Duration
4 days
Course Description
Red Hat Enterprise Security: Network Services (RHS333) is an intensive course that equips senior system administrators and security professionals with the skills and knowledge required to harden systems against both internal and external attacks. This class advances beyond the essential security coverage offered in the Red Hat Certified Engineer (RHCE) curriculum and delves more deeply into the security features, capabilities, and how to properly respond to sophisticated security threats aimed at enterprise systems.
Students will also cover an in-depth analysis of the ever-changing threat models as they pertain to Red Hat Enterprise Linux. At the end of the 4-day course, students should be able to design and implement an adequate security profile for critical enterprise systems.
An RHCE who successfully completes this course is prepared to take the Red Hat Enterprise Security Network Services Expertise Exam (EX333).
Audience:
- Experienced Linux system administrators responsible for the overall security of their systems and networked services
- Experienced Linux system administrators tasked with security on other operating systems but who now want to perform those tasks on a Red Hat Linux system
- An RHCE interested in earning a Red Hat Certification of Expertise, or a Red Hat Certified Security Specialist (RHCSS) or Red Hat Certified Architect (RHCA) credential
Prerequisites:
- The essential elements of how to configure the services covered, as this course will be focusing on more advanced topics
- RHCE certification or equivalent experience
- Candidates who are not an RHCE are encouraged to check their experience levels by taking a free pre-assessment test at redhat.com/training/assessment
Course Outline
RHS333 goes beyond the essential security coverage offered in the RHCE curriculum and delves deeper into the security features, capabilities, and risks associated with the most commonly deployed services. Among the topics covered in this four-day, hands-on course are the following:
- The Threat Model and Protection Methods
- Internet threat model and the attacker's plan
- System security and service availability
- An overview of protection mechanisms
- Basic Service Security
- SELinux
- Host-based access control
- Firewalls using Netfilter and iptables
- TCP wrappers
- xinetd and service limits
- Cryptography
- Overview of cryptographic techniques
- Management of SSL certificates
- Using GnuPG
- Logging and NTP
- Time synchronization with NTP
- Logging: syslog and its weaknesses
- Protecting log servers
- BIND and DNS Security
- BIND vulnerabilities
- DNS Security: attacks on DNS
- Access control lists
- Transaction signatures
- Restricting zone transfers and recursive queries
- DNS Topologies
- Bogus servers and blackholes
- Views
- Monitoring and logging
- Dynamic DNS security
- Network Authentication: RPC, NIS, and Kerberos
- Vulnerabilities
- Network-managed users and account management
- RPC and NIS security issues
- Improving NIS security
- Using Kerberos authentication
- Debugging Kerberized Services
- Kerberos Cross-Realm Trust
- Kerberos Encryption
- Network File System
- Overview of NFS versions 2, 3, and 4
- Security in NFS versions 2 and 3
- Improvements in security in NFS4
- Troubleshooting NFS4
- Client-side mount options
- OpenSSH
- Vulnerabilities
- Server configuration and the SSH protocols
- Authentication and access control
- Client-side security
- Protecting private keys
- Port-forwarding and X11-forwarding issues
- Electronic Mail with Sendmail
- Vulnerabilities
- Server topologies
- Email encryption
- Access control and STARTTLS
- Anti-spam mechanisms
- Postfix
- Vulnerabilities
- Security and Postfix design
- Configuring SASL/TLS
- FTP
- Vulnerabilities
- The FTP protocol and FTP servers
- Logging
- Anonymous FTP
- Access control
- Apache security
- Vulnerabilities
- Access control
- Authentication: files, passwords, Kerberos
- Security implications of common configuration options
- CGI security
- Server side includes
- suEXEC
- Intrusion Detection and Recovery
- Intrusion risks
- Security policy
- Detecting possible intrusions
- Monitoring network traffic and open ports
- Detecting modified files
- Investigating and verifying detected intrusions
- Recovering from, reporting, and documenting intrusions
This is a version-specific reference outline. Confirm the current syllabus and delivery arrangements with EIEIO.