Introduction

Linux server hardening is a critical process to reduce the attack surface and ensure system integrity. Combined with periodic maintenance, it ensures the server operates securely and efficiently. In this technical guide, we will explore best practices for hardening and maintaining Linux servers, from initial configuration to continuous monitoring.

1. Secure Initial Configuration

1.1. System Updates

Keeping the system updated is the first step. Use apt update && apt upgrade (Debian/Ubuntu) or yum update (RHEL/CentOS). Configure automatic security updates with unattended-upgrades.

1.2. Disable Unnecessary Services

Review running services with systemctl list-units --type=service --state=running and disable those not needed. For example, systemctl disable cups if you don't use printing.

1.3. Configure Firewall

Use ufw or iptables. Example with UFW: ufw default deny incoming, ufw default allow outgoing and enable only essential ports (SSH, HTTP/HTTPS).

2. Access Security

2.1. Secure SSH Authentication

• Disable root login: PermitRootLogin no in /etc/ssh/sshd_config.
• Use public key authentication.
• Change SSH port (optional).
• Implement fail2ban to prevent brute force attacks.

2.2. User and Permission Management

Use the principle of least privilege. Create users with useradd and assign permissions with chmod and chown. Configure sudo for administrative tasks.

3. File System Protection

Mount partitions with secure options like noexec, nosuid, and nodev in /etc/fstab. Implement SELinux or AppArmor for mandatory access control.

4. Periodic Maintenance

4.1. Log Monitoring

Review /var/log regularly. Use logrotate to manage rotation. Tools like auditd allow detailed auditing.

4.2. Vulnerability Analysis

Scan periodically with lynis or OpenVAS. Maintain an inventory of software and its versions.

4.3. Backups

Automate backups with rsync or tar. Store copies on a remote server. As we saw in our article on Work Orders, process documentation is key.

5. Additional Tools

• ClamAV: Antivirus for Linux.
• rkhunter: Rootkit detection.
• aide: File integrity monitor.

Conclusion

Linux server hardening and maintenance is an ongoing process. Implementing these practices significantly reduces security risks. For more technical guides, visit our Guides and Tutorials section.