Linux Server Security Hardening in 10 Essential Steps

Securing a Linux server is a fundamental skill for any system administrator. With the rise in cyberattacks and intrusion attempts, it is crucial to put an effective hardening strategy in place from the moment the server is first deployed.

This guide details 10 essential steps to significantly strengthen the security of your Linux servers, whether they are hosted in your own infrastructure or in the cloud.

1. Keep the System Up to Date

Every security strategy starts with regular updates. Security patches are released frequently to close newly discovered vulnerabilities.

For Debian/Ubuntu:

# Update the package list
sudo apt update

# Install updates
sudo apt upgrade -y

# Update the kernel and critical packages
sudo apt dist-upgrade -y

For RHEL/CentOS/Fedora:

# Update all packages
sudo dnf update -y
# or with yum on older systems
sudo yum update -y

Pro tip: Set up automatic security updates with unattended-upgrades on Debian/Ubuntu or dnf-automatic on Fedora/RHEL.

# On Debian/Ubuntu
sudo apt install unattended-upgrades
sudo dpkg-reconfigure -plow unattended-upgrades

# On RHEL/CentOS 8/Fedora
sudo dnf install dnf-automatic
sudo systemctl enable --now dnf-automatic.timer

2. Secure SSH

SSH is often the main entry point to your server, which makes it a prime target for attackers.

Change the Default Port

Edit the /etc/ssh/sshd_config file:

# Replace 22 with a non-standard port (between 1024 and 65535)
Port 2222

Disable Password Authentication

PasswordAuthentication no
ChallengeResponseAuthentication no

Set Up Key-Based Authentication

On your local machine:

# Create a key pair if you don't have one
ssh-keygen -t ed25519 -a 100

# Copy the public key to the server
ssh-copy-id -i ~/.ssh/id_ed25519.pub utilisateur@serveur

Restrict Root Access and Allowed Users

PermitRootLogin no
AllowUsers utilisateur1 utilisateur2

Apply the Changes

sudo systemctl restart sshd

3. Configure a Firewall

A properly configured firewall is essential for controlling inbound and outbound traffic.

UFW (Uncomplicated Firewall) for Debian/Ubuntu

# Installation
sudo apt install ufw

# Basic configuration
sudo ufw default deny incoming
sudo ufw default allow outgoing

# Allow SSH (on the modified port if necessary)
sudo ufw allow 2222/tcp

# Allow other services as needed
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp

# Enable the firewall
sudo ufw enable

Firewalld for RHEL/CentOS/Fedora

# Install if necessary
sudo dnf install firewalld

# Enable the service
sudo systemctl enable --now firewalld

# Basic configuration
sudo firewall-cmd --permanent --add-service=ssh
sudo firewall-cmd --permanent --add-service=http
sudo firewall-cmd --permanent --add-service=https

# If you changed the SSH port
sudo firewall-cmd --permanent --remove-service=ssh
sudo firewall-cmd --permanent --add-port=2222/tcp

# Apply the changes
sudo firewall-cmd --reload

4. Install and Configure Fail2ban

Fail2ban monitors your system logs and temporarily blocks IP addresses that show signs of malicious activity.

# Installation
sudo apt install fail2ban # Debian/Ubuntu
sudo dnf install fail2ban # RHEL/CentOS/Fedora

# Create a local configuration file
sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local

Edit /etc/fail2ban/jail.local to customize the configuration:

[DEFAULT]
# Ban an IP for 1 hour (3600 seconds)
bantime = 3600
# Ban after 5 failed attempts
maxretry = 5
# Observation window for attempts (in seconds)
findtime = 600

[sshd]
enabled = true
port = 2222
logpath = %(sshd_log)s
maxretry = 3

Enable and start the service:

sudo systemctl enable --now fail2ban

5. Secure Partitioning and Mount Options

If you are setting up a new server, consider a partitioning scheme that includes separate partitions for /home, /tmp, /var, /var/log, and /var/log/audit so that a partition filling up doesn’t affect the entire system.

For existing systems, harden the mount options in /etc/fstab:

# Mount /tmp with noexec, nosuid and nodev
/dev/sdXY  /tmp  ext4  defaults,nosuid,nodev,noexec  0 0

# Mount /home with nosuid and nodev
/dev/sdXZ  /home  ext4  defaults,nosuid,nodev  0 0

If you don’t have separate partitions, you can use temporary file systems:

# Add to /etc/fstab
tmpfs  /tmp  tmpfs  defaults,nosuid,nodev,noexec,size=1G  0 0

Apply the changes:

sudo mount -o remount /tmp

6. Harden the Kernel with sysctl

Edit /etc/sysctl.conf to strengthen the kernel’s security settings:

# Désactiver le transfert IP si ce n'est pas un routeur
net.ipv4.ip_forward = 0

# Protection contre les attaques de type Spoofing
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1

# Ignorer les réponses ICMP broadcast
net.ipv4.icmp_echo_ignore_broadcasts = 1

# Protection contre les attaques SYN flood
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_max_syn_backlog = 2048
net.ipv4.tcp_synack_retries = 2

# Protection contre les attaques de type martian packets
net.ipv4.conf.all.log_martians = 1
net.ipv4.conf.default.log_martians = 1

# Désactiver les pings (optionnel)
net.ipv4.icmp_echo_ignore_all = 1

# Désactiver le protocole IPv6 si non utilisé
net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1

Apply the changes:

sudo sysctl -p

7. Audit and Limit Installed Packages

Minimize the attack surface by installing only the packages you need.

