The Complete Linux Security Training Course: All In One

Explore Linux distributions such as Red Hat Enterprise Linux, CentOS, Ubuntu, and Kali Linux, and learn to harden services, the boot process, logging, intrusion detection, and firewall configurations.

Linux is the kernel that interfaces with hardware to run programs. A desktop environment forms a Linux distribution with software from KDE, Apache, and GNU.

Explore Linux distributions from Mint and Ubuntu to Fedora, and how distro watch tracks releases; learn how apt and RPM manage software across GNOME, KDE, and Cinnamon.

Understand the difference between binary-based and source-based Linux distributions, including packaging like RPM and Debian, as well as Gentoo and Arch, with their build-from-source versus prebuilt options and dependency trade-offs.

Master Ubuntu package management with apt-get for install, update, upgrade, and dependency handling; use apt-cache search and apt-get remove on debian-based systems.

Learn how Red Hat package management uses yum to install, update, search, and remove packages, resolve dependencies, check mirrors, and manage RPM files.

Explore how the boot process starts with a POST, then firmware, and uses the master boot record or partition table to locate boot code and load the kernel with Grub.

Enable bios passwords and boot protections to prevent access after physical intrusion. Encrypt hard drives and lock servers or desktops to deter tampering.

Explore Grub, the key Linux bootloader, its stages, configuration files like grub.cfg and menu entries, and how to boot kernels with parameters, recovery mode, and single-user mode.

Learn to secure the boot manager by configuring grub with super users and passwords, editing the grub header, exporting environment variables, and running update grub to secure the boot menu.

Explore how the internet super server xinetd, also called inetd or Zion DX, configures services via service files, maps ports such as port 21 for ftp, and launches relevant daemons.

Explore run levels as groups of services and how to boot Linux into targeted configurations, examining rc startup directories, init.d scripts, and the ASCII order that launches or stops services.

Learn how systemd replaces run levels with targets, such as graphical and multi-user, using systemctl to view defaults, isolate targets, and set default boot targets.

Learn to secure grub by replacing clear-text passwords with a hashed sha-512 password using grub-mkpasswd-pbkdf2, update grub, and add a backup super user to test access.

Explore Lilo config to generate a basic Lilo configuration file and install Lilo into the master boot record, then compare Lilo with Grub as an older, less configurable option.

Learn to manage Linux services by inspecting the /etc/init.d scripts and using the service utility to start, stop, and check the status of daemons such as dbus and exim.

Learn to manage Linux services with system CTL, restarting, checking status, and enabling or disabling at boot. See how system CTL also handles devices and drivers for broader control.

Wrap services with TCP wrappers to enforce access control using hosts allow and hosts deny, defaulting to access granted if not listed, protecting plaintext services like Telnet or FTP.

Link services to ports and transport protocols, and use netstat to list listening ports and their processes, with examples like ssh on 22 and smtp on 25.

Configure postfix on linux to reduce information disclosure and prevent relaying. Set up postmaster and abuse aliases, enforce smtpd restrictions, enable rbl checks, and enable authentication.

Explore Apache configuration on Linux, including global settings, ports, virtual hosts, sites available and enabled, and SSL, with emphasis on document roots, logs, and modules.

Configure security directives in Apache to harden the server, hide version details by setting server tokens and server signature, disable trace, and control directory indices and modules.

Explore how Apache virtual hosts bind multiple domain names to a single IP, each with its own document root, log directives, and security settings, configured via the sites enabled directory.

Enable dnssec to sign your zone with an encryption key and exchange keys with other dns servers, improving zone security and validation.

Change the MySQL root password and rename root to new root, then flush privileges. Restrict access to localhost by binding to 127.0.0.1 on port 3306 and enable auditing logs.

Learn to lock down PostgreSQL by creating a login role with a password and an expiration date, and configure access controls to restrict databases, users, and addresses.

Learn to harden a Tomcat installation by securing the shutdown port with a strong passphrase, managing http/1.1 and ajp connectors, and replacing stack traces with a custom error page.

Learn how to harden a JBoss application server on CentOS by editing the configuration xml to disable verbose error fragments, hide server details, enable ssl, and disable the welcome content.

Explore mod_security as a web application firewall for Apache, utilizing the core ruleset, configuring for detection, and activating rules with audit logging.

