Linux Hardening Guide
Linux OS Hardening: A Comprehensive Guide to Enhancing Security#
Securing a Linux operating system, commonly referred to as “hardening,” is a critical process for protecting systems from cyber threats and unauthorized access. It involves a multi-layered approach to reduce the system’s attack surface and minimize vulnerabilities. This summary outlines key areas and best practices for hardening a Linux environment.
1. Minimize the Attack Surface:
- Remove Unnecessary Software: Uninstall any packages, applications, and services that are not essential for the system’s intended purpose. A minimal installation is generally more secure. Regularly audit installed software.
- Disable Unused Services: Stop and disable services that are not actively in use. This can be done using tools like
systemctl
(for systemd-based systems) orservice
andchkconfig
(for older init systems). - Physical Security & BIOS/UEFI Protection:
- Secure physical access to the server.
- Set strong BIOS/UEFI passwords to prevent unauthorized changes to boot order or settings.
- Enable SecureBoot to ensure only signed code is loaded during the boot process.
- Disable booting from external devices like USB drives or CDs/DVDs if not required.
- Disable unused USB ports or other hardware interfaces in the BIOS/UEFI.
2. Secure User Accounts and Access Control:
- Strong Authentication:
- Enforce strong password policies: require complexity (mix of uppercase, lowercase, numbers, symbols) and a minimum length (e.g., 10-16 characters).
- Implement password aging, forcing users to change passwords regularly (e.g., every 90 days).
- Prevent password reuse.
- Consider using password managers.
- Two-Factor Authentication (2FA): Implement 2FA for an additional layer of security, especially for SSH and other critical access points.
- Principle of Least Privilege:
- Create dedicated user accounts for specific tasks instead of using the root account for daily operations.
- Use
sudo
to grant specific administrative privileges to regular users only when necessary. Limit the use ofsudo
. - Ensure only the root user has User ID (UID) 0.
- Disable Root Login: Disable direct root login via SSH. Administrators should log in with their user accounts and then use
sudo
if elevated privileges are needed. - Account Management:
- Regularly audit user accounts and remove or disable inactive accounts.
- Lock user accounts after a certain number of failed login attempts (e.g., using
fail2ban
or PAM configurations).
- SSH Hardening:
- Use SSH key-based authentication instead of password-based authentication, as it’s significantly more secure.
- Change the default SSH port (22) to a non-standard port.
- Disable SSH password authentication if using key-based authentication.
- Restrict which users can log in via SSH using
AllowUsers
orAllowGroups
in thesshd_config
file. - Keep OpenSSH server software up to date.
3. Configure Network Security:
- Firewall Implementation:
- Enable and configure a host-based firewall (e.g.,
iptables
,nftables
, or user-friendly frontends likeufw
). - Implement a “default deny” policy, blocking all incoming traffic by default and only allowing traffic to explicitly approved services and ports (e.g., SSH, HTTP/HTTPS if it’s a web server).
- Block ICMP traffic (ping requests) if not necessary, as it can be used for network reconnaissance.
- Enable and configure a host-based firewall (e.g.,
- Minimize Open Ports: Regularly scan for open ports using tools like
netstat
orss
. Close any ports that are not absolutely necessary for the system’s function. - Network Parameters/Kernel Tuning:
- Disable IP forwarding if the system is not intended to be a router (
net.ipv4.ip_forward = 0
). - Disable ICMP redirect acceptance (
net.ipv4.conf.all.accept_redirects = 0
andnet.ipv4.conf.default.accept_redirects = 0
). - Disable sending ICMP redirects (
net.ipv4.conf.all.send_redirects = 0
andnet.ipv4.conf.default.send_redirects = 0
). - Enable TCP SYN Cookies (
net.ipv4.tcp_syncookies = 1
) to help mitigate SYN flood attacks. - Enable protection against bogus ICMP error responses (
net.ipv4.icmp_ignore_bogus_error_responses = 1
).
- Disable IP forwarding if the system is not intended to be a router (
- TCP Wrappers: If applicable, use TCP Wrappers (
/etc/hosts.allow
and/etc/hosts.deny
) for an additional layer of access control for network services.
