CoreQ Academy My progress
READDEMOGUIDED LABINDEPENDENT LABQUIZREVIEW
Module 7 of 7 · 30 min

Capstone: harden the server

Intermediate · 3/5

Written by CoreQ Academy (drafted with AI assistance). Awaiting review by Sean Ofodile.

You will be able to
  • Combine log analysis, file editing and permissions
  • Harden SSH against brute force
  • Document an incident clearly

Bringing it together

You found brute-force attempts earlier. Now close the doors they were trying: disable root login over SSH, require keys instead of passwords, make sure only root can change the SSH config, and write a short incident note.

Editing in place

sed -i 's/old/new/' FILE replaces text in a file. Always check with grep afterwards.

$ sudo sed -i 's/PermitRootLogin yes/PermitRootLogin no/' /etc/ssh/sshd_config
$ grep PermitRootLogin /etc/ssh/sshd_config

Demo: try these in the terminal

cat /etc/ssh/sshd_configsee the current settings
ls -l /etc/ssh/sshd_configcheck ownership and mode

Quiz

Knowledge quiz · pass mark 80%
  1. Which mode prevents anyone except the owner from modifying sshd_config?
  2. You should restart sshd from your only open session without testing.
  3. Why disable PasswordAuthentication?
  4. What belongs in a short incident note? (choose all)
  5. 198.51.100.23 failed once and then logged in as alice. What should you do next?
  6. Which sshd_config setting stops direct root logins?
  7. Replace 'yes' with 'no' everywhere in conf.txt in place.
    $
  8. Order a safe hardening workflow.
    1. edit the setting
    2. restart from a second session and test login
    3. verify with grep
    4. back up the config