Introduction to misconfiguration audits on a Linux server
Starting from least privilege you audit accounts, file permissions, SUID files, listening services and update status on a Linux server, and apply a first hardening list with CIS benchmarks and Lynis.
Level 101 · 14 lessons · 12 practice labs
Lessons
Core ideas
- What a misconfiguration is: a lock with the key under the doormat
- The principle of least privilege
- Reviewing the user and group lists
- Short task: find the needless accounts on the lab server
File permissions
- Reading file permissions and recognising risky ones
- Finding world-writable files and directories
- Finding and removing wrong SUID permissions on Linux
- Fixing the permissions of configuration files
- Short task: find and fix five files with wrong permissions
Services and updates
- Auditing listening services
- Auditing update status
- Introduction to CIS benchmarks
- A first automated audit with Lynis
- Capstone: audit a Linux server and apply the first hardening list
Practice labs
- Find the unneeded accounts on this server: Review users and groups and list unused or unexplained accounts with reasons.
- Trim excess group memberships by least privilege: Compare privileged group memberships with job needs, remove extras and verify the result.
- Find and close a leaver's remaining access: Find and clean up a leaver's account, keys, cron jobs and file ownership on Ilgıntepe Tekstil's server.
- Find world-writable files and directories: List world-writable paths system-wide, set aside the expected ones and report the risky ones.
- Find a wrong SUID bit, remove it and recheck: Compare SUID files with package defaults, remove the extra one's bit and list them again.
- Find and fix five files with wrong permissions: Find wrong ownership and permissions on config, key and log files, fix them and confirm services still run.
- Audit listening services and disable the unneeded one: Map open ports to processes, stop the service with no business need and disable it permanently.
- Audit and report the server's update state: Record pending security updates, last update date and automatic update setting in the report table.
- Restrict a service that should listen only locally: Bind the database service exposed on the external interface to localhost and confirm it is unreachable from outside.
- Run a first Lynis audit and classify the findings: Separate warnings and suggestions in the audit output and write the top five tasks by priority.
- Check and apply five CIS benchmark controls by hand: Evidence the current state of five chosen controls, fix the non-compliant ones and show the score change.
- Audit a Linux server and apply the first hardening list: Audit Tarçınlı Fırın's server, apply a ten-item hardening list and report the Lynis score increase.
About this course
Starting from least privilege you audit accounts, file permissions, SUID files, listening services and update status on a Linux server, and apply a first hardening list with CIS benchmarks and Lynis.
What you will learn
- Core ideas
- File permissions
- Services and updates
Prerequisites
No prior knowledge is needed; the course starts from zero.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at beginner level; every term is explained where it first appears.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.