Tuning Linux for Security: Essential Tips

Update and Patch Regularly
Strengthen User Account Security
Harden File and Directory Permissions
Configure a Firewall
Secure SSH Access
Implement System Auditing and Intrusion Detection
Harden the Linux Kernel
Secure Applications and Services
Enable Logging and Monitoring
Backup and Disaster Recovery
Conclusion
References

1. Update and Patch Regularly

Why it matters: Outdated software is one of the top attack vectors. Vulnerabilities in the Linux kernel, libraries, or applications (e.g., OpenSSL, Apache) are frequently exploited by attackers. Regular updates patch these flaws before they can be weaponized.

How to implement:

Automate updates: Use your distribution’s package manager to keep the system and installed software up-to-date.
- Debian/Ubuntu: sudo apt update && sudo apt upgrade -y (for manual updates) or enable unattended-upgrades for automation:
```
sudo apt install unattended-upgrades  
sudo dpkg-reconfigure -plow unattended-upgrades  # Enable automatic security updates  
```
- RHEL/CentOS/Rocky Linux: sudo dnf update -y or use dnf-automatic:
```
sudo dnf install dnf-automatic  
sudo systemctl enable --now dnf-automatic.timer  
```
Audit third-party software: Remove unused apps (e.g., sudo apt purge <package>) and avoid untrusted repositories (PPAs, RPM fusion).

2. Strengthen User Account Security

User accounts are often the weakest link. Compromised credentials can grant attackers unrestricted access.

Key steps:

Enforce strong passwords:

Use pam_pwquality to enforce complexity (e.g., minimum length, mixed case, symbols). Edit /etc/security/pwquality.conf:

minlen = 12  
dcredit = -1  # Require at least 1 digit  
ucredit = -1  # Require at least 1 uppercase letter  
lcredit = -1  # Require at least 1 lowercase letter  
ocredit = -1  # Require at least 1 symbol

Set password expiration with /etc/login.defs:

PASS_MAX_DAYS 90   # Expire after 90 days  
PASS_MIN_DAYS 7    # No changes for 7 days  
PASS_WARN_AGE 14   # Warn 14 days before expiration

Limit sudo privileges:
- Use visudo to edit /etc/sudoers and restrict users to specific commands (avoid ALL=(ALL) ALL for non-admins):
```
alice ALL=(ALL) /usr/bin/apt, /usr/bin/systemctl restart apache2  # Restrict Alice to apt and Apache restarts  
```
Disable root login:
- For local access: Set PermitRootLogin no in /etc/ssh/sshd_config (see Secure SSH Access).
- For physical access: Use sudo passwd -l root to lock the root account (reversible with sudo passwd -u root).
Remove unused accounts:
- Audit accounts with cat /etc/passwd and delete obsolete ones: sudo userdel -r <username> (the -r flag removes home directories).
Enable Multi-Factor Authentication (MFA):
- Use pam_google_authenticator or pam_u2f (for hardware keys like YubiKey). For SSH, add auth required pam_google_authenticator.so to /etc/pam.d/sshd.

3. Harden File and Directory Permissions

Incorrect file permissions can expose sensitive data (e.g., /etc/shadow, private keys) or allow privilege escalation.

Best practices:

Follow the principle of least privilege:
- Restrict read/write/execute access to only necessary users/groups. For example:
  - User home directories: chmod 700 /home/<user> (no access to others).
  - SSH keys: chmod 600 ~/.ssh/id_rsa (read/write for owner only).
  - Sensitive configs: /etc/sudoers should have 0440 permissions.
Secure critical system files:
- Use chattr to make files immutable (prevents accidental/ malicious modification):
```
sudo chattr +i /etc/passwd /etc/shadow /etc/sudoers  # +i = immutable  
```
  (Use chattr -i to reverse when updates are needed.)
Set a strict umask:
- The umask defines default permissions for new files. Edit /etc/profile or ~/.bashrc to set umask 027 (new files: 640, directories: 750).

Audit permissions with find:

Identify world-writable files (high risk):

find / -perm -0002 -type f 2>/dev/null  # Ignore errors with 2>/dev/null

4. Configure a Firewall

A firewall acts as a gatekeeper, blocking unauthorized network traffic. Linux offers powerful built-in tools for this.

