Linux security for DevSecOps
Hardening servers and images.
Level 201 · 21 lessons · 18 practice labs
Lessons
Exposed surface
- Classifying listening services: You will learn to list which services listen on which address on a server and classify each as needed, restrictable or removable.
- Restricting an admin interface to loopback: You will learn to restrict an admin interface to listen only on the local (loopback) address instead of leaving it open to the outside network.
- Closing legacy ports: You will understand why old, unused services such as Telnet are a risk, and learn to close them on your own server.
- Disabling directory listing and exposed backups: You will learn to turn off directory listing on a web server and to find and remove backup files accidentally left exposed.
- Closing diagnostic endpoints: You will learn that diagnostic endpoints such as debug and status pages can leak information, and how to close them.
- Turning off debug mode in production: You can show what an application’s debug mode exposes and set production settings to safe values.
- Short task: report every externally reachable service on a server with reasons
Permissions and users
- Permissions of secret, environment and upload files: You will learn to review permissions on secrets, environment files and uploads, so only the users who need them can read or write.
- Narrowing sudo rules: You will learn to spot sudo rights that are too broad and narrow them so each user can run only the commands their job needs.
- Dedicated service users: You will understand how running each service as its own limited user keeps the damage small even if one service is compromised.
- Hardening cron jobs that run as root: You will learn to review the files and permissions of cron jobs that run as root, and close weak points others could change.
- Using a safe PATH and full paths in scripts: By fixing PATH at the top of a script and calling commands by full path, you can prevent hijacking by a look-alike command.
- Path boundaries in backup scripts: realpath and symlink checks: With realpath you can keep a backup script inside its allowed directory and block escapes through symbolic links.
- Short task: move an app running as root to its own user
Secrets and services
- Finding hardcoded credentials and moving them to an environment file: With grep you can find passwords embedded in scripts and configs and move them to an environment file with restricted permissions.
- Secrets leaking through the process environment: /proc and ps: You can measure who can see secrets via /proc/PID/environ and ps output, and close that leak.
- Service environment files: EnvironmentFile and permissions: With systemd EnvironmentFile you can pass secret settings to a service safely and make the file readable only by root and the service.
- Confining a service: ProtectSystem and ReadWritePaths: With ProtectSystem and ReadWritePaths you can let a service write only to its own log and data directories.
- Cleaning up temporary exceptions after an incident: You can systematically list and close the firewall, sudo and permission exceptions opened during an incident and return the server to a safe state.
- Short task: restart a service with systemd restrictions and confirm it still works
Capstone
- Capstone: harden an application server: Capstone: on a fictional company's application server, you review exposed services, permissions and privileges and harden the server.
Practice labs
- Classify listening services as needed or not: Tie each port in the ss output to its process and flag those an application server does not need.
- Restrict an admin interface to loopback: Bind an admin panel listening on every interface to 127.0.0.1 and show it is still reachable through an SSH tunnel.
- Report every externally reachable service with reasons: Examine the server from inside and outside, close the legacy ports and write the owner and reason for every port left open.
- Turn off directory listing on the web server: Disable the setting that shows directory contents and verify the request now returns 403.
- Close exposed backups and diagnostic endpoints: Find the backup archive in the web root and the health and metrics endpoints, move the backup and open the endpoints to the internal network only.
- Turn off debug mode left on in production without side effects: Find the environment variable that enables debug mode, turn it off and prove the interactive console endpoint is gone and the app stays healthy.
- Fix the permissions of secret and environment files: Find a world-readable environment file and key, and narrow their ownership and permissions to the service user.
- Narrow the deploy account’s broad sudo rule: Reduce a rule allowing every command to the service restart command only and show another command is refused.
- Move an app running as root to its own user: Create a dedicated service user, sort out file ownership and the port requirement, start the service as that user and confirm scripts cannot run in the upload directory.
- List root’s cron jobs and their script permissions: Extract root’s scheduled jobs and flag the scripts they run that someone else can write to.
- Use a safe PATH and full paths in a script: Convert a maintenance script that uses bare command names to full paths, fix PATH and show a planted look-alike command no longer runs.
- Add path boundary and symlink checks to a backup script: Show in your own lab that the script archives outside the allowed directory through a symlink, add a realpath check and test the fix.
- Find the hardcoded credential in the code: Search the app directory for password and key patterns and state where the embedded database password sits.
- Move an embedded password into the service’s environment file: Move the password to a root-only file loaded via EnvironmentFile and confirm the app runs.
- Stop a secret leaking through the process environment: Show the password is visible to other users in the command line and through /proc, switch to file-based delivery and prove the leak is closed.
- Read a service’s security score with systemd-analyze: Write the service’s score and its three weightiest gaps from systemd-analyze security output.
- Confine a service with ProtectSystem and ReadWritePaths: Add the restrictions to the unit and verify the service can write only to its data directory and still works.
- Clean up temporary exceptions left after an incident and harden the server: Find the temporarily opened port, the broad sudo rule and the loosened unit setting, revert them and evidence the server’s final state with a checklist.
About this course
Hardening servers and images.
What you will learn
- Exposed surface
- Permissions and users
- Secrets and services
- Capstone
Prerequisites
Finishing the level 101 courses of the same path, or knowing those topics, is enough.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 201; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.