Securing systems.Strengthening resilience.

Patch management

System packages were audited with apt, available fixes were inventoried, and a forced update was used to verify the system reflected the latest installed security patches.

sudo apt update && sudo apt upgrade

CIS benchmark hardening

More than 25 unused services and client packages were identified and removed, including legacy file-transfer, web, discovery, mail, and remote-access services. A verification script confirmed each package was removed instead of merely stopped.

Outcome

Root login was locked and the resulting system state was checked against a hardened configuration checklist, producing a repeatable baseline for future verification.

User and group management

Two representative users were created. Alice received membership in an administrators group while Bob remained a standard user, demonstrating access assignment based on role rather than convenience.

sudo groupadd admins
sudo usermod -aG admins alice

Password policy enforcement

The libpam-pwquality module enforced operating-system password requirements. Weak, common, short, and username-matching passwords were rejected during validation.

Outcome

The final environment demonstrated both preventive authentication controls and a clear least-privilege account structure suitable for repeatable administration.

File permissions

A secure_data directory was created with owner-only read, write, and execute permissions.

mkdir secure_data
chmod 700 secure_data

LUKS encryption

Because the VM lacked full-disk encryption, an encrypted container was created, formatted with LUKS, opened with a passphrase, mounted, and used to protect the existing sensitive-data directory.

Backup and recovery

A compressed archive was created, the source data was deliberately removed, and the archive was restored to validate recoverability rather than merely assuming the backup was usable.

tar -czvf backup.tar.gz secure_data

Workflow

The automation triggers when an RSS source changes, retrieves the new item, and passes its content through a normalization pipeline.

Content transformation

Incoming JSON or HTML is converted into compatible plain text before the SharePoint HTTP connector and Repost API create the news item.

Operational value

The result removes repetitive manual publishing while helping internal teams track industry updates and vulnerability advisories from approved sources.