--- title: "P1: Linux Server Hardening" canonical: https://openvapt.com/academy/p1.html html: https://openvapt.com/academy/p1.html site: OpenVAPT, https://openvapt.com/ license: OpenVAPT Source-Available Licence 1.3, https://openvapt.com/legal/licence-text.html modified: 2026-10-16 version: 0.1.0-alpha.6 --- # P1: Linux Server Hardening Patching, accounts, privileges, file permissions, scheduled jobs and kernel settings: the foundations of a defensible Linux server. - Level: Practitioner - Time: about 30 minutes - Read first: F1, F3 ## You Will Be Able To - Explain why unsupported releases and pending security updates are high risk. - Recognise dangerous account, sudo and permission configurations. - Explain what common kernel hardening parameters protect against. ## Patching and Support Lifecycles Most real-world compromises use vulnerabilities that already had a fix. A release past end of life receives no more fixes, so every new flaw stays open forever. Keeping a supported release and installing security updates promptly removes the largest class of risk on most servers. ## Accounts and Privileges Any account with user id 0 is root, whatever its name. Accounts with empty passwords can log in with nothing. Sudo rules marked NOPASSWD turn any takeover of that user into instant root. Each of these violates least privilege. ## Permissions, SUID and Cron World-writable files under /etc or in cron directories let any local user change what root runs. SUID programs run with their owner's rights; one placed in /tmp or a web folder is a classic privilege escalation trick. The sticky bit on /tmp stops users deleting each other's files. ## Kernel Hardening and Logging Kernel parameters such as address space layout randomisation, restricted kernel pointers and disabled ICMP redirects make exploitation harder. Persistent logs, an audit daemon and synchronised time are what let you investigate afterwards. Module P16 covers them in depth. ## In Summary Keep the release supported and patched. Watch for extra root accounts, NOPASSWD sudo rules and loose permissions. Kernel settings make exploitation harder. Logs and time sync let you investigate later. ## Apply It - [HOST-FS-001 Sensitive Account Files Have Unsafe Permissions](https://openvapt.com/checks/HOST-FS-001.md) (high) - [HOST-FS-002 Temporary Directory Missing the Sticky Bit](https://openvapt.com/checks/HOST-FS-002.md) (high) - [HOST-FS-003 World-Writable Files in System Configuration](https://openvapt.com/checks/HOST-FS-003.md) (high) - [HOST-FS-004 Unexpected SUID or SGID Programs](https://openvapt.com/checks/HOST-FS-004.md) (high) - [HOST-FS-005 Cron Files Writable by Non-Root Users](https://openvapt.com/checks/HOST-FS-005.md) (high) - [HOST-FS-006 Boot Loader Configuration Exposed](https://openvapt.com/checks/HOST-FS-006.md) (medium) - [HOST-FS-007 Private TLS Keys Readable by Others](https://openvapt.com/checks/HOST-FS-007.md) (high) - [HOST-FS-008 Temporary Filesystems Allow Executables or Devices](https://openvapt.com/checks/HOST-FS-008.md) (low) - [HOST-FS-009 Default File Creation Mask Too Permissive](https://openvapt.com/checks/HOST-FS-009.md) (low) - [HOST-FS-010 /var/tmp Not a Separate Filesystem](https://openvapt.com/checks/HOST-FS-010.md) (low) - [HOST-FS-011 /home Not a Separate Filesystem With nodev](https://openvapt.com/checks/HOST-FS-011.md) (low) - [HOST-FS-012 Log Directories on the Root