2_pam.xml

<?xml version="1.0"?>

<scenario xmlns="http://www.github/cliffe/SecGen/scenario"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://www.github/cliffe/SecGen/scenario">

  <name>Pluggable Authentication Modules lab</name>
  <author>Z. Cliffe Schreuders</author>
  <description>
    # Introduction
    In this lab, you will explore Pluggable Authentication Modules (PAM) and Secure Shell (SSH) to enhance your understanding of authentication and security in Linux and Unix-like systems. PAM is a component that allows for the flexibility and extensibility of authentication methods, making it possible for various programs to leverage different authentication schemes, providing a standardized way to configure and manage authentication rules.

    Throughout the lab, you will gain hands-on experience with PAM by examining available PAM modules, understanding the structure of PAM configuration files, and making modifications to enforce policies including: password complexity requirements, time constraints, lockout policies after repeated login failures, creating home directories, enforcing session limits through cron jobs. You will also explore SSH password-less authentication, a powerful method of securely accessing remote systems without the need for traditional passwords. By generating SSH key pairs and configuring authorized keys, you will learn how to enhance the security and convenience of remote access.

    By the end of this lab, you will have a solid grasp of PAM's role in authentication, the benefits of SSH key-based authentication, and the practical skills to enhance the security and usability of authentication mechanisms in Linux systems.

    # Hackerbot and CTF challenges
    This is a Hackerbot lab. The labsheet is available once you claim a set of VMs. Work through the labsheet, then when prompted interact with Hackerbot.

    The Hackerbot tasks involve configuring password policies, testing your ability to use PAM to enhance authentication security.

    # Lecture
    [Slides continued here](http://z.cliffe.schreuders.org/presentations/slides/1718/ADS_slides_out_week_6/WNS_ADS_Lectures_5_Authentication.html)

    # Reading
    [Chapter 4 "Users, Passwords, and Authentication": Garfinkel, S. Spafford, G. and Schwartz, A. (2003), Practical Unix and Internet Security, O'Reilly. (ISBN-10: 0596003234)](https://www-dawsonera-com.ezproxy.leedsbeckett.ac.uk/abstract/9781449310325)

  </description>

  <type>ctf-lab</type>
  <type>hackerbot-lab</type>
  <type>lab-sheet</type>
  <difficulty>intermediate</difficulty>

  <CyBOK KA="AAA" topic="Authentication">
    <keyword>identity management</keyword>
    <keyword>user authentication</keyword>
    <keyword>facets of authentication</keyword>
  </CyBOK>
  <CyBOK KA="OSV" topic="Primitives for Isolation and Mediation">
    <keyword>authentication and identification</keyword>
    <keyword>Linux authentication</keyword>
    <keyword>Authentication frameworks (PAM)</keyword>
  </CyBOK>

  <video>
    <title>Authentication</title>
    <by>Z. Cliffe Schreuders</by>
    <url>https://youtu.be/z4L6Yv5ry1A</url>
    <type>lecture-prerecorded</type>
    <CyBOK KA="AAA" topic="Authentication">
      <keyword>identity management</keyword>
      <keyword>user authentication</keyword>
      <keyword>facets of authentication</keyword>
    </CyBOK>
    <CyBOK KA="OSV" topic="Primitives for Isolation and Mediation">
      <keyword>authentication and identification</keyword>
      <keyword>Linux authentication</keyword>
    </CyBOK>
  </video>
  <video>
    <title>Biometrics</title>
    <by>Z. Cliffe Schreuders</by>
    <url>https://youtu.be/-zcnfmoLjYI</url>
    <type>lecture-prerecorded</type>
    <CyBOK KA="AAA" topic="Authentication">
      <keyword>identity management</keyword>
      <keyword>user authentication</keyword>
      <keyword>facets of authentication</keyword>
      <keyword>AUTHENTICATION - BIOMETRICS</keyword>
    </CyBOK>
  </video>
  <video>
    <title>Authentication Tokens and One-Time Passwords</title>
    <by>Z. Cliffe Schreuders</by>
    <url>https://youtu.be/xHs3LB4Yyrk</url>
    <type>lecture-prerecorded</type>
    <CyBOK KA="AAA" topic="Authentication">
      <keyword>identity management</keyword>
      <keyword>user authentication</keyword>
      <keyword>facets of authentication</keyword>
      <keyword>AUTHENTICATION - OTP (ONE-TIME PASSWORD)</keyword>
      <keyword>AUTHENTICATION - TOKENS</keyword>
    </CyBOK>
  </video>

