The Practical Linux Hardening Guide

"Did you know all your doors were locked?" - Riddick (The Chronicles of Riddick)

_{Created by trimstray and contributors}

I'm back, work in progress...

---

Table of Contents

• Introduction
  • General disclaimer
  • The importance of Linux hardening
  • How to hardening GNU/Linux?
• Policy Compliance
  • Center of Internet Security (CIS)
  • Security Technical Implementation Guide (STIG)
  • Security Content Automation Protocol (SCAP)
• DevSec Hardening Framework
• Contributing
• Other official hardening guides
• Pre install tasks
  • Physical system security
    • Introduction
    • Secure rooms
    • Monitoring
    • Air conditioning
    • Fire protection
    • Locked racks
    • Console security
    • BIOS protection
    • Summary checklist
  • Hard disk encryption
    • Introduction
    • Encrypt root filesystem
    • Encrypt /boot partition
    • Swap partition
    • Summary checklist
• Post install tasks
  • Bootloader configuration (grub)
    • Introduction
    • Protect bootloader with password
    • Protect bootloader config files
    • Summary checklist
  • Disk partitions
    • Introduction
    • Separate disk partitions
    • Mount options: nodev, noexec and nosuid
    • Secure /boot directory
    • Secure /tmp and /var/tmp
    • Secure /dev/shm
    • Secure /proc filesystem
    • Swap partition
    • Disk quotas
    • Summary checklist
  • Keep system updated
  • Package management
    • Automatic security updates
    • Remove packages with known issues
  • Netfilter ruleset
  • TCP wrapper
  • Users and groups
    • Limit su access
    • Disable root account
    • Logins to system console
    • Disable shell accounts
    • Strong password policy
    • Password aging
    • Previous passwords
    • Login failures
    • Protect single user mode
  • System path permissions
    • World writable files
  • PAM module
  • Limits
  • Shadow passwords
  • Linux kernel hardening
    • Kernel parameters
      • Network security
      • System security
  • Remove unused modules
  • Secure shared memory
  • IRQ balance
  • Disable compilers
  • Email notifications
    • Rebooting the system
  • Backups
  • External devices
    • Disable USB usage
• Tools
  • Logging and Auditing
    • Auditd
    • Tiger
    • Aide
    • Logwatch
  • Other
    • Fail2ban
    • PSAD
    • SELinux
    • Entropy daemon
    • Centralized authentication service
  • Testing tools
    • Lynis
    • Chrootkit
• Services
  • Disable all unnecessary services
    • Common unix print system
    • Summary checklist
  • System services
    • OpenSSH
    • NTP
    • Cron
    • Anacron
    • GnuPG 2
      • Unattended key generation
  • DNS services
    • Bind9
  • Mail services
    • Postfix
  • Web services
    • Nginx
      • Files and directories permissions
      • Use HTTPS
      • Enable HTTP2
      • Separate domains
      • Redirect all unencrypted traffic to HTTPS
      • Enable HTTP Strict Transport Security
      • Diffie Hellman Ephemeral Parameter
      • Security related headers
    • Apache
  • Databases
    • PostgreSQL
    • MySQL
    • Redis
  • Queues
    • AMQP
• Containers
  • LXC/LXD
  • Docker
  • Hashicorp suite
• Deployment
• Testing configuration
• External resources

Introduction

General disclaimer

This Hardening Guide provide a high-level overview of the security hardening GNU/Linux systems. It is not an official standard but it touches and use industry standards.

Before you start remember:

The Practical Linux Hardening Guide also contains my comments that may be differ from certain industry standards. If you are not sure what to do please see Policy Compliance and think about what you actually do at your server.

The importance of Linux hardening

Out of the box, Linux servers don’t come "hardened" (e.g. with the attack surface minimized). It’s up to you to prepare for each eventuality and set up systems to notify you of any suspicious activity in the future.

How to hardening GNU/Linux?

In my opinion you should definitely drop all non-industry policies, articles, manuals and other. We have a lot of great GNU/Linux hardening policies to provide safer operating systems compatible with security protocols and security policies.

Primarily you should use Security Benchmarks/Policies which describe consensus best practices for the secure configuration of target systems because configuring your systems in compliance with e.g. CIS has been shown to eliminate 80-95% of known security vulnerabilities.

Policy Compliance

Center of Internet Security (CIS)

The Center for Internet Security (CIS) is a nonprofit organization focused on improving public and private-sector cybersecurity readiness and response.

Security Technical Implementation Guide (STIG)

A Security Technical Implementation Guide (STIG) is a cybersecurity methodology for standardizing security protocols within networks, servers, computers, and logical designs to enhance overall security.

Security Content Automation Protocol (SCAP)

Security Content Automation Protocol (SCAP) provides a mechanism to check configurations, vulnerability management and evaluate policy compliance for a variety of systems. One of the most popular implementations of SCAP is OpenSCAP and it is very helpful for vulnerability assessment and also as hardening helper.

DevSec Hardening Framework

Security + DevOps: Automatic Server Hardening.

This project covered a lot of the things in this guide, which can be automated (e.g. setting of grub password or enforcing the permissions of the common directories).

Project: DevSec Hardening Framework + GH repository: dev-sec.

Thanks for @artem-sidorenko!

Contributing

If you find something which doesn't make sense, or one of these doesn't seem right, or something seems really stupid; please make a pull request or please add valid and well-reasoned opinions about your changes or comments.

Before add pull request please see this.

Other official hardening guides

Type of hardening guide	Comments
STIGs Master List
Arch Linux
CentOS Linux
Debian GNU/Linux	old guide - to update
Fedora Linux	old guide - to update
Red Hat Enterprise
Slackware Linux	some data may not be available
Ubuntu Linux	some data may not be available