Host security

Fewer things running, fewer things reachable

A service that is not running cannot be exploited, so the first hardening step is always an inventory: systemctl list-units --type=service for what is running and ss -tulpn for what is listening. Disabling is two separate operations — systemctl stop ends it now, systemctl disable stops it starting at boot, and doing only one of them is a classic half-fix. The older inetd and xinetd super-servers started services on demand from /etc/inetd.conf or /etc/xinetd.d/, and are the answer when a question describes a service with no daemon of its own. On a SysV-init host the equivalent question about what starts at boot is answered by /etc/inittab, whose initdefault entry names the runlevel to enter when the kernel command line does not; a systemd host replaces that whole file with the default.target symlink.

The inventory is only useful once each socket has a name against it, and the flags that do it are worth learning as a set: -l for listening sockets, -t and -u to pick TCP or UDP, -n to keep addresses and ports numeric, and -p to attribute each socket to a process. The last one needs privilege — a socket owned by another user is anonymous otherwise — so sudo ss -ltnp is the invocation that answers "which daemon is holding 0.0.0.0:8080". netstat -ltnp is the net-tools spelling of the same thing, and lsof -i :8080 reaches it from the file-descriptor side.

TCP wrappers control access by host through /etc/hosts.allow and /etc/hosts.deny, with allow checked first and deny second; it is legacy but still examinable. A host firewall is the general answer, and it is worth being able to recognise iptables, nftables and the friendlier front ends firewalld and ufw by name.

xinetd carries its own access control, so a service it wraps can be filtered without TCP wrappers and without disabling it: only_from = 10.0.5.0/24 in that service's file under /etc/xinetd.d/ is the allow list, and no_access is the deny list; where an address matches both, the more specific mask wins. Do not confuse either with bind, which chooses which local address the service listens on rather than who may reach it.

Who may log in at all

/etc/nologin, when it exists, blocks every non-root login and prints its contents as the reason — the standard way to close a machine for maintenance. A shell of /sbin/nologin or /bin/false in /etc/passwd stops one account being used interactively while leaving it usable by a service, and the command that puts it there is usermod -s /sbin/nologin contractor: the account, its UID and its files are untouched, only the seventh field of its passwd line changes, and nobody else on the host is affected. That is the answer when a question bars ONE named account — touch /etc/nologin would bar everybody, and passwd -l is weaker than either, because locking the password leaves any non-password route in. /etc/securetty limits which terminals root may log in on directly, and disabling root logins over SSH (PermitRootLogin no in /etc/ssh/sshd_config) is the same idea for the network.

Password policy sits in /etc/login.defs and in the PAM stack, and chage enforces ageing per account. None of this is a substitute for the general rule the exam keeps returning to: give an account the least privilege that lets it do its job.

Password SHADOWING is assumed on any current system, and the commands that turn it on are still asked about, because an inherited host may not have it. /etc/passwd has to stay world-readable so that any program can map a UID to a name; the hashes must not be. pwconv is the shadow-suite command that reconciles the two — it creates or updates /etc/shadow from /etc/passwd, moving each hash out of the world-readable file and leaving an x behind. pwunconv is its inverse and puts the hashes back, and grpconv and grpunconv are the same pair for /etc/group and /etc/gshadow.