Lab Scenario: Security Audit & System Hardening
You are a cybersecurity analyst at TechCorp Inc. The IT director has asked you to perform a security audit on a Ubuntu Linux server that will host sensitive customer data. Your task is to assess the current security posture and implement basic hardening measures to prepare the system for production deployment.
What You'll Learn & Accomplish:
- User Privilege Assessment: Verify current user permissions and understand privilege escalation risks
- Process Monitoring: Identify running services and potential security vulnerabilities
- Network Security Analysis: Discover open ports and network services that could be attack vectors
- Log Analysis: Review authentication logs to detect suspicious activities
- File System Hardening: Implement proper file permissions to protect sensitive data
Security Audit Tasks - Execute Each Command:
-
Verify User Identity: whoami
Purpose: Confirms your current user context and privilege level - essential for security assessments
-
Audit Running Processes: ps aux
Purpose: Identifies all running processes to detect unauthorized services or potential malware
-
Network Port Scanning: netstat -tuln
Purpose: Lists all open network ports to identify potential attack surfaces and unnecessary services
-
Authentication Log Review: tail -n 10 /var/log/auth.log
Purpose: Examines recent login attempts and authentication events to detect intrusion attempts
-
Secure File Permissions: chmod 755 /tmp/secure_file
Purpose: Sets proper file permissions (owner: read/write/execute, group/others: read/execute only)
Ubuntu Server 20.04 LTS - Security Lab Environment
Welcome to Ubuntu 20.04.3 LTS (GNU/Linux 5.4.0-74-generic x86_64)
*** System Information ***
Last login: Mon May 27 10:30:15 2025 from 192.168.1.100
Security Lab Environment Ready - Begin your audit!
student@security-lab:~$
_
student@security-lab:~$
Audit Progress: 0/5 security checks completed
Security Audit Complete! Skills Mastered:
System Administration
User privilege verification and process monitoring
Network Security
Port scanning and service identification
Log Analysis
Authentication log review and threat detection
File System Security
Permission management and data protection