Harden the Linux Web Server

Scenario

Copperline Tile Supply sells floor tile from one Ubuntu web server, copperline-web01. Priya Nair, an outside auditor, reviewed it last week and sent back this findings list: - Telnet answers on TCP port 23. Nobody has used it in years. - SSH accepts passwords. The baseline says PasswordAuthentication must be no. The team signs in with SSH keys. - netcat (the nc command) is installed, and nobody on the team knows who put it there. - /etc/shadow can be read by every account on the server. The baseline says it must be mode 640, owned by root, group shadow. - Root can sign in over SSH. The baseline says PermitRootLogin must be no. Close all five findings. Uninstall netcat; don't just hide the command. Root must not be able to sign in over SSH at all, with a password or with a key: set PermitRootLogin to no, not prohibit-password. Port 23 must be closed now and must stay closed after the server reboots. The SSH changes must be live on the running server, not only saved in a file. Two things must keep working: the shop's website, which Apache serves on TCP port 80, and SSH on port 22, which the team uses to run the server. The server is at its boot menu. Log in as Bench Technician with the password Tech!23; sudo asks for the same password. The Terminal is on the dock.

These instructions stay visible beside the lab while you work.You can reread these instructions in the lab at any time.