Linux Hardening (ANSSI)
The same discipline - Linux hardening following ANSSI guidelines - tackled at two different points of the curriculum, at two different levels of rigor: a Linux administration exam in Bachelor 3, then a full production-grade hardening TP in Master 2, applied to a real server on 08/04/2026. The second directly fed into extending the security audit script deployed to production on this very site (mmkh.fr) the same day.
Stage 1 - Linux administration exam (Bachelor 3, May 2024)
Solo installation and hardening of a Debian VM under exam conditions: mandatory advanced
partitioning (separate boot, LVM, Serpent disk encryption), seven labeled partitions with
restrictive mount options (nodev, nosuid, noexec on
mount points that have no business executing binaries), SSH restricted to ed25519 key
authentication, a temporary user created via useradd, and a KDE desktop
environment installed. The first hands-on application of least-privilege and disk
compartmentalization principles that would resurface, two years later, at the scale of a
production server.
Stage 2 - Production hardening TP (Master 2, 08/04/2026)
Full application of ANSSI recommendations on a real vm-lpic server, solo:
- SSH: root login fully disabled, ed25519-only key authentication
(password auth disabled), access restricted via
AllowGroups. - Disk encryption: LUKS partition with the decryption key stored in a
file protected by the immutable attribute (
chattr +i), cleanly wired intocrypttab/fstab. - Home-grown PKI: a local certificate authority under OpenSSL, a server certificate for nginx, and client-side mutual authentication (mTLS) via a PKCS12 bundle.
- systemd sandboxing of nginx: the service confined in a dedicated
cgroups slice and hardened with directives such as
ProtectSystem=full,NoNewPrivileges,SystemCallFilter=@system-service- this is what drives thesystemd-analyze securityscore from 9.6 (UNSAFE) to 2.6 (OK), shown above. - nftables firewall in default-drop policy, with filtering by source
UID (
skuid) and by transport port (th dport). - Additional hardening: neutralizing dangerous hard links, auditing
SUID binaries, locking sensitive files with
chattr +i, restricting NTP to prevent amplification abuse.
Direct outcome: extending the production audit script
The same day, this work fed directly into extending audit_linux_security_v2.sh,
the read-only audit script used on the personal VPS (mmkh.fr): six new sections aligned with
ANSSI-BP-028 were added - accounts and privileges (duplicate UID 0, password policy, sudo
rules), kernel hardening via sysctl (ASLR randomize_va_space,
kptr_restrict, ptrace_scope, anti-spoofing
rp_filter, SYN cookies), USB devices and kernel modules, AppArmor status
(enforce/complain mode, profile loaded for the exposed web server), auditd
logging (rules on /etc/passwd, /etc/shadow,
/etc/sudoers, sshd_config), and
nodev/nosuid/noexec mount options on
/tmp, /dev/shm, /var/tmp, /home. The
script is built to auto-detect the environment it audits (nginx vs apache2, LUKS present or
not, nftables/ufw/iptables, virtual or physical machine).