Payment by bank transfer · Moroccoتعلَّم · مارِس · أتقِن

Catalogue / Cybersecurity

Linux Server Hardening

Shrink the attack surface of a Debian, Ubuntu or Rocky Linux server one measure at a time, then prove it with a Lynis audit and the ANSSI recommendations.

  • Intermediate to advanced
  • 13 lessons
  • 11 h 30 min
  • Versions Debian 12, Ubuntu 24.04, Rocky 9

A MasterLinux course · Original text

What you will learn

  • Build a simple threat model and measure a server's attack surface
  • Lock down accounts, sudo and passwords with PAM, pwquality and faillock
  • Harden SSH (keys, no root, AllowGroups, modern algorithms) without locking yourself out
  • Write an nftables firewall with a "deny all except" policy and translate it to firewalld
  • Shut down unneeded services and ports, and confine the remaining ones with systemd
  • Automate security updates on Debian, Ubuntu and Rocky Linux
  • Fix permissions, SUID/SGID, umask and mount options (noexec, nosuid, nodev)
  • Make SELinux and AppArmor work for you instead of disabling them
  • Log with journald and auditd, check integrity with AIDE, ban with fail2ban
  • Audit with Lynis, rely on ANSSI and the CIS Benchmarks, and harden a web server end to end

Course content

13 lessons · 11 h 30 min
Section 1 — Fundamentals3 lessons · 1 h 55 min
  1. Threat model and attack surface Preview30 min
  2. Accounts, sudo and passwords (PAM, pwquality, faillock) 40 min
  3. Hardened SSH — keys, no root, AllowGroups and cryptography 45 min
Section 2 — Shrinking the surface4 lessons · 2 h 40 min
  1. Firewall — nftables and firewalld with a "deny all" policy 45 min
  2. Unneeded services and ports — stop, mask, confine 40 min
  3. Automatic security updates 35 min
  4. Permissions, SUID/SGID, umask and mount options 40 min
Section 3 — Control and detection4 lessons · 3 h 5 min
  1. SELinux (Rocky) and AppArmor (Debian, Ubuntu) 50 min
  2. Logging with journald and auditd 50 min
  3. File integrity with AIDE 40 min
  4. fail2ban — automatically ban attackers 45 min
Section 4 — Audit and project2 lessons · 3 h 50 min
  1. Global audit with Lynis, ANSSI and the CIS Benchmarks 50 min
  2. Final project — harden a web server from end to end 3 h

Requirements

  • The “Fundamentals” course (included) or solid hands-on experience with the Linux command line
  • Able to administer a Debian or Rocky server (packages, services, users)
  • A practice virtual machine (Debian 12 or Rocky 9) for the labs

Who is this course for?

  • Technicians and system administrators who want to secure their servers
  • Students aiming for a first job in cybersecurity or operations
  • Developers and freelancers who host their own applications on a VPS