CCNA Linux Security and Hardening Questions

Disabling password authentication forces the use of cryptographic keys, which are significantly harder to brute-force than even complex passwords. This change effectively eliminates the risk of automated credential stuffing because the server will reject any attempt that does not present a valid private key, regardless of the password's strength.

The find command with -perm -4000 locates files with the setuid bit set, which run with the file owner's privileges, often root. Removing the setuid bit from binaries that do not require it eliminates a common privilege escalation vector while preserving necessary functionality. This is a core hardening action for setuid auditing.

Audit watches are attached to the inode of the watched file. Tools like vipw and vigr edit a temporary copy and then rename it over the original, creating a new inode. The watch on the old inode no longer applies, so the modification is not logged. This is a well-known limitation that requires watching the directory or using a different audit key strategy.

This awk command parses /etc/shadow using colon as the field separator and checks if the second field (the password hash) is empty. If so, it prints the username. This directly identifies accounts with empty passwords, which is a critical security risk. It is a precise and efficient way to audit for this specific misconfiguration.

Password-protecting the GRUB 2 menu with a superuser entry prevents interactive editing of kernel parameters at boot, and restricting permissions on grub.cfg blocks unprivileged reading of the bootloader configuration. Together these satisfy the stated hardening policy, because only users who supply the GRUB password can modify boot entries, and other local users cannot inspect the configuration file.

The /etc/security/pwquality.conf file is used by the pam_pwquality PAM module to enforce password complexity requirements such as minimum length (minlen), required character classes (ucredit, lcredit, dcredit, ocredit), and password history via the remember parameter (often set in PAM configuration but also influenced by pwquality). This is the correct location to define the specified password policy for local accounts on modern Linux distributions.

Locking the root password with passwd -l root prepends an exclamation mark to the hash in /etc/shadow, disabling password-based logon for root while still allowing services and sudo to function. Granting named accounts sudo privileges ensures accountability and satisfies the policy that administrative tasks be performed through individual accounts with elevation.

The 's' in the owner's execute position indicates the Set User ID bit is active. Since the owner is root, any user running this binary will have their effective user ID changed to root. This allows the program to perform administrative tasks that the standard user would normally be restricted from.

The aide --check command compares the current file system state against the previously initialized AIDE database. It reports any changes, such as file additions, deletions, or modifications, based on the rules defined in the AIDE configuration. This is the correct command to perform a manual integrity check. It is typically run after the initial database is created and can be scheduled via cron for regular monitoring.

A BIOS or UEFI password prevents unauthorized users from changing the boot order or modifying hardware-level settings. This is the first line of defense against an attacker trying to boot the system from an external USB drive or optical media to gain access to the underlying data on the disks.

When legitimate scripts must execute from /home, using mandatory access control such as SELinux booleans or AppArmor profiles restricts execution to approved binaries and paths without breaking the developer's workflow. This maintains defense in depth while allowing required functionality, unlike blunt mount options that would block all execution.

visudo -c parses the sudoers file and any included files, reporting syntax errors without modifying anything, while a recursive grep across /etc/sudoers and /etc/sudoers.d identifies all NOPASSWD grants. Together they provide reliable syntax validation and a complete inventory of passwordless command authorizations, which is exactly what the engineer needs for verification.

This approach implements a 'whitelist' strategy, which is the most secure method for firewall configuration. By dropping all traffic by default, the administrator ensures that only the traffic explicitly defined (in this case, SSH) can reach the server, effectively closing all other ports and reducing the attack surface.