Lab — Hardening Checklist for a Box You Own

Pick the computer you are sitting at if you own it, or another device whose admin you are. “Own” means you may change its settings without asking a school, employer, café, or roommate. If this is a locked-down work PC you must not reconfigure, write that honestly and complete the account rows (MFA/unique passwords) on personal accounts you control from a browser, and mark OS-update/logging as “not authorized to change this managed PC — skipped with reason.” Do not “borrow” a campus image. Do not harden a neighbor's router. Do not enable logging on a POS you do not own.

Accounts in scope are identities you control: your mail, your cloud console, your bank, your Git host, your password manager. You will not enroll MFA on a shared club login you do not own. You will not reset a classmate's password “to help.” You will not unique-password a café Wi-Fi portal. The checklist is personal hygiene plus OS hygiene, written down so the quiz cannot be a vibe.

cat > "$NOTES" << 'EOF'
=== HARDENING LAB (Cyberlium M06 L04) ===
MFA_ON_MY_ACCOUNTS: (Y/N/partial — honest)
UNIQUE_SECRETS: (password manager / unique per site — Y/N)
UPDATES: (OS auto-update on — Y/N)
LOGGING: (I know where logs live / backup — Y/N)
ETHICS: settings panels, not scanners of strangers
EOF

Required rows: (1) legal line — original Cyberlium, not an exam dump. (2) machine_i_own — hostname you chose to share with yourself, or “personal laptop,” not a campus asset tag. (3) mfa — at least one account you control now has a second factor, or a dated plan if enrollment is blocked today (still not a bypass). (4) unique_passwords — reuse called out if you found it; manager named if you use one. (5) updates — OS or apps updated, or update-check date. (6) logging_enabled — Windows Event Log / macOS unified logging / journald observed on, or Settings path you used; not cleared. (7) least_privilege — daily account vs admin from Lesson 2, one sentence. (8) ethics — no attacking others, no dump/cracker, no implant, no wipe of others' logs.

Forbidden rows: exploit steps, cracker output, other people's hashes, neighbor IPs, wipe commands, startup-implant how-tos, Metasploit screenshots titled hardening. If a sentence would help attack a stranger, delete it. If a sentence would help future-you keep YOUR mail, keep it. chmod 600 so another local account on a shared PC does not read the file. You may copy definitions from access-credentials-notes.txt, privilege-levels-notes.txt, and persistence-logs-notes.txt; this lab's filename is specifically hardening-lab-notes.txt.

grep -E "MFA_ON_MY_ACCOUNTS|UNIQUE_SECRETS|UPDATES|LOGGING|ETHICS" "$NOTES"

MFA: open the security page of an account you own (mail/cloud/Git) and record whether a second factor is on. Unique passwords: confirm in your manager that two important accounts do not share a secret — do not paste those secrets into the notes. Updates: Windows Update / macOS Software Update / your distro's updater — record last check, not a screenshot of someone else's patch Tuesday. Logging: Event Viewer opens and Security log exists; or `journalctl --header` on Linux you own; or you toggled a diagnostic setting you are allowed to toggle. Do not nmap the LAN “to find more boxes to harden.” Do not Nessus the café. One machine. Yours.

Failure modes that still pass if you tell the truth: you cannot enable MFA on a bank that only offers SMS yet — write that and enable an authenticator app on mail instead. You cannot patch a locked work PC — write the skip reason. Logging UI is confusing — write “I opened Event Viewer / Console.app and saw logs exist” without exporting other users' events. Failure modes that fail the course: success against a roommate's Mac, hydra against a login, log-clear “tests,” kernel gists attached as extra credit.

sudo apt install nmap

brew install nmap

choco install nmap  # or download https://nmap.org/download.html

uname -a || echo $OSTYPE

Follow the block on YOUR computer. Fill blanks in an editor. Do not paste real passwords into the file. When the four hygiene rows plus ethics are honest, chmod 600.

sudo apt install python3

brew install python3

cd "$HOME/cyberlium-lab"

python3 hardening_lab_remind.py || python hardening_lab_remind.py

{

You enabled (or honestly scheduled) MFA, unique secrets, updates, and logging on a machine you own, wrote least privilege as a control, and locked the checklist. That is system-hacking-domain literacy as Cyberlium teaches it — original, not an exam dump, not EC-Council lab text. Next — Quiz — System Hacking Concepts — ten APPLY items on access, privilege, logs, and ethics without exploit steps. Then Module 7: Malware Families Without Samples.