Kernel, boot and service isolation
You protect the boot chain and kernel that attackers use for persistence, isolate services with systemd and narrow system calls with seccomp.
Level 401 · 15 lessons · 15 practice labs
Lessons
The boot chain
- The secure boot chain: UEFI, shim, GRUB, kernel
- GRUB password and protecting kernel parameters
- Disk encryption with LUKS and key management
- Short task: prove that single-user mode can’t be entered without a password
The kernel
- Kernel lockdown mode and signed modules
- Disabling unneeded kernel modules: usb-storage and rare protocols
- Kernel command line hardening options
- Kernel updates, reboots and live patching
- Short task: block unused file system modules permanently
Service isolation
- Scoring services with systemd-analyze security
- Sandboxing options: PrivateTmp, ProtectHome, NoNewPrivileges
- Filtering system calls with seccomp: SystemCallFilter
- Linux capabilities: CapabilityBoundingSet and AmbientCapabilities
- Short task: bring a service’s exposure score from 9 to under 3
Capstone
- Capstone: layered protection from boot to service on a critical server
Practice labs
- Put a password on GRUB and lock menu editing: Add a hashed GRUB password, regenerate the config and show editing without the password is blocked.
- Add a backup key to a LUKS disk and remove the old one: Add a new key slot, test unlocking, delete the old key a leaver knew and list the slots.
- Find the unsigned link in the Secure Boot chain: Inspect Secure Boot state with mokutil and dmesg, find the module that loaded unsigned and explain how it got in.
- Block the usb-storage module for good: Write a block rule in modprobe.d, try to load the module and show it does not load.
- Disable unused file system and network protocol modules: Block modules such as cramfs, dccp and sctp, check the loaded list and show the block holds after a reboot.
- Turn on kernel lockdown and try loading an unsigned module: Enable lockdown in integrity mode and prove an unsigned test module is refused and /dev/mem access is closed.
- Read the security options on the kernel command line: Inspect /proc/cmdline, list the missing hardening options and write down what each one does.
- Add hardening options to the kernel command line: Add options such as init_on_free and slab_nomerge to the GRUB settings, reboot and show they are active.
- Spot a server still on an old kernel after live patching: Compare installed, running and live-patched kernel versions, identify the flaw that needs a reboot and plan it.
- Measure a service’s exposure score: Score the service with systemd-analyze security and note the three settings that cost the most points.
- Add PrivateTmp and ProtectHome to a report service: Add the sandbox options with a drop-in file, restart the service and show it still works.
- Narrow a service with seccomp and capability filters: Bring the score under 3 by adding SystemCallFilter and CapabilityBoundingSet and test the service still does its job.
- Run a service on port 80 without root: Run the service as its own user, grant only CAP_NET_BIND_SERVICE and prove it holds no other capability.
- Read which capabilities a service runs with: Show the effective capability set of the running service’s process and the related settings in its unit file.
- Limit the capabilities of a service running as root: Leave the service only the two capabilities it needs with CapabilityBoundingSet and NoNewPrivileges and confirm it runs.
About this course
You protect the boot chain and kernel that attackers use for persistence, isolate services with systemd and narrow system calls with seccomp.
What you will learn
- The boot chain
- The kernel
- Service isolation
- Capstone
Prerequisites
You should have practised the topics of the same path up to level 301.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 401; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.