Linux Hardening

Linux is everywhere - web servers, cloud infrastructure, containers, embedded devices, developer workstations. And because it’s so prevalent, it’s also a top target. The good news is that Linux gives you a lot of control over your security posture. The bad news is that control only helps if you actually use it. This page covers the practical hardening steps you should apply to any Linux system, whether it’s a production server, a cloud VM, or a dev box handling sensitive work.

Where to Start - The CIS Benchmark

Before doing anything manual, grab the CIS Benchmark for your distribution. CIS maintains specific benchmarks for:

Ubuntu (LTS versions)
Red Hat Enterprise Linux / CentOS / AlmaLinux
Debian
SUSE Linux Enterprise
Amazon Linux

These are free to download at cisecurity.org/cis-benchmarks. They tell you exactly what to configure and why. Use them as your checklist. For a quick automated audit, run Lynis:

# Install and run Lynis
sudo apt install lynis   # or dnf install lynis on RHEL-based
sudo lynis audit system

It’ll give you a hardening index and a list of suggestions. A good starting target is 70+.

User and Authentication Hardening

If root is accessible directly, you’re one credential leak away from a full system compromise.

# Lock the root account password (use sudo instead)
sudo passwd -l root

# In /etc/ssh/sshd_config - disable root SSH login
PermitRootLogin no

Enforce Strong Password Policies

Edit /etc/security/pwquality.conf:

minlen = 14
minclass = 3
maxrepeat = 2

And configure password aging in /etc/login.defs:

PASS_MAX_DAYS   90
PASS_MIN_DAYS   7
PASS_WARN_AGE   14

Audit Existing Users and Groups

# Find users with UID 0 (should only be root)
awk -F: '$3 == 0 {print $1}' /etc/passwd

# Find accounts with empty passwords
sudo awk -F: '$2 == "" {print $1}' /etc/shadow

# List all users with login shells
grep -v 'nologin\|false' /etc/passwd

Remove or lock any accounts that aren’t needed:

sudo usermod -L username    # Lock account
sudo userdel username       # Remove account (add -r to also remove home dir)

Configure sudo Properly

Never give blanket ALL=(ALL) NOPASSWD: ALL to regular accounts. Edit via visudo:

# Good - requires password
username ALL=(ALL) ALL

# Avoid this in production
username ALL=(ALL) NOPASSWD: ALL

SSH Hardening

SSH is the most common remote access method - and one of the most targeted services. Lock it down. Edit /etc/ssh/sshd_config:

# Use key-based auth only - no passwords
PasswordAuthentication no
PubkeyAuthentication yes

# Disable root login
PermitRootLogin no

# Only allow specific users
AllowUsers yourusername

# Disable unused auth methods
PermitEmptyPasswords no
ChallengeResponseAuthentication no
UsePAM yes

# Use a non-default port (security through obscurity, but reduces noise)
Port 2222

# Limit auth attempts
MaxAuthTries 3
LoginGraceTime 30

# Disable X11 forwarding if not needed
X11Forwarding no

# Disable agent forwarding if not needed
AllowAgentForwarding no

# Set strong crypto
Ciphers aes256-gcm@openssh.com,chacha20-poly1305@openssh.com
MACs hmac-sha2-256,hmac-sha2-512
KexAlgorithms curve25519-sha256,diffie-hellman-group16-sha512

After editing:

sudo systemctl reload sshd

Always test the new config before closing your current session:

ssh -T -p 2222 user@host

Firewall Configuration

UFW (Ubuntu / Debian)

# Enable UFW
sudo ufw enable

# Default: deny all incoming, allow all outgoing
sudo ufw default deny incoming
sudo ufw default allow outgoing

# Allow only what you need
sudo ufw allow 22/tcp      # or your custom SSH port
sudo ufw allow 443/tcp     # HTTPS if it's a web server
sudo ufw allow from 10.0.0.0/8 to any port 8080  # Restrict by source IP

# Check status
sudo ufw status verbose

firewalld (RHEL / CentOS / Fedora)

