110.2 Setup Host Security

Introduction

This lesson is about reducing the attack surface of a Linux host.

The main question is:

How do you harden a Linux machine at the host level by controlling passwords, services, access rules, and basic daemon exposure?

What you should be able to do after this lesson:

• Understand shadow passwords.
• Recognize why unused network services should be disabled.
• Understand the purpose of /etc/nologin.
• Recognize the idea of TCP wrappers.
• Understand that some services are started on demand.
• Understand why host hardening begins with fewer exposed entry points.

Big Idea: Host Security Starts with Less Exposure

At beginner level, host hardening mostly means:

• store credentials securely
• expose fewer services
• block logins when appropriate
• avoid leaving old network services open

That is a much better mental model than trying to memorize every security file in one sitting.

Shadow Passwords

Linux systems separate public account information from protected password data.

Relevant files:

/etc/passwd
/etc/shadow

Simple idea:

• /etc/passwd must stay readable enough for the system to map user names and IDs
• /etc/shadow stores protected password hashes and aging data

Check the permissions:

ls -l /etc/passwd /etc/shadow

You should see that /etc/shadow is much more restricted.

Disable Unused Services

Every unused network service is one more thing that could be attacked.

That is why hardening often begins with:

• identifying what is listening
• deciding what is actually needed
• disabling what is not needed

Useful commands:

ss -tulpn
systemctl list-unit-files --type=service
systemctl list-units --type=service --state=running

Do not disable random services on a production host. But do understand the security principle:

• fewer services
• fewer open ports
• smaller attack surface

/etc/nologin

This file can temporarily block non-root logins.

Simple use case:

• maintenance window
• system recovery
• temporary administrative lockdown

If /etc/nologin exists, regular users are usually prevented from logging in and shown its message.

That makes it a very small but practical host-security tool.

Services Started on Demand

Not every service must run all the time.

Historically, some services were started only when a connection arrived. That means:

• less idle exposure
• less resource use

Names you may see here:

• xinetd
• systemd socket activation

LPIC expects awareness of this concept because it appears in service-management history and security design.

TCP Wrappers

TCP wrappers use:

/etc/hosts.allow
/etc/hosts.deny

They provide host-based allow and deny rules for supported network services.

Simple idea:

• allow certain clients
• deny others

This is not a complete firewall. It is an application-level access control method for supported daemons.

A Practical Hardening Order

For a small Linux host, a sensible order is:

1. confirm password hashes are protected in /etc/shadow
2. inspect open services
3. disable anything not required
4. review login restrictions
5. apply simple host-based restrictions where relevant

That is the core logic behind this objective.

Practice Step by Step

1) Check password storage files

1. Run: ls -l /etc/passwd /etc/shadow
2. Explain why the two files do not have the same permissions.

2) Inspect running and enabled services

1. Run: systemctl list-units --type=service --state=running
2. Then: systemctl list-unit-files --type=service
3. Identify one service you understand and whether it is enabled.

3) Inspect login blocking mechanisms

1. Run: ls -l /etc/nologin
2. If it exists, view it: sudo cat /etc/nologin
3. Learn to recognize its role without needing to enable it right now.

4) Check TCP wrapper files

1. Run: ls -l /etc/hosts.allow /etc/hosts.deny
2. If they exist, inspect them: sudo sed -n '1,80p' /etc/hosts.allow sudo sed -n '1,80p' /etc/hosts.deny
3. Remember that these rules affect only software that supports TCP wrappers.

Cheat Sheet

ls -l /etc/passwd /etc/shadow
ss -tulpn
systemctl list-unit-files --type=service
systemctl list-units --type=service --state=running
ls -l /etc/nologin
sudo cat /etc/nologin
ls -l /etc/hosts.allow /etc/hosts.deny
sudo sed -n '1,80p' /etc/hosts.allow
sudo sed -n '1,80p' /etc/hosts.deny

Legacy / Exam Note

TCP wrappers and some on-demand service models are older than many modern Linux setups. A lot of current systems rely more on systemd, firewalls, and service-specific access controls. For LPIC, you should still recognize hosts.allow and hosts.deny and know what they were used for.