Filesystem](https://openvapt.com/checks/HOST-FS-012.md) (low) - [HOST-FS-013 Temporary Filesystems Allow Executables](https://openvapt.com/checks/HOST-FS-013.md) (low) - [HOST-FS-014 World-Writable Files Outside Temporary Directories](https://openvapt.com/checks/HOST-FS-014.md) (medium) - [HOST-FS-015 Files With No Known Owner or Group](https://openvapt.com/checks/HOST-FS-015.md) (low) - [HOST-FS-016 SUID or SGID Programs Outside the Known Baseline](https://openvapt.com/checks/HOST-FS-016.md) (medium) - [HOST-FS-017 World-Writable Directories Without the Sticky Bit](https://openvapt.com/checks/HOST-FS-017.md) (medium) - [HOST-FS-018 Kernel Symbol Map or Initial RAM Disk Readable by Others](https://openvapt.com/checks/HOST-FS-018.md) (low) - [HOST-FS-019 Cron and At Not Restricted to Allowed Users](https://openvapt.com/checks/HOST-FS-019.md) (low) - [HOST-FS-020 Cron Configuration Readable by Other Users](https://openvapt.com/checks/HOST-FS-020.md) (low) - [HOST-FS-021 Shell Profile Sets a Permissive File Creation Mask](https://openvapt.com/checks/HOST-FS-021.md) (low) - [HOST-FS-022 Account Database Files or Their Backups Not Owned and Locked by Root](https://openvapt.com/checks/HOST-FS-022.md) (high) - [HOST-KRN-001 Address Space Layout Randomisation Not Fully Enabled](https://openvapt.com/checks/HOST-KRN-001.md) (medium) - [HOST-KRN-002 Kernel Pointers Exposed to Unprivileged Users](https://openvapt.com/checks/HOST-KRN-002.md) (low) - [HOST-KRN-003 Kernel Log Readable by Unprivileged Users](https://openvapt.com/checks/HOST-KRN-003.md) (low) - [HOST-KRN-004 Setuid Programs May Dump Core](https://openvapt.com/checks/HOST-KRN-004.md) (low) - [HOST-KRN-005 IP Forwarding Enabled](https://openvapt.com/checks/HOST-KRN-005.md) (low) - [HOST-KRN-006 ICMP Redirects Accepted](https://openvapt.com/checks/HOST-KRN-006.md) (low) - [HOST-KRN-007 Source-Routed Packets Accepted](https://openvapt.com/checks/HOST-KRN-007.md) (low) - [HOST-KRN-008 TCP SYN Cookies Disabled](https://openvapt.com/checks/HOST-KRN-008.md) (low) - [HOST-KRN-009 Unprivileged eBPF Allowed](https://openvapt.com/checks/HOST-KRN-009.md) (medium) - [HOST-KRN-010 Process Tracing Not Restricted](https://openvapt.com/checks/HOST-KRN-010.md) (low) - [HOST-KRN-011 Symlink Protection Disabled](https://openvapt.com/checks/HOST-KRN-011.md) (low) - [HOST-KRN-012 Hardlink Protection Disabled](https://openvapt.com/checks/HOST-KRN-012.md) (low) - [HOST-KRN-013 Reverse Path Filtering Disabled](https://openvapt.com/checks/HOST-KRN-013.md) (low) - [HOST-KRN-014 Martian Packets Not Logged](https://openvapt.com/checks/HOST-KRN-014.md) (low) - [HOST-KRN-015 Server Sends ICMP Redirects](https://openvapt.com/checks/HOST-KRN-015.md) (low) - [HOST-KRN-016 Broadcast ICMP Echo Answered](https://openvapt.com/checks/HOST-KRN-016.md) (low) - [HOST-KRN-017 IPv6 ICMP Redirects Accepted](https://openvapt.com/checks/HOST-KRN-017.md) (low) - [HOST-KRN-018 Performance Events Open to Unprivileged Users](https://openvapt.com/checks/HOST-KRN-018.md) (low) - [HOST-KRN-019 Magic SysRq Key Enabled](https://openvapt.com/checks/HOST-KRN-019.md) (low) - [HOST-KRN-020 FIFO Protection in Shared Directories Disabled](https://openvapt.com/checks/HOST-KRN-020.md) (low) - [HOST-KRN-021 Regular File Protection in Shared Directories Disabled](https://openvapt.com/checks/HOST-KRN-021.md) (low) - [HOST-KRN-022 Unprivileged User Namespaces Allowed](https://openvapt.com/checks/HOST-KRN-022.md) (low) - [HOST-KRN-023 