Linux: Capstone and Certification Prep

# 1. Set static system hostname and update package repositories
sudo hostnamectl set-hostname web-prod-01.internal
sudo apt update && sudo apt -y upgrade

# 2. Create unprivileged administrator account with custom UID
sudo useradd -m -u 1200 -s /bin/bash -c "Primary Deployer" deployer

# 3. Add deployer to administrative group (sudo on Debian/Ubuntu, wheel on RHEL)
sudo usermod -aG sudo deployer

# 4. Configure password aging policy (expire password every 90 days)
sudo chage -M 90 -W 7 deployer

# 5. Provision public key SSH authentication for deployer
sudo mkdir -p /home/deployer/.ssh
sudo cp ~/.ssh/authorized_keys /home/deployer/.ssh/
sudo chown -R deployer:deployer /home/deployer/.ssh
sudo chmod 700 /home/deployer/.ssh
sudo chmod 600 /home/deployer/.ssh/authorized_keys

# 1. Create drop-in hardened SSH configuration
sudo tee /etc/ssh/sshd_config.d/99-hardened.conf << 'EOF'
PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes
MaxAuthTries 3
ClientAliveInterval 300
ClientAliveCountMax 2
X11Forwarding no
EOF

# 2. Test configuration syntax before reloading the daemon
sudo sshd -t
sudo systemctl reload sshd

# 3. Configure packet filtering firewall with UFW
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow 22/tcp comment "SSH Remote Access"
sudo ufw allow 80/tcp comment "HTTP Web Traffic"
sudo ufw allow 443/tcp comment "HTTPS Encrypted Web Traffic"
sudo ufw --force enable
sudo ufw status verbose

# 1. Install Nginx and Let's Encrypt Certbot
sudo apt install -y nginx certbot python3-certbot-nginx

# 2. Create web root directory and demo landing page
sudo mkdir -p /var/www/capstone/html
sudo chown -R deployer:www-data /var/www/capstone
sudo chmod -R 755 /var/www/capstone

cat << 'EOF' | sudo tee /var/www/capstone/html/index.html
<!DOCTYPE html>
<html lang="en">
<head><title>Production Host</title></head>
<body><h1>Production Capstone Host Active</h1></body>
</html>
EOF

# 3. Define Nginx server block
sudo tee /etc/nginx/sites-available/capstone.conf << 'EOF'
server {
    listen 80;
    server_name capstone.example.com;
    root /var/www/capstone/html;
    index index.html;

    add_header X-Frame-Options "SAMEORIGIN";
    add_header X-Content-Type-Options "nosniff";

    location / {
        try_files $uri $uri/ =404;
    }
}
EOF

# 4. Enable configuration and test syntax
sudo ln -sf /etc/nginx/sites-available/capstone.conf /etc/nginx/sites-enabled/
sudo nginx -t && sudo systemctl reload nginx

# 5. Acquire automated SSL/TLS certificate with Certbot
sudo certbot --nginx -d capstone.example.com --non-interactive --agree-tos -m admin@example.com

# 1. Create backup script at /usr/local/bin/system-backup.sh
sudo tee /usr/local/bin/system-backup.sh << 'EOF'
#!/usr/bin/env bash
set -euo pipefail

BACKUP_DIR="/var/backups/web-capstone"
TIMESTAMP="$(date +%Y%m%d_%H%M%S)"
ARCHIVE_NAME="capstone_${TIMESTAMP}.tar.gz"

mkdir -p "${BACKUP_DIR}"

# Create compressed archive of web files and configs
tar -czf "${BACKUP_DIR}/${ARCHIVE_NAME}" -C /var/www/capstone html

# Generate checksum for archive integrity
sha256sum "${BACKUP_DIR}/${ARCHIVE_NAME}" > "${BACKUP_DIR}/${ARCHIVE_NAME}.sha256"

# Remove archives older than 7 days
find "${BACKUP_DIR}" -type f -name "capstone_*.tar.gz*" -mtime +7 -delete

logger -t capstone-backup "Backup completed: ${ARCHIVE_NAME}"
EOF

# 2. Assign execution permissions
sudo chmod 750 /usr/local/bin/system-backup.sh
sudo chown root:root /usr/local/bin/system-backup.sh

# 3. Install scheduled daily backup cron job
sudo tee /etc/cron.d/capstone-backup << 'EOF'
# Run daily at 02:30 AM as root
30 2 * * * root /usr/local/bin/system-backup.sh >/var/log/backup.log 2>&1
EOF

# 1. At the emergency prompt, supply the root password to access the shell
# Prompt shown: Give root password for maintenance
# (or press Control-D to continue):

# 2. Remount the root filesystem as read-write to enable modifications
mount -o remount,rw /

# 3. Inspect recent boot journal entries to find the failing mount point
journalctl -xb | grep -i mount

# 4. Edit /etc/fstab and comment out or fix the erroneous device UUID
vim /etc/fstab

# 5. Reload systemd mount generators to verify resolution
systemctl daemon-reload
mount -a

# 6. Exit emergency shell and resume normal multi-user target boot
exit