Options:

UFW (Uncomplicated Firewall): Simple for beginners (default on Ubuntu):

sudo ufw default deny incoming   # Block all incoming traffic  
sudo ufw default allow outgoing  # Allow all outgoing traffic  
sudo ufw allow 22/tcp            # Allow SSH (adjust port if needed)  
sudo ufw allow 443/tcp           # Allow HTTPS  
sudo ufw enable                  # Start firewall on boot  
sudo ufw status verbose          # Verify rules

Firewalld: Dynamic firewall (default on RHEL/CentOS):

sudo firewall-cmd --set-default-zone=drop  # Block incoming by default  
sudo firewall-cmd --add-service=ssh --permanent  # Allow SSH  
sudo firewall-cmd --reload  # Apply changes

iptables: Advanced, low-level control (use for complex rules):

sudo iptables -P INPUT DROP    # Default drop incoming  
sudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT  # Allow SSH  
sudo iptables-save > /etc/iptables/rules.v4  # Persist rules (Debian/Ubuntu)

Tips:

Log dropped packets for auditing: Add --log-prefix "FIREWALL DROP: " to iptables rules.
Use stateful rules: Allow established connections with iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT.

5. Secure SSH Access

SSH is the primary way to remote-manage Linux systems—making it a prime target for attackers.

Hardening steps:

Disable password authentication: Use SSH keys instead. Edit /etc/ssh/sshd_config:
```
PasswordAuthentication no  
PubkeyAuthentication yes  
```

Restrict SSH access:

PermitRootLogin no          # No direct root login  
AllowUsers alice bob        # Only allow specific users  
AllowGroups ssh-users       # Or specific groups  
MaxAuthTries 3              # Lock after 3 failed attempts  
X11Forwarding no            # Disable GUI forwarding (reduces attack surface)

Use modern SSH protocol: Ensure Protocol 2 (only) is enabled (default in newer OpenSSH).
Harden SSH key management:
- Use ED25519 keys (more secure than RSA): ssh-keygen -t ed25519.
- Protect keys with a passphrase (ssh-keygen -p to add one later).
Block brute-force attacks with fail2ban:
- Install and enable fail2ban to ban IPs after repeated failed SSH attempts:
```
sudo apt install fail2ban  
sudo systemctl enable --now fail2ban  
```
  (Config in /etc/fail2ban/jail.local.)

6. Implement System Auditing and Intrusion Detection

Even with firewalls and strong permissions, you need to detect breaches after they occur.

Tools to use:

auditd: Logs system events (file access, process execution, user actions).
- Install: sudo apt install auditd (RHEL/CentOS: pre-installed).
- Monitor sensitive files with rules in /etc/audit/rules.d/audit.rules:
```
-w /etc/passwd -p wa -k passwd_changes  # Log write/append to passwd  
-w /usr/bin/sudo -p x -k sudo_exec     # Log sudo execution  
```
- Search logs with ausearch -k passwd_changes.
File Integrity Monitoring (FIM): Detect unauthorized file changes with tools like:
- AIDE (Advanced Intrusion Detection Environment):
```
sudo apt install aide  
sudo aideinit  # Generate baseline  
sudo aide --check  # Compare current state to baseline  
```
- Tripwire or OSSEC: Enterprise-grade FIM with alerting.

Lynis: A security auditing tool that scans for vulnerabilities:

sudo apt install lynis  
sudo lynis audit system  # Generates a detailed report

7. Harden the Linux Kernel

The kernel is the core of the OS; hardening it reduces attack surface and mitigates exploits.

Key techniques:

Secure GRUB bootloader:
- Set a GRUB password to prevent tampering with boot options (e.g., single-user mode). Edit /etc/grub.d/00_header and run sudo update-grub.
- Disable risky features in /etc/default/grub:
```
GRUB_CMDLINE_LINUX_DEFAULT="quiet splash nousb noexec=nosuid"  # Disable USB, noexec on /tmp  
```

Tweak sysctl parameters:
Edit /etc/sysctl.conf or /etc/sysctl.d/99-security.conf to enable kernel protections:

# Network hardening  
net.ipv4.conf.all.rp_filter=1        # Enable reverse path filtering  
net.ipv4.tcp_syncookies=1            # Mitigate SYN floods  
net.ipv4.icmp_echo_ignore_broadcasts=1  # Block broadcast pings  

# Memory protection  
kernel.randomize_va_space=2          # Enable ASLR (Address Space Layout Randomization)  
kernel.exec-shield=1                 # Prevent execution of stack memory

Apply changes with sudo sysctl -p.

