Linux Security and Hardening, The Practical Security Guide

Explore how IP addresses enable traffic between systems by defining network and host portions, private versus public addresses, and the transition from IPv4 to IPv6, with NAT and addressing.

Explore how IP addresses identify devices and how ports route traffic to specific applications. Review ports for DNS 53, email 25, POP3 110, IMAP 143, FTP 21, HTTPS 443, and the 0–65535 range.

Understand tcp/ip basics, IP addressing, packet delivery, and the roles of TCP and UDP in networks, and the OSI seven-layer model including the three-way handshake (SYN, SYN-ACK, ACK).

Explore why Linux is considered relatively secure and how the superuser differs from other users, then examine open source implications, encryption, multi-factor authentication, software management, and least privilege.

Explore the tradeoffs between accessibility and security in Linux, and why security depends on proper administration. Learn to prevent misconfigured permissions, weak passwords, and insecure transmission.

Linux uses a multi-user design with strict file permissions and service accounts, limiting access to owned files. Open source and signed packages via central package management strengthen security and updates.

Adopt practical security guidelines and principles for Linux, minimize installed software, isolate services, enforce least privilege, enable multi-factor authentication, log activity, and encrypt data in transit and at rest.

Explore how Linux security relies on ongoing monitoring, least privilege, encryption, and log monitoring, while leveraging open source benefits, multi-user design, package management, and built-in firewall.

Assess physical security for Linux systems, tackle third-party hosting and cloud implications, and implement practical plans to mitigate physical risks while protecting systems against common physical threats.

Learn physical security concepts to protect Linux systems, including restricting access to server rooms, maintaining logs, enforcing need-based access, and considering data center and cloud security implications.

Learn to secure Linux systems by hardening single user mode, guarding grub boot entries with a root password, and configuring systemd rescue and emergency targets.

Explore how single user mode can expose a root prompt without a password, and learn to secure it by setting a root password and verifying with systemd during boot.

Protect the grub bootloader by requiring a password, configuring /etc/grub.d/40_custom, and regenerating grub configuration, while noting the risks posed by physical access.

Discover how to enable disk encryption on Linux using dm-crypt/luks, protect data with a strong passphrase or key, and access decrypted data transparently when mounted.

Encrypt a newly added disk in a Linux VM using cryptsetup, create a dm-crypt mapper under /dev/mapper, format as ext4, mount, and secure boot with a passphrase.

Encrypt a new device, using a file as a virtual block device in cloud environments, generate random data with dd, create and mount a filesystem, then close the encrypted device.

Back up the existing device, prepare a separate drive or server, create a new filesystem, mount it, restart, and restore the backup to the newly encrypted device.

Disable control-alt-delete to prevent reboot via keyboard remote access, safeguarding against bypassing single user mode. Configure the system to ignore c-a-d and reload the init settings.

Learn how physical access threats can compromise a Linux system and implement protections such as bootloader passwords, locked block devices, and disable reboot control to prevent bypass.

Explore Linux account types, enforce strong password practices with shadow passwords, manage password expiry and account locks and unlocks, monitor logs and intrusion detection systems, and implement multi-factor authentication.

Discover how pluggable authentication modules (PAM) centralize authentication on Linux. Learn how interfaces for login, account, password, and session use configuration files and control flags to secure access.

Explore a PAM configuration example that demonstrates directive order, login restrictions via /etc/shadow, and password quality enforcement with a password quality module (retry=3) and dictionary word checks, ensuring strong credentials.

Examine Linux password security by understanding root privileges, UID 0, and the shadow file, then enforce strong passwords, PAM pwquality guidelines, and password aging to require changes and manage expirations.

Explore how the uid 0 root account exists in /etc/passwd, with password fields and shadow storage, and how only one account should use uid 0 to preserve root access.

Learn practical linux hardening to control account access by disabling interactive logins and locked shells, and protect against brute-force with fail2ban and two-factor options like google authenticator or rsa tokens.

Practice hardening Linux by using a normal user with sudo, disabling direct root logins, and maintaining an audit trail while limiting service accounts and removing unused accounts.

Demonstrates hardening Linux logon security by editing the login device file, removing unauthorized devices, and verifying access across virtual consoles and normal user accounts.

Practice demonstrates configuring and using sudo to run commands as different users, inspecting permissions, validating configurations, and auditing sudo logs to enforce strict access control and prevent cross-user privileges.

Discover techniques to secure network services, understand how the local firewall works, prevent information leakage, test for open ports, and perform port scans.

Run services as dedicated non-root users and bind them to needed interfaces. Limit exposure by not exposing databases to the public network and using firewalls to restrict access.

Identify and secure Linux network services by listing and disabling unused daemons with systemctl, inspect listening ports with netstat, and limit exposure by binding critical services to the loopback address.

Secure sshd with key-based authentication, manage public and private keys, and configure authorized_keys and login rules, while employing local and remote port forwarding to encrypt connections.

Enforce sshd hardening by enabling stronger encryption and authentication. Restrict listen addresses with ListenAddress to private networks and change the default port to reduce exposure.

Learn Linux firewall fundamentals with iptables and netfilter. Build rules across filter and security tables, using input, output, forward, prerouting, and postrouting chains to control traffic.

Configure the Linux firewall from the command line using iptables, specify tables like filter, and manage input, forward, and output chains with insert, append, delete, and flush, applying default policy.

Explore practical firewall rule examples with iptables, including input chain, filter table, source and destination addressing, port 22 rules, and netfilter state tracking to block or permit traffic.

Explore file and directory modes, showing how read, write, and execute permissions govern accessing file contents, modifying data, running programs, and listing or creating items in directories.

Learn how Linux assigns a file to one user and one group, and use sudo to change ownership with chown, verify results, and ensure home directories are owned correctly.

Set file permissions in linux using numeric mode to read, write, and execute for user, group, and others (7 5 0) with chmod, then verify with ls.

Learn symbolic permission changes in Linux with chmod using u, g, and o and operators =, +, and - to set read, write, and execute rights.

Explain how umask sets default file and directory permissions in Linux security, demonstrate calculating 666/777 minus umask, show commands to view and set umask, and apply per-user and system changes.

Understand Tripwire, a host-based intrusion detection system that monitors critical system files for unauthorized changes and alerts on discrepancies; learn to install, configure, and test on CentOS 7.

Update the system and enable the epel repository, then install tripwire on CentOS 7. Create keys, initialize the database, configure policy, test with sample files, and schedule daily checks.

Learn how to install fail2ban and configure it to scan logs in real time, detect brute-force attempts, and block suspicious IP addresses with iptables on CentOS 7.

Install epel and fail2ban on CentOS 7, then customize jail.local to ban offending IPs with bantime, findtime, and maxretry, and manage bans via iptables and service status.