How To Secure A Linux Server

An evolving how-to guide for securing a Linux server that, hopefully, also teaches you a little about security and why it matters.

Table of Contents

• Introduction
• Guide Objective
• Why Secure Your Server
• Why Yet Another Guide
• Other Guides
• To Do / To Add
• Guide Overview
• About This Guide
• My Use-Case
• Editing Configuration Files - For The Lazy
• Contributing
• Before You Start
• Identify Your Principles
• Picking A Linux Distribution
• Installing Linux
• Pre/Post Installation Requirements
• Other Important Notes
• Using Ansible Playbooks to secure your Linux Server
• The SSH Server
• Important Note Before You Make SSH Changes
• SSH Public/Private Keys
• Create SSH Group For AllowGroups
• Secure /etc/ssh/sshd_config
• Remove Short Diffie-Hellman Keys
• 2FA/MFA for SSH
• The Basics
• Limit Who Can Use sudo
• Limit Who Can Use su
• Run applications in a sandbox with FireJail
• NTP Client
• Securing /proc
• Force Accounts To Use Secure Passwords
• Automatic Security Updates and Alerts
• More Secure Random Entropy Pool (WIP)
• Add Panic/Secondary/Fake password Login Security System
• The Network
• Firewall With UFW (Uncomplicated Firewall)
• Docker And UFW
• iptables Intrusion Detection And Prevention with PSAD
• Application Intrusion Detection And Prevention With Fail2Ban
• Application Intrusion Detection And Prevention With CrowdSec
• The Auditing
• File/Folder Integrity Monitoring With AIDE (WIP)
• Anti-Virus Scanning With ClamAV (WIP)
• Rootkit Detection With Rkhunter (WIP)
• Rootkit Detection With chrootkit (WIP)
• logwatch - system log analyzer and reporter
• ss - Seeing Ports Your Server Is Listening On
• Lynis - Linux Security Auditing
• OSSEC - Host Intrusion Detection
• The Danger Zone
• The Miscellaneous
• MSMTP (Simple Sendmail) with Google
• Gmail and Exim4 As MTA With Implicit TLS
• Separate iptables Log File
• Left Over
• Contacting Me
• Helpful Links
• Acknowledgments
• License and Copyright

(TOC made with nGitHubTOC)

Introduction

Guide Objective

This guides purpose is to teach you how to secure a Linux server.

There are a lot of things you can do to secure a Linux server and this guide will attempt to cover as many of them as possible. More topics/material will be added as I learn, or as folks contribute.

Ansible playbooks of this guide are available at How To Secure A Linux Server With Ansible by moltenbit.

(Table of Contents)

Why Secure Your Server

I assume you're using this guide because you, hopefully, already understand why good security is important. That is a heavy topic onto itself and breaking it down is out-of-scope for this guide. If you don't know the answer to that question, I advise you research it first.

At a high level, the second a device, like a server, is in the public domain -- i.e. visible to the outside world -- it becomes a target for bad-actors. An unsecured device is a playground for bad-actors who want access to your data, or to use your server as another node for their large-scale DDOS attacks.

What's worse is, without good security, you may never know if your server has been compromised. A bad-actor may have gained unauthorized access to your server and copied your data without changing anything, so you'd never know. Or your server may have been part of a DDOS attack, and you wouldn't know. Look at many of the large scale data breaches in the news -- the companies often did not discover the data leak or intrusion until long after the bad-actors were gone.

Contrary to popular belief, bad-actors don't always want to change something or lock you out of your data for money. Sometimes they just want the data on your server for their data warehouses (there is big money in big data) or to covertly use your server for their nefarious purposes.

(Table of Contents)

Why Yet Another Guide

This guide may appear duplicative/unnecessary because there are countless articles online that tell you how to secure Linux, but the information is spread across different articles, that cover different things, and in different ways. Who has time to scour through hundreds of articles?

