17. Why Learn All This Before Kali Linux?
17.3 From Linux and SSH to Brute Force, Privilege Escalation and Hardening
Kali swatah Linux aahe – aani bahutek targets pan Linux servers aahet. Part 2 che commands attack aani defence donhi madhe roj lagtat.
| You learnt (Part 2) | Attack side | Defence side |
|---|---|---|
SSH, key pairs, chmod 400 |
Hydra password brute force against SSH | Key-only login, PasswordAuthentication no, fail2ban |
Users, groups, sudo |
Privilege escalation (विशेषाधिकार वाढ) via weak sudo rules |
Least privilege, review sudo -l |
Permissions, SUID, find |
find / -perm -4000 to hunt SUID binaries |
Remove unnecessary SUID bits, correct ownership |
Processes, services, ss |
Finding vulnerable services running as root | Disable unused services |
Logs, grep, awk |
Attackers try to clear logs | Reading /var/log/secure or auth.log to detect attacks |
| cron | Persistence through cron jobs | Auditing crontabs |
| Package management | Exploiting outdated software | sudo yum update / sudo apt upgrade regularly |
sudo grep "Failed password" /var/log/secure | tail # Amazon Linux: failed SSH logins
sudo grep "Failed password" /var/log/auth.log | tail # Ubuntu
sudo -l # what can this user run as root?
Why this matters for security
Tools like linPEAS only list possible weaknesses; you must understand Linux permissions to know which findings are real. The same knowledge makes you a good defender: every hardening step in Part 11 (SSH config, fail2ban, firewall, updates) is a Linux command you already know.
Ravindra Bagale's Tip
If your EC2 instance is on the internet, open /var/log/secure once – even without you doing anything, you'll see many "Failed password" attempts. These are bots. Students panic – don't panic! If SSH is key-only and port 22 is open only to your IP, these attempts are useless. This is the first lesson of "defence".
Ravindra Bagale's Tip – मराठी
तुमचा EC2 internet वर असेल तर /var/log/secure एकदा उघडा – तुम्ही काही न करता पण अनेक "Failed password" attempts दिसतील. हे bots आहेत. Students घाबरतात – घाबरू नका! Key-only SSH आहे आणि port 22 फक्त तुमच्या IP ला open आहे तर हे attempts निरुपयोगी आहेत. हाच "defence" चा पहिला धडा.
Ravindra Bagale's Tip – हिंदी
तुम्हारा EC2 internet पर है तो एक बार /var/log/secure खोलो – तुम्हारे कुछ किए बिना भी कई "Failed password" attempts दिखेंगे. ये bots हैं. Students घबरा जाते हैं – घबराओ मत! SSH key-only है और port 22 सिर्फ़ तुम्हारे IP के लिए open है तो ये attempts बेकार हैं. यही "defence" का पहला सबक है.
Practice task
On your EC2 instance, count failed SSH attempts with grep and wc -l, list the top source IPs with awk and sort | uniq -c, and check sshd_config for PasswordAuthentication.