Hardening Capstone: Close Every Hole on a Careless Box

A host was provisioned carelessly and shipped with six independent security holes. Harden it to the baseline — every one must be closed. This is a defensive capstone: it chains SSH hardening, sudo policy, file permissions, account hygiene, and cron review into one scenario.

1. This host still accepts a direct SSH login as root. Close that off in the sshd configuration.

2. SSH still accepts password authentication; this host should be key-only. Turn it off.

3. An account has been granted passwordless sudo through a NOPASSWD rule in /etc/sudoers.d/ — a standing backdoor. Find it and revoke it.

4. A script under /usr/local/bin runs as root but is world-writable, so any user can rewrite what root executes. Fix its permissions so only root can modify it.

5. A non-root account has been given UID 0 in /etc/passwd — a hidden root-equivalent. Remove it.

6. /etc/cron.d/ contains a job that pipes a downloaded script straight into a root shell on a schedule. Remove it.

See /root/brief.txt. Grading reads the resulting config/state; it does not start sshd/cron. Note: for sshd_config, the first value of a keyword wins — don't just append under the old line.