Linux security and hardening

Who gets in 4 topics

• Entry check: are you ready to harden a server?
  A forty-five minute check of the Linux skills this course builds on, with a pointer to the earlier topic to revisit for each one.
• Ssh keys instead of passwords
  How an ssh key pair works, the file permissions that make it safe, putting a public key on a server, checking fingerprints, one key per person and device, and revoking…
• sudo and least privilege
  Why work as a normal user, how sudoers rules are written and checked, what to avoid (ALL, careless NOPASSWD, wildcards, shell-opening programs), and how to read the sudo…
• Accounts, passwords and PAM
  The life of an account (create, change, pause, end), locking and expiring, password ageing with chage, finding empty passwords, the PAM stack and password strength, with…

Who can touch what 4 topics

• Modes, ownership and umask
  Owner, group and others with r, w and x, setting modes and owners, the umask for new files, auditing for world-writable and owner-less files, and a shared team folder.
• Access control lists
  Named users and groups on a file with ACLs, getfacl and setfacl, the mask and effective permissions, default ACLs for new files, and when to use a group instead.
• Setuid, setgid, sticky and capabilities
  The three special mode bits, why setuid programs are a risk and how to baseline them, sticky for shared folders, setgid for team folders, and capabilities as a smaller…
• Attributes and mandatory access control
  Immutable and append-only file attributes, why mandatory access control confines programs whatever their owner, AppArmor and SELinux modes, and the habit of learning in…

Closing the doors 4 topics

• Hardening sshd
  The sshd settings that close the front door (root login, passwords, AllowUsers, tries, grace time, X11), testing with sshd -t and reading with sshd -T, and the order of…
• A host firewall with ufw
  What a host firewall does, default deny, allow rules with source restrictions, the order that avoids a lockout, counting listening ports with ss, and rule hygiene.
• Updates and a smaller attack surface
  Why updates are the cheapest defence, a patching routine and automatic security updates, taking inventory and running less, replacing clear-text services, and keeping a…
• Slowing brute force with fail2ban
  How fail2ban counts failures and bans addresses, jails, filters and limits, enabling and reading it, protecting your own network, lifting a ban, testing a filter, and…

Seeing what happened 4 topics

• Reading the logs that matter
  Where sign-in evidence lives, the four questions (how many, from where, which accounts, did anyone get in), counting with grep, awk, sort and uniq, last, lastb and who…
• Watching important files with auditd
  What the audit system records, watch rules (path, accesses, key), finding events with ausearch and aureport, auid and sudo, keeping rules across reboots, and choosing…
• Noticing change: baselines and integrity checks
  What a baseline and a hash are, checking a few files with sha256sum, whole-tree checks with AIDE (init, activate, check), the setuid baseline with find and diff, where…
• When something looks wrong: the incident routine
  The six-step routine (preserve, contain, investigate, eradicate, recover, record), locking accounts and ending processes, why keys and sessions matter, looking for what…

Infrastructure behind security 4 topics

• The map of security infrastructure
  The parts that make security work on one server (identity store, ssh daemon, sudo policy, host firewall, log pipeline and clock), a card for each with role, resource…
• Sizing, capacity and cost of watching
  The audit daemon and the integrity database as parts, how much a log grows (events times bytes times days times margin), finding the slowest or fullest stage with…
• Failure, secrets and recovery
  Secrets and backups as parts, a failure table (failure, symptom, first check, safe action) and practising it, keeping secrets out of scripts, logs and command lines…
• Operating it: alerts, updates, handover and trade-offs
  Monitoring and alerting and the update routine as parts, what a good alert says and why every check has a heartbeat, updates as a routine with a reboot window, a…

Interview ready 2 topics

• Interview ready: access, permissions and hardening
  The questions people really ask about keys, sudo, permissions, ACLs, setuid, the firewall and hardening, with model answers, a routine for timed hands-on tasks, strong…
• Interview ready: detection, response and a mock round
  The questions people really ask about logs, auditing, integrity checks and incident response, with model answers, strong and weak answers, four timed terminal tasks and…

The hardening checklist and evidence

A checklist for vault covering ssh, sudo, accounts, permissions, firewall and updates, with the command that shows the effective setting for each and a before-and-after transcript.

The detection and response pack

A log-reading routine, a set of audit watches, an integrity baseline, an incident record with times, and a failure table.

The security map and handover

A card for each part that grants or records access, a capacity sheet for the record, and a one-page handover with alerts and who to call.

Why take this course

• Harden a real server step by step
• Know what is in force, not just what you typed
• Notice and handle a break-in calmly

You will build

• A hardened and watched server
• A detection and response pack
• A security map and handover

What you can do afterwards

• Protect a server with confidence
• Explain your choices and their risks
• Answer security interview questions with specifics