HTB Academy - Linux Security

sudo apt update && sudo apt full-upgrade -y    # (aka dist-upgrade)
sudo apt autoremove --purge -y                 # clean unused

sudo dnf upgrade -y
sudo dnf autoremove -y

sudo apt install -y unattended-upgrades
sudo dpkg-reconfigure --priority=low unattended-upgrades

sudo apt install -y ufw
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow 22/tcp        # SSH
# sudo ufw allow 80/tcp      # HTTP (if needed)
# sudo ufw allow 443/tcp     # HTTPS (if needed)
sudo ufw enable
sudo ufw status verbose

sudo dnf install -y firewalld
sudo systemctl enable --now firewalld
sudo firewall-cmd --set-default-zone=public
sudo firewall-cmd --permanent --add-service=ssh
# sudo firewall-cmd --permanent --add-service=http
# sudo firewall-cmd --permanent --add-service=https
sudo firewall-cmd --reload

getenforce                       # Enforcing | Permissive | Disabled
sestatus

# /etc/selinux/config
SELINUX=enforcing
SELINUXTYPE=targeted

sudo setenforce 1               # switch to enforcing at runtime (if supported)

sudo seinfo -t httpd_t -x 2>/dev/null || true        # needs setools-console
# manage file contexts
sudo semanage fcontext -a -t httpd_sys_content_t "/srv/www(/.*)?"
sudo restorecon -Rv /srv/www
# toggle booleans (feature switches)
sudo getsebool -a | grep httpd
sudo setsebool -P httpd_can_network_connect on

sudo aa-status
sudo aa-enforce /etc/apparmor.d/*      # enforce loaded profiles
sudo aa-complain /etc/apparmor.d/abstractions/*  # tune in complain mode

# list local users (with shells)
awk -F: '$7 ~ /(bash|zsh|fish|sh)$/ {print $1 ":" $7}' /etc/passwd

# new user example (no sudo by default)
sudo adduser alice
# grant limited admin (create a bounded sudoers drop-in if needed)
echo 'alice ALL=(ALL:ALL) /usr/bin/systemctl restart myapp' | sudo tee /etc/sudoers.d/alice-myapp
sudo visudo -cf /etc/sudoers.d/alice-myapp     # validate syntax

sudo apt install -y libpam-pwquality
sudoedit /etc/security/pwquality.conf
# Recommended baseline
# minlen = 14
# dcredit = -1
# ucredit = -1
# lcredit = -1
# ocredit = -1
# maxrepeat = 3
# dictcheck = 1

# default for new users
sudo sed -i 's/^PASS_MAX_DAYS.*/PASS_MAX_DAYS   365/' /etc/login.defs
sudo sed -i 's/^PASS_MIN_DAYS.*/PASS_MIN_DAYS   1/'   /etc/login.defs
sudo sed -i 's/^PASS_WARN_AGE.*/PASS_WARN_AGE   14/'  /etc/login.defs

# per-user example
sudo chage -M 365 -m 1 -W 14 alice

# RHEL9+/Fedora, Debian 12+ typically have pam_faillock
sudo authselect enable-feature with-faillock 2>/dev/null || true
# Or edit /etc/pam.d/system-auth and password-auth (RHEL) or common-auth (Debian):
# auth required pam_faillock.so preauth silent deny=5 unlock_time=900
# auth [default=die] pam_faillock.so authfail deny=5 unlock_time=900
# account required pam_faillock.so

sudo cp /etc/ssh/sshd_config /etc/ssh/sshd_config.bak.$(date +%F)
sudo tee -a /etc/ssh/sshd_config >/dev/null <<'EOF'

# --- Hardening ---
Protocol 2
PermitRootLogin no
PasswordAuthentication no        # consider key-only if feasible
PubkeyAuthentication yes
MaxAuthTries 3
LoginGraceTime 30
ClientAliveInterval 300
ClientAliveCountMax 2
AllowUsers alice                  # limit if practical
EOF

sudo systemctl restart sshd

# journald + rsyslog present on most systems
systemctl is-enabled rsyslog 2>/dev/null || echo "rsyslog not installed"
sudo journalctl --disk-usage
sudo journalctl -p warning -xn

# log rotation
sudo ls /etc/logrotate.d/

# NTP
timedatectl status
sudo timedatectl set-ntp true                 # systemd-timesyncd
# or install chrony for servers
# Debian/Ubuntu: sudo apt install -y chrony
# RHEL/Fedora:   sudo dnf install -y chrony ; sudo systemctl enable --now chronyd

# list enabled units
systemctl list-unit-files --type=service | grep enabled
# stop + disable what you do not need
sudo systemctl disable --now cups.service avahi-daemon.service || true

# enumerate listening sockets
ss -tulpen

# enumerate SUID/SGID
sudo find / -xdev -type f \( -perm -4000 -o -perm -2000 \) -print 2>/dev/null

# remove SUID bit when not required
sudo chmod u-s /path/to/binary

# prefer capabilities over SUID when you must grant specific privileges
sudo getcap -r / 2>/dev/null | sort
sudo setcap cap_net_bind_service=+ep /usr/sbin/mydaemon  # example

# Patching
/usr/bin/env bash -c 'if command -v apt >/dev/null; then apt -s upgrade | grep -q "0 upgraded" || echo "Upgrades pending"; fi'

# Firewall
sudo ufw status 2>/dev/null || sudo firewall-cmd --list-all 2>/dev/null || echo "Check nftables/iptables"

# MAC
(command -v getenforce >/dev/null && getenforce) || (command -v aa-status >/dev/null && aa-status) || echo "No MAC module active?"

# Accounts
sudo awk -F: '$7 ~ /(bash|zsh|fish|sh)$/ {print $1}' /etc/passwd | wc -l
sudo grep -E "^[^#].*pam_faillock" -r /etc/pam.d/ 2>/dev/null || echo "No faillock?"

# Logging/Time
timedatectl status | sed -n '1,6p'
journalctl -p err -n 5 --no-pager