The Practical Linux Hardening Guide

"Did you know all your doors were locked?" - Riddick (The Chronicles of Riddick)

_{Created by trimstray and contributors}

💥 Work in progress, just a moment... First, I update a Table Of Content.

---

Table Of Content

• Checklist - document the host information
• Pre install tasks
  • Physical system security
    • BIOS protection
  • Partitioning scheme
  • Hard disk encryption
  • Bootloader configuration
• Post install tasks
  • Disk partitions
    • Lock the boot directory
    • Secure /tmp and /var/tmp
    • Disk quotas
  • Keep system updated
  • Package management
    • Remove packages with known issues
  • Netfilter ruleset
  • TCP wrapper
  • Users and groups
    • Limit su access
    • Disable root account
    • Logins to system console
    • Disable shell accounts
    • Strong password policy
    • Password aging
    • Previous passwords
    • Login failures
  • System path permissions
    • World writable files
  • PAM module
  • Limits
  • Shadow passwords
  • Linux kernel hardening
  • Kernel parameters
    • Improve network security
    • Improve system security
  • Remove unused modules
  • Secure shared memory
  • IRQ balance
  • Disable compilers
  • Email notifications
  • Backups
  • External devices
    • Disable USB usage
• Tools
  • Logging and Auditing
    • Auditd
    • Tiger
    • Aide
    • Logwatch
  • Other
    • Fail2ban
    • PSAD
    • SELinux
    • Entropy daemon
    • Centralized authentication service
  • Testing tools
    • Lynis
    • Chrootkit
• Hardening Services
  • Disable all unnecessary
  • System services
    • OpenSSH
    • NTP
    • Cron
    • Anacron
    • GnuPG 2
      • Unattended key generation
  • DNS services
    • Bind9
  • Mail services
    • Postfix
  • Web services
    • Nginx
    • Apache
    • Securing and tuning HTTP/HTTPS protocols
      • Use HTTPS
      • Enable HTTP2
      • Separate domains
      • Redirect all unencrypted traffic to HTTPS
      • Enable HTTP Strict Transport Security
      • Security related headers
  • Databases
    • PostgreSQL
    • MySQL
    • Redis
  • Queues
    • AMQP
• Deployment
• Testing configuration
• External resources