From First Login to Hardware-Backed Security
Whether you've never opened a terminal or you're ready to harden a production login flow, this collection meets you where you are: guided courses for building Linux fundamentals, reference primers and a self-audit checklist for going deeper, hands-on VirtualBox labs — including hardware-backed FIDO2 authentication and Secure Boot — for practicing real security changes safely, and a browser-only statistics course on detecting bots from human activity timing.
Start here
This collection is built in three tiers — pick the one that matches where you are today.
- New to Linux? Start with Linux 101 — a guided, no-experience-required course covering distros, the command line, and a full install walkthrough.
- Comfortable with Linux, want to go deeper? The Command & File Reference primer, the PAM Primer, and the Hardening Checklist below build and verify the fundamentals the labs assume.
- Ready for hands-on hardware security? The FIDO2 and Secure Boot labs below are hands-on VirtualBox environments for practicing real authentication and boot-trust changes.
Hardware-backed login, sudo, and SSH
Using the VirtualBox lab VM
A known-good starting point for the FIDO lab path: Debian FIDO VM v4.4, a virtual appliance that gives learners a repeatable baseline so they can explore authentication changes without risking their primary workstation. Download it, import it, and take your first snapshot before making any changes.
By the end of this track you'll have a hardware-backed FIDO2/PIN login working end-to-end, PAM edits made and tested without locking yourself out, and — if you continue to the follow-on labs — sudo-specific step-up authentication and FIDO-backed SSH access.
Verify the SHA-256 hash, import into your hypervisor, boot once, log in as vboxuser, and take a
Clean Import snapshot before beginning. Only tested under VirtualBox.
sha256sum "fido_vm_v4.4_[20260715-1101]-baseline.ova"
c0b575bc93c202a28bb67f6b9d40c32d009aaa74eddb40d4923a806737aee566
Import steps
These steps follow VirtualBox, the hypervisor the appliance was tested under.
- Download the
.ovafile above. - Open Oracle VirtualBox.
- Select File → Import Appliance.
- Choose the downloaded
.ovafile. - Review the appliance settings and select Finish.
- Boot the VM once to confirm it reaches the login screen.
- Power it off and create a snapshot named Clean Import.
The VirtualBox appliance import dialog shows a MAC address policy option — this is standard VirtualBox UI. No MAC addresses are embedded in the .ova file, so all three policy choices produce the same outcome: new addresses are generated on import.
Initial VM account
The imported VM starts with one local account.
| Account | Password | Purpose |
|---|---|---|
vboxuser | qazwsx |
Initial local account; member of the sudo group. |
root | disabled | Use sudo from vboxuser for initial administration. |
Use snapshots aggressively
These labs intentionally modify authentication, boot, and trust configuration. Snapshots are part of the lab procedure.
- Clean Import — immediately after importing and first boot validation.
- Before FIDO Changes — before editing PAM, mapping tokens, or locking passwords.
- Before Privilege Separation — before separating login and
sudotoken behavior. - Completed Lab — after verified expected behavior.
Linux 101
A guided tour of the Linux ecosystem for anyone who's shakier on the basics than the primer assumes — distro choice, desktop environments, the command line, and a real worked example of a full post-install setup with the reasoning behind every choice.
You'll walk away with: a working mental model of the Linux ecosystem and a real, reasoned post-install setup you built yourself.
Open Linux 101 →Linux Command & File Reference
Recommended first reading before the hands-on labs. A guided, no-VM tour of the commands and system files that run and secure a Linux machine — the shell, filesystem, users and groups, permissions, PAM, services, processes, logs, and network exposure — each with what it prints and why it matters to a defender. The identity, permissions, and PAM sections are the exact foundation the FIDO and Secure Boot labs build on.
You'll walk away with: fluency in the shell, permissions, and PAM concepts every lab below assumes.
Open primer →Linux Hardening Checklist
An interactive self-audit that mirrors the primer section by section — accounts, password and PAM policy, sudo, permissions and SUID, software, services, scheduled tasks, network and firewall, SSH, and logging. Each of the 45 checks expands to the command that verifies it and what a good result looks like. Progress is saved in the browser, and it prints to a clean paper worksheet.
You'll walk away with: a verified, scored self-audit of your own machine's security posture.
Open checklist →PAM Primer
A focused, no-VM deep dive into Pluggable Authentication Modules: rule anatomy, the
required/requisite/sufficient/optional
control keywords, the shared common-* stack files, pam_unix and
pam_faillock, how to edit PAM without locking yourself out, reading
journalctl to watch it happen live, a preview of pam_u2f — the
exact module the FIDO lab adds to the stack — and what pam_systemd /
loginctl do once a login has already succeeded.
You'll walk away: understanding exactly how a PAM stack decides pass or fail — the prerequisite for every FIDO lab edit.
Open PAM primer →FIDO Privilege Separation Lab v0.1
A follow-on lab after the initial FIDO login build. Learners separate normal login identity from
privileged authorization: the blue key logs into the system, while a separate yellow key is required
for sudo. Covers PAM service separation, sudo-specific policy, credential caching,
testing, rollback, and recovery planning.
