"Did you know all your doors were locked?" - Riddick (The Chronicles of Riddick)
I'm back, work in progress...
- Introduction
- Policy Compliance
- DevSec Hardening Framework
- Contributing
- External resources
- Pre install tasks
- Post install tasks
- Bootloader configuration (grub)
- Disk partitions
- Keep system updated
- Package management
- Netfilter ruleset
- TCP wrapper
- Users and groups
- System path permissions
- PAM module
- Limits
- Shadow passwords
- Linux kernel hardening
- Remove unused modules
- Secure shared memory
- IRQ balance
- Disable compilers
- Email notifications
- Backups
- External devices
- Tools
- Services
- Containers
- Deployment
- Testing configuration
The Practical Linux Hardening Guide provides a high-level overview of the security hardening GNU/Linux systems. It is not an official standard or handbook but it touches and use industry standards.
This guide also provides you with practical step-by-step instructions for building your own hardened systems and services.
A few simple rules for this project:
- this guide does not exhaust everything about Linux hardening
- it contains the different topics related to hardening (e.g. services)
- some hardening rules/descriptions can be done better
- you can think of it also as a checklist
Before you start remember:
This guide also contains my comments that may be differ from certain industry principles. If you are not sure what to do please see Policy Compliance chapter and think about what you actually do at your server.
Simply speaking, hardening is the process of making a system more secure. Out of the box, Linux servers don’t come "hardened" (e.g. with the attack surface minimized). It’s up to you to prepare for each eventuality and set up systems to notify you of any suspicious activity in the future.
You need to harden your system to protect your assets as much as possible. Why it's important? Please read a great and short article that explains hardening process step by step by Michael Boelen.
In my opinion you should definitely drop all non-industry policies, articles, manuals and other (especially on your production environments but also if you harden standalone home server). This stuff exist to give false sense of security.
We have a lot of great GNU/Linux hardening policies to provide safer operating systems compatible with security protocols. For me, CIS and the various NSA STIGs are about the best actual prescriptive guides.
Most of all you should use Security Benchmarks/Policies which describe consensus best practices for the secure configuration of target systems because configuring your systems in compliance with e.g. CIS has been shown to eliminate 80-95% of known security vulnerabilities.
On the other hand e.g. STIG itself is just a complicated (for newbies difficult to implement) check-list. In my opinion ideally, real world implementation is automated via something like OpenSCAP.
You should use a rational approach, remember that more is not better. Each environment is different so security rules should all work in theory, but sometimes it not works as well.
The Center for Internet Security (CIS) is a nonprofit organization focused on improving public and private-sector cybersecurity readiness and response.
Please see CIS Benchmarks.
A Security Technical Implementation Guide (STIG) is a cybersecurity methodology for standardizing security protocols within networks, servers, computers, and logical designs to enhance overall security.
Please see Stigviewer for explore all stigs.
Security Content Automation Protocol (SCAP) provides a mechanism to check configurations, vulnerability management and evaluate policy compliance for a variety of systems.
One of the most popular implementations of SCAP is OpenSCAP and it is very helpful for vulnerability assessment and also as hardening helper.
Security + DevOps: Automatic Server Hardening.
This project covered a lot of the things in this guide, which can be automated (e.g. setting of grub password or enforcing the permissions of the common directories).
Project: DevSec Hardening Framework + GH repository: dev-sec.
Thanks for @artem-sidorenko!
If you find something which doesn't make sense, or one of these doesn't seem right, or something seems really stupid; please make a pull request or please add valid and well-reasoned opinions about your changes or comments.
Before add pull request please see this.
| Type of hardening guide | Comments |
|---|---|
| STIGs Master List | |
| Arch Linux | |
| CentOS Linux | |
| Debian GNU/Linux | old guide - to update |
| Fedora Linux | old guide - to update |
| Red Hat Enterprise | |
| Slackware Linux | some data may not be available |
| Ubuntu Linux | some data may not be available |