  <video>
    <title>Network-based Authentication (SSO, AD, LDAP, Kerberos)</title>
    <by>Z. Cliffe Schreuders</by>
    <url>https://youtu.be/c2dPdQmaVyo</url>
    <type>lecture-prerecorded</type>
    <CyBOK KA="AAA" topic="Authentication">
      <keyword>identity management</keyword>
      <keyword>authentication in distributed systems</keyword>
      <keyword>user authentication</keyword>
      <keyword>Network based-authentication with heterogeneous Linux and Windows networks</keyword>
    </CyBOK>
    <CyBOK KA="AAA" topic="Authorisation">
      <keyword>AUTHORIZATION - SSO (SINGLE SIGN-ON)</keyword>
      <keyword>AUTHORIZATION - LDAP (LIGHTWEIGHT DIRECTORY ACCESS PROTOCOL)</keyword>
      <keyword>AUTHENTICATION - KERBEROS</keyword>
      <keyword>ACTIVE DIRECTORY DOMAIN SERVICES (ADDS)</keyword>
    </CyBOK>
    <CyBOK KA="AAA" topic="Access Control in Distributed Systems">
      <keyword>core concepts</keyword>
      <keyword>federated access control</keyword>
    </CyBOK>
  </video>
  <video>
    <title>Lightweight Directory Access Protocol (LDAP)</title>
    <by>Z. Cliffe Schreuders</by>
    <url>https://youtu.be/dCBabesIXo8</url>
    <type>lecture-prerecorded</type>
    <CyBOK KA="AAA" topic="Authentication">
      <keyword>identity management</keyword>
      <keyword>authentication in distributed systems</keyword>
      <keyword>user authentication</keyword>
    </CyBOK>
    <CyBOK KA="AAA" topic="Authorisation">
      <keyword>theory</keyword>
      <keyword>Network based-authentication with heterogeneous Linux and Windows networks</keyword>
      <keyword>AUTHORIZATION - LDAP (LIGHTWEIGHT DIRECTORY ACCESS PROTOCOL)</keyword>
    </CyBOK>
  </video>
  <video>
    <title>Kerberos overview</title>
    <by>Z. Cliffe Schreuders</by>
    <url>https://youtu.be/rhdcxhSDqp4</url>
    <type>lecture-prerecorded</type>
    <CyBOK KA="AAA" topic="Authentication">
      <keyword>identity management</keyword>
      <keyword>authentication in distributed systems</keyword>
      <keyword>user authentication</keyword>
      <keyword>Network based-authentication with heterogeneous Linux and Windows networks</keyword>
    </CyBOK>
    <CyBOK KA="AAA" topic="Authorisation">
      <keyword>AUTHENTICATION - KERBEROS</keyword>
    </CyBOK>
  </video>
  <video>
    <title>Active Directory</title>
    <by>Z. Cliffe Schreuders</by>
    <url>https://youtu.be/PCXK2cK8tpE</url>
    <type>lecture-prerecorded</type>
    <CyBOK KA="AAA" topic="Authentication">
      <keyword>identity management</keyword>
      <keyword>authentication in distributed systems</keyword>
      <keyword>user authentication</keyword>
      <keyword>Network based-authentication with heterogeneous Linux and Windows networks</keyword>
    </CyBOK>
    <CyBOK KA="AAA" topic="Authorisation">
      <keyword>AUTHORIZATION - SSO (SINGLE SIGN-ON)</keyword>
      <keyword>AUTHORIZATION - LDAP (LIGHTWEIGHT DIRECTORY ACCESS PROTOCOL)</keyword>
      <keyword>AUTHENTICATION - KERBEROS</keyword>
      <keyword>ACTIVE DIRECTORY DOMAIN SERVICES (ADDS)</keyword>
    </CyBOK>
    <CyBOK KA="AAA" topic="Access Control in Distributed Systems">
      <keyword>core concepts</keyword>
      <keyword>federated access control</keyword>
    </CyBOK>
  </video>

