Linux Security Hardening
Users, permissions, SSH, firewalls, logging and CIS benchmarks.
Taught by Kiran Basnet · Security Engineer
What you'll learn
- Audit a fresh Linux server with Lynis and turn the findings into a prioritised hardening plan
- Configure least-privilege user accounts, sudo rules and password policies that survive an audit
- Find and fix dangerous file permissions, SUID binaries and insecure mount options
- Secure SSH with key-only authentication, restricted users and fail2ban
- Build a default-deny host firewall with ufw or nftables and verify it from outside
- Collect security-relevant logs with auditd and journald and automate patching against CIS controls
About this course
Most servers, containers and cloud instances run Linux, and a default installation is far more open than it needs to be. This Linux security hardening course is for system administrators, DevOps engineers and developers who deploy to Ubuntu, Debian or RHEL-family servers and want a repeatable hardening checklist they can defend in an audit. You will lock down user accounts and sudo, fix file permissions and mount options, secure SSH with keys and fail2ban, build a default-deny firewall with ufw and nftables, capture the right events with auditd and journald, automate patching, and measure everything against the CIS benchmarks with Lynis and OpenSCAP. Every lesson ends with commands you can run on a test VM today. You should already be comfortable with the Linux command line, editing configuration files and basic networking; no prior security experience is needed.
Course content
7 lessons- 1The Hardening Mindset and Your BaselineUnderstand attack surface, meet the CIS benchmarks and run your first Lynis audit on a test server.Preview
- 2Users, Groups and sudoEnforce least privilege with personal accounts, tight sudoers rules, locked service users and password policy.
- 3File Permissions, SUID and Mount OptionsFix world-writable files, dangerous SUID binaries, umask defaults and the mount flags on temporary filesystems.
- 4Locking Down SSHKey-only logins, a hardened sshd_config, restricted users and fail2ban to stop brute-force noise.
- 5Host Firewalls with ufw and nftablesBuild a default-deny firewall, allow only what the server needs, and verify it from the outside.
- 6Logging and Auditing with auditd and journaldCapture logins, sudo, file changes and privileged commands, then ship logs somewhere attackers cannot reach.
- 7Patching, Services and Automating CIS ComplianceAutomate updates, disable unneeded services, harden the kernel and measure the result with OpenSCAP and Lynis.