Secure web server communications with ssl and tls on apache. Create a self-signed RSA 2048 certificate (SHA-1), place the key and cert, configure mod_ssl, and verify the tls connection.

Explore greylisting with Postgrey on Linux, configure Postfix with recipient restrictions and white lists, and use policy services to delay unfamiliar senders and reduce spam.

Explore how Linux systems generate and store log files in /var/log, configure syslog with facilities and severities, and use logs to diagnose daemon, mail, and auth events.

configure linux syslog to send all log messages to a remote server by adding destination lines with hosts and ports, protecting logs from local tampering by an attacker.

Learn to read linux log files in /var/log, understand log rotation, and interpret entries with timestamp, system name, and process data using a pager like less.

Learn to use Logwatch to parse log files, configure outputs (stdout, text, HTML, mail), enable archives for rotated logs, and summarize service activity for secure system monitoring.

Configure a local syslog server to listen for and store log messages, enabling log aggregation for a SIEM and centralized alerts for network attacks.

Explore how to read linux login history with utmp and wtmp using last and lastb, view failed logins with btemp, and use -f for historical records.

learn how linux antivirus uses clam av tools, including fresh clam for signature updates and clam scan for recursive scans, including full system scans with sudo.

Learn how Tripwire, a host-based intrusion detection system, protects critical system files by generating site and local encryption keys, configuring policy and database, and running checks to detect unauthorized changes.

Learn how to use Samhain for file integrity checking, initialize a baseline database, generate signatures, and run periodic checks to monitor changes in a host-based intrusion detection setup.

Learn how Prelude unifies alerts from intrusion detection systems, including Snort, into a single server using components like Prelude Correlate, Prelude Log Agent, Prelude Llml, and Prelude Manager.

Explore how Linux intrusion detection tools perform file integrity checks to detect rootkits. Configure Aide to initialize its database, run daily checks, and manage logs and cron scheduling.

Install and configure Snort on Linux (Ubuntu) to monitor network traffic with rule-based intrusion detection. Update rules with Pulled Pork and enable syslog and pcap outputs for analysis.

Configure snort's binary unified log with Barnyard Two to generate alerts and route them to syslog, databases, Prelude, or tcpdump formats readable by Wireshark.

Explore Snort graphical interfaces, including Norby, and learn how to navigate dashboards, queues, and signature data across events, sensors, and IPs, with notes on Linux packaging.

Snort captures packets around incidents, dumps them to var log snort as the unified log and to tcp dump logs, then opens them in Wireshark for detailed analysis.

Explore how rootkit hunter scans for rootkits and malware on Linux, reports findings, and guides updating, checking, and scheduling periodic scans with cron jobs.

Explore how Linux authenticates users by examining the ETSI files, including the password file, shadow file, and group file, detailing uid, gid, home, shell, and hashed passwords.

Create a Linux user with useradd, set a primary group, define a home directory with -d and -m, assign /bin/bash as the shell, and set the password with passwd.

Enforce password policy by configuring login defaults, pam rules with sha-512 and cracklib to verify complexity (two numbers, two lowercase letters, two symbols). Apply per-user shadow defaults and three retries.

Examines how administrators test password resilience by cracking hashes with John the Ripper, shadow data, word lists, and incremental mode to assess password strength.

Explore graphical user management in Ubuntu: create and manage local users and groups via system settings, including advanced options, password generation, and integration with LDAP or Active Directory.

Explore how AppArmor implements mandatory access controls through profiles that grant or deny program capabilities and file system access, contrasting with discretionary controls and improving security.

Learn Unix permissions by mapping read, write, and execute to user, group, and world; use chmod with 777 or 600 and verify with ls -l.

Learn how SELinux enforces mandatory access controls on Linux, manage enforcing versus permissive modes, boot-time configuration, and file context labeling using targets like MLS/MLRS on Red Hat.

Explore how Linux labels files beyond Unix permissions, using users, roles, and types; examine httpd content contexts and practice changing and restoring file contexts.

change the SELinux context of the indexed html to httpd_sys_content_t in the home directory, restore it with restorecon, and use semanage fcontext to make the change permanent.

Examine pluggable authentication modules (PAM) on Linux, review configuration files for ftp and ssh, and see how modules like lib pam unix, ldap, and winbind enable authentication and policy control.

