anchor.diff:  
   10.xx.0.15:8080/MainServlet
   
  +If you cannot, let the instructor know.
  +
   === System hardening scan
   
   Now, let's install OpenSCAP on caraxx and see what it finds.
   
  -NOTE: OpenSCAP is still very Red Hat-centric. However, there is a Github project covering Ubuntu vulnerabilities that will suffice for education purposes.
  -
  -....
  -vagrant@cara1:~$ mkdir lab-10
  -vagrant@cara1:~$ cd lab-10/
  -vagrant@cara1:~/lab-10$ sudo apt-get install libopenscap8    # install OpenSCAP
  -vagrant@cara1:~/lab-10$ sudo apt-get install git
  -vagrant@cara1:~/lab-10$ git clone https://github.com/GovReady/ubuntu-scap.git
  -vagrant@cara1:~/lab-10$ cd ubuntu-scap
  -vagrant@cara1:~/lab-10$ sudo ./run_tests.sh
  +NOTE: OpenSCAP is still very Red Hat-centric. However, there is an (outdated) Github project covering Ubuntu vulnerabilities that will suffice for education purposes.
  +
  +....
  +public1@seis660:~/Calavera$ vagrant ssh cara1
  +Welcome to Ubuntu 14.04.3 LTS (GNU/Linux 3.19.0-25-generic x86_64)
  +
  + * Documentation:  https://help.ubuntu.com/
  +Last login: Sat Apr 16 00:22:20 2016 from 10.0.2.2
  +
  +vagrant@caraxx:~$ mkdir lab-10
  +vagrant@caraxx:~$ cd lab-10/
  +vagrant@caraxx:~/lab-10$ sudo apt-get install libopenscap8  -y  # install OpenSCAP
  +vagrant@caraxx:~/lab-10$ sudo apt-get install git -y
  +vagrant@caraxx:~/lab-10$ git clone https://github.com/GovReady/ubuntu-scap.git
  +vagrant@caraxx:~/lab-10$ cd ubuntu-scap
  +vagrant@caraxx:~/lab-10$ sudo ./run_tests.sh
   ....
   
   NOTE: Normally we would not like to see git on a production server, but it's convenient for this lab.
  
positive.code: 
  We are going to focus on caraxx and espinaxx since hackers would likely try to exploit these servers first. Why? Because these two environments contain production code. This gives your team 2 servers to work with.
  
  Restart the virtual servers by doing "vagrant up" on:
  
  * espinaxx
  * caraxx
  
  We may need to work as a class to figure out how to restart certain services that were not set to restart on reboot. This is a good hands-on exercise.
  
  Minimally, caraxx needs
  `sudo service tomcat6 start`. Via X, you should be able to see Artifactory:
  
  10.xx.0.12:8081/artifactory
  
  
negative.code: 
  The `run_test.sh` script creates an HTML vulnerability scan report in the current working directory called `results.html`. An easy way to view this report is to install a text-based web browser:
  
    sudo apt-get install lynx-cur -y
  
  Then, you can view the report in your terminal window by running the command:
  
  