Harden a Live Web and SSH Box

The two hardening labs Headers On and Lock the Door, on a live server instead of a text box. The Falaj Water Office runs a small web site and an SSH daemon for its one administrator. The site answers without the response headers that tell a browser how to behave safely and advertises its exact version; the SSH daemon accepts direct root login, passwords, empty passwords, ten tries per connection and X11 forwarding.

In the terminal, edit /gen/app/nginx.conf and /gen/app/sshd_config (the administrator's account name, generated for you, is in /gen/README.txt), run restart after changing nginx.conf, and run check to see every item with the reason it matters. When you are done, ask the lab to grade: the checker reads the live response headers and the daemon's effective settings, and it also proves that nothing was switched off.

One rule you must not break: the site keeps serving its pages and the administrator keeps key login. reset puts the shipped files back if you want to start again.