
Learn essential linux security investigation tools used by cybersecurity professionals to uncover suspicious activity on a linux server, including checking open ports, active connections, and running processes.
Learn core Linux security concepts that endure beyond tools—attack surfaces, defense in depth, least privilege, monitoring and incident response—so you can master any security tool efficiently.
Explore how security is a process that reduces risk through confidentiality, integrity, and availability, using defense in depth and least privilege with Linux permissions.
Use Nmap to map your attack surface by identifying open ports and services on a server, such as ssh on port 22 and http on port 80.
Run lsof with sudo to list open files and identify which application uses a port, showing pid, user, IP version, and listening status for security investigations.
Run Lynis to audit Linux security and hardening, scanning for weak configurations, outdated settings, and compliance gaps, then address unsafe findings like Nginx service.
Learn SELinux fundamentals for Linux security, including mandatory access control (MAC), labels, and how to diagnose and fix access denials for web content without disabling SELinux.
Learn practical Linux firewall configuration using ufw, iptables, and nftables to secure DevOps and IT infrastructure. Explore the strengths and use cases of each tool within Linux security.
Learn how OpenSSL enables SSL and TLS management, including generating, viewing, and verifying certificates, keys, and CSRs, and troubleshooting encrypted connections and certificate expiration.
Apply a Linux hardening checklist to audit, harden, and protect Linux systems within DevOps workflows.
Learn how to use journalctl to investigate system logs for security incidents, track SSH access, authentication successes and failures, and identify exact times, users, and IPs.
Discover how a user-space tool searches Linux audit logs produced by the kernel auditd daemon, returning event time, type, pid, uid, and kernel image for security investigations.
Discover RkHunter, a Linux security checking tool, that detects rootkits by scanning for signs of compromise and manages baselines and regular scans as part of a multi-layer defense.
Test network connectivity with netcat by listening on a port on one machine and connecting from another, then observe a bidirectional exchange over nc.
Learn to capture and inspect network traffic with tcpdump across all interfaces, create pcap and pcapng files, and visualize ICMP echo request and reply in Wireshark.
Why Linux Security Matters
Linux powers modern infrastructure, cloud platforms, containers, and enterprise applications. Whether you're a Linux administrator, DevOps engineer, SRE, or IT professional, understanding how to secure Linux systems is a critical skill in today's environments.
In this course, you'll learn practical Linux security concepts and gain hands-on experience with the tools commonly used to assess, monitor, harden, and troubleshoot Linux systems.
We'll begin with the fundamentals of Linux security, including defense in depth, least privilege, detection and monitoring, and a practical security assessment workflow. These concepts will help you understand not only how security tools work, but when and why to use them.
From there, we'll use real-world demonstrations to assess, monitor, harden, and troubleshoot Linux systems using industry-standard security tools.
What You'll Learn
Discover open ports, services, and attack surfaces with Nmap, ss, and lsof
Assess Linux security posture using Lynis and OpenSCAP
Secure Linux firewalls using UFW, iptables, and nftables
Protect systems against common attacks using Fail2ban
Secure Linux systems with SELinux through practical, hands on examples
Work with certificates, encryption, and TLS using OpenSSL
Monitor security events using Auditd and Journalctl
Investigate security incidents using Ausearch
Detect malware, rootkits, and signs of compromise using ClamAV and Rkhunter
Validate and troubleshoot security controls using Netcat and Tcpdump
Who This Course Is For
This course focuses on practical learning rather than theory alone. Every tool is demonstrated in a Linux environment so you can follow along and apply the techniques in your own lab, workplace, or cloud environment.
By the end of this course, you'll understand how security professionals approach Linux security, identify risks, monitor systems effectively, investigate security events, and use industry-standard tools to improve your security posture.
Whether you're a Linux administrator, DevOps engineer, SRE, cybersecurity student, or IT professional, this course will help you build practical Linux security skills that you can apply immediately in real-world environments.