I85PREP
⌘ K
LPIC-3 Security study materials
LPIC-3 Security study resources

LPIC-3 Security: Host Security

LPIC-3 Security · Work through your exam, one topic at a time.

All guide sections

Host Security

Host security covers hardening a running Linux system: storage and boot integrity, minimal services, strong authentication, and evidence you can audit later.

Core rules

  • Reduce attack surface: list listeners with ss -tulpn, then systemctl disable --now, systemctl mask, and remove packages rather than just stopping units.
  • Partitioning and mount options: separate /var, /var/log, /home, /tmp; use noexec,nosuid,nodev on /tmp and removable media.
  • Disk encryption with LUKS2: cryptsetup luksFormat, luksOpen, an entry in /etc/crypttab, a filesystem UUID in /etc/fstab, plus a header backup. Regenerate the initramfs after editing crypttab.
  • SSH: PermitRootLogin no, PasswordAuthentication no, AllowUsers/AllowGroups, bounded MaxAuthTries; run sshd -t before reload. Home directory 700, authorized_keys 600.
  • sysctl hardening persisted in /etc/sysctl.d/: kernel.kptr_restrict=2, kernel.dmesg_restrict=1, net.ipv4.conf.all.rp_filter=1.
  • Auditing: auditd rules for privileged execution, persistent journald (Storage=persistent), and an AIDE database captured from a known-good state.

Worked example

Encrypting a data volume: cryptsetup luksFormat /dev/vdb1, cryptsetup luksOpen /dev/vdb1 data, mkfs.xfs /dev/mapper/data. Then /etc/crypttab: data UUID=<luks-uuid> none luks and fstab references /dev/mapper/data.

Reasoning: crypttab must reference the LUKS container UUID (from cryptsetup luksUUID), not the filesystem UUID, otherwise unlocking fails at boot; none means prompt for a passphrase, or supply a key file with restrictive permissions.

Traps

Locking yourself out of SSH - keep a second session open; setting noexec on /home and breaking user tooling; forgetting dracut -f or update-initramfs -u after crypttab changes; using chmod 777 as a fix; leaving a LUKS key file world-readable.