Linux hardening

Correct — The share is computed from /etc/machine-id, the source package name and the version, so identical builds can fall on either side of 75% for a few days.

Correct — The nightly job skips the package quietly. Record each hold with an owner and a date, and run apt-mark unhold as soon as a fixed version ships.

Correct — KSTA 1 means the running kernel is the newest one installed. Livepatch shows as available, but without Pro attached it patches nothing.

Correct — systemd-analyze cat-config shows 00-lima-enable-mdns.conf after Ubuntu's file. A 99- drop-in wins, and ss then prints only its header.

Correct — Recommended packages are installed by default and can include daemons. Add the ones you really want by name.

Correct — Mark the tools you use with apt-mark manual first, or keep ubuntu-standard and accept the FTP client.

Correct — Group rules and per-user files both grant sudo. The empty admin group would also make anyone added to it an administrator, so review all three.

Correct — L means locked (no usable password) and -1 means unset, so the account never ages out.

Correct — That is why the lab's sixth attempt, with the right password, got "The account is locked due to 5 failed logins."

Correct — Without enforce_for_root, root only sees the BAD PASSWORD message. The lesson's drop-in adds the option so root is held to the same rules.

Correct — That is the cost of the rule: with tar -cf (no compression) the backup works, and a tool that must start helpers should not get NOEXEC.

Correct — Rename it to 50-hard-sudo-ops; sudo -l -U then lists the rules. Names ending in ~ are skipped the same way.

Correct — 40-redhat-crypto-policies.conf is read after your file, and sshd keeps the first value for each keyword, so no later policy change reaches these ciphers.

Correct — Create the list first (ssh-keygen -k -f) and ship it together with the setting.

Correct — The requested command is passed in SSH_ORIGINAL_COMMAND for a forced program that wants to read it; df ignores it.

Correct — "max 1G" proves the drop-in was read, and "free" is what remains under that cap.

Correct — x509/name checks the name as well as the CA. Answering on the right address is not enough.

Correct — The NTS sources carry require and trust, so an unauthenticated server is used only when they agree; with them unreachable it waits (state W in chronyc(1)). Give the internal server NTS, or keep TCP 4460 and UDP 123 open.

Correct — audit 4 expands path and dir rules into system call lists, and auditctl -l shows what the kernel really enforces.

Correct — The reload applies auditd.conf and logs who did it. service auditd restart also works, through the package's legacy-actions script.

Correct — auid names the person who logged in, uid the effective identity, and the PATH record marks the file as created.

Correct — Run getcap over the same local filesystems, as the lesson's perms-snapshot does. A capability can be as strong as SUID root.

Correct — Ubuntu uses SGID shadow, RHEL a SUID root unix_chkpwd. The question is whether either has moved from its platform's shipped state.

Correct — If root copies it with cp -p to a mount without nosuid, the promotion returns, which is why the option belongs on mounts ordinary users can write.

Correct — The test mount failed and the kernel logged "ext4: Unknown parameter 'noexce'". Fix it, test again, back up fstab, then install.

Correct — The backup holds the old keyslot, which wraps the same volume key. Store header backups as carefully as the disk.

Correct — It picks costs for about two seconds per opening on that machine at that moment, with memory between 64 MiB and 1 GiB, so a stolen header is expensive to brute-force.

Correct — systemd creates /var/lib/hard-sandbox, owned by the dynamic user, and leaves the rest read-only.

Correct — Read the failure in journalctl -u, loosen the directive behind it, and test that the service still does its job.

Correct — systemd.exec(5) says environment variables are not suitable for secrets; move the token into a credential.

Correct — Arguments sit in /proc/PID/cmdline for local accounts to read; a file with the right owner and mode, or standard input, does not.

Correct — Call programs by absolute path in the script too, so the search order cannot redirect them.

Correct — On Ubuntu the file needs group crontab (root:crontab 0640). The CIS mode fits RHEL's cronie.

Correct — A fresh Ubuntu server has no host firewall until you add rules and run ufw enable.

Correct — The public zone's default target rejects what it does not allow, a faster and clearer failure than a timeout.

Correct — A dropped packet gets no answer, so the client retries until -w 3 runs out: three packets for each of the two ports.

Correct — Use systemd-run --on-active=5min nft -f /etc/nftables.conf to reload the known-good file, and stop the timer once the change works.

Correct — With all at 1, the 2 on eth0 makes loose mode apply to that interface alone.

Correct — That is why the lesson's file sets log_martians in all and default alone. OR is enough to switch something on, never to switch it off.

Correct — Both kernels start at 2 (CONFIG_BPF_UNPRIV_DEFAULT_OFF). 1 refuses the same calls and is a one-way latch.

Correct — 2 also protects group-writable sticky directories; pinning 1 on Ubuntu loosens it.

Correct — Write rules for modules that exist on the kernel and that the host does not need, such as can or sctp on Ubuntu.

Correct — With /bin/false, modprobe exits non-zero with an error, so an attempt to load the module is visible.

Correct — A running process keeps the confinement it started with, and the new profile applies from its next start.

Correct — Without auditd, AppArmor's records reach the kernel log as audit type=1400 lines.

Correct — Denials are only logged now, for every service on the host. Raise it as a finding and find out who switched it and why.

Correct — semanage fcontext -l -C lists it as a local customisation, so every future relabel agrees with it.

Correct — > in the size position means larger, m and c are the modification and change times, and H the content hashes.

Correct — aide.db.new is rewritten each day, while aide.db stays the baseline until a person copies the new file into place.

Correct — Run the comparison from another system or trusted boot media, with a database and an aide binary kept off the host.

Correct — Compare scores for the same profile over time, and read the failing rules rather than the number.

Correct — Files owned by configuration management or cloud-init get rewritten on their next run, and the two start to fight.

Correct — The lab scanned cis_server_l1; the profile named plain cis is Level 2 Server.