OS hardening and security best practices in Operating Systems - Mini Project: Build & Apply

OS Hardening and Security Best Practices

📖 Scenario: You are a system administrator responsible for securing a company's servers. To protect the servers from unauthorized access and attacks, you need to apply basic OS hardening and security best practices.

🎯 Goal: Build a checklist of OS hardening steps and security best practices that can be applied to a server to improve its security.

📋 What You'll Learn

Create a list of common OS hardening steps with exact items

Add a configuration variable to set a security level

Use a loop to filter and collect only the best practices relevant to the chosen security level

Complete the checklist by adding a final summary statement

💡 Why This Matters

🌍 Real World

System administrators use OS hardening steps to protect servers from attacks and unauthorized access.

💼 Career

Understanding and applying OS security best practices is essential for roles in IT support, cybersecurity, and system administration.

1

Create the OS Hardening Steps List

Create a list called hardening_steps with these exact items: 'Disable unused services', 'Apply security patches', 'Configure firewall', 'Set strong passwords', 'Enable automatic updates'.

Operating Systems

# Create the list hardening_steps with the specified items
# Your code here

Hint

Use square brackets to create a list and include all items as strings separated by commas.

2

Set the Security Level Configuration

Create a variable called security_level and set it to the string 'medium'.

Operating Systems

hardening_steps = ['Disable unused services', 'Apply security patches', 'Configure firewall', 'Set strong passwords', 'Enable automatic updates']
# Set the security_level variable to 'medium'
# Your code here

Hint

Assign the string 'medium' to the variable security_level.

3

Filter Hardening Steps by Security Level

Create a new list called selected_steps that includes only these items from hardening_steps when security_level is 'medium': 'Apply security patches', 'Configure firewall', and 'Set strong passwords'. Use a for loop with the variable step to iterate over hardening_steps and add the matching items to selected_steps.

Operating Systems

hardening_steps = ['Disable unused services', 'Apply security patches', 'Configure firewall', 'Set strong passwords', 'Enable automatic updates']
security_level = 'medium'
selected_steps = []
# Use a for loop with variable step to add the specified items to selected_steps
# Your code here

Hint

Use a for loop to check each step and append only the allowed steps to selected_steps.

4

Add Final Summary Statement

Create a variable called summary and set it to the string 'Security checklist ready for medium level'.

Operating Systems

hardening_steps = ['Disable unused services', 'Apply security patches', 'Configure firewall', 'Set strong passwords', 'Enable automatic updates']
security_level = 'medium'
selected_steps = []
for step in hardening_steps:
    if step in ['Apply security patches', 'Configure firewall', 'Set strong passwords']:
        selected_steps.append(step)
# Create the summary variable with the specified string
# Your code here

Hint

Assign the exact string to the variable summary.

Practice

1. What is the main goal of OS hardening in computer systems?

easy

A. To increase the number of installed applications

B. To reduce security vulnerabilities by tightening system settings

C. To make the system run faster by removing hardware

D. To allow all users full access to system files

Solution

1. Step 1: Understand OS hardening purpose

   OS hardening means making the system more secure by reducing weak points.

2. Step 2: Evaluate options

   Only To reduce security vulnerabilities by tightening system settings describes reducing vulnerabilities by tightening settings, which matches OS hardening.

3. Final Answer:

   To reduce security vulnerabilities by tightening system settings -> Option B

4. Quick Check:

   OS hardening = reduce vulnerabilities [OK]

Hint: OS hardening means making system safer, not faster or more open [OK]

Common Mistakes:

• Confusing hardening with performance tuning
• Thinking hardening means adding more software
• Believing hardening allows more user access

2. Which of the following commands is commonly used to update software packages on a Linux system as part of OS hardening?

easy

A. apt-get update

B. rm -rf /

C. mkdir new_folder

D. ping google.com

Solution

1. Step 1: Identify update command

   On Linux, apt-get update refreshes package lists to get latest software versions.

2. Step 2: Check other commands

   rm -rf / deletes files dangerously, mkdir creates folders, ping tests network. Only apt-get update updates software.

3. Final Answer:

   apt-get update -> Option A

4. Quick Check:

   Update packages = apt-get update [OK]

Hint: Updating software uses package manager commands like apt-get update [OK]

Common Mistakes:

• Confusing file commands with update commands
• Using network commands for updating
• Not knowing package manager syntax

3. Consider this Linux command sequence for OS hardening:

sudo apt-get update && sudo apt-get upgrade -y

What is the expected result after running these commands?

medium

A. The system will remove all unused files

B. The system will restart immediately

C. The system will create a backup of all files

D. The system will update package lists and upgrade installed packages automatically

Solution

1. Step 1: Analyze apt-get update

   This command refreshes the list of available software packages and versions.

2. Step 2: Analyze apt-get upgrade -y

   This command upgrades all installed packages to the latest versions automatically without asking for confirmation.

3. Final Answer:

   The system will update package lists and upgrade installed packages automatically -> Option D

4. Quick Check:

   Update + upgrade = refresh + install latest [OK]

Hint: Update refreshes lists; upgrade installs new versions [OK]

Common Mistakes:

• Thinking upgrade deletes files
• Assuming commands create backups
• Believing system restarts automatically

4. A system administrator tries to disable unused services for OS hardening using this command:

systemctl disable sshd

But the SSH service still starts after reboot. What is the likely mistake?

medium

A. They forgot to mask the service with systemctl mask sshd

B. They should use systemctl stop sshd to stop the service immediately

C. They need to reboot twice for changes to apply

D. The service name is incorrect; it should be ssh instead of sshd

Solution

1. Step 1: Understand systemctl disable effect

   This command prevents the service from starting automatically but does not stop it if already running or mask it.

2. Step 2: Recognize masking necessity

   Masking a service with systemctl mask blocks all attempts to start it, including manual or dependency starts.

3. Final Answer:

   They forgot to mask the service with systemctl mask sshd -> Option A

4. Quick Check:

   Disable ≠ block start; mask blocks start [OK]

Hint: Disable stops auto-start; mask blocks all starts [OK]

Common Mistakes:

• Confusing disable with stop
• Not knowing mask blocks service fully
• Assuming reboot applies all changes immediately

5. You want to harden a Linux server by removing unnecessary user accounts and setting strong password policies. Which combination of actions best achieves this?

hard

A. Keep all default accounts and disable system updates to avoid changes

B. Create new user accounts with simple passwords and disable firewall

C. Delete unused user accounts, enforce password complexity via PAM modules, and set account lockout policies

D. Allow all users to use root privileges and disable password expiration

Solution

1. Step 1: Remove unused user accounts

   Unused accounts increase attack surface; deleting them reduces risk.

2. Step 2: Enforce strong password policies

   Using PAM modules to require complexity and setting lockout policies prevents easy guessing and brute force attacks.

3. Final Answer:

   Delete unused user accounts, enforce password complexity via PAM modules, and set account lockout policies -> Option C

4. Quick Check:

   Remove unused + strong passwords = better security [OK]

Hint: Remove unused accounts and enforce strong passwords [OK]

Common Mistakes:

• Creating weak passwords intentionally
• Allowing root access to all users
• Disabling updates or firewalls