Linux Security Fundamentals: Level up your security skills

Explore how PAM handles authentication on Linux systems, from storing passwords and grouping to managing users and groups. Enforce strong passwords and account lockout policies to secure your system.

Explore user management by inspecting /etc/passwd, /etc/shadow, and group files, examine password hashes and salt, configure test accounts, set passwords and shells, and assign supplementary groups to control access.

Explore Linux permissions and ownership, learn how to view and modify file access with owner, group, and world roles, using ls, chmod, and chown.

Explore how access control lists extend traditional UNIX permissions by enabling per-user entries with getfacl and setfacl, showing owner, group, and other permissions and practical examples.

Explore Linux file attributes, including the sticky bit on directories and executables, plus immutable and append-only attributes, to control who can modify or delete files and how writes occur.

Explore pam configuration with password quality and fail lock settings, adjust min length and complexity via credits or explicit rules, and observe fail lock and reset mechanics in pam_unix.

Learn how sudo enables fine-grained privileged access on Linux. Edit /etc/sudoers with visudo to validate syntax and define user, host, and command aliases.

Manage Linux firewall security with firewalld by configuring zones and zone-based rules and services across networks, and learn why host-based firewalls enhance security even when a dedicated firewall sits outside.

Configure firewall zones with firewall-cmd, assign interfaces to work, public, or home zones, and set rules with the permanent option to persist across reboots, noting the default zone is public.

Explore local and physical security basics for Linux, including securing the boot process, restricting removable media, enforcing session timeouts, encrypting data, and displaying login banners.

Lock down grub by creating a SHA-512 hashed password with PBKDF2, set a super user, and write the grub configuration to /boot to prevent attackers from altering boot parameters.

Learn how rsyslog collects and routes Linux logs using facilities and priorities, directing output to files or remote systems, with reliable, auditable logs for incident investigations.

Explore rsyslog defaults and logging rules, customize what logs are captured, and configure sending logs to a remote syslog server, with examples for var log messages and var log secure.

Learn how remote logging centralizes enterprise-wide log collection using rsyslog and tools like Logstash, enabling secure, auditable analysis across the network while configuring queuing and least-privilege operation.

Learn to deploy a rsyslog server in a secure lab: configure tcp-based log collection on port 514, enable queuing, enforce least privilege, and organize logs by host ip.

Demonstrates configuring an Rsyslog client for on-disk queuing, forwarding to an Rsyslog server over tcap, testing with the logger command, and ensuring message delivery even when the server goes down.

Learn how auditd monitors linux system activity with file watches and system-call rules, tracks file changes and permissions, and uses preconfigured audit rules for centralized log analysis.

Learn how auditd reporting turns raw logs into actionable insights by using reports and searches to summarize events, such as user logins and SE Linux failures.

Explore SELinux fundamentals, including mandatory access control, type enforcement, and domains, and learn how to troubleshoot without disabling SELinux, using audit logs and AVC denials.

Explore SELinux basics with tools, view contexts, domains, and types, and use getenforce and setenforce to toggle enforcing, permissive, or disabled modes while inspecting httpd and vsftpd policies.

Use audit2allow to generate SELinux policy modules that permit necessary actions after testing in permissive mode. Load and distribute the module to enable httpd access to /content.