Day 14: Project: harden Ubuntu 24.04 + backup script

Phase 1 capstone project

Put every tool from this week together: provision and harden a fresh Ubuntu 24.04 box, then write a real backup script with rotation. This is the first genuinely hands-on deliverable in the course — do it on an actual VM (a cheap cloud instance or a local VM is fine).

Part 1: Provision & harden

Hardening checklist

Create a non-root user with sudo access; disable direct root SSH login
Install your SSH public key; set PasswordAuthentication no
Enable a firewall (ufw) allowing only SSH + the ports your app needs
Enable unattended-upgrades for security patches
Confirm sshd -t passes before reloading, and that you can still log in after each change

Part 2: Backup script with rotation

Write a script that backs up a directory (or a database dump), timestamps the archive, and deletes backups older than N days — this "rotation" logic is the part most first attempts get wrong (usually by matching filenames too loosely and deleting the wrong thing).

backup.sh skeleton — fill in the gaps

#!/usr/bin/env bash
set -euo pipefail

SRC_DIR="/opt/myapp/data"
BACKUP_DIR="/opt/backups"
RETENTION_DAYS=7
TIMESTAMP="$(date +%Y%m%d-%H%M%S)"
ARCHIVE="$BACKUP_DIR/backup-$TIMESTAMP.tar.gz"

mkdir -p "$BACKUP_DIR"
tar -czf "$ARCHIVE" -C "$SRC_DIR" .
echo "Created $ARCHIVE"

# Rotation: delete archives older than RETENTION_DAYS
find "$BACKUP_DIR" -name "backup-*.tar.gz" -mtime "+$RETENTION_DAYS" -delete

Test the rotation logic before trusting it

Before running this against real data, test find ... -mtime +N against a directory of dummy timestamped files first — an off-by-one in retention logic silently deletes backups you needed, and you usually only discover it during an actual incident.

Schedule it with cron (Day 11)

0 2 * * *  /opt/scripts/backup.sh >> /var/log/backup.log 2>&1

The Four Questions: SSH key-based authentication

Worked example for Docker (from the roadmap): dependency hell → consistent runtime environments → VMs too heavy → shared kernel, weaker isolation. Now do the same for SSH keys: what problem (password weaknesses) did they solve, why couldn't the previous approach (passwords) solve it, and what trade-off did keys introduce (key management/distribution)?

Why was this created?

What problem does it solve?

Why couldn't the previous approach solve it?

What trade-offs does it introduce?

Write it up

Per the roadmap's Parallel Track A, write a short public post: what you hardened, what broke the first time, and your backup script's retention logic. This becomes your first real incident-log/portfolio entry.

Phase 1 complete — you should now be able to

Provision and SSH-harden a fresh Linux box from scratch, no copy-pasting a guide
Write a Bash script with proper error handling (set -euo pipefail)
Explain and implement backup rotation correctly
Have written your Four Questions answer for this phase

Day 14: Project: harden Ubuntu 24.04 + backup script

Phase 1 capstone project

Part 1: Provision & harden

Part 2: Backup script with rotation

We use cookies