The presentation focuses on main differences between Linux and Windows Operation Systems. It explains basic system architecture, introduces the most important commands for IT audit and gives overall prospective of Linux systems audit. It is also an opportunity to interact with an auditor, who has a real-world experience as systems engineer and has a prospective of an audit process from both sides. Speakers: Gene Kartavtsev, CISA, PCIP, ISA

1. HOW TO AUDIT LINUX
A Practical and Easy Primer
ISACA Presentation – Minnesota Chapter
Gene Kartavtsev - CISA, PCIP
December 12, 2017

2. AGENDA
How do I
audit
Linux?
About Linux
What is Linux?
Linux Architecture
How does Linux do it?
Linux Audit
What is to audit in Linux?

3. ABOUT LINUX
What is Linux?

4. QUIZ: IS LINUX
• …an Operating System (OS)?
• …free?
• … more secure?
• …a penguin?
• …worth it?
• …a Unix?

5. IS LINUX AN OPERATING SYSTEM?

6. IS LINUX FREE?

7. IS LINUX MORE SECURE?

8. IS LINUX A PENGUIN?

9. IS LINUX WORTH IT?

10. IS LINUX A UNIX?

11. LINUX FACTS
• Linux is not an OS, but it is the kernel, GNU Linux is the OS and it comes
in over 300 flavors.
• Linux Kernel was written by a 21 year finish college student as a part of
his hobby
• Linux is 26 years old
• Linux is running on all 500 of the TOP500 supercomputers in the world.
• Android Operating System is based off of Linux
• Oscar-winning visual effects of the Titanic by James Cameron came
from machines with Linux and Avatar was completely developed in 3D
Applications on Linux platform.
• Linux is everywhere…

12. PLACES LINUX IS RUNNING
USA
• U.S. Department of Defense
• U.S. Navy Submarine Fleet
• U.S. Postal Service
• U.S. Federal Courts
• Traffic control of San Francisco
• New York Stock Exchange
• Amazon, Google, Wikipedia
OTHER COUNTRIES
• The City of Munich, Germany
• French Parliament
• State-Owned Industrial and
Commercial Bank of China
• Government of Mexico City
• Czech Post
• Russian, Switzerland Schools
• German Universities

13. LINUX STANDARD BASE
The Linux Standard Base (LSB) is a joint project by several Linux distributions under the
organizational structure of the Linux Foundation to standardize the software system structure,
including the file system hierarchy used in the Linux operating system.

14. LINUX PROS AND CONS
PROS
• Easy to install
• It is free
• It is stable
• Intelligent architecture
• Many distributions available
• Security
CONS
• Not too “user friendly”
• Does not have dedicated support
• Might not support a hardware
• Desktop applications might not be
available
• Learning curve is required

15. LINUX
ARCHITECTURE
How does Linux do it?

16. RUNLEVELS
A runlevel is one of the modes that a Unix -based operating system will run in.
Each runlevel has a certain number of services stopped or started, giving the user control over the
behavior of the machine. Conventionally, seven runlevels exist, numbered from zero to six.
Runlevel Mode Action
0 Halt Shuts down system
1 – “safe mode” Single-User Mode
Does not configure network
interfaces, start daemons, or
allow non-root logins
2 -”often no used”
Multi-User Mode
Does not configure network
interfaces or start daemons.
3 – “server” Multi-User Mode with Networking Starts the system normally.
4-”often no used” Undefined Not used/User-definable
5 – “desktop” X11
As runlevel 3 + display
manager(X) – Desktop
environment
6- “reboot” Reboot Reboots the system
Init (short for initialization) is the program on Unix and Unix-like systems that spawns all other processes. It runs as a
daemon and typically has PID 1
Example: init 6 - will reboot the machine

17. LINUX FILE SYSTEM
Shareable Unshareable
Static /usr
/opt
/etc
/boot
Variable /var/mail
/var/spool/news
/var/run
/var/lock
FHS - Filesystem Hierarchy Standard - defines the directory structure and directory
contents in Linux distributions. It is maintained by the Linux Foundation. In the FHS,
all files and directories appear under the root directory /