  <system>
    <system_name>desktop</system_name>
    <base distro="Debian 12" type="desktop" name="KDE"/>

    <input into_datastore="IP_addresses">
      <!-- 0 desktop -->
      <value>172.16.0.2</value>
      <!-- 1 server -->
      <value>172.16.0.3</value>
      <!-- 2 hackerbot_server -->
      <value>172.16.0.4</value>
    </input>

    <!-- generate some usernames to use -->
    <input into_datastore="usernames">
      <!-- main user -->
      <generator type="random_sanitised_word">
        <input into="wordlist">
          <value>mythical_creatures</value>
        </input>
      </generator>
      <!-- 4 other users -->
      <generator type="random_sanitised_word">
        <input into="wordlist">
          <value>mythical_creatures</value>
        </input>
      </generator>
      <generator type="random_sanitised_word">
        <input into="wordlist">
          <value>mythical_creatures</value>
        </input>
      </generator>
      <generator type="random_sanitised_word">
        <input into="wordlist">
          <value>mythical_creatures</value>
        </input>
      </generator>
      <generator type="random_sanitised_word">
        <input into="wordlist">
          <value>mythical_creatures</value>
        </input>
      </generator>
    </input>

    <!-- generate some passwords to be cracked -->
    <input into_datastore="weak_passwords">
      <generator type="weak_password_generator"/>
      <generator type="weak_password_generator"/>
      <generator type="weak_password_generator"/>
      <generator type="weak_password_generator"/>
    </input>

    <!-- accounts on the desktop, with the main user as a sudoer, with no flags -->
    <input into_datastore="user_accounts_desktop">
      <!-- main user, sudoer -->
      <generator type="account">
        <input into="username">
          <datastore access="0">usernames</datastore>
        </input>
        <input into="password">
          <value>tiaspbiqe2r</value>
        </input>
        <input into="super_user">
          <value>true</value>
        </input>
      </generator>
      <!-- other users, with weak passwords, no flags -->
      <generator type="account">
        <input into="username">
          <datastore access="next">usernames</datastore>
        </input>
        <input into="password">
          <datastore access="0">weak_passwords</datastore>
        </input>
      </generator>
      <generator type="account">
        <input into="username">
          <datastore access="next">usernames</datastore>
        </input>
        <input into="password">
          <datastore access="next">weak_passwords</datastore>
        </input>
      </generator>
      <generator type="account">
        <input into="username">
          <datastore access="next">usernames</datastore>
        </input>
        <input into="password">
          <datastore access="next">weak_passwords</datastore>
        </input>
      </generator>
      <generator type="account">
        <input into="username">
          <datastore access="next">usernames</datastore>
        </input>
        <input into="password">
          <datastore access="next">weak_passwords</datastore>
        </input>
      </generator>
    </input>

    <!-- an admin account used for hackerbot access to the desktop and also spoilers/administration of the challenge -->
    <input into_datastore="spoiler_admin_pass">
      <generator type="strong_password_generator"/>
    </input>

    <!--Create the users-->
    <utility module_path=".*/parameterised_accounts">
      <input into="accounts">
        <datastore>user_accounts_desktop</datastore>
      </input>
    </utility>

    <utility module_path=".*/kde_minimal">
      <input into="autologin_user">
        <datastore access="0">usernames</datastore>
      </input>
      <input into="accounts">
        <datastore>user_accounts_desktop</datastore>
      </input>
      <input into="autostart_konsole">
        <value>true</value>
      </input>
    </utility>
    <utility module_path=".*/handy_cli_tools"/>
    <utility module_path=".*/hash_tools"/>
    <utility module_path=".*/pam_modules"/>

