Linux hardening

Start from a default Ubuntu Server 26.04 install and harden it one control at a time: patching, fewer services, accounts and PAM, sudo, SSH, trustworthy logs and auditd, file permissions, mounts and disk encryption, systemd sandboxing and secrets, host firewalls and nftables, kernel settings and modules, AppArmor and SELinux, integrity monitoring and CIS benchmarks. Every control states the threat it addresses, how to configure and verify it, what it costs in operation, and how to roll it back, with RHEL 10 shown wherever it differs. Twenty-four lessons across eight sections, each with a self-test, and a final exam.