Linux Security: A Complete Guide to Protecting Your System

Security is a fundamental aspect of Linux system administration. Whether you manage a production server or a personal computer, protecting your system against threats is essential. This guide covers the best practices and techniques for effectively securing your Linux environment.

Core Security Principles

Regular System Updates

The first line of defense is keeping your system up to date:

# Pour Debian/Ubuntu
sudo apt update
sudo apt upgrade

# Pour Fedora/RHEL
sudo dnf upgrade

# Pour Arch Linux
sudo pacman -Syu

Configure automatic updates for security patches:

# Sur Debian/Ubuntu
sudo apt install unattended-upgrades
sudo dpkg-reconfigure unattended-upgrades

User and Permission Management

Principle of Least Privilege

# Créer un utilisateur standard (non root)
sudo adduser nouvel_utilisateur

# Ajouter aux sudoers (pour les tâches administratives)
sudo usermod -aG sudo nouvel_utilisateur

# Vérifier les groupes d'un utilisateur
groups utilisateur

Strengthening Passwords

# Configurer une politique de mots de passe forts
sudo apt install libpam-pwquality
sudo nano /etc/security/pwquality.conf

# Paramètres recommandés
# minlen = 12
# minclass = 3
# enforce_for_root

Network Security

Firewall Configuration

UFW (Uncomplicated Firewall) simplifies firewall management:

# Installation
sudo apt install ufw

# Configuration de base
sudo ufw default deny incoming
sudo ufw default allow outgoing

# Autoriser SSH
sudo ufw allow ssh

# Autoriser d'autres services si nécessaire
sudo ufw allow 80/tcp  # HTTP
sudo ufw allow 443/tcp  # HTTPS

# Activer le pare-feu
sudo ufw enable

# Vérifier le statut
sudo ufw status verbose

Securing SSH

SSH is often the main target of attacks:

# Éditer la configuration SSH
sudo nano /etc/ssh/sshd_config

Recommended changes:

# Désactiver la connexion root
PermitRootLogin no

# Utiliser uniquement le protocole SSH v2
Protocol 2

# Désactiver l'authentification par mot de passe
PasswordAuthentication no

# Limiter les utilisateurs autorisés
AllowUsers utilisateur1 utilisateur2

# Changer le port par défaut (optionnel mais efficace)
Port 2222

# Limiter les tentatives d'authentification
MaxAuthTries 3

Restart the SSH service:

sudo systemctl restart sshd

SSH Key Authentication

# Sur votre machine locale, générer une paire de clés
ssh-keygen -t ed25519 -C "votre_email@exemple.com"

# Copier la clé publique sur le serveur
ssh-copy-id -i ~/.ssh/id_ed25519.pub utilisateur@serveur

# Ou manuellement
cat ~/.ssh/id_ed25519.pub | ssh utilisateur@serveur "mkdir -p ~/.ssh && cat >> ~/.ssh/authorized_keys"

Intrusion Protection

Fail2ban - Protection Against Brute-Force Attacks

# Installation
sudo apt install fail2ban

# Configuration
sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
sudo nano /etc/fail2ban/jail.local

Recommended configuration:

[sshd]
enabled = true
port = ssh
filter = sshd
logpath = /var/log/auth.log
maxretry = 3
bantime = 3600

Start and enable the service:

sudo systemctl enable fail2ban
sudo systemctl start fail2ban

Intrusion Detection with AIDE

AIDE (Advanced Intrusion Detection Environment) monitors file changes:

# Installation
sudo apt install aide

# Initialiser la base de données
sudo aideinit

# Vérifier les modifications
sudo aide --check

System Hardening

Disabling Unnecessary Services

# Lister les services actifs
systemctl list-units --type=service --state=active

# Désactiver un service
sudo systemctl disable service_inutile
sudo systemctl stop service_inutile

Securing the Bootloader

# Définir un mot de passe GRUB
sudo grub-mkpasswd-pbkdf2
sudo nano /etc/grub.d/40_custom

# Ajouter les lignes suivantes
# set superusers="admin"
# password_pbkdf2 admin <mot_de_passe_généré>

# Mettre à jour GRUB
sudo update-grub

Data Encryption

# Chiffrer le répertoire personnel
sudo apt install ecryptfs-utils
sudo ecryptfs-migrate-home -u utilisateur

# Chiffrer une partition complète (lors de l'installation)
# Utiliser LUKS via l'installateur de votre distribution

Monitoring and Logging

Logging Configuration

# Vérifier les journaux système
sudo journalctl -xe

# Surveiller les tentatives de connexion
sudo tail -f /var/log/auth.log

# Configurer la rotation des journaux
sudo nano /etc/logrotate.conf

Monitoring Tools

# Installer des outils de surveillance
sudo apt install logwatch
sudo apt install auditd

# Configurer des rapports quotidiens
sudo nano /etc/cron.daily/00logwatch

Security Audits

Lynis - Security Auditing Tool

# Installation
sudo apt install lynis

# Exécuter un audit complet
sudo lynis audit system

# Générer un rapport
sudo lynis audit system --report-file /tmp/lynis-report.dat

OpenVAS - Vulnerability Scanner

# Installation (peut varier selon la distribution)
sudo apt install openvas

# Configuration initiale
sudo openvas-setup

# Accéder à l'interface web
# https://localhost:9392

Additional Best Practices

Secure Backups

# Utiliser rsync avec SSH
rsync -avz -e ssh /chemin/source utilisateur@serveur:/chemin/destination

# Automatiser avec cron
# 0 2 * * * rsync -avz -e ssh /chemin/source utilisateur@serveur:/chemin/destination

Isolation with AppArmor or SELinux

# AppArmor (Ubuntu/Debian)
sudo apt install apparmor apparmor-utils
sudo aa-enforce /etc/apparmor.d/*

# SELinux (Fedora/RHEL)
sudo dnf install selinux-policy-targeted
sudo setenforce 1

Conclusion

Linux security is an ongoing process that requires vigilance and regular updates. By applying the measures described in this guide, you will establish a solid foundation for protecting your system against most common threats.

Keep in mind that perfect security doesn’t exist, but a defense-in-depth approach with multiple layers of protection significantly reduces risk. Stay informed about the latest vulnerabilities and adapt your security strategy accordingly.