VPS & Self-Hosting
You deployed something to a server. Now learn to defend it. SSH keys, a firewall that denies by default, fail2ban banning the ones who keep coming back, patching that actually happens, and backups you have really restored — each taught by watching an attack, then stopping it.
Not yet reviewed
Before you start
- Linux Fundamentalsabout 6h
This course expects those first. Nothing is locked — sign in and it will say where you stand.
The minute a server has a public address, it is being tried — not by someone who chose you, but by machines trying everyone. The first hour of a box is about closing the doors those machines rattle: a real user, a key instead of a password, and an SSH daemon told to stop accepting the easy way in.
1 lesson · 1 hands-on · 3 min
A firewall you can trust is one that blocks everything and then opens only the doors you can name out loud. The dangerous port is never the one you meant to open — it is the database, the admin panel, the debug server you forgot was listening.
1 lesson · 1 hands-on · 3 min
You cannot stop the internet from knocking, but you can make it expensive. A few failed logins is noise; the same address failing a hundred times is an attacker, and fail2ban reads that in the log and shuts the door on them — for an hour, and for the ones who keep coming back, for weeks.
- Attack
- Telemetry
- Fix
- Detection
3 lessons · 3 hands-on · 6 min
The vulnerability that takes your box is almost never a new one — it is an old, known, already-patched one that nobody applied. Patching that depends on you remembering is patching that does not happen, so you make it automatic, and you make sure it finishes the job by rebooting.
1 lesson · 1 hands-on · 2 min
Two ways a well-run box gives itself away: a reverse proxy that leaks the real server behind it, and a secrets file sitting in the one place every scanner looks. Both are small, both are common, and both are closed by knowing where the edge of your box actually is.
1 lesson · 1 hands-on · 3 min
A backup you have never restored is a hope, not a backup — the restore is the exercise, not the copy. And a box nobody watches is one where the bad day is discovered by a customer. Both are about the day something goes wrong, prepared for on a day it has not.
1 lesson · 1 hands-on · 3 min
Everything at once, on a box that is being scanned as you work. The log fills with attempts; you close the doors one by one; and by the end the same stream of attackers is hitting a box that has nothing left to give them. Graded on what the box is, not what you remember.
1 lesson · 1 hands-on · 2 min
Labs
Hands-on challenges for this course. Each one hides a flag you have to find.
Exam
Timed, and it issues a credential anyone can verify. Practice quizzes are untimed; this one is not.