documentation/lynis/get-started/#first-run
  +
  +You need to call lynis using the `./lynis` approach, since its path is not in your $PATH variable. Try following the instructions, which have interesting inconsistencies with what will happen.
  +
  +In particular you will see:
  +
  +`WARNING: output may be incomplete or inaccurate, you should run this program as super-user.`
  +
  +Hit Ctrl-C to abort. What do you need to do? Do it. [See hint #1 below if you are completely stumped, but you should know this by now. It's likely to be on a test.]
  +
  +Now you are getting a different error, not reflected in the instructions either. The error gives you all that you need to fix it. [See hint #2 below.]
  +
  +Fixed? Now you should be able to run the first scan as the lynis directions suggest. Lots of output that looks like:
  +
  +....
  +- Checking for old files in /tmp                            [ OK ]
  + - Checking /tmp sticky bit                                  [ OK ]
  + - Mount options of /                                        [ OK ]
  + - Checking Locate database                                  [ FOUND ]
  +.
  +.
  +.
  +
  + * Consider hardening SSH configuration [SSH-7408]
  +    - Details  : AllowAgentForwarding (YES --> NO)
  +      https://cisofy.com/controls/SSH-7408/
  +
  +  * Add a legal banner to /etc/issue, to warn unauthorized users [BANN-7126]
  +      https://cisofy.com/controls/BANN-7126/
  +
  +....
  +
  +Let's fix the legal banner issue. See:
  +
  +http://askubuntu.com/questions/420375/how-to-add-legal-banner-in-etc-issue-and-etc-issue-net-in-ubuntu
  +http://csrc.nist.gov/publications/nistbul/csl93-03.txt
  +
  +Between these two resources you should be able to fix the issue. When you have, run the scan again and post evidence to Slack.
  +
  +=== System hardening
   
   Now for the hard part. Find another vulnerability you can fix. To use class time most efficiently, you should post the vulnerabilities you are researching to Slack. Don't start on something someone else is doing.
   
  -Obviously, you should coordinate your research within your team as well, dividing up search results to review so you can more quickly identify if this vulnerability can easily be fixed.
  -
   We will pause class and discuss interesting cases.
   
   Be prepared to share you results, positive or negative. If you fix a vulnerability, be sure to document the steps so they could be scripted.
   
  -When you have fixed your SCAP vulnerability, read http://www.sonatype.org/nexus/2015/11/13/did-you-wake-up-to-an-alert-about-the-java-deserialization-vulnerability and discuss with your team. What is the National Vulnerability Database? Be prepared to discuss in class.
  +After you have fixed one more lynis vulnerability, read http://www.sonatype.org/nexus/2015/11/13/did-you-wake-up-to-an-alert-about-the-java-deserialization-vulnerability and discuss with your neighbors. What is the National Vulnerability Database? Be prepared to discuss in class.
   
   === Web vulnerability testing scan
   
  
positive.code: Go:
  
  ....
  wget https://github.com/zaproxy/zaproxy/releases/download/2.4.3/ZAP_2.4.3_Linux.tar.gz
  tar -xvf ZAP_2.4.3_Linux.tar.gz
  
  cd ZAP_2.4.3/
  ./zap.sh -cmd -quickurl http://10.xx.0.15:8080/MainServlet
  ....
  
  
negative.code: 
  * The Change will then be confirmed as having fixed the Problem, which will then be closed out.
  
  
  == Tools
  The following tools were evaluated as part of developing this lab.
  