linuxexpert-practice-labs/labs/lpic-1/110-2-host-security

LPIC-1 110.2: Setting up host security

Turning off a service nobody needs, /etc/nologin, and the nologin shell.

Before you start

The lab runs a service nobody needs, legacy-echo, which listens on TCP port 7007. It creates users tess and testuser (password Lab-Pass-1); tess can log in over SSH with the key /root/lab-keys/tess (ssh -i /root/lab-keys/tess tess@localhost). Keep a root session open while you do task 2.

Tasks

1. List every listening service with ss -tulpn, and turn off legacy-echo with systemctl disable --now. Check it's gone, then mask it and try to start it.
2. Create /etc/nologin with a message, and try to log in as tess over SSH (and on the console, if you have one). Then remove /etc/nologin from the session you kept open.
3. Give testuser the shell /usr/sbin/nologin and try su - testuser.

Hints

• ss -tulpn | grep 7007; systemctl status legacy-echo; systemctl mask, systemctl start.
• echo "Down for maintenance" > /etc/nologin; root can still log in. journalctl --since -10min shows the refused login.
• usermod -s, getent passwd testuser.