For Teachers · Back to the Module · Print with your browser's Print command.

P1 Teacher Answer Key: Linux Server Hardening

Teacher Answer Key (about 30 minutes, Practitioner level)

Name: ______________________ Class: __________ Date: __________

Read first: F1, F3

Learning Objectives

• [ ] Explain why unsupported releases and pending security updates are high risk.
• [ ] Recognise dangerous account, sudo and permission configurations.
• [ ] Explain what common kernel hardening parameters protect against.

Key Terms

Write each definition in your own words.

• End of Life: The date after which a product no longer receives security fixes from its maintainer.
• Patch Management: The process of finding, testing and installing software updates, especially security fixes.
• Least Privilege: Giving every account and process only the access it needs, nothing more.
• SUID: Set-user-ID: a file permission that makes a program run with its owner's privileges, often root.
• Sticky Bit: A permission on shared directories such as /tmp that stops users deleting each other's files.
• ASLR: Address space layout randomisation: the kernel places code and data at unpredictable memory addresses, which makes memory-corruption exploits harder.
• Hardening: Reducing a system's attack surface and weaknesses through configuration.

Lab Tasks

Use only the simulated lab or a machine your teacher has authorised.

1. Run: openvapt demo --only HOST- --out p1
2. For each failed HOST check, find the line in internal/lab/lab.go that differs between the vulnerable and hardened server.
3. On a test machine you own: sudo openvapt scan --only HOST- and compare.

Self-Check Questions

1. Why is an operating system past end of life high risk?

• [ ] a) It runs slower
• [x] b) New vulnerabilities in it will never be fixed
• [ ] c) It cannot run Go programs
• [ ] d) It cannot be backed up
• Answer: b. No more security fixes means every future flaw stays open forever.

1. An account named backup has UID 0. What does that mean?

• [ ] a) It is a normal user
• [x] b) It has full root privileges
• [ ] c) It cannot log in
• [ ] d) It is a system account with limited rights
• Answer: b. UID 0 is root regardless of the account name.

1. What does kernel.randomize_va_space = 2 provide?

• [x] a) Full address space layout randomisation
• [ ] b) Faster networking
• [ ] c) Disk encryption
• [ ] d) Kernel module signing
• Answer: a. Value 2 randomises the stack, shared libraries, the VDSO and the heap. Random addresses make memory exploits harder.

1. Why is a sudo rule marked NOPASSWD risky?

• [ ] a) It logs every command
• [x] b) Anyone who takes over that user gets root without knowing a password
• [ ] c) It disables sudo for that user
• [ ] d) It only works for root
• Answer: b. NOPASSWD turns any takeover of that user into instant root, which breaks least privilege.

1. What does the sticky bit on /tmp do?

• [ ] a) Makes files in /tmp permanent
• [x] b) Stops users deleting each other's files
• [ ] c) Stops programs running from /tmp
• [ ] d) Encrypts /tmp
• Answer: b. In a shared folder with the sticky bit, only a file's owner (or root) can delete or rename it.

1. Why is a SUID program in a web folder a warning sign?

• [x] a) It runs with its owner's rights, a classic privilege escalation trick
• [ ] b) It makes the site slower
• [ ] c) The web server cannot read SUID files
• [ ] d) It is the normal way to install web applications
• Answer: a. SUID programs run with their owner's rights. One placed where users or a web application can write is a common way to gain root.

Reflection

Which finding from this module would matter most on a server you are responsible for, and why?

________________________________________________________________

Sources

• NIST SP 800-123, Guide to General Server Security: https://csrc.nist.gov/pubs/sp/800/123/final
• NIST SP 800-40 Rev. 4, Enterprise Patch Management: https://csrc.nist.gov/pubs/sp/800/40/r4/final

Adapted from the OpenVAPT Academy (openvapt.com), built by AI Cybersecurity Engineers, used under the OpenVAPT Source-Available Licence 1.3. Free teaching use under TEACHING.md. Please cite OpenVAPT: see CITING.md or openvapt.com/cite.html. OpenVAPT is not affiliated with, and is not endorsed by, this institution or any third party named in this material. Pre-release versions may be wrong or unstable. Use at your own risk. If you adapt this material, say where you changed it.