- Lab
-
Libraries: If you want this lab, consider one of these libraries.
- Core Tech
Ubuntu Security Hardening
Harden an Ubuntu server across four defensive layers in one sitting. In this lab, you will: - lock down SSH with key-based authentication and `sshd_config` restrictions, - configure `fail2ban` to automatically block repeated failed login attempts, - enable the `ufw` firewall with rate-limited SSH and port-scoped allow rules, - define `auditd` rules to track `passwd` changes and `sudo` usage, - correlate security events with `ausearch`, `aureport`, and `journalctl`, and - work with AppArmor profiles by switching between `complain` and `enforce` modes, inspecting the audit trail with `ausearch -m AVC`, and refining profiles interactively with `aa-logprof`. You will finish with the practical skills needed to deliver a hardened Ubuntu server that can withstand an external security audit.
Lab Info
Table of Contents
-
Challenge
Harden SSH Access and Validate with fail2ban
To start things off, you will generate an ED25519 SSH key pair with
ssh-keygenand install it for theauditoruser. You will then harden the SSH daemon by writing a drop-in under/etc/ssh/sshd_config.d/that disables root login, disables password authentication, enforces anAllowUsersallow-list, and tightensMaxAuthTriesandLoginGraceTime. Next, you will validate the configuration withsshd -tandsshd -T, prove the policy with positive and negative login tests against/var/log/auth.log, and configurefail2banwith production-grade jail values to defend the system against brute-force attempts. -
Challenge
Enable UFW, Configure auditd, and Correlate Security Events
Next, you will configure a host firewall by setting a deny-by-default inbound policy with
ufw, opening only the ports the dashboard requires, applying SSH rate limiting withufw limit, and confirming the rules survive aufw reload. You will then write audit rules under/etc/audit/rules.d/that watch/etc/passwd,/etc/shadow, and/var/log/auth.logfor changes and log everyexecveof/usr/bin/sudo. After loading the rules withaugenrules --load, you will trigger each event class and correlate the trail both live withjournalctl -fand retrospectively withausearch,aureport,journalctl, and the auth log. -
Challenge
Manage AppArmor Profiles and Review Denial Logs
To finish things off, you will manage mandatory access control profiles with AppArmor. You will inspect the live posture with
aa-status, view the customnginxprofile, switch it between complain and enforce modes usingaa-complainandaa-enforce, and run a rogue script under the profile withaa-execto watch the kernel block forbidden operations. You will then examine the audit subsystem withausearch -m AVCfor the forensic trail, and close out by practicing theaa-logprofinteractive refinement workflow used in production to tune real profiles against real workloads.
Real skill practice before real-world application
Hands-on Labs are real environments created by industry experts to help you learn. These environments help you gain knowledge and experience, practice without compromising your system, test without risk, destroy without fear, and let you learn from your mistakes. Hands-on Labs: practice your skills before delivering in the real world.
Learn by doing
Engage hands-on with the tools and technologies you’re learning. You pick the skill, we provide the credentials and environment.
Follow your guide
All labs have detailed instructions and objectives, guiding you through the learning process and ensuring you understand every step.
Turn time into mastery
On average, you retain 75% more of your learning if you take time to practice. Hands-on labs set you up for success to make those skills stick.