18. LINUX FILE SYSTEM
Directory Description Windows equivalent
/ File structure root C:
bin System command binaries (executables) and shells
(command prompt). Used to bring the system up
C:Windowssystem32
boot Files necessary to boot the system ntldr, ntdetect.com, boot.ini
dev Files that communicate with hardware (device drivers) C:WindowsSystem32Drivers
etc Etc[etera] - Critical system configuration files ( *.ini , registry) C:WindowsSystem32Drivers, regedit
home Home directories for users C:Users
lib Essential shared libraries and kernel modules *.dll, *.ocx files
mnt Mount point for mounting a file system temporarily. It can be
used for remotely located file system
D:CDROM, server
Map Network Drive
opt Optional application software packages C:WindowsProgam Files"Program Name (Ex.
Fonts)
root Home directory for special user root (system administrator) C:UsersAdministrator
sbin Essential system binaries only for root (system administrator) .msc, Microsoft Management Console
tmp Temporary files %TEMP%
usr User binaries, including programs , games, etc. C:Program files
var Variable data . Ex. Email, print jobs, logs, etc.. %AppData%, %SystemRoot%, C:Windows Logs,
C:WindowsSystem32config (Event Viewer files)

19. PERMISSIONS - rwx rwx rwx
PERMISSION TYPES
R-Read (4), W-Write (2), X-Execute (1)
0 – Nothing
1- x
2 – w
4 – r
3 – wx = 1+2
5 – rx = 4+1
6 – rw = 4+2
7 – rwx = 4+2+1
USERS & GROUPS
[---] - Owner, [---] - Group, [---] - All users
• owner - The Owner permissions apply only
the owner of the file or directory, they will
not impact the actions of other users.
• group - The Group permissions apply only
to the group that has been assigned to the
file or directory, they will not effect the
actions of other users.
• all users - The All Users permissions apply to
all other users on the system, this is the
permission group that you want to watch
the most.
ls –lah lists folder content in long format. –l - long listing format, -a – all files, h - human-readable
Example: ls –lah /home/user
-rw------- 1 gene gene 2.4K Dec 10 22:03 .bash_history

20. WHO HAS PERMISSIONS TO DO WHAT?
Example: rw-r--r--

21. ROOT AND SUDO
ROOT (SU–SUPER[SWITCH] USER)
• Has unlimited privileges
• Has only one password
• Can make a damage to the
system without warning
• Username is always known to bad
guys
• Has only super user role
SUDO (SUPER USER DO)
• Minimizes root privileges
• Root password is not shared or
used
• Prompts for password for every
major step
• Easier “undo” as it logs every step
• Easier admin role transfer
• Authentication timeout
su – switches to root account
su user switches to a user account ,
-c command – will run a command as a user
sudo command – prompts for user password and confirms a
request to execute a command
The sudo command makes it easier to practice the principle
of least privilege

22. LINUX COMMANDS
Task Linux Windows
Information about system uname - a winver
Current date and time date date /t , time /t
Clear screen clear cls
Compare files diff fc
Find a string in a file grep find
View a file less more
Display location in a file
system
pwd chdir
List files in a directory Ls -la dir
Find IP ifconfig ipconfig
See System information lscpu systeminfo
See file system usage df -aTh Disk Manager, net use
See running processes ps –ef tasklist
See command description whatis <command> help
See environmental variables env set
See what user is logged in whoami whoami
See network protocols in use netstat netstat

23. LINUX FUN
• Killing Daemons
• Avoiding Zombies
• Fortune Telling
• Finding Jokes
• Saying “Thank you !”

24. LINUX AUDIT
What is to audit in Linux?

25. LINUX – Know before the audit
• Linux is not going out of business
• Linux is an intelilgent Operating System
• Linux follows standards
• Linux administration is a culture
• Linux audit can be easily automated

