Learn Linux Security Through Practical Steps

Keep packages up to date to reduce vulnerabilities; use Debian stable with buckboards for security updates, verify sources, and upgrade as needed. Consider a weekly cron job to maintain security.

Learn to prevent Linux users from reusing old passwords by configuring shadow password storage and setting a limit on remembered passwords per account.

Learn how to set and enforce local user password expiration on Linux by configuring maximum, minimum, and warning days with chage, and verify changes for secure access.

Enforce strong passwords on a local server by configuring pwquality to require nine characters, two character classes, no more than four consecutive same class characters, and a three retry limit.

Disable root login by changing the root entry in /etc/passwd from bash to nologin to prevent access. Ensure at least one user has sudo privileges to avoid being locked out.

Learn how the /etc/securetty file restricts root logins by listing permitted ttys. If the file is missing or empty, create it and leave it empty to prevent root logins.

Configure an ssh banner before login to display a security warning and prohibit unauthorized access, and enable a message of the day after login.

Learn to log into remote systems with ssh keys, a public/private key pair, and an optional passphrase by generating keys and copying the public key to the remote host.

Learn how ssh verifies host authenticity using fingerprints stored in the known_hosts file, and recognize warnings when a host's identity changes as a potential man-in-the-middle attack.

Learn to secure a server with iptables by configuring input, output, and forward chains, adding drop or reject rules, and saving rules for reboot persistence.

Fail2ban scans log files and bans IP addresses to prevent brute-force attacks, using jail configurations and iptables rules with per-service overrides and restart implications.

Use the fail2ban-client command to view jail status, list banned IPs, reload configuration, and set ban times, including permanent bans with negative values, then unban via iptables.

Learn to secure Linux services with TCP wrappers by configuring hosts.allow and hosts.deny, understanding rule precedence, and using service, client fields, IP ranges, and domains to permit or block access.

Lynis audit tool scans Linux systems for security information such as kernel version, file permissions, firewall rules, accounts without passwords, and more, reporting status and hardening suggestions.