Security Engineering Foundations

Running a Linux server is one skill. Knowing how it is attacked is a second. Building the defences — and being able to prove they work — is a third, and it is the one that decides whether an incident is a footnote or a headline. This course is that third skill. You work on `linux01`, a single Ubuntu 24.04 LTS machine you own completely. Over ten lessons you write a threat model for the service it runs, measure it against a hardening baseline you can re-run, replace ufw with a stateful default-deny **nftables** firewall you prove with real traffic, put SSH behind a **certificate authority** with short-lived certificates and a revocation list, build a two-tier **private CA** with OpenSSL and serve nginx over TLS a client actually validates, extend **fail2ban** with a filter you test offline before you enable it, take secrets off command lines and out of journals with systemd's credential tools, and finish with tamper-evident logging, TLS syslog forwarding and an **AIDE** integrity baseline. Two habits run through every lesson. The first is the **armed rollback**: before a change that can lock you out, you schedule its undo, then disarm it once you have proved the change is good. The second is **proof by measurement**: a control you have not seen block something is not a control you can operate, so every defence here is exercised until it fails on purpose — a wrong hostname, an expired certificate, a revoked key, a flooded rate limit. The final project hands you a host belonging to a synthetic veterinary group and asks you to harden it end to end and hand it over, with a runbook, residual risks and a rollback plan a colleague could follow.