Enable AppArmor/SELinux:
- AppArmor (default on Ubuntu): Enforces mandatory access control (MAC). Enable with sudo aa-enforce /etc/apparmor.d/*.
- SELinux (default on RHEL/CentOS): More strict than AppArmor. Set to enforcing mode in /etc/selinux/config.
Disable unused kernel modules:
Blacklist unnecessary modules (e.g., usb_storage, firewire) in /etc/modprobe.d/blacklist.conf:
```
blacklist usb_storage  
blacklist firewire-core  
```

8. Secure Applications and Services

Even a hardened OS is vulnerable if applications are misconfigured.

Best practices:

Minimize installed software: Use dpkg -l (Debian) or rpm -qa (RHEL) to list packages and remove bloatware.
Run services as non-root users:
- Web servers (Nginx/Apache): Configure to run as www-data or apache (not root).
- Databases (MySQL/PostgreSQL): Use dedicated system users.
Secure web servers:
- Enable TLS 1.3 only (disable TLS 1.0/1.1). For Nginx, edit /etc/nginx/nginx.conf:
```
ssl_protocols TLSv1.3;  
ssl_prefer_server_ciphers on;  
```
- Add security headers (e.g., Strict-Transport-Security, X-Content-Type-Options).
Container security:
- For Docker, run containers as non-root users and enable seccomp profiles:
```
docker run --user 1000:1000 --security-opt seccomp=default.json myimage  
```

9. Enable Logging and Monitoring

Logs are critical for post-incident analysis. Centralized logging and real-time monitoring help detect breaches early.

Steps:

Centralize logs with rsyslog/Graylog:
- Configure rsyslog to forward logs to a central server (e.g., Graylog, ELK Stack). Edit /etc/rsyslog.conf to send logs to @central-log-server:514.
Rotate logs to prevent disk bloat:
- Use logrotate (configured in /etc/logrotate.conf). Set max log size and retention (e.g., weekly, rotate 4).
Monitor with tools like Prometheus/Grafana:
- Track system metrics (CPU, memory, network) and set alerts for anomalies (e.g., sudden spikes in SSH failed logins).
Automate alerting: Use tools like Nagios or Zabbix to trigger alerts for critical events (e.g., auditd logs of /etc/passwd changes).

10. Backup and Disaster Recovery

Even with perfect security, backups are your last line of defense against data loss (e.g., ransomware, hardware failure).

Backup best practices:

Encrypt backups: Use tools like borgbackup or rsync -e ssh with encrypted storage (e.g., LUKS-encrypted external drives).
Store backups offsite: Cloud storage (AWS S3, Backblaze) or physical media in a secure location.
Test restores regularly: A backup is useless if you can’t restore from it.

Automate backups: Use cron jobs to run borg create or rsync nightly. For example:

# Cron job to backup /home daily at 2 AM  
0 2 * * * /usr/bin/borg create --exclude-caches /backup/borg::$(date +%Y-%m-%d) /home

Conclusion

Securing Linux is a continuous process, not a one-time task. By combining these tips—from patching and user management to firewall rules and backups—you’ll create a layered defense that significantly reduces risk. Regularly audit your system with tools like lynis or aide, stay updated on new vulnerabilities, and adapt your strategy as threats evolve. Remember: the goal isn’t perfection, but resilience.

References

Ubuntu Server Security Guide
Red Hat Enterprise Linux Security Guide
UFW Documentation
SELinux Project Wiki
NIST Special Publication 800-171 (Security for Non-Federal Systems)
Lynis Security Scanner
BorgBackup Documentation

Table of Contents

1. Update and Patch Regularly

How to implement:

2. Strengthen User Account Security

Key steps:

3. Harden File and Directory Permissions

Best practices:

4. Configure a Firewall

Options:

Tips:

5. Secure SSH Access

Hardening steps:

6. Implement System Auditing and Intrusion Detection

Tools to use:

7. Harden the Linux Kernel

Key techniques:

8. Secure Applications and Services

Best practices:

9. Enable Logging and Monitoring

Steps:

10. Backup and Disaster Recovery

Backup best practices:

Conclusion

References