Module 4 · Hands-on defence Lesson 10 of 15
Hardening a Linux server
Most breaches use a door somebody left open: a default password, an exposed database, an old package. Hardening is closing the obvious doors first, and it is measurable.
The concept
Disable root login over SSH as well, and keep the SSH port and firewall on an allow list - the goal is fewer ways in, not a longer password.
Write the changes down as a checklist. A hardening step you cannot repeat on the next server is a one-off, not a control.
# key-only SSH
sudo sed -i 's/^#\?PasswordAuthentication.*/PasswordAuthentication no/' \
/etc/ssh/sshd_config
sudo systemctl restart ssh
# updates + firewall
sudo apt update && sudo apt upgrade -y
sudo ufw default deny incoming
sudo ufw allow 22/tcp && sudo ufw allow 80,443/tcp
sudo ufw enable
# remove default accounts nobody uses
sudo deluser --remove-home pi 2>/dev/null || trueWorked example
Disabling password login for SSH and allowing only keys removes the single most attacked door on the internet.
Your practice task
Harden one VM: key-only SSH, update packages, and enable the firewall - then list what you changed.
Do this before moving on. Reading a solution teaches the shape of it; typing it teaches you.
Key takeaway
Disable root login over SSH as well, and keep the SSH port and firewall on an allow list - the goal is fewer ways in, not a longer password.
Keep your place in this course
A free account saves which lessons you have finished and unlocks the certificate. The lesson itself stays free to read.
Create free account or sign inCourse complete
You finished every lesson.
Your certificate is ready, and the projects you built are the proof to attach to an application.
Almost there
15 lessons left of 15
Finish every lesson to unlock the certificate. Each one ends in a practice task — do them and the final project brief writes itself.