Course Objective & Scope
Linux servers power the majority of enterprise workloads, cloud instances and container hosts; misconfigured firewall rules or over-privileged services can quickly lead to full host compromise. This hands-on course covers Linux network administration, packet filtering (nftables/iptables), secure remote access, kernel and filesystem hardening, Mandatory Access Control (SELinux/AppArmor) and auditing with auditd.
In the lab, participants harden a Linux server against CIS Benchmark guidelines, troubleshoot and inspect suspicious traffic using tcpdump and ss, and leave with a production server hardening checklist.
Who Should Attend?
- Linux system administrators and infrastructure engineers
- DevOps, SRE and platform engineers
- Cybersecurity specialists responsible for server hardening and infrastructure security
- Prerequisite: basic Linux command-line proficiency and TCP/IP networking knowledge
Key Takeaways
- Configure iproute2, routing, DNS, network namespaces and kernel network parameters (sysctl)
- Write stateful firewall and NAT rulesets using nftables and iptables
- Reduce the attack surface through SSH, sudo, PAM, file permissions and systemd service sandboxing
- Enforce process confinement using SELinux or AppArmor profiles
- Detect unauthorised activity and network anomalies with auditd, journald and tcpdump
Curriculum
Linux Network Stack, Configuration and Diagnostics
- iproute2, VLANs/bridges/bonding, routing tables and network namespaces
- Tuning network performance and TCP/IP security with ss, tcpdump, ethtool and sysctl
Firewall Management: nftables and iptables
- Netfilter architecture, tables/chains/rules and stateful packet filtering
- Rate limiting, port forwarding, packet logging and persistent firewall policies
Identity, SSH and Service Hardening
- SSH key/certificate authentication, bastion setups, PAM and sudo policies
- Auditing SUID/SGID binaries, filesystem mount options and systemd unit sandboxing
Mandatory Access Control: SELinux and AppArmor
- Limits of DAC and how MAC (SELinux contexts/booleans, AppArmor profiles) works
- Troubleshooting in enforcing mode (audit2allow) and confining critical daemons
Logging, Auditing (auditd) and Integrity Monitoring
- Monitoring critical files, syscalls and privilege use with the Linux Audit framework (auditd)
- CIS Benchmark compliance verification and an enterprise Linux hardening checklist
Other Courses in This Category
-
Static and dynamic malware analysis in isolated labs, PE/ELF inspection, behavioural monitoring, unpacking, code analysis with Ghidra and YARA rule authoring for security analysts.
- Live Course
- 5 modules
-
All 8 domains of the (ISC)² CISSP Common Body of Knowledge (CBK), risk and governance mindset, security architecture and scenario-based question analysis for experienced security professionals.
- Live Course
- 5 modules
-
The CIA triad, modern threat vectors, identity and access management, network security and baseline hardening practices for IT and software teams who need to identify and mitigate enterprise security risks.
- Live Course
- 5 modules
-
Identity, device posture, network micro-segmentation and continuous verification using NIST SP 800-207 and the CISA Zero Trust Maturity Model for infrastructure and security architects planning enterprise adoption.
- Live Course
- 5 modules
-
OWASP Top 10, threat modeling, secure coding, SAST/DAST/SCA integration and Secure SDLC controls for software and AppSec teams aiming to find and fix vulnerabilities before production.
- Live Course
- 5 modules
-
OWASP API Security Top 10, BOLA/BFLA, OAuth 2.1 and JWT security, GraphQL/gRPC attack surfaces and API gateway controls for engineering and security teams protecting enterprise APIs.
- Live Course
- 5 modules
Get in touch
