Born2beroot
ProjectM1
Set up a hardened virtual machine with users, sudo, SSH, a firewall and a monitoring script.
Requires
Unlocks
Guide
Born2beroot is a milestone M1 system administration project, done solo. You install a server in a virtual machine (Debian stable or Rocky Linux) with no graphical interface, partition it with encrypted LVM, harden it with a firewall, a strict sudo policy and a password policy, and write a monitoring shell script that broadcasts system information every ten minutes. You hand in only a signature.txt with the SHA1 of the virtual disk, so the machine you defend is exactly the one you built.
What you will learn
- Installing a Linux server from scratch and choosing between Debian and Rocky
- Disk partitioning, LUKS encryption and LVM logical volumes
- Users, groups and
sudoconfiguration withvisudo - Password policies with
login.defsandpam_pwquality - SSH configuration (custom port, no root login) and a firewall (UFW on Debian, firewalld on Rocky)
- AppArmor or SELinux basics
- Shell scripting and
cron, plus reading system data from/proc,free,df,lsblk,ssandjournalctl
Before you start
- Previous nodes: Libft. Born2beroot is independent from C but sits in the same milestone as ft_printf and get_next_line.
- Tools: VirtualBox (or UTM on Apple Silicon), the Debian netinst ISO, and enough disk space in your campus storage (
sgoinfreorgoinfre). - Read about LVM (physical volume, volume group, logical volume) before the installer asks you about it.
- Pick Debian unless you have a reason: there is more documentation and fewer surprises with AppArmor and UFW.
Plan of attack
- Day 1: create the VM in a persistent folder, install Debian without a desktop, and set up the encrypted LVM layout the subject asks for (the bonus layout has more logical volumes, decide now).
- Day 1: set the hostname to your login followed by
42, create your user, add it tosudoanduser42groups. - Day 2: configure
sudo(password attempts, custom bad password message, log directory/var/log/sudo, TTY mode, restricted secure path). - Day 2: password policy: expiry, minimum days, warning days, length, upper, lower and digit requirements, maximum repeated characters, no username in the password. Apply the expiry rules to existing users with
chage. - Day 3: SSH on port 4242 with root login disabled, and the firewall allowing only that port. Test from the host with port forwarding.
- Day 3: write
monitoring.shprinting architecture, physical and virtual CPUs, RAM, disk, CPU load, last boot, LVM status, TCP connections, logged users, IP and MAC, and sudo command count. Broadcast it withwall. - Day 4: schedule it with
cronevery ten minutes, and know how to stop it without editing the script. - Day 4 (bonus): WordPress with lighttpd, MariaDB and PHP, plus one extra service of your choice that you can justify.
- Day 5: take the SHA1 of the disk, write
signature.txt, then never boot that VM again without a snapshot (booting changes the hash).
Commands you should be able to type without notes during the defence:
lsblk
sudo ufw status numbered
sudo adduser newuser && sudo usermod -aG user42 newuser
sudo hostnamectl set-hostname newname42
sudo chage -l newuser
sha1sum born2beroot.vdi
Common pitfalls
- Booting the evaluated VM after generating the signature: the hash no longer matches and the evaluation stops.
- Storing the VM in a folder that is wiped at logout.
- Not knowing what LVM, AppArmor,
aptversusaptitude, or a firewall actually do. The defence is mostly questions. - A password policy that applies only to new users because you forgot
chagefor root and your user. - A monitoring script that hardcodes values or breaks when a command output changes format.
- Forgetting to change the hostname live during the defence, or not knowing how to add a user to a group.
How it is evaluated
- Peer evaluation only. The evaluator compares the disk SHA1 with
signature.txt, then boots a clone. - You explain how a virtual machine works, why you chose your distribution, and the difference between the tools you used.
- Live tasks: create a user, add it to a group, change the hostname, check the partitions with
lsblk, show the sudo log, show the firewall rules, add a firewall rule, connect over SSH with the new user, and explain the monitoring script line by line. - The bonus (extra partitions, WordPress stack, extra service) is graded only if the mandatory part is perfect.