Cyberstudy
Supplementary — not from your PDF Intermediate ~45 min

Audit and harden a Linux VM

Run the open-source auditing tool Lynis on your practice VM, fix a few of its findings, and re-run it to see the hardening index improve.

Environment

A Linux VM you own (Ubuntu/Debian). Install Lynis with sudo apt install lynis.

Before you start

  • Read Benchmarks and Secure Configuration Guides (p.246), Hardening Concepts (p.247) and Hardening Techniques (p.264).

You will

  • Produce a baseline audit
  • Fix findings and measure the improvement
  • Relate findings to benchmark guidance

Steps

  1. 1

    Snapshot the VM.

  2. 2

    Run sudo lynis audit system and note the 'Hardening index' near the end.

  3. 3

    Read the Warnings and Suggestions. Pick three you understand, such as installing security updates, disabling an unused service, or tightening SSH settings.

  4. 4

    Apply the fixes: sudo apt update && sudo apt upgrade, sudo systemctl disable --now <unused-service>, or edit /etc/ssh/sshd_config as in the SSH lab.

  5. 5

    Re-run the audit and compare the hardening index.

  6. 6

    Match two findings to the ideas on p.246–247: baselines, disabling unnecessary services, secure defaults.

Check your understanding

  • ?Why is a documented secure baseline better than hardening each server by hand?
  • ?What's the risk of an unused service left running?
  • ?Why snapshot before hardening?