Linux Essentials Preparation · lesson 20 of 23 · 25 min
Linux Security Fundamentals
Linux security is built on the principle of least privilege — every user and process should have only the minimum access needed. This lesson covers the key security concepts tested on the LPI Linux Essentials exam and foundational for any cybersecurity role.
Key Security Concepts
SSH Security
Firewall Basics
Log Files for Security
Package Security
Flashcard Drill
Least privilege Users and processes get only the minimum access needed — reduces blast radius. SSH key authentication Public key on server, private key on client — more secure than passwords. PermitRootLogin no SSH config setting that prevents direct root login via SSH. /var/log/auth.log Authentication log — SSH logins, sudo usage, failed attempts (Debian/Ubuntu). ufw Uncomplicated Firewall — easy iptables frontend for Ubuntu/Debian. Fail2ban Automatically bans IPs after repeated failed login attempts. journalctl Query the systemd journal — journalctl -u sshd shows SSH service logs. LUKS Linux Unified Key Setup — full disk encryption for Linux. apt upgrade Upgrades all installed packages to latest versions on Debian/Ubuntu. /etc/ssh/sshd_config SSH server configuration file — controls authentication, port, allowed users.
Worked Scenario: SSH Hardening
Scenario
A sysadmin needs to harden SSH on a new Ubuntu server. List the key configuration changes to make in /etc/ssh/sshd_config.
1. Disable root login: PermitRootLogin no — prevents direct root SSH access.
2. Use key authentication only: PasswordAuthentication no — eliminates brute-force password attacks.
3. Restrict users: AllowUsers alice bob — only these users can SSH in.
4. Change the port: Port 2222 — reduces automated scanning (security through obscurity, not a primary control).
5. Restart SSH: systemctl restart sshd — apply changes.
6. Install Fail2ban: apt install fail2ban — auto-bans IPs after repeated failures.
Knowledge Check — 12 Questions
Linux Security (Linux Essentials)
Which file controls SSH server configuration?
- /etc/ssh/ssh_config
- /etc/ssh/sshd_config
- /etc/sshd.conf
- /home/.ssh/config
Answer: /etc/ssh/sshd_config
/etc/ssh/sshd_config is the SSH daemon (server) configuration file.
Which log file on Ubuntu records SSH logins and sudo usage?
- /var/log/syslog
- /var/log/auth.log
- /var/log/kern.log
- /var/log/messages
Answer: /var/log/auth.log
/var/log/auth.log records authentication events on Debian/Ubuntu systems.
To prevent direct root login via SSH, set _____ no in sshd_config.
Answer: PermitRootLogin
PermitRootLogin no prevents the root account from logging in directly via SSH.
Which tool automatically bans IPs after repeated failed SSH login attempts?
- ufw
- iptables
- Fail2ban
- firewalld
Answer: Fail2ban
Fail2ban monitors log files and bans IPs that show signs of brute-force attacks.
SSH key authentication is more secure than passwords because:
- Keys are shorter
- Private keys never leave the client — cannot be brute-forced remotely
- Keys are stored in /etc/passwd
- Keys expire automatically
- Answer: Private keys never leave the client — cannot be brute-forced remotely
SSH key auth uses asymmetric cryptography — the private key never leaves the client, making remote brute-force impossible.
Which firewall tool is the default on Ubuntu/Debian?
- firewalld
- iptables
- ufw
- nftables
Answer: ufw
ufw (Uncomplicated Firewall) is the default firewall management tool on Ubuntu/Debian.
Running services as root is a security best practice.
- True
- False
Answer: False
Services should run as dedicated low-privilege accounts — if compromised, the attacker gets minimal access.
Which command queries the systemd journal for SSH service logs?
- cat /var/log/sshd
- journalctl -u sshd
- grep sshd /var/log/auth.log
- tail /var/log/secure
Answer: journalctl -u sshd
journalctl -u sshd queries the systemd journal for logs from the SSH service.
To upgrade all packages on Ubuntu, run apt _____.
Answer: upgrade
apt upgrade upgrades all installed packages to their latest available versions.
The principle of least privilege means:
- All users get admin access
- Users get only the minimum access needed for their job
- Root is disabled
- Passwords must be complex
- Answer: Users get only the minimum access needed for their job
Least privilege limits access to only what is necessary — reduces the impact of a compromise.
To disable password authentication in SSH (keys only), set which option in sshd_config?
- PermitRootLogin no
- PasswordAuthentication no
- PubkeyAuthentication no
- AllowUsers none
Answer: PasswordAuthentication no
PasswordAuthentication no disables password-based SSH login — only key authentication is allowed.
Which authentication log file is used on RHEL/CentOS (equivalent to auth.log)?
- /var/log/auth.log
- /var/log/secure
- /var/log/syslog
- /var/log/messages
Answer: /var/log/secure
/var/log/secure is the authentication log on RHEL/CentOS — equivalent to /var/log/auth.log on Debian/Ubuntu.
Previous lesson: Users and groups: useradd, usermod, userdel, passwd, id, /etc/passwd, /etc/shadow, sudo, wheel
Back to Linux Essentials Preparation
Next lesson: SSH: key-based authentication, sshd_config hardening, port forwarding, scp, sftp