Linux+ exam prep: security
You bring a Linux server up to audit standard, from users and sudo rules to PAM, SSH, SELinux, AppArmor, the firewall, disk encryption and auditd.
Level 201 · 16 lessons · 12 practice labs
Lessons
Identity and access
- Users, groups and sudo rules
- Login policy with PAM modules
- SSH hardening: keys, multi-factor authentication and allow lists
- ACLs, setuid, setgid and the sticky bit
- Short task: give a contractor limited, time-boxed access
System protection
- SELinux modes, contexts and booleans
- AppArmor profiles
- Firewalls: firewalld, nftables and ufw
- Disk encryption with LUKS
- File integrity monitoring and package verification
- Short task: run the web server with least privilege
Audit and compliance
- Watching access to critical files with auditd
- Certificates, GPG signatures and secure transfer
- A hardening check: open services, kernel settings, password policy
- Reviewing security logs: failed logins and privilege escalations
- Capstone: prepare a server that will pass an audit
Practice labs
- Put the sticky bit on a shared drop folder: In a drop folder everyone can write to you stop users deleting each other's files and test it with two accounts.
- Give an auditor read-only access with ACLs: Without changing the group layout you give an external auditor account read-only rights on the accounting directory and cover new files with a default ACL.
- Clean up setuid files that belong to no package: You find setuid and setgid files not installed by the package manager, decide which are risky and remove the bits.
- Limit SSH login to one group: You allow only the admin group to log in through sshd and show that an account outside the group is refused.
- Give a supplier SFTP-only drop access: You confine Tepegöz Optik's supplier account to SFTP chrooted into its own directory with no shell and show shell login is refused.
- Add a second factor to SSH for admins: With PAM you require a one-time code on top of the key for the admin group, exempt service accounts and test both cases.
- Put an audit watch on account files: You add a write watch for /etc/passwd and /etc/shadow and show that a change turns up in ausearch.
- Find who changed a configuration: From the audit records you work out which user and command changed an sshd setting overnight and report it with the timestamp.
- Write persistent audit rules for privileged commands: You write persistent audit rules recording every run of sudo, su and account-management commands and produce a summary with aureport.
- Check whether package files were altered: You check installed files with package verification commands and report two files altered afterwards and what changed.
- Verify the signature of a downloaded archive: You import the publisher's public key, verify a release archive's signature and hash and tell the tampered copy apart.
- Run a hardening check and raise the score: You run a script checking open services, kernel settings and password policy, fix the five most critical findings and record the new score.
About this course
You bring a Linux server up to audit standard, from users and sudo rules to PAM, SSH, SELinux, AppArmor, the firewall, disk encryption and auditd.
What you will learn
- Identity and access
- System protection
- Audit and compliance
Prerequisites
Finishing the level 101 courses of the same path, or knowing those topics, is enough.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 201; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.