Skip to main content

Linux Server Hardening

  • 1. Encrypt Data Communication for Linux Server
  • All data transmitted over a network is open to monitoring. Encrypt transmitted data whenever possible with password or using keys / certificates.
  • GnuPG allows to encrypt and sign your data and communication, features a versatile key management system as well as access modules for all kind of public key directories.
  • SSH / RSYNC / SFTP for file transfer
  • SSL whenever it's possible
  • 2. Avoid Using FTP, Telnet, and Rlogin / Rsh Services
  • Commands and transferred files can be captured by anyone on the same network using a packet sniffer.
  • Use instead OpenSSH , SFTP, or FTPS (FTP over SSL)
  • 3. Minimize Software to Minimize Vulnerability
yum list installed
yum list packageName

or

dpkg --list
dpkg --info packageName
  • 4. One Network Service Per System, VM or Container

Run each exposed service isolated via VM, Docker, LXC..

  • 5. Keep Linux Kernel and Software Up to Date
yum update

or

apt update && apt upgrade
  • 6. Use Linux Security Extensions

Use SELinux, Apparmor, Grsecurity when possible.

Feature SELinux AppArmor grsecurity
Automated No (audit2allow and system-config-selinux) Yes (Yast wizard) Yes (auto training / gradm)
Powerful policy setup Yes (very complex) Yes Yes
Default and recommended integration CentOS / RedHat / Debian Suse / OpenSuse / Ubuntu based Any Linux distribution
Training and vendor support Yes (Redhat) Yes (Novell) No (community forum and lists)
Recommend for Advanced user New / advanced user New users
Feature Attaches labels to all files, processes and objects Pathname based system does not require labeling or relabeling filesystem ACLs
  • 7. SELinux
  • 8. Linux User Accounts and Strong Password Policy
  • 9. Set Up Password Aging for Better Security
  • 10. Restrict Use of Previous Passwords
  • 11. Lock User Accounts After Login Failures
  • 12. Verify No Accounts Have Empty Passwords
  • 13. Ensure No Non-Root Accounts Have UID Set to 0
  • 14. Disable Root Login
  • 15. Physical Server Security
  • 16. Disable Unwanted Linux Services
  • 17. Find Listening Network Ports
  • 18. Delete X Window Systems (X11)
  • 19. Configure Iptables and TCPWrappers Based Firewall
  • 20. Harden Linux Kernel with /etc/sysctl.conf
  • 21. Separate Disk Partitions for Linux System
  • 22. Implement Disk Quotas
  • 23. Disable IPv6 if Not Using It
  • 24. Disable Unwanted SUID and SGID Binaries
  • 25. Check for World-Writable Files
  • 26. Remove Noowner Files
  • 27. Use Centralized Authentication Service
  • 28. Implement Kerberos for Authentication
  • 29. Configure Logging and Auditing
  • 30. Monitor Suspicious Logs with Logwatch / Logcheck
  • 31. Use System Accounting with auditd
  • 32. Secure OpenSSH Server
  • 33. Install and Use Intrusion Detection Systems (IDS)
  • 34. Disable USB/Firewire/Thunderbolt Devices
  • 35. Disable Unused Services
  • 36. Use fail2ban/denyhost for IDS
  • 37. Secure Apache/PHP/Nginx Server
  • 38. Protect Files, Directories, and Email
  • 39. Perform Regular Backups
  • 40. Additional Recommendations and Conclusion
Back to top