Home/Learn/Linux/Linux Security Hardening

Linux Security Hardening

Advanced

Security

Harden a Linux server by securing SSH, configuring the firewall (iptables/ufw), auditing with auditd, managing SELinux/AppArmor, and following the principle of least privilege throughout.

Overview

A freshly provisioned Linux server is not secure by default. Production hardening covers several layers: SSH configuration (disable root login, key-only auth, change port), firewall rules (allow only needed ports), package hygiene (remove unnecessary packages, enable auto-updates), access control (SELinux or AppArmor for mandatory access control), and audit logging (auditd for who did what, when). Security is not a one-time setup — it requires continuous monitoring, log review, and keeping software patched.

SSH Hardening

SSH is the primary attack surface for a remote Linux server. Disabling password authentication and root login, combined with fail2ban, eliminates the most common attack vectors.

/etc/ssh/sshd_config — hardening

# /etc/ssh/sshd_config — SSH server configuration

# Disable root login (use sudo from a regular account instead)
PermitRootLogin no

# Disable password authentication (require SSH keys)
PasswordAuthentication no
ChallengeResponseAuthentication no
PubkeyAuthentication yes

# Allow only specific users
AllowUsers akshay deploy-bot
# AllowGroups sshusers

# Restrict to specific key algorithms (disable weak ones)
HostKeyAlgorithms ssh-ed25519,rsa-sha2-512,rsa-sha2-256
KexAlgorithms curve25519-sha256,diffie-hellman-group14-sha256
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com

# Other hardening
MaxAuthTries 3
LoginGraceTime 30
ClientAliveInterval 300
ClientAliveCountMax 2
Banner /etc/ssh/banner.txt       # show legal warning before login

# After changes, validate then reload:
sshd -t                          # test configuration syntax
sudo systemctl reload sshd

# fail2ban — ban IPs after repeated failed logins
sudo apt install fail2ban
# /etc/fail2ban/jail.local:
# [sshd]
# enabled = true
# maxretry = 3
# bantime = 3600     # 1 hour ban
# findtime = 600     # within 10 minutes

Firewall — ufw and iptables

ufw (Uncomplicated Firewall) is the friendly front-end for iptables on Debian/Ubuntu. For complex rules, iptables/nftables directly. Default policy: deny all inbound, allow all outbound.

bash — ufw and iptables firewall setup

# ufw — Uncomplicated Firewall (Ubuntu/Debian)
sudo ufw enable
sudo ufw default deny incoming    # block all inbound by default
sudo ufw default allow outgoing   # allow all outbound

# Allow specific ports
sudo ufw allow 22/tcp             # SSH
sudo ufw allow 80/tcp             # HTTP
sudo ufw allow 443/tcp            # HTTPS
sudo ufw allow from 10.0.0.0/8 to any port 5432  # PostgreSQL from internal network only

# Deny a specific IP
sudo ufw deny from 1.2.3.4

# Status
sudo ufw status verbose
sudo ufw status numbered          # numbered for easy deletion
sudo ufw delete 3                 # delete rule #3

# iptables — direct (all distros)
# Allow established connections (critical — must be first)
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -i lo -j ACCEPT              # allow loopback
iptables -A INPUT -p tcp --dport 22 -j ACCEPT  # SSH
iptables -A INPUT -p tcp --dport 80 -j ACCEPT  # HTTP
iptables -A INPUT -p tcp --dport 443 -j ACCEPT # HTTPS
iptables -P INPUT DROP                         # default DROP

# Persist iptables rules
apt install iptables-persistent
iptables-save > /etc/iptables/rules.v4

Audit Logging & System Hardening

auditd logs security-relevant events. Combine with regular updates, unnecessary package removal, and sysctl hardening for a layered security posture.

bash — auditd, sysctl hardening, auto-updates

# auditd — audit daemon
apt install auditd
systemctl enable --now auditd

# /etc/audit/rules.d/hardening.rules — what to audit
# Monitor /etc/passwd and /etc/shadow modifications
-w /etc/passwd -p wa -k identity
-w /etc/shadow -p wa -k identity
-w /etc/sudoers -p wa -k sudoers

# Monitor privilege escalation
-a always,exit -F arch=b64 -S execve -F euid=0 -k root-commands

# Monitor SSH logins
-w /var/log/auth.log -p wa -k authentication

# Query audit logs
ausearch -k sudoers --start today   # sudoers changes today
ausearch -k identity -ts recent     # recent identity changes
aureport --auth --start today       # authentication summary

# sysctl hardening (/etc/sysctl.d/99-hardening.conf)
net.ipv4.ip_forward = 0                    # disable IP forwarding (not a router)
net.ipv4.conf.all.accept_redirects = 0     # don't accept ICMP redirects
net.ipv4.tcp_syncookies = 1                # SYN flood protection
kernel.dmesg_restrict = 1                  # restrict dmesg to root
kernel.kptr_restrict = 2                   # hide kernel pointers

sysctl -p /etc/sysctl.d/99-hardening.conf  # apply immediately

# Auto-security updates (Debian/Ubuntu)
apt install unattended-upgrades
dpkg-reconfigure unattended-upgrades       # enable automatic security updates

Key Points to Remember

1Disable root SSH login and password authentication — key-only auth eliminates brute force.
2Default-deny firewall: allow only ports 22 (SSH), 80 (HTTP), 443 (HTTPS), plus app-specific ports.
3fail2ban bans IPs after repeated failed SSH attempts — essential for internet-facing servers.
4auditd logs security-relevant events (file modifications, privilege escalation, logins).
5sysctl hardening disables IP forwarding, ICMP redirects, and restricts kernel pointer exposure.
6Enable unattended security updates — most breaches exploit known, patched vulnerabilities.

Interview Questions

How do you secure a freshly provisioned Linux server?

What is the difference between iptables and ufw?

Ask Aria about Linux Security Hardening

Your personal AI tutor — ask anything about this concept

Revision Status

Personal Notes

Discussion

Loading discussion…

Cron, at & Automation