Skip to content

Linux hardening

A default install trusts everyone. This is the hands-on hardening path: lock down access (SSH, keys, PAM, sudo), cut the network attack surface (nftables default-deny, network sysctls, fewer services), harden the kernel and filesystem (sysctl, module blacklists, mount options), enforce mandatory access control (SELinux and AppArmor), and prove it with auditing, integrity monitoring, and CIS benchmarks. Sixteen lessons across five sections, each ending with a self-test.

Intermediate5 sections · 16 lessons · ~5h total · 50-question self-test

01

Access hardening

5 lessonsTest yourself

01SSH hardeningKeys only, no root, minimal exposure.14 min 02Keys, MFA & bastionsStrong auth and a single front door.12 min 03Accounts & PAM policyPassword rules, lockout, and login limits.12 min 04Hardening sudoNarrow rules, logging, and the escape hatches.10 min 05Scheduled-task hardeningcron & timer privilege boundaries and PATH hijack.12 min

02

Network hardening

3 lessonsTest yourself

01A default-deny firewall (nftables)A host firewall you can actually read.14 min 02Network kernel hardening (sysctl)No forwarding, no redirects, sane defaults.12 min 03Minimize services & exposureEvery listener you remove is risk removed.10 min

03

Kernel & filesystem

3 lessonsTest yourself

01Kernel & memory hardening (sysctl)ptrace, dmesg, kptr, and friends.12 min 02Kernel module controlBlacklist what you never load.10 min 03Mount options & filesystemnoexec, nosuid, nodev where they belong.12 min

04

Mandatory access control

2 lessonsTest yourself

01SELinux in enforcing, calmlyRead denials, write targeted modules, never disable.16 min 02AppArmor profilesPath-based confinement, complain to enforce.12 min

05

Audit & compliance

3 lessonsTest yourself

01auditd rules that matterIdentity files, privileged execs, module loads.14 min 02File integrity monitoringAIDE: know when the system changes.10 min 03CIS benchmarks with OpenSCAPScan, remediate, and track drift.12 min

Progress is saved in this browser only — no account required.

Final exam

Test yourself on everything

50 questions drawn from all 5 sections — every answer explained as you pick.

Start final exam