26. LINUX AUDIT CHALLENGES
TOP 5 SYSADMIN’S COMPLAINTS ABOUT AUDIT
• You're vague: Please do your homework
before making request
• You make urgent, last-minute requests:
Please let me know about your request in
advance
• You waste your sysadmin's time: Please let
me know about everything you need at
once
• You abuse your rights: Running an
application as root isn't a fix
• You take your sysadmin for granted: Not
getting the slightest recognition when
everything works, but being excessively
blamed when something fails

27. LINUX AUDIT - “Secrets”
• Develop a relationship with Linux admin before the
audit
• Establish credibility with Linux admin
• Communicate the Audit process
• Scope
• Timeline
• Deliverables
• Be current
• Don’t be afraid to be a geek

28. LINUX AUDIT OBJECTIVES
• Authorized User Access
• Authorized Services, Daemons, Modules
• Authorized Networking/Connections
• Authorized File Access
• Appropriate Logging
• Appropriate Security Parameters
• Authorized Applications

29. LINUX AUDIT - What should we look at?
/etc - Primary system configuration directory
/home/$USER - User data and user configuration
information
/var/log - Security logs, application logs, etc.

30. LINUX AUDIT - Basic system profiling
Linux distribution name and version
/etc/*-release
Computer name
/etc/hostname
IP Address(es)
/etc/hosts
/var/lib/dhclient

31. LINUX AUDIT - User accounts
Basic user data
/etc/passwd
Group membership
/etc/group
Admin users
/etc/sudoers
/etc/passwd (UID 0 account has admin privileges)

32. LINUX AUDIT - User login history
User, time, login durations
/var/log/wtmp (use last command)
Other logs
/var/log/auth.log
/var/log/sudo.log
Commands
last, lastlog, w, who

33. LINUX AUDIT – No place like $HOME
User files
/home/<user>
/root
Important user files
$HOME/.* - (Hidden files/directories start with “.”)
$HOME/.bash_history - commands history
$HOME/.ssh – remote access information

34. LINUX AUDIT – Daemons, services
Start-up scripts
/etc/inittab, /etc/init.d, /etc/rc.d
/etc/init.conf, /etc/init
Scheduled tasks
/etc/cron*
/var/spool/cron/*
Commands
ps –ef, ps aux

35. RESOURCES TO LEARN LINUX
GENERAL
• LinuxCommand.org
• The Linux System Administrator's
Guide
• GNU Operating System
• More… 12 Resources to Learn
Linux
SECURITY AND AUDIT
• SANS Pen Testing
• LinuxSecurity.com
• Linux-Audit.com
• Linuxtopia.org

36. QUESTIONS?

37. ABOUT SPEAKER
Gene Kartavtsev, CISA, PCIP
Gene has 20 years of Information Technology experience, which includes IT audit, security,
architecture, engineering and support.
Prior to focusing on IT Governance, Risk and Compliance, Gene worked at several global financial
services and Media companies, including Bloomberg L.P and Thomson Reuters, where he sharpened
his skills in information systems engineering and architecture. He participated in thousands of
complex IT implementations and was often involved in solving technology challenges vital to the
success of the core business.
In 2012 while working at JetBlue on a PCI controls implementation project, Gene discovered the
interesting world of IT compliance. (Maybe insert something here about what you liked about IT
compliance)
Later, after moving from New York to Minnesota Gene followed his passion in IT Risk Management
and Compliance and has held several roles that have required a combination of technical expertise
and knowledge of the latest IT regulations. Gene has rounded out his practical knowledge with
CISA, PCIP, and ISA certifications.
Gene recently joined Express Scripts, where he enjoys working with the challenges of applying
multiple IT regulatory standards to many areas of large company operations.
Other interests include spending time with the family, traveling and bicycle randonneuring - a long-
distance, unsupported, noncompetitive cycling within prescribed time limits.
LinkedIn: https://www.linkedin.com/in/gkartavtsev
Email: gkartavtsev@gmail.com