Think like an attacker, act like a defender

Security people have a habit: before they defend a server, they look at it the way an attacker would. What can someone reach from outside? What's running that nobody remembers? Who can log in? You can't protect what you don't know is there, so this lesson is about seeing your own server clearly, and then making it smaller and safer.

Permission comes first

Everything in this path happens on machines you own or are responsible for: your server, your practice lab, a VM on your own computer. Looking for weaknesses in someone else's computer without written permission is illegal in most countries, even if you "only looked" and changed nothing. Laws like the USA's Computer Fraud and Abuse Act and the UK's Computer Misuse Act are written exactly for that.

Professionals who test other people's systems (penetration testers) always have a signed agreement first that says exactly what they may test, when, and how. No agreement, no testing. That's the whole difference between a security job and a crime.

Threat modelling in four questions

You can't protect everything from everyone, so professionals start with four questions (from Adam Shostack's threat-modelling framework):

1. What are we working on? A small web server for a club, with a members list.
2. What can go wrong? A guessed password, a forgotten service leaking the members list, an old account nobody watches.
3. What are we going to do about it? Keys only for SSH, turn off what isn't needed, remove old accounts, keep it patched.
4. Did we do a good job? Check again, from the outside, the way an attacker would.

Notice question 2 is about likely problems, not movie hackers. Most real break-ins use something boring: a reused password, an old account, a test server someone forgot to switch off.

Your attack surface

Your attack surface is everything on the server that someone could reach or abuse. The smaller it is, the less can go wrong. Here's how to map it:

In ss -tlnp, look at the Local Address column. 127.0.0.1:… or 127.0.0.53%lo:… means only the server itself can connect. 0.0.0.0:… or [::]:… means every network the server is on can reach it. The -p part names the program, which is why it needs sudo.

The defender's habits

• Less is safer. Every service you don't need is a door you don't have to guard. Stop it and disable it: sudo systemctl disable --now NAME.
• Least privilege. Each account gets only what it needs. Old accounts get locked or removed, and admin rights are rare.
• Layers (defence in depth). Assume one protection will fail someday. A strong SSH setup and a firewall and updates and logs mean one mistake isn't the end.
• Patch (Linux Basics 2, lesson 6), watch (Linux Sysadmin, lesson 4) and back up (Linux Sysadmin, lesson 8). Boring, and the best protection there is.

Try it: the previous admin's leftovers 🔎

You've just taken over this server. The previous admin said "it's all fine". Map the attack surface, find what doesn't belong, and shrink it.

Quick check