Hardening Linux: updates, permissions and Lynis

In short: Hardening means setting up a system so that it offers as little attack surface as possible. The basics are surprisingly simple: keep it current, few services, few rights, good login.

The checklist

1. Automatic updates: apply security updates regularly (unattended-upgrades on Debian/Ubuntu, dnf-automatic on Fedora/RHEL), see Package management on Linux.
2. Only needed services: systemctl list-unit-files --state=enabled, switch off the superfluous (systemd).
3. Firewall: block everything by default, open only what is needed (Linux firewall).
4. Secure SSH: keys instead of passwords, root login off, see SSH on Linux.
5. Few rights: normal users, sudo only where needed, services with their own user (Users, groups and file permissions).
6. Mandatory access control: keep SELinux and AppArmor enabled.
7. Encryption: disk with LUKS (partitions, LVM and encryption), traffic with HTTPS.
8. Slow down brute force: fail2ban blocks addresses after many failed attempts.
9. Read the logs: logs and scheduling.
10. Test backups (backups on Linux).

Lynis

lynis audit system checks the system and delivers a list of warnings and suggestions and a hardening index. Do not blindly apply every suggestion, but as a checklist it is very useful.

Attitude

Security is a continuous task, not a state. Every additional piece of software is more attack surface, every secret in plain text a risk.

See also: Linux in the data centre