# Check active zones
sudo firewall-cmd --get-active-zones

# Remove a service from the public zone
sudo firewall-cmd --zone=public --remove-service=dhcpv6-client --permanent

# Add only what's needed
sudo firewall-cmd --zone=public --add-service=https --permanent

sudo firewall-cmd --reload

File System and Permissions

Set noexec, nodev, nosuid on Appropriate Partitions

Edit /etc/fstab to add mount options:

/tmp        tmpfs   defaults,noexec,nosuid,nodev   0 0
/var/tmp    tmpfs   defaults,noexec,nosuid,nodev   0 0
/dev/shm    tmpfs   defaults,noexec,nosuid,nodev   0 0

Find World-Writable Files and SUID/SGID Binaries

# World-writable files (potential for tampering)
sudo find / -xdev -type f -perm -002 2>/dev/null

# SUID binaries (can be privilege escalation vectors)
sudo find / -xdev -perm /4000 -type f 2>/dev/null

# SGID binaries
sudo find / -xdev -perm /2000 -type f 2>/dev/null

Review the results - remove SUID bits from binaries that don’t need them:

sudo chmod u-s /path/to/binary

Restrict /etc/cron.* Access

sudo chown root:root /etc/crontab
sudo chmod 600 /etc/crontab
sudo chmod 700 /etc/cron.d /etc/cron.daily /etc/cron.weekly /etc/cron.monthly

Kernel Hardening (sysctl)

Kernel parameters significantly impact security posture. Edit /etc/sysctl.conf or drop files in /etc/sysctl.d/:

# Disable IP source routing
net.ipv4.conf.all.accept_source_route = 0
net.ipv6.conf.all.accept_source_route = 0

# Disable ICMP redirects
net.ipv4.conf.all.accept_redirects = 0
net.ipv6.conf.all.accept_redirects = 0
net.ipv4.conf.all.send_redirects = 0

# Enable reverse path filtering (helps prevent IP spoofing)
net.ipv4.conf.all.rp_filter = 1

# Ignore ICMP broadcast requests
net.ipv4.icmp_echo_ignore_broadcasts = 1

# Protect against SYN flood attacks
net.ipv4.tcp_syncookies = 1

# Disable IPv6 if not needed
net.ipv6.conf.all.disable_ipv6 = 1

# Restrict kernel pointer exposure
kernel.kptr_restrict = 2

# Restrict dmesg access to root
kernel.dmesg_restrict = 1

# Disable core dumps for SUID programs
fs.suid_dumpable = 0

# Enable ASLR
kernel.randomize_va_space = 2

Apply changes:

sudo sysctl -p

Audit Logging (auditd)

auditd is the Linux kernel’s audit framework - essential for monitoring and forensics.

# Install
sudo apt install auditd   # or: sudo dnf install audit

# Enable and start
sudo systemctl enable auditd
sudo systemctl start auditd

Add audit rules to /etc/audit/audit.rules:

# Log all authentication events
-w /etc/passwd -p wa -k identity
-w /etc/group -p wa -k identity
-w /etc/shadow -p wa -k identity
-w /etc/sudoers -p wa -k sudo_rules

# Log sudo usage
-a always,exit -F arch=b64 -S execve -C uid!=euid -F euid=0 -k setuid

# Log SSH config changes
-w /etc/ssh/sshd_config -p wa -k sshd_config

# Log privileged command execution
-a always,exit -F arch=b64 -S execve -F euid=0 -k root_commands

Services - Disable What You Don’t Need

# List all running services
systemctl list-units --type=service --state=running

# Disable a service you don't need
sudo systemctl stop servicename
sudo systemctl disable servicename
sudo systemctl mask servicename   # Prevents it from being started at all

Common services to consider disabling if not in use:

avahi-daemon (mDNS/zeroconf - usually not needed on servers)
cups (printing - almost never needed on servers)
bluetooth
rpcbind (only needed for NFS)
nfs (unless you’re using NFS)
telnet / rsh / rlogin (never use these)

Package Management Security

# Remove packages you don't need
sudo apt remove --purge package-name

# Enable automatic security updates (Ubuntu/Debian)
sudo apt install unattended-upgrades
sudo dpkg-reconfigure unattended-upgrades

# RHEL/CentOS equivalent
sudo dnf install dnf-automatic
sudo systemctl enable dnf-automatic.timer

AppArmor and SELinux

These are Mandatory Access Control (MAC) systems that restrict what programs can do, even if they’re compromised.

