Security

The module stack in /etc/pam.d decides whether to let a user in, which password to accept and when to lock them out.

The Linux firewall: filtering traffic with simple ufw and low-level nftables, checking the rules.

The classic Linux firewall — chains, rules, NAT, and why nftables replaced it.

Parts of root's rights: a process or a file gets only the one it needs, e.g. CAP_NET_BIND_SERVICE for a low port.

Unit settings that strip a service of root, system writes and new privileges; systemd-analyze security rates them.

Mandatory access control on Ubuntu — service profiles, enforce/complain modes.

A TLS certificate binds a server key to a site name; openssl reads its fields, checks the chain and issues a new one.

A fast VPN on a key pair instead of passwords; the private key in wg0.conf needs permissions, like an SSH key.

Grants temporary root rights via sudoers; edit the file only through visudo, or a mistake locks everyone out of sudo.

The visudo command edits /etc/sudoers and files in /etc/sudoers.d and refuses to save a rule with a grammar error.

GnuPG: GPG keys, encrypting files, signing and verifying, symmetric mode with a passphrase.

Kernel-level auditing — who did what and when; watch rules and event search.

The OpenSSH server; edit the config with a second session open — a mistake in PermitRootLogin locks you out immediately.

Ubuntu's service that installs updates from allowed origins once a day on an apt timer; by default only security ones.

Log-based banning — protecting SSH and services from brute force; jails, status, unban.