IPv6 Source-Routed Packets Accepted](https://openvapt.com/checks/HOST-KRN-023.md) (low) - [HOST-KRN-024 Secure ICMP Redirects Accepted](https://openvapt.com/checks/HOST-KRN-024.md) (low) - [HOST-KRN-025 IPv6 Router Advertisements Accepted](https://openvapt.com/checks/HOST-KRN-025.md) (low) - [HOST-KRN-026 Bogus ICMP Error Responses Logged](https://openvapt.com/checks/HOST-KRN-026.md) (low) - [HOST-KRN-027 Kexec Kernel Replacement Allowed](https://openvapt.com/checks/HOST-KRN-027.md) (low) - [HOST-KRN-028 Unprivileged userfaultfd Allowed](https://openvapt.com/checks/HOST-KRN-028.md) (low) - [HOST-KRN-029 TTY Line Discipline Autoloading Enabled](https://openvapt.com/checks/HOST-KRN-029.md) (low) - [HOST-KRN-030 BPF JIT Hardening Off](https://openvapt.com/checks/HOST-KRN-030.md) (low) - [HOST-KRN-031 io_uring Open to Unprivileged Users](https://openvapt.com/checks/HOST-KRN-031.md) (low) - [HOST-MAC-001 No Mandatory Access Control Enforced](https://openvapt.com/checks/HOST-MAC-001.md) (low) - [HOST-OS-001 Operating System Past End of Security Support](https://openvapt.com/checks/HOST-OS-001.md) (high) - [HOST-PKG-001 Security Updates Waiting to Be Installed](https://openvapt.com/checks/HOST-PKG-001.md) (high) - [HOST-PKG-002 Repository Signature Checks Disabled](https://openvapt.com/checks/HOST-PKG-002.md) (high) - [HOST-PKG-003 Third-Party Package Repositories Present](https://openvapt.com/checks/HOST-PKG-003.md) (info) - [HOST-PKG-004 Many Old Kernels Retained](https://openvapt.com/checks/HOST-PKG-004.md) (low) - [HOST-PKG-005 Running Kernel Older Than Installed Kernel](https://openvapt.com/checks/HOST-PKG-005.md) (medium) - [HOST-PKG-006 Package Lists Not Refreshed Automatically](https://openvapt.com/checks/HOST-PKG-006.md) (low) - [HOST-SVC-001 Unnecessary Legacy Services Running](https://openvapt.com/checks/HOST-SVC-001.md) (low) - [HOST-SVC-002 Telnet Server Installed or Enabled](https://openvapt.com/checks/HOST-SVC-002.md) (medium) - [HOST-SVC-003 rsh, rlogin, rexec or finger Server Installed or Enabled](https://openvapt.com/checks/HOST-SVC-003.md) (medium) - [HOST-SVC-004 TFTP Server Installed or Enabled](https://openvapt.com/checks/HOST-SVC-004.md) (medium) - [HOST-SVC-005 FTP Server Installed or Enabled](https://openvapt.com/checks/HOST-SVC-005.md) (medium) - [HOST-SVC-006 NIS Server or Client Installed or Enabled](https://openvapt.com/checks/HOST-SVC-006.md) (medium) - [HOST-SVC-007 Avahi or CUPS Installed or Enabled](https://openvapt.com/checks/HOST-SVC-007.md) (low) - [HOST-SVC-008 NFS Server or rpcbind Installed or Enabled](https://openvapt.com/checks/HOST-SVC-008.md) (low) - [HOST-SVC-009 DHCP or DNS Server Installed or Enabled](https://openvapt.com/checks/HOST-SVC-009.md) (low) - [HOST-SVC-010 Samba File Server Installed or Enabled](https://openvapt.com/checks/HOST-SVC-010.md) (low) - [HOST-SVC-011 SNMP Agent or Squid Proxy Installed or Enabled](https://openvapt.com/checks/HOST-SVC-011.md) (low) - [HOST-SVC-012 inetd Super-Server Installed or Enabled](https://openvapt.com/checks/HOST-SVC-012.md) (low) - [HOST-UPD-001 Automatic Security Updates Not Configured](https://openvapt.com/checks/HOST-UPD-001.md) (low) - [HOST-UPD-002 Reboot Required to Apply Updates](https://openvapt.com/checks/HOST-UPD-002.md) (medium) ## Lab 1. `Run: openvapt demo --only HOST- --out p1` 2. `For each failed HOST check, find the line in internal/lab/lab.go that differs between the vulnerable and hardened server.