Learn how to use net stat to view listening ports and active connections, use -a and -n for complete numeric output, and pipe to less for paging.

Monitor system processes in real time with top and list all processes with ps -e and ps -eaf, checking memory, swap, owner, pid, and status, with grep -v filtering.

Master process control by terminating unresponsive programs with kill by pid, sending signals such as 9, and using killall to stop all instances by name like Firefox.

Learn how to use nmap to perform port scans, including TCP syn scans, UDP scans, and OS detection, testing individual ports or entire networks.

Explore OpenVAS, a vulnerability assessment tool in Kali Linux, performing network scans to detect open ports and banner versions, review reports, and assess potential vulnerabilities without exploitation.

Explore the Nexpose community vulnerability scanner on Linux, set up a scan site with assets and credentials, note the 32-host limit, review pci, hipaa, and generate pdf reports with Metasploit.

Learn to locate files with the find utility, starting from a directory or root, search by name or type, and use quotes for pattern matching with -name, -type, and -not.

Learn how to capture packets with tcpdump on a console, filter by host or IP, save to a pcap file, and analyze headers for secure network monitoring.

Learn about Wireshark's graphical packet capture, view frames, IP and TCP headers, apply filters, and save or open pcaps for analysis.

Explore how lspci and lsusb reveal PCI and USB hardware on your system, showing host bridges, controllers, and plugged-in devices for practical troubleshooting.

Explore the linux kernel’s security role and how it interfaces hardware with user space, review kernel logs and boot messages, and learn to build a kernel for a hardened system.

Compare monolithic and modular kernels and see how a compressed kernel image loads into memory, while modules are managed with lsmod, insmod, and rmmod in /lib/modules.

Learn to view and modify kernel parameters, such as net.ipv4.ip_forward, using ctl, and make persistent changes by editing the ctl file and inspecting /proc for current values.

Figure out the current kernel and boot files, then configure and build the kernel, exploring the initial RAM disk, module loading, system map, and the linux headers and source.

Configure a custom linux kernel using menuconfig to select 64-bit or 32-bit builds and module options. Save the .config and run make to build, install, and boot the new kernel.

Pull the running kernel configuration from the system using /proc/configs or boot directory config files, then copy it into your Linux source and run make menuconfig, tweaking as needed.

Explore iptables as the Linux firewall, loading kernel modules and configuring rule sets. Learn to list and manage these rules with verbose output to understand the kernel-stored firewall.

Enable nat with iptables by configuring masquerade in the nat postrouting chain and forwarding related or established traffic between two interfaces. Persist net.ipv4.ip_forward to keep forwarding across reboots.

Explore how iptables organizes rules into four built-in tables—filter, nat, mangle, raw—and their chains like input, output, forward, and pre/post routing. See how default table choices influence rule placement.

Learn how to create iptables rules by matching on protocol, ports, tcp flags, udp, icmp types, and addresses to control traffic in the filter table.

This lecture demonstrates using iptables for rate limiting by matching tcp flags and limiting to one packet per second, including icmp echo requests and port scan protection.

Explore stateful iptables matching with new, established, and related connections, including how related connections attach to established ones via the state table, and how invalid states are handled.

Learn to handle matched packets by jumping to targets on the destination IP address within the input or the output chain, using accept, drop, and log.

Learn how iptables logs appear as kernel and syslog messages, detailing blocked multicast traffic with source and destination addresses, interface data, ports, TTL, and protocol information. Access requires administrative privileges.

Configure iptables to manage traffic across multiple interfaces by defining input and forward rules, addressing interface directionality, and applying port-based matches such as tcp with port 80.

Explore the graphical firewall interface to manage zones, services, ports, port forwarding, and masquerading, then distinguish in-memory runtime changes from permanent on-disk configurations.

Learn to configure firewall dx rich rules for IPv4, including service-based rules, source addresses with mask, rate-limited accepts, logging, and audit dx, and understand how complexity affects security.

Discover how ufw overlays iptables to simplify firewall management on ubuntu, enabling or disabling rules, viewing status, and opening or blocking ports such as 80, 8080, and the ssh service.

Learn about gufw, the graphical interface for ufw, and manage firewall rules with profiles, default policies, listeners, and a status log that shows executed commands.