As I was going through research for my Debian build, I kept notes. At the end I realized that, along with what I already knew, and what I was learning, I had the makings of a how-to guide. I figured I'd put it online to hopefully help others learn, and save time.

I've never found one guide that covers everything -- this guide is my attempt.

Many of the things covered in this guide may be rather basic/trivial, but most of us do not install Linux every day, and it is easy to forget those basic things.

(Table of Contents)

Other Guides

There are many guides provided by experts, industry leaders, and the distributions themselves. It is not practical, and sometimes against copyright, to include everything from those guides. I recommend you check them out before starting with this guide.

• The Center for Internet Security (CIS) provides benchmarks that are exhaustive, industry trusted, step-by-step instructions for securing many flavors of Linux. Check their About Us page for details. My recommendation is to go through this guide (the one you're reading here) first and THEN CIS's guide. That way their recommendations will trump anything in this guide.
• For distribution specific hardening/security guides, check your distributions documentation.
• https://security.utexas.edu/os-hardening-checklist/linux-7 - Red Hat Enterprise Linux 7 Hardening Checklist
• https://cloudpro.zone/index.php/2018/01/18/debian-9-3-server-setup-guide-part-1/ - # Debian 9.3 server setup guide
• https://blog.vigilcode.com/2011/04/ubuntu-server-initial-security-quick-secure-setup-part-i/ - Ubuntu Server Initial Security guide
• https://www.tldp.org/LDP/sag/html/index.html
• https://seifried.org/lasg/
• https://news.ycombinator.com/item?id=19178964
• https://wiki.archlinux.org/index.php/Security - many folks have also recommended this one
• https://securecompliance.co/linux-server-hardening-checklist/
• VPS-SECURE - One-command Ubuntu 24.04 VPS hardening: SSH key-only on 2222, CrowdSec IPS, Endlessh honeypot, UFW with Docker bypass fixed, kernel hardening, AIDE/rkhunter/auditd, Telegram alerts.

(Table of Contents)

To Do / To Add

• [ ] Custom Jails for Fail2ban
• [ ] MAC (Mandatory Access Control) and Linux Security Modules (LSMs)
• https://wiki.archlinux.org/index.php/security#Mandatory_access_control
• Security-Enhanced Linux / SELinux
  • https://en.wikipedia.org/wiki/Security-Enhanced_Linux
  • https://linuxtechlab.com/beginners-guide-to-selinux/
  • https://linuxtechlab.com/replicate-selinux-policies-among-linux-machines/
  • https://teamignition.us/how-to-stop-being-a-scrub-and-learn-to-use-selinux.html
• AppArmor
  • https://wiki.archlinux.org/index.php/AppArmor
  • https://security.stackexchange.com/questions/29378/comparison-between-apparmor-and-selinux
    • http://www.insanitybit.com/2012/06/01/why-i-like-apparmor-more-than-selinux-5/
• [ ] disk encryption
• [ ] Rkhunter and chrootkit
  • http://www.chkrootkit.org/
  • http://rkhunter.sourceforge.net/
  • https://www.cyberciti.biz/faq/howto-check-linux-rootkist-with-detectors-software/
  • https://www.tecmint.com/install-rootkit-hunter-scan-for-rootkits-backdoors-in-linux/
• [ ] shipping/backing up logs - https://news.ycombinator.com/item?id=19178681
• [ ] CIS-CAT - https://learn.cisecurity.org/cis-cat-landing-page
• [ ] debsums - https://blog.sleeplessbeastie.eu/2015/03/02/how-to-verify-installed-packages/

(Table of Contents)

Guide Overview

About This Guide

This guide...

• ...is a work in progress.
• ...is focused on at-home Linux servers. All of the concepts/recommendations here apply to larger/professional environments but those use-cases call for more advanced and specialized configurations that are out-of-scope for this guide.
• ...does not teach you about Linux, how to install Linux, or how to use it. Check https://linuxjourney.com/ if you're new to Linux.
• ...is meant to be Linux distribution agnostic.
• ...does not teach you everything you need to know