    <utility module_path=".*/iceweasel">
      <input into="accounts">
        <datastore>user_accounts_desktop</datastore>
      </input>
      <input into="autostart">
        <value>true</value>
      </input>
      <input into="start_page">
        <datastore access="2">IP_addresses</datastore>
      </input>
    </utility>

    <utility module_path=".*/pidgin">
      <input into="server_ip">
        <datastore access="2">IP_addresses</datastore>
      </input>
      <input into="accounts">
        <datastore access="0">user_accounts_desktop</datastore>
      </input>
    </utility>

    <vulnerability module_path=".*/ssh_root_login">
      <input into="root_password">
        <datastore>spoiler_admin_pass</datastore>
      </input>
    </vulnerability>

    <network type="private_network">
      <input into="IP_address">
        <datastore access="0">IP_addresses</datastore>
      </input>
    </network>

    <build type="cleanup">
      <input into="root_password">
        <datastore>spoiler_admin_pass</datastore>
      </input>
    </build>
  </system>

  <system>
    <system_name>server</system_name>
    <base distro="Debian 12" type="desktop" name="KDE"/>

    <!-- user accounts on the server, with matching usernames and passwords, but with flags to find -->
    <input into_datastore="user_accounts_server">
      <!-- main user, NOT sudoer -->
      <generator type="account">
        <input into="username">
          <datastore access="0">usernames</datastore>
        </input>
        <input into="password">
          <value>tiaspbiqe2r</value>
        </input>
        <input into="super_user">
          <value>false</value>
        </input>
      </generator>
      <!-- other users, with the SAME weak passwords, WITH flags -->
      <generator type="account">
        <input into="username">
          <datastore access="next">usernames</datastore>
        </input>
        <input into="password">
          <datastore access="0">weak_passwords</datastore>
        </input>
      </generator>
      <generator type="account">
        <input into="username">
          <datastore access="next">usernames</datastore>
        </input>
        <input into="password">
          <datastore access="next">weak_passwords</datastore>
        </input>
      </generator>
      <generator type="account">
        <input into="username">
          <datastore access="next">usernames</datastore>
        </input>
        <input into="password">
          <datastore access="next">weak_passwords</datastore>
        </input>
      </generator>
      <generator type="account">
        <input into="username">
          <datastore access="next">usernames</datastore>
        </input>
        <input into="password">
          <datastore access="next">weak_passwords</datastore>
        </input>
      </generator>
    </input>

    <!--Create the users-->
    <utility module_path=".*/parameterised_accounts">
      <input into="accounts">
        <datastore>user_accounts_server</datastore>
      </input>
    </utility>

    <utility module_path=".*/handy_cli_tools"/>

    <vulnerability module_path=".*/ssh_root_login">
      <input into="root_password">
        <datastore>spoiler_admin_pass</datastore>
      </input>
    </vulnerability>

    <network type="private_network">
      <input into="IP_address">
        <datastore access="1">IP_addresses</datastore>
      </input>
    </network>
    <build type="cleanup">
      <input into="root_password">
        <datastore>spoiler_admin_pass</datastore>
      </input>
    </build>
  </system>

  <system>
    <system_name>hackerbot_server</system_name>
    <base distro="Kali" name="MSF"/>

    <service type="ircd"/>

    <utility module_path=".*/metasploit_framework"/>
    <utility module_path=".*/nmap"/>
    <utility module_path=".*/handy_cli_tools"/>

    <service type="httpd"/>

    <utility module_path=".*/hackerbot">
      <input into="hackerbot_configs" into_datastore="hackerbot_instructions">
        <generator module_path=".*/hbpam">
          <input into="accounts">
            <datastore>user_accounts_desktop</datastore>
          </input>
          <input into="root_password">
            <datastore>spoiler_admin_pass</datastore>
          </input>
          <input into="server_ip">
            <datastore access="1">IP_addresses</datastore>
          </input>
        </generator>
      </input>
    </utility>

    <network type="private_network" >
       <input into="IP_address">
        <datastore access="2">IP_addresses</datastore>
       </input>
    </network>

    <build type="cleanup">
      <input into="root_password">
        <datastore>spoiler_admin_pass</datastore>
      </input>
    </build>
  </system>

</scenario>