OS Hardening: Linux Security

Securing the Core: A Comprehensive Guide to Linux Hardening

Linux is the operating system that powers the internet, from small web servers to massive cloud infrastructures. Its open-source nature makes it highly flexible, but out-of-the-box configurations are rarely secure enough for production environments. Server hardening is the process of reducing the attack surface by eliminating potential vulnerabilities and implementing restrictive security policies. This guide explores the ten most critical steps every System Administrator and Security Researcher should take to protect their Linux assets.

1. Update Often and Automate Patches

The most common entry point for attackers is through unpatched software vulnerabilities. New exploits (CVEs) are discovered daily. Managing updates is not just about the kernel, but every library and package installed on the system.

Technical Execution: Use tools like unattended-upgrades on Debian/Ubuntu to automate security patches. For manual auditing, regularly run:

2. SSH Hardening: The Gatekeeper

SSH (Secure Shell) is the primary method for remote management and, consequently, the primary target for brute-force attacks.

• Disable Root Login: Never allow direct root access via SSH. Change PermitRootLogin no in /etc/ssh/sshd_config.
• Key-Based Auth: Disable password authentication entirely (PasswordAuthentication no) and use RSA or Ed25519 keys.
• Change Port: Move SSH from port 22 to a non-standard port (e.g., 2244) to evade 99% of automated bot scans.

3. Implement a Strict Firewall (UFW/IPTables)

A server should only communicate through the ports it absolutely needs. For a web server, that is typically only 80 (HTTP) and 443 (HTTPS), plus your custom SSH port.

UFW Command Example:

4. Least Privilege Principle: Sudo and Groups

Operating as a root user is dangerous. Every action should be performed by a standard user with sudo privileges, and those privileges should be limited. Use the /etc/sudoers file to restrict what specific users can execute. Audit your accounts regularly with cat /etc/passwd to ensure no ghost accounts exist.

5. Securing Shared Memory

Shared memory (/run/shm) can be used in local attacks to execute malicious code. You can harden it by adding the following line to /etc/fstab:

This prevents programs from executing in shared memory and ignores SUID bits.

6. Use Intrusion Prevention (Fail2Ban)

Fail2Ban monitors your log files (like /var/log/auth.log) for suspicious activity. If it sees too many failed login attempts from a single IP, it automatically updates your firewall rules to ban that IP for a specified period. It is an essential "set and forget" tool for public-facing servers.

7. Filesystem Integrity and Monitoring

How do you know if a system binary like /bin/ls has been replaced by a rootkit? Use AIDE (Advanced Intrusion Detection Environment) or Tripwire. These tools create a database of file hashes and alert you if any critical system files are modified.

8. Disabling Unnecessary Services and IPv6

Every running service is a potential door. If you aren't using an FTP server or a legacy print service, disable them. Furthermore, if your infrastructure doesn't strictly require IPv6, disabling it can reduce the complexity of your firewall rules and eliminate a secondary attack path.

9. Kernel Hardening with Sysctl

The Linux kernel can be tuned for security via /etc/sysctl.conf. Critical settings include:

• IP Spoofing Protection: net.ipv4.conf.all.rp_filter = 1
• Disable ICMP Redirects: Prevents MitM attacks via redirect packets.
• ASLR (Address Space Layout Randomization): Ensures memory addresses are randomized to prevent buffer overflow exploits.

10. Regular Security Auditing (Lynis)

Security is not a destination, it's a journey. Use a tool like Lynis. It performs an extensive health scan of your Linux system, provides a security score, and gives specific suggestions for hardening based on your distribution.

Conclusion

Linux server hardening requires a layered approach. By combining strict access controls, proactive monitoring, and kernel-level tuning, you can transform a vulnerable box into a high-security asset. Remember, the goal of hardening is to make the cost of an attack higher than the value of the data being sought. As technology evolves, so should your hardening checklist. Stay vigilant, stay updated, and stay secure.