Skill · Linux · Harden a Linux server against a baseline
Harden a NixOS server declaratively: versioned measures, test before switching, runtime checks and rollback to a healthy generation
Write a NixOS server's hardening in a versioned module, activate it with nixos-rebuild test before making it permanent, prove each measure on the machine, then roll back to a healthy generation if a measure breaks the system.
Start lesson 1The Linux domain
- 2 lessons
- ~1 h 15 of reading
- 3 quizzes
- 0 proof lab
The path
Where it comes from, where it leads
What you need to know first, where you stand on this skill, and what it opens next. Your status is computed in your browser, from what you have read and passed.
Before · 2 prerequisites
- Describe a reproducible environment in Nix: shell.nix, flakes and NixOS configuration
- Harden the running kernel: persistent sysctl parameters and blocked modules
Recommended before · 5
- Harden a server's access and privileges: SSH, PAM, sudo, permissions and scheduling
- Harden boot, mounts and the local session: GRUB, nodev, nosuid, noexec, banners, dconf
- Trace who did what on a Linux server with auditd: persistent rules, ausearch and aureport
- Confine a service: mandatory access control (SELinux or AppArmor), then systemd sandboxing
- Measure a server's gap to a hardening baseline and prioritize the measures (ANSSI-BP-028, CIS)
This skill, for you
Harden a NixOS server declaratively: versioned measures, test before switching, runtime checks and rollback to a healthy generation
Computing
It unlocks · nothing yet
No other skill requires it: it is an end-of-path skill.
The path through the foundations From the most upstream foundation to this skill: what is in place, what remains to read.
Lessons
How to learn it
2 lessons, about ~1 h 15, in program order. Each lesson ends with its quiz.
The program
2 lessons · ~1 h 15
Beyond the lessons
Assess, practise, pass the proof
Reading a lesson confirms nothing. A skill is confirmed by a passed quiz, practised in a guided lab, and put to the test by a challenge or a mission; an imported lab result is not verified by the site.
Assess yourself
3 quizzes
At the end of the lessons: passed at 70%, they confirm the skill.
Practice
No guided lab
No guided lab practices it yet.
Proof
No proof
Neither a challenge nor a mission with a proof yet.
Apply it on real infrastructure
Hands-on lessons: their labs count as practice and their quizzes assess you, without being required to acquire it.
Placement test
Preparing the questions…
Your answers in detail
For each question asked: your answer, the correct answer, its explanation and the page to reread.
Around it
Who requires it, who teaches it
Required by
Taught by
Same block · Harden a Linux server against a baseline
- Measure a server's gap to a hardening baseline and prioritize the measures (ANSSI-BP-028, CIS)
- Harden a server's access and privileges: SSH, PAM, sudo, permissions and scheduling
- Harden boot, mounts and the local session: GRUB, nodev, nosuid, noexec, banners, dconf
- Harden the running kernel: persistent sysctl parameters and blocked modules
- Confine a service: mandatory access control (SELinux or AppArmor), then systemd sandboxing
- Trace who did what on a Linux server with auditd: persistent rules, ausearch and aureport
- Rebuild a KSPP-hardened kernel and prove its options at boot