1 Prerequisites This skill 2 Unlocked

Skill · Linux · Harden a Linux server against a baseline

Harden the running kernel: persistent sysctl parameters and blocked modules

Harden the running kernel: persistent sysctl settings for the kernel and network stack, and rarely needed modules blocked with modprobe.d.

Start lesson 1The Linux domain

• 2 lessons
• ~1 h 00 of reading
• 2 quizzes
• 0 proof lab

The path

Where it comes from, where it leads

What you need to know first, where you stand on this skill, and what it opens next. Your status is computed in your browser, from what you have read and passed.

Before · 1 prerequisite

• Manage users, permissions and processes

Recommended before · 2

• Filter a server's traffic with a host firewall, NAT included
• Administer a systemd service

This skill, for you

Harden the running kernel: persistent sysctl parameters and blocked modules

Computing

It unlocks · 2 skills

• Restrict and audit eBPF on a server: block unprivileged loading, delegate CAP_BPF, harden the JIT and inventory loaded programs
• Harden a NixOS server declaratively: versioned measures, test before switching, runtime checks and rollback to a healthy generation

Lessons

How to learn it

2 lessons, about ~1 h 00, in program order. Each lesson ends with its quiz.

The program

2 lessons · ~1 h 00

1. 1sysctl: harden the Linux kernel and network stack· 40 min
2. 2Désactiver des modules noyau inutiles sous Linux (in French)· 20 min

Beyond the lessons

Assess, practise, pass the proof

Reading a lesson confirms nothing. A skill is confirmed by a passed quiz, practised in a guided lab, and put to the test by a challenge or a mission; an imported lab result is not verified by the site.

Assess yourself

2 quizzes

At the end of the lessons: passed at 70%, they confirm the skill.

Practice

1 guided lab

• Harden kernel parameters persistently with sysctl.d

Proof

No proof

Neither a challenge nor a mission with a proof yet.

Around it

Who requires it, who teaches it

Required by

• Linux Administrator
• LFCS

In red: the certification it prepares for.

Taught by

• Durcissement Linux (in French)

Same block · Harden a Linux server against a baseline

• Measure a server's gap to a hardening baseline and prioritize the measures (ANSSI-BP-028, CIS)
• Harden a server's access and privileges: SSH, PAM, sudo, permissions and scheduling
• Harden boot, mounts and the local session: GRUB, nodev, nosuid, noexec, banners, dconf
• Confine a service: mandatory access control (SELinux or AppArmor), then systemd sandboxing
• Trace who did what on a Linux server with auditd: persistent rules, ausearch and aureport
• Rebuild a KSPP-hardened kernel and prove its options at boot
• Harden a NixOS server declaratively: versioned measures, test before switching, runtime checks and rollback to a healthy generation

×

See in the glossary →