4. Harden File Systems and Data:
- Full Disk Encryption: Encrypt hard disks (especially for laptops and sensitive servers) to protect data at rest. This prevents unauthorized access if the physical disks are stolen.
- Partitioning Strategy:
- Create separate partitions for critical directories like
/tmp
,/var
,/var/log
,/var/log/audit
, and/home
. This helps prevent one partition from filling up and affecting the entire system and allows for more granular mount options.
- Create separate partitions for critical directories like
- Mount Options:
- Set restrictive mount options for partitions in
/etc/fstab
. For example, usenodev
(do not interpret character or block special devices),nosuid
(do not allow set-user-identifier or set-group-identifier bits to take effect), andnoexec
(do not allow execution of binaries) on partitions like/tmp
,/var/tmp
, and/home
where appropriate.
- Set restrictive mount options for partitions in
- File Permissions:
- Ensure file and directory permissions are restrictive. Use the principle of least privilege, granting only the necessary read, write, and execute permissions.
- Regularly check for world-writable files and directories and restrict them.
- Lock Boot Directory: Protect the boot directory (e.g.,
/boot
or/boot/efi
) by setting appropriate ownership (root:root) and read-only permissions where possible for critical bootloader configuration files likegrub.cfg
.
5. Implement Robust Logging and Auditing:
- Enable and Configure Auditing: Use the Linux Audit Daemon (
auditd
) to log security-relevant events, such as system calls, file access, and administrative actions. - Centralized Logging: Send logs to a secure, centralized log server. This protects logs from being tampered with if a system is compromised and aids in correlation and analysis. Tools like
rsyslog
orsyslog-ng
can be configured for this. - Monitor Critical Logs: Regularly review system logs for suspicious activity, failed login attempts, and other security events.
- File Integrity Monitoring: Implement file integrity monitoring tools (e.g., AIDE, Tripwire) to detect unauthorized changes to critical system files and configurations.
- Restrict Core Dumps: Limit or disable core dumps (
fs.suid_dumpable = 0
andhard core 0
in/etc/security/limits.conf
) as they can contain sensitive information.
6. Apply Kernel Hardening:
- Keep the Kernel Updated: Regularly update the Linux kernel to apply the latest security patches that address known vulnerabilities. Consider rebootless patching solutions for critical systems.
- Kernel Security Modules: Utilize security modules like SELinux (Security-Enhanced Linux) or AppArmor. These provide Mandatory Access Control (MAC) mechanisms to further restrict the actions of processes beyond standard Discretionary Access Control (DAC) permissions.
- Kernel Parameter Tuning (sysctl): In addition to network parameters, other
sysctl
settings can enhance security (e.g., related to ASLR, restricting access to kernel pointers). - Secure Boot: (Mentioned earlier) Ensures the integrity of the boot process.
7. Manage Software Securely:
- Regular Updates and Patching: Keep all installed software, including the operating system and applications, up to date with the latest security patches. Automate this process where feasible.
- Use Trusted Repositories: Only install software from official and trusted package repositories. Be cautious when adding third-party repositories.
- Software Bill of Materials (SBOM): Maintain an inventory of all software components and their versions to quickly identify and address vulnerabilities.
8. Regularly Audit and Test:
- Security Audits: Conduct regular security audits using tools like Lynis or OpenSCAP to identify potential vulnerabilities and misconfigurations.
- Vulnerability Scanning: Perform regular vulnerability scans with tools like OpenVAS or Nessus.
- CIS Benchmarks: Consider using the Center for Internet Security (CIS) Benchmarks for your specific Linux distribution as a guide for comprehensive hardening. These benchmarks provide detailed configuration recommendations.
Key Principles:
- Defense in Depth: Employ multiple layers of security controls.
- Stay Informed: Keep up to date with the latest security threats and best practices.
- Documentation: Document your hardening procedures and system configurations.
- Backups: Regularly back up critical data and test the restoration process.
Linux OS hardening is an ongoing process, not a one-time task. Continuous monitoring, regular updates, and periodic reviews of security configurations are essential to maintain a secure system.