Linux Security Guide - Hardening, Firewalls & Best Practices

Why Linux Security Matters

While Linux is inherently more secure than many operating systems due to its permission model and open-source transparency, no system is invulnerable. A properly hardened Linux system is a formidable barrier against threats, but it requires proactive configuration and ongoing maintenance.

Security is not a single step but a layered approach. Each layer you add makes it exponentially harder for attackers to compromise your system.

SSH Hardening

SSH is the primary way to access Linux servers remotely, making it a top target for attackers. These configurations significantly reduce your attack surface.

Disable Root Login and Password Authentication

# Edit SSH configuration

sudo nano /etc/ssh/sshd_config

# Set these values:

PermitRootLogin no

PasswordAuthentication no

PubkeyAuthentication yes

MaxAuthTries 3

LoginGraceTime 60

AllowUsers deployer admin

# Restart SSH

sudo systemctl restart sshd

Change the Default SSH Port

While not a security measure on its own, changing the default port reduces noise from automated scanners:

# In /etc/ssh/sshd_config

Port 2222

# Remember to update your firewall

sudo ufw allow 2222/tcp

sudo ufw delete allow OpenSSH

Important: Before changing the SSH port or disabling password authentication, make sure you have tested that your SSH key works. Losing SSH access to a remote server can be difficult or impossible to recover from.

Firewall Configuration

A firewall is your first line of defence. UFW (Uncomplicated Firewall) makes iptables management straightforward on Ubuntu and Debian systems.

UFW Essentials

# Check current status

sudo ufw status verbose

# Set default policies

sudo ufw default deny incoming

sudo ufw default allow outgoing

# Allow specific services

sudo ufw allow ssh

sudo ufw allow http

sudo ufw allow https

# Allow from a specific IP only

sudo ufw allow from 203.0.113.50 to any port 22

# Rate limit SSH connections

sudo ufw limit ssh

# Enable the firewall

sudo ufw enable

Intrusion Prevention with Fail2Ban

Fail2Ban monitors log files and automatically bans IP addresses that show signs of malicious activity, such as repeated failed login attempts.

# Install Fail2Ban

sudo apt install fail2ban -y

# Create a local configuration

sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local

sudo nano /etc/fail2ban/jail.local

# Recommended settings for SSH

[sshd]

enabled = true

port = ssh

filter = sshd

logpath = /var/log/auth.log

maxretry = 3

bantime = 3600

findtime = 600

# Start and enable

sudo systemctl enable fail2ban

sudo systemctl start fail2ban

# Check banned IPs

sudo fail2ban-client status sshd

User and Permission Management

Proper user management is fundamental to Linux security. Follow the principle of least privilege: grant users only the minimum access they need.

Managing Sudo Access

# Edit sudoers safely

sudo visudo

# Allow a user to run specific commands only

deployer ALL=(ALL) NOPASSWD: /usr/bin/systemctl restart nginx

# Require password for sudo (default, recommended)

Defaults timestamp_timeout=5

File Permission Best Practices

Set home directories to 700 so only the owner can access them
Configuration files containing secrets should be 600 (owner read/write only)
Scripts that need execution should be 750 (owner all, group read/execute)
Never set files to 777 — this gives everyone full access
Use chown and chgrp to assign proper ownership to files and directories

Automatic Security Updates

Unpatched vulnerabilities are one of the most common attack vectors. Configure automatic security updates to stay protected:

# Install unattended-upgrades (Ubuntu/Debian)

sudo apt install unattended-upgrades -y

sudo dpkg-reconfigure -plow unattended-upgrades

# Verify the configuration

cat /etc/apt/apt.conf.d/20auto-upgrades

# Should show:

# APT::Periodic::Update-Package-Lists "1";

# APT::Periodic::Unattended-Upgrade "1";

Disk Encryption

Full disk encryption (LUKS) protects data if the physical hardware is stolen or accessed without authorization. Most Linux installers offer the option to enable encryption during setup.

# Check if LUKS is active

sudo lsblk -f

# Encrypt an external drive

sudo cryptsetup luksFormat /dev/sdb1

sudo cryptsetup luksOpen /dev/sdb1 encrypted_drive

sudo mkfs.ext4 /dev/mapper/encrypted_drive

sudo mount /dev/mapper/encrypted_drive /mnt/secure

Security Auditing Tools

🔎 Lynis

A comprehensive security auditing tool that scans your system for vulnerabilities, configuration issues, and hardening opportunities. Run sudo lynis audit system for a full report with actionable recommendations.

🔎 ClamAV

An open-source antivirus engine for detecting trojans, viruses, and malware. While Linux malware is rare, ClamAV is essential for servers that handle files from Windows users or email attachments.

🔎 rkhunter

A rootkit detection tool that scans for known rootkits, backdoors, and local exploits. Regular scans help ensure the integrity of system binaries and configuration files.

🔎 AIDE

Advanced Intrusion Detection Environment monitors file system changes. It creates a database of file hashes and alerts you when system files are unexpectedly modified.

Security Checklist

Use this checklist to assess the security posture