AppArmor - Default on Ubuntu/Debian. Usually easier to work with.
SELinux - Default on RHEL/CentOS/Fedora. More powerful, steeper learning curve.

# AppArmor - check status and profiles
sudo aa-status

# SELinux - check status
sestatus

# Never set SELinux to permissive/disabled in production unless you know what you're doing
# Most "just disable SELinux" advice on StackOverflow is lazy - learn to fix the policy instead

Useful Tools for Linux Hardening

Tool	What it’s for
Lynis	System audit and hardening recommendations
OpenSCAP	Compliance scanning against CIS/STIG benchmarks
AIDE	File integrity monitoring - detects unauthorized changes
Fail2ban	Automatically bans IPs with too many failed login attempts
rkhunter	Rootkit hunter and system integrity checker
chkrootkit	Another rootkit detection tool
auditd	Kernel-level audit framework for logging
Ansible	Automate hardening configs across many systems

Quick Wins - Things to Do First

If you’re hardening a Linux server and don’t know where to start, do these first:

Update all packages
Disable root SSH login
Switch to key-based SSH authentication
Enable and configure UFW or firewalld
Disable unused services
Enable auditd
Run Lynis and address the top findings

These alone will dramatically improve your posture relative to a default install.

Reference

CIS Ubuntu Linux Benchmark
Lynis - Quick security audit for any Linux system
DISA STIG for Red Hat - Government-grade hardening
Linux Audit Documentation - RHEL security hardening guide

There’s no such thing as a fully hardened system - only systems that are harder to attack than others. The goal is to make exploitation as difficult and noisy as possible.

Welcome

Awesome Resources

Red Teaming 101

Blue Teaming 101

GRC 101

General IT Knowledge

Linux

Linux Hardening

Where to Start - The CIS Benchmark

User and Authentication Hardening

Enforce Strong Password Policies

Audit Existing Users and Groups

Configure sudo Properly

SSH Hardening

Firewall Configuration

UFW (Ubuntu / Debian)

firewalld (RHEL / CentOS / Fedora)

File System and Permissions

Set noexec, nodev, nosuid on Appropriate Partitions

Find World-Writable Files and SUID/SGID Binaries

Restrict /etc/cron.* Access

Kernel Hardening (sysctl)

Audit Logging (auditd)

Services - Disable What You Don’t Need

Package Management Security

AppArmor and SELinux

Useful Tools for Linux Hardening

Quick Wins - Things to Do First

Reference

​Linux Hardening

​Where to Start - The CIS Benchmark

​User and Authentication Hardening

​Disable the Root Login (or Restrict It Heavily)

​Enforce Strong Password Policies

​Audit Existing Users and Groups

​Configure sudo Properly

​SSH Hardening

​Firewall Configuration

​UFW (Ubuntu / Debian)

​firewalld (RHEL / CentOS / Fedora)

​File System and Permissions

​Set noexec, nodev, nosuid on Appropriate Partitions

​Find World-Writable Files and SUID/SGID Binaries

​Restrict /etc/cron.* Access

​Kernel Hardening (sysctl)

​Audit Logging (auditd)

​Services - Disable What You Don’t Need

​Package Management Security

​AppArmor and SELinux

​Useful Tools for Linux Hardening

​Quick Wins - Things to Do First

​Reference

Linux Hardening

Where to Start - The CIS Benchmark

User and Authentication Hardening

Disable the Root Login (or Restrict It Heavily)

Enforce Strong Password Policies

Audit Existing Users and Groups

Configure sudo Properly

SSH Hardening

Firewall Configuration

UFW (Ubuntu / Debian)

firewalld (RHEL / CentOS / Fedora)

File System and Permissions

Set noexec, nodev, nosuid on Appropriate Partitions

Find World-Writable Files and SUID/SGID Binaries

Restrict /etc/cron.* Access

Kernel Hardening (sysctl)

Audit Logging (auditd)

Services - Disable What You Don’t Need

Package Management Security

AppArmor and SELinux

Useful Tools for Linux Hardening

Quick Wins - Things to Do First

Reference