Harden a Linux server, and prove it worked
This is the defend side of the track. You stand up a deliberately weak Linux server in a container on your own machine, measure how exposed it is with a real scanner (nmap), then apply the hardening a professional would: key-only SSH with no root login, a firewall, fail2ban, removing services you do not need, and automatic security updates. The proof is the before and after: the same scan that found three open ports and password logins returns one open port and refuses passwords once you are done. Everything happens against your own practice box in Docker, never anyone else's machine. It pairs with the Build a hacking lab and Burp lessons: those teach you to attack, this teaches you to close the doors.
- Docker, on Windows, macOS or Linux. If you did the Build a hacking lab lesson you already have it and know the basics; if not, that lesson installs Docker Desktop and explains containers and networks first. This mission assumes you can run
dockercommands - You run everything from a Linux-style terminal. On Windows that means WSL2 (the slim Linux built into Windows), because both Docker and the scanner live there and the scanner needs to reach the container's own address. On Linux or a Mac, your normal terminal is that place
- nmap, the scanner, installed in that same terminal. Step 3 installs it in one line (
sudo apt install nmap). It is free and open source - About 1GB of free disk space for the Ubuntu container image and the tools installed inside it
The idea: shrink what an attacker can reach
Understand attack surface and defence in depth before you build anything, and fix in your mind that this only ever happens on your own box.
Every program on a server that listens for connections from the network is a door. Some doors you need (the one people use to reach your website). Many you forgot were ever open. The sum of all those doors, every open port, every running service, every account that can log in, is the server's attack surface: everything an attacker could possibly try to push on. Hardening a server is mostly one idea, made concrete in a dozen ways: make that surface as small as you can, so there is less to attack in the first place.
A port is a numbered doorway on a machine, one per service. A web server usually waits on port 80, a secure web server on 443, SSH (the remote-login service) on port 22. When a port is open, something behind it is listening and will answer. A scan of a machine is really a knock on every numbered door to see which ones answer, and that list of answers is the attack surface seen from outside.
The second idea runs through the whole lesson: defence in depth. It means not relying on any single wall. You turn off password logins, and you also put up a firewall, and you also run fail2ban, and you also remove services you do not use. If one layer fails or is misconfigured, the next still stands. No single step here is the answer; the stack of them is.
A related habit is least privilege: give every account and every service the least power it needs to do its job, and no more. A login that cannot become the all-powerful root user is far less useful to an attacker who steals it. You will see this when you stop root from logging in over the network: admins log in as an ordinary user and step up with
sudoonly when they must.CarefulEverything in this mission is done against a practice server you build yourself, running in a container on your own machine. Scanning or probing a server you do not own or have written permission to test is a criminal offence in the UK (the Computer Misuse Act 1990) and almost everywhere else, even with no damage done and even if you were only looking. A scanner like nmap pointed at someone else's machine is exactly that kind of probing. Keep it on your own box.TipThe same rule as the Build a hacking lab lesson applies, from the other direction. There you only attacked software built to be attacked. Here you only defend a box you own. Before any command touches anything, ask: do I own this? For the whole of this mission the answer is yes, because you are about to build it.