System security fundamentals: UFW, sudoers
Hardening principles, patching and least privilege.
Level 101 · 19 lessons · 18 practice labs
Lessons
The logic of hardening
- Hardening principles: You will understand what hardening means: closing what is unneeded, least privilege and layered defence, and where to start on a system.
- Attack surface: what stays open on a server
- Security baseline: what we will measure
- Listening ports: You will learn to list which ports a server is listening on and flag unexpected ones by asking why each is there.
- From port to process: You will learn to trace a listening port back to the process and program that owns it, and stop an unneeded one safely.
- Removing unneeded services: systemctl disable and mask
- Short task: list and switch off the unneeded services on a server
The firewall
- Firewalls with UFW: You will use UFW to decide which incoming connections a server accepts, and set up a simple firewall that blocks everything by default.
- UFW rules: application profiles and logging
- Basic filtering with iptables: ICMP and port rules: You can read iptables rules, add and test ICMP and port rules on your own server and make them persistent.
- Short task: write rules that allow only SSH and web traffic
Accounts and privileges
- Login auditing: w and last: You will use w and last to see who logged in, when and from where, and learn to spot unusual logins.
- Sudoers and visudo: You will learn to control who has sudo rights and for which commands, edit safely with visudo, and apply the least-privilege principle.
- Permission audit: You will learn to find and fix world-writable files and unnecessarily privileged programs, and to make permission audits a regular habit.
- Shared memory hardening: You will learn why the shared memory area should be blocked from running programs, and how to do it with mount options.
- Short task: find everyone with sudo rights and justify each one
Patching and capstone
- Updates and patching: You will learn why updates and patches are among the most effective defences, and how to check for security updates and apply them safely.
- Automatic security updates: unattended-upgrades
- Capstone: harden a server: You will harden a fictional company's lab server using the steps you learned, and prepare a short checklist showing its state before and after.
Practice labs
- Find and stop the unneeded listening service on this server: Trace each listening port to its process, then stop the useless service and keep it from starting at boot.
- Clean up a web server that still runs a print service: Find services such as CUPS and Avahi that a web server does not need, disable them and show their ports are closed.
- Bind the exposed database port to localhost only: Reconfigure a database listening on every interface to listen on 127.0.0.1 only and confirm the application still works.
- Shut down for good a service that keeps coming back: Find the timer that keeps restarting a service, mask both the service and its trigger, and prove it stays off after a reboot.
- Write UFW rules that allow web traffic only: Set the default policy to deny, allow ports 80 and 443 and verify the rule list.
- Narrow an SSH rule open to everyone down to the office network: Restrict the rule that allows SSH from anywhere to the office subnet and apply the change without locking yourself out.
- Find the address probing the server in the UFW log and block it: Turn on UFW logging, pick out the address with the most blocked attempts and add a deny rule for it.
- Close a port left open by badly ordered rules: Find a broad allow rule that shadows a later deny, reorder the rules and test that the port is really closed.
- List everyone who has sudo rights: Go through the sudo group and the sudoers files and produce the complete list of privileged users.
- Remove a leaver’s forgotten sudo rule: Find a rule under sudoers.d that belongs to someone who has left, remove it safely with visudo and check the syntax.
- Close the escape route in a single-command sudo grant: Show that the editor a user may run with sudo can spawn a shell, then narrow the rule to a full path and fixed arguments.
- Find out who logged in to the server last night: Extract the night-time sessions from last and w output and list them with user, time and source address.
- Tell a password-guessing run apart from ordinary failed logins: Count lastb and auth.log entries and separate the source making many attempts in a short time from forgetful users.
- Catch a successful login from a never-seen location: Find the successful session that follows a run of failures and line up the records that show the account was taken over.
- List and install the pending security updates: Identify the packages that come from the security repository, install them and show none are left pending.
- Turn on automatic updates but leave reboots for the night: Enable unattended-upgrades for security updates only and set it to reboot at 03:00 when needed.
- Find the service still using an old library after patching: Find the processes still holding the old OpenSSL in memory despite the patch, restart only those and verify.
- Catch the service a package update re-enabled and the rule exposing it: Compare yesterday’s and today’s listening ports, find the re-enabled service and the UFW rule allowing it, close both and write a script that reports the difference daily.
About this course
Hardening principles, patching and least privilege.
What you will learn
- The logic of hardening
- The firewall
- Accounts and privileges
- Patching and capstone
Prerequisites
No prior knowledge is needed; the course starts from zero.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at beginner level; every term is explained where it first appears.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.