Garanti del Talento

dgt_sys04 – Security

Module Title: dgt_sys04 – Security

Overview:
The “dgt_sys04 – Security” module is designed to give students advanced knowledge of how Linux-based systems are secured and the practical judgement to secure them. The curriculum focuses on the critical security practices that ensure the integrity, confidentiality and availability of system resources. It combines the theoretical concepts with practical exercises to build a robust understanding of Linux security.

In this module the theory is non-negotiable, because in practice you will be the one approving security changes made by a machine. You will not edit sshd_config or write firewall rules by hand: you will tell the machine, in natural language, what the policy must be (key-only SSH on a non-default port, SELinux enforcing, only the required ports open) and then read every rule and configuration line it produces, checking that it does exactly that and does not lock you out or leave a gap open.

Module Objectives:
By the end of this module, participants will be able to:

  1. Understand the fundamental principles of Linux security.
  2. Have SELinux policies implemented and managed correctly, verifying that SELinux always stays enabled for optimal system protection.
  3. Specify firewall requirements and review the iptables rules the machine generates to create secure network environments.
  4. Direct the hardening of SSH daemon configurations to mitigate common vulnerabilities, and verify the result.
  5. Ensure password-based logins are disabled in favour of more secure authentication methods.
  6. Have the default SSH port changed to reduce unauthorized access attempts, understanding its real security value.
  7. Have SSH key-based authentication implemented and confirm it works before password access is removed.

Module Units:

  1. Introduction to Linux Security
  2. Overview of threats and vulnerabilities specific to Linux systems.

  3. Importance of maintaining a secure system environment.

  4. SELinux Fundamentals

  5. Introduction to SELinux (Security-Enhanced Linux).
  6. The significance of enabling SELinux for enforcing access controls.

  7. Natural-language exercises: asking the machine to configure and troubleshoot SELinux policies, then reading the contexts and denials it reports.

  8. Networking Security with iptables

  9. Basics of network packet filtering and the role of iptables.
  10. How rules protect against common network-based attacks, and how to read them.

  11. Lab sessions in which you describe a secure firewall setup to the machine and audit the ruleset it builds.

  12. Securing SSH Services

  13. Understanding potential vulnerabilities in SSH daemons.
  14. Configurations for hardening SSH, including disabling password authentication.
  15. Changing the default SSH port and its implications for security.

  16. SSH key-based authentication methods.

  17. Passwordless Authentication Strategies

  18. Exploring alternatives to traditional password logins.
  19. How SSH keys are generated and deployed, and how to check what the machine did at each step.

  20. Best practices for managing public and private keys securely.

  21. Advanced Security Measures

  22. Additional security enhancements such as fail2ban and auditing tools.
  23. Monitoring and logging techniques to detect suspicious activities.
  24. Continuous improvement strategies for maintaining system security.

Target Audience:
This module is intended for IT professionals, system administrators, network engineers and cybersecurity enthusiasts who are responsible for managing Linux-based systems. It assumes a basic understanding of Linux administration.

Prerequisites:
– Familiarity with the Linux command-line environment, enough to read commands and their output.
– Basic knowledge of networking concepts.
– Understanding of SSH fundamentals.

Module Format:
The module is delivered through interactive lectures, natural-language labs and real-world case studies. Participants will have access to virtual lab environments where they instruct the machine and verify its changes.

Assessment:
Participants’ understanding and skills will be evaluated through quizzes, lab assignments and a final project in which they guide the machine to secure a Linux system according to the principles taught in the module, and then demonstrate that every measure is in place and working.

The students can push their exercises to the Academy DevOps & SRE Git project. For this module, create a folder with your username as its name in the following subfolder: https://github.com/Garanti-Del-Talento/gdt_academy