` 3. `On a test machine you own: sudo openvapt scan --only HOST- and compare.` ## Check Yourself Answer keys are public for every channel (see Teaching With OpenVAPT). 1. Why is an operating system past end of life high risk? - A. It runs slower - B. New vulnerabilities in it will never be fixed - C. It cannot run Go programs - D. It cannot be backed up - Answer: B. No more security fixes means every future flaw stays open forever. 2. An account named backup has UID 0. What does that mean? - A. It is a normal user - B. It has full root privileges - C. It cannot log in - D. It is a system account with limited rights - Answer: B. UID 0 is root regardless of the account name. 3. What does kernel.randomize_va_space = 2 provide? - A. Full address space layout randomisation - B. Faster networking - C. Disk encryption - D. Kernel module signing - Answer: A. Value 2 randomises the stack, shared libraries, the VDSO and the heap. Random addresses make memory exploits harder. 4. Why is a sudo rule marked NOPASSWD risky? - A. It logs every command - B. Anyone who takes over that user gets root without knowing a password - C. It disables sudo for that user - D. It only works for root - Answer: B. NOPASSWD turns any takeover of that user into instant root, which breaks least privilege. 5. What does the sticky bit on /tmp do? - A. Makes files in /tmp permanent - B. Stops users deleting each other's files - C. Stops programs running from /tmp - D. Encrypts /tmp - Answer: B. In a shared folder with the sticky bit, only a file's owner (or root) can delete or rename it. 6. Why is a SUID program in a web folder a warning sign? - A. It runs with its owner's rights, a classic privilege escalation trick - B. It makes the site slower - C. The web server cannot read SUID files - D. It is the normal way to install web applications - Answer: A. SUID programs run with their owner's rights. One placed where users or a web application can write is a common way to gain root. ## Key Terms - End of Life: The date after which a product no longer receives security fixes from its maintainer. - Patch Management: The process of finding, testing and installing software updates, especially security fixes. - Least Privilege: Giving every account and process only the access it needs, nothing more. - SUID: Set-user-ID: a file permission that makes a program run with its owner's privileges, often root. - Sticky Bit: A permission on shared directories such as /tmp that stops users deleting each other's files. - ASLR: Address space layout randomisation: the kernel places code and data at unpredictable memory addresses, which makes memory-corruption exploits harder. - Hardening: Reducing a system's attack surface and weaknesses through configuration. ## References - [NIST SP 800-123, Guide to General Server Security](https://csrc.nist.gov/pubs/sp/800/123/final) - [NIST SP 800-40 Rev. 4, Enterprise Patch Management](https://csrc.nist.gov/pubs/sp/800/40/r4/final) Offline: `openvapt learn P1`. --- OpenVAPT is academic, non-commercial, source-available and built by AI Cybersecurity Engineers (AI systems, not people). Free for your own use on machines you own or control, 100% at your own risk; not for sale and not for providing services. This page in HTML: https://openvapt.com/academy/p1.html. Part of OpenVAPT Academy. How to cite: https://openvapt.com/cite.html. Site summary for models: https://openvapt.com/llms.txt.