Security (DevSecOps) · Module 01

Hardening a Linux server

Shrink the attack surface of a Linux server: least privilege with sudo, special permissions and ACLs, key-only SSH, a host firewall, and watching logins and audit logs.

Practice interactively →

What you will learn

• Grant minimal sudo rights with files in /etc/sudoers.d and visudo
• Read and set SUID, SGID, the sticky bit, umask and ACLs
• Harden SSH: key-only, no root login, limited attempts, fail2ban
• Open only the ports you need with ufw or firewalld
• Investigate logins and changes to key files with the journal, auth.log and auditd

Lessons

1. Users, sudo and the least-privilege principle

   Every person and service gets only the rights it needs; grant sudo per command in /etc/sudoers.d, edit it with visudo, and never work as root day to day.

2. umask, SUID/SGID/sticky bit and ACLs

   Understand how umask sets default permissions, how special bits can be abused for privilege escalation, and how ACLs grant fine-grained rights to one user without widening a group.

3. Hardening SSH: key-only, no root login, fail2ban

   SSH is the most common way into a server; use keys instead of passwords, disable root login, limit users and attempts, test the config before reloading and block brute force with fail2ban.

4. Host firewalls: ufw and firewalld

   Deny inbound traffic by default and open only the service ports you need; ufw on Ubuntu and firewalld on the Red Hat family are friendly front ends to nftables, used alongside cloud security groups.

5. Watching logins and audit logs

   Know who logged in, who failed and who changed key files; read the journal and auth.log, use last/lastb, set watches with auditd and ship logs to a central system.