List Installed Packages

# Debian/Ubuntu
dpkg -l

# RHEL/CentOS/Fedora
rpm -qa

Remove Unnecessary Packages

# Debian/Ubuntu
sudo apt remove paquet-inutile
sudo apt autoremove

# RHEL/CentOS/Fedora
sudo dnf remove paquet-inutile

Check Running Services

sudo systemctl list-units --type=service --state=active

Disable Non-Essential Services

sudo systemctl disable service-non-essentiel
sudo systemctl stop service-non-essentiel

8. Set Up an Intrusion Detection System

AIDE (Advanced Intrusion Detection Environment) is an integrity-checking tool that detects unauthorized changes to system files.

# Installation
sudo apt install aide # Debian/Ubuntu
sudo dnf install aide # RHEL/CentOS/Fedora

# Initialize the database
sudo aideinit
# or
sudo aide --init

# The command creates a database in /var/lib/aide/aide.db.new
# On some systems, you need to rename it
sudo mv /var/lib/aide/aide.db.new /var/lib/aide/aide.db

# Check integrity regularly
sudo aide --check

Set up a cron job for regular checks:

echo "0 4 * * * root /usr/sbin/aide --check | mail -s 'AIDE Integrity Check' admin@example.com" | sudo tee /etc/cron.d/aide-check

9. Strengthen the Password Policy

A strong password policy is essential, even if you use SSH key authentication.

Install libpam-pwquality on Debian/Ubuntu or pam_pwquality on RHEL/CentOS/Fedora.

sudo apt install libpam-pwquality # Debian/Ubuntu
sudo dnf install pam_pwquality # RHEL/CentOS/Fedora

Edit the /etc/pam.d/common-password file (Debian/Ubuntu) or /etc/security/pwquality.conf (RHEL/CentOS/Fedora):

# Exemple pour Debian/Ubuntu dans /etc/pam.d/common-password
password requisite pam_pwquality.so retry=3 minlen=12 difok=3 ucredit=-1 lcredit=-1 dcredit=-1 ocredit=-1 reject_username enforce_for_root

# Exemple pour RHEL/CentOS/Fedora dans /etc/security/pwquality.conf
minlen = 12
dcredit = -1
ucredit = -1
lcredit = -1
ocredit = -1
difok = 3

To configure password expiration:

sudo chage -M 90 -m 7 -W 14 utilisateur

This command:

• Forces a password change every 90 days (-M 90)
• Requires a minimum of 7 days between changes (-m 7)
• Warns the user 14 days before expiration (-W 14)

10. Monitor and Audit the System

Log monitoring is crucial for detecting intrusion attempts.

Set Up Centralized Logging

For a larger infrastructure, consider setting up a centralized logging server.

Configure auditd for Advanced Logging

# Installation
sudo apt install auditd audispd-plugins # Debian/Ubuntu
sudo dnf install audit # RHEL/CentOS/Fedora

# Enable at boot
sudo systemctl enable --now auditd

Edit /etc/audit/rules.d/audit.rules to add custom rules:

# Surveiller les modifications des fichiers de configuration
-w /etc/passwd -p wa -k identity
-w /etc/group -p wa -k identity
-w /etc/shadow -p wa -k identity
-w /etc/sudoers -p wa -k identity
-w /etc/ssh/sshd_config -p wa -k sshd_config

# Surveiller les échecs d'authentification
-a always,exit -F arch=b64 -S open -F a1&01003 -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access
-a always,exit -F arch=b32 -S open -F a1&01003 -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access
-a always,exit -F arch=b64 -S open -F a1&01003 -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access
-a always,exit -F arch=b32 -S open -F a1&01003 -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access

Reload the rules:

sudo auditctl -R /etc/audit/rules.d/audit.rules

Monitor Logins with LogWatch

# Installation
sudo apt install logwatch # Debian/Ubuntu
sudo dnf install logwatch # RHEL/CentOS/Fedora

# Manual run
sudo logwatch --output mail --mailto admin@example.com --detail high

Set up a cron job for daily reports by editing /etc/cron.daily/00logwatch.

Conclusion

Securing a Linux server is an ongoing process that requires vigilance and regular updates. These 10 steps will help you build a solid foundation to protect your systems against the majority of common threats.

Keep in mind that this list is not exhaustive. Depending on your environment and specific needs, you may need additional measures such as:

• Setting up automated backup solutions
• Implementing a role-based access control (RBAC) solution
• Using an intrusion prevention system (IPS)
• Setting up a VPN for remote access
• Implementing SELinux or AppArmor for mandatory access control

Security is a balance between functionality and protection. Always adapt these recommendations to your specific needs, and don’t hesitate to consult your Linux distribution’s official documentation for guidance tailored to your environment.

Which security measures have you found most effective for your Linux servers? Share your experience in the comments!