110.1 Perform Security Administration Tasks

Introduction

This lesson is about the everyday security checks a Linux administrator should be able to perform.

The main question is:

What routine security tasks help you reduce risk on a Linux system, and which commands should you know to inspect users, privileges, open services, and password aging?

What you should be able to do after this lesson:

• Inspect open ports and listening services.
• Find SUID and SGID files.
• Understand password aging basics.
• Use sudo safely and know why visudo matters.
• Inspect login history and current sessions.
• Understand shell limits with ulimit.

Big Idea: Security Administration Is Mostly Careful Inspection

At LPIC-1 level, security work is less about advanced cryptography and more about good habits:

• know who can log in
• know which services are exposed
• know which files run with special privileges
• know when passwords expire
• know who has administrative access

That is the level of thinking you want here.

Open Ports and Listening Services

Network exposure is one of the first things to inspect.

Useful commands:

ss -tulpn
sudo ss -tulpn

If nmap is installed, a safe beginner test is scanning localhost:

nmap localhost

That helps you answer:

• which ports are listening?
• are they TCP or UDP?
• which process owns them?

SUID and SGID Files

Some executable files run with the permissions of the file owner or group.

These special mode bits are:

• SUID
• SGID

Why this matters:

• they are sometimes necessary
• they also deserve extra security attention

Find SUID files:

find / -perm -4000 -type f 2>/dev/null

Find SGID files:

find / -perm -2000 -type f 2>/dev/null

You do not panic when you find them. You inspect whether they are expected.

Password Aging

Password aging policies reduce the chance that old credentials stay valid forever.

Useful command:

chage -l <user>

This shows information such as:

• last password change
• minimum days
• maximum days
• warning period

Change password aging:

sudo chage -M 90 -W 7 <user>

The main beginner idea:

• passwd changes the password itself
• chage changes password aging policy

sudo and visudo

Administrative access should be controlled carefully.

Important rules:

• use sudo for privileged commands
• edit sudo policy with visudo, not a normal editor

Show sudo version and policy basics:

sudo -V
sudo -l

The file you should know:

/etc/sudoers

And often:

/etc/sudoers.d/

Session and Login Inspection

Useful commands:

who
w
last

These answer different questions:

• who is logged in now?
• what are they doing?
• who logged in recently?

This is basic but practical security awareness.

Shell Limits with ulimit

ulimit controls resource limits for the shell and processes started from it.

Show current limits:

ulimit -a

Examples of things limits can affect:

• number of open files
• core dump creation
• process counts

You do not need deep tuning yet. You do need to know that limits are one part of basic system hardening and stability.

A Simple Security Check Routine

On a small Linux host, a sensible routine is:

1. inspect listening services
2. review privileged access
3. inspect password aging
4. check current and recent logins
5. review SUID and SGID files

That is exactly the kind of practical order LPIC likes.

Practice Step by Step

1) Inspect listening services

1. Run: ss -tuln
2. If you have sudo, run: sudo ss -tulpn
3. Identify one listening service and its port.

2) Inspect password aging

1. Run: sudo chage -l $USER
2. Note:
   • maximum password age
   • warning period

3) Review current and past logins

1. Run: who
2. Then: w
3. Then: last | head
4. Compare what each command tells you.

4) Find privileged executables

1. Run: find /usr /bin /sbin -perm -4000 -type f 2>/dev/null | head
2. Then: find /usr /bin /sbin -perm -2000 -type f 2>/dev/null | head
3. Notice that special bits are not rare, but they do deserve attention.

Cheat Sheet

ss -tuln
sudo ss -tulpn
nmap localhost
find / -perm -4000 -type f 2>/dev/null
find / -perm -2000 -type f 2>/dev/null
sudo chage -l <user>
sudo chage -M 90 -W 7 <user>
sudo -l
who
w
last
ulimit -a