You'll walk away with: login and sudo
authority cleanly separated onto two different keys.
FIDO SSH Authentication Lab v1.0
A follow-on lab that moves the hardware key from local login to remote access. Learners create a
resident sk-ed25519 key on the token — the private key never leaves the hardware — and
enforce PIN + touch for SSH with verify-required on both client and server. No PAM
changes, so rollback is simple. Ties back to the blue/yellow key model: the login key versus the SSH key.
You'll walk away with: a hardware-resident SSH key enforcing PIN and touch on every connection.
Open lab guide →Boot-time trust and disk encryption
By the end of this track you'll have UEFI Secure Boot enabled with your own Machine Owner Key enrolled, full-disk encryption unlocking automatically via the TPM with a documented recovery path, and hands-on experience with the PCR-relaxation procedure a kernel update requires.
Secure Boot and TPM behavior depend heavily on firmware. This track was tested on physical hardware — teach on physical devices where possible.
Secure Boot Lab v4.5
The current Secure Boot, TPM, and full-disk encryption lab. Covers UEFI Secure Boot, LUKS2 with Clevis TPM2 auto-unlock, PCR policy, MOK enrollment, and kernel update re-enrollment procedures. Includes reference to the automated toolset.
Tested on physical hardware. Secure Boot and TPM behavior depend heavily on firmware — teach on physical devices where possible.
You'll walk away with: Secure Boot enrolled, disk encryption auto-unlocking via TPM, and a tested recovery path.
Open lab guide →Secure Boot Quickstart
The condensed happy path: bare Debian install to working TPM-backed auto-unlock, one method (Clevis TPM2, PCR 7), no branches. Skips MOK/DKMS, UKIs, IMA, and the systemd-cryptenroll alternative — links out to the full lab for those.
You'll walk away with: a working baseline ready for the Kernel Update PCR Guide, without reading the full lab doc first.
Open quickstart →Kernel Update PCR Guide v4.5
Step-by-step procedure for performing a kernel update with temporary PCR relaxation and strict policy re-enrollment. Covers which PCRs change, slot transition commands, stable vs runtime PCR values, and a mapping of each manual step to its automation equivalent.
You'll walk away: knowing exactly which PCRs move on a kernel update and how to re-enroll safely.
Open guide →TPM Update Automation Manual v4.5
Installation, testing, and operations manual for the kernel-update-tpm automated toolset. Covers install, verification, APT hook operation, sentinel file anatomy, monitoring, and six recovery procedures keyed to specific failure modes.
You'll walk away: able to install, verify, and recover the automated toolset that handles PCR re-enrollment for you.
Open manual →Statistical Timing Analysis
By the end of this track you'll be able to name, and independently compute, the specific statistical test that separates each of five synthetic bot-behavior tiers from genuine human activity — coefficient of variation, chi-square goodness-of-fit, autocorrelation and the runs test, circular statistics, and adversarial calibration — and why combining several tests correctly beats trusting any single one.
Unlike the tracks above, this one runs entirely in your browser — no VM, no hardware token, nothing to install. Every diagram and number on the page is generated live from the same Python code that builds the exercise dataset, not hand-typed.
Detecting Bots in Human Activity Logs
Five synthetic activity-log generators, easiest to hardest to catch, each paired with the statistical theory behind the test that separates it from a real human — fixed-interval, i.i.d. uniform, Gaussian jitter with no drift, a full human-behavior simulator, and an adversarially-calibrated "ultra-hard" tier with US federal holiday awareness. Includes a Further Reading section with six real academic citations.
You'll walk away with: the specific statistical test — and the reasoning behind it — that separates each bot tier from a real human, from a single coefficient of variation up through adversarial calibration.
Open the course →Instructor's Links
Outside viewing for those looking to go deeper. This is background and enrichment material — it is not required for any lab path, and students are not expected to watch it, but are encouraged to do so.
Mostly long-form documentaries — roughly 40 to 55 minutes each. Those are homework, or pull specific chapters; none of them fit inside a class block. Short clips are marked with their runtime and can be played in class as-is.
Supply chain and software trust
-
The Internet Was Weeks Away From Disaster And No One Knew
The XZ Utils backdoor (CVE-2024-3094) — a multi-year social-engineering campaign that hid an
sshdauthentication bypass inside a compression library. Directly relevant to the FIDO labs: it is an attack on exactly the login path those labs harden. Covers SSH and end-to-end encryption along the way. -
Google Just Killed Ad Blockers. Here's What To Do.
What browser should you use, and why it isn't Chrome. Manifest V3 traded the blocking
webRequestAPI for a rule-limited replacement, which is what broke uBlock Origin in Chrome. The trust question underneath it: the same company ships the browser, the ad network, and the extension store. Short enough to play in class.
VM Appliances
-
fido_vm_v4.4_[20260714-1447]-baseline.ova
2.5G
no longer hosted
d1a5bd0d98e6b122aabe49a911cb86b8b1025dcd2673774f456f22111bd9b0ef -
fido_vm_v4.3_[20260617-2039]-baseline.ova
2.9G
no longer hosted
f03321f430fe5151bba47a3a827a6db5d43b9c7509da09736a7bc53596463dd1