Security

File permissions

The Unix permission model — read/write/execute, owner/group/other, special bits.

sudo — running commands as another user

Grants temporary root rights via sudoers; edit the file only through visudo, or a mistake locks everyone out of sudo.

visudo — edit sudoers safely

The visudo command edits /etc/sudoers and files in /etc/sudoers.d and refuses to save a rule with a grammar error.

PAM: login checks, password policy and lockout

The module stack in /etc/pam.d decides whether to let a user in, which password to accept and when to lock them out.

Users and groups

Linux accounts and groups; usermod -G without -a replaces all of a user's supplementary groups instead of adding one.

Firewall — nftables / ufw

The Linux firewall: filtering traffic with simple ufw and low-level nftables, checking the rules.

useradd — create a user

The useradd command creates a user account with a home directory, shell, groups and UID; passwd sets the password.

passwd — change or lock a password

The passwd command changes your own password; as root it sets, locks and shows the passwords of other users.

usermod — change an account and its groups

The usermod command changes an existing account — groups, login shell, home directory, name and locking.

The classic iptables firewall

The classic Linux firewall — chains, rules, NAT, and why nftables replaced it.

auditd — security auditing

Kernel-level auditing — who did what and when; watch rules and event search.

ssh, scp — connecting and copying over SSH

A client for logging in and copying files over SSH; host aliases in ~/.ssh/config remove repeated connection parameters.

sshd — the SSH server

The OpenSSH server; edit the config with a second session open — a mistake in PermitRootLogin locks you out immediately.

Special permission bits: setuid, setgid, sticky

Special permission bits: setuid and setgid run a program as its owner; setgid and sticky shape shared directories.

Capabilities: root split into parts

Parts of root's rights: a process or a file gets only the one it needs, e.g. CAP_NET_BIND_SERVICE for a low port.

SSH keys and ssh-agent

Key pairs for passwordless login; sshd rejects ~/.ssh if it is writable by the group or by others.

Extended permissions (ACL)

Flexible rights beyond rwx — getfacl/setfacl, per-user and per-group grants.

ssh-keyscan — collecting host keys

Pre-populate known_hosts with server keys — skip the interactive "yes" on first ssh.

Service hardening: User=, ProtectSystem, NoNewPrivileges

Unit settings that strip a service of root, system writes and new privileges; systemd-analyze security rates them.

AppArmor

Mandatory access control on Ubuntu — service profiles, enforce/complain modes.

nmap: which ports are visible from outside

A port scanner: shows which ports of a machine are open, closed or filtered, as another machine sees them.

restic — deduplicated backups

Incremental encrypted backups with snapshots; without the password the repository cannot be decrypted at all.

unattended-upgrades: security updates with no one at the keyboard

Ubuntu's service that installs updates from allowed origins once a day on an apt timer; by default only security ones.

fail2ban

Log-based banning — protecting SSH and services from brute force; jails, status, unban.

GPG — encryption and signatures

GnuPG: GPG keys, encrypting files, signing and verifying, symmetric mode with a passphrase.

TLS and certificates — openssl, the chain, verification

A TLS certificate binds a server key to a site name; openssl reads its fields, checks the chain and issues a new one.

WireGuard — VPN on keys

A fast VPN on a key pair instead of passwords; the private key in wg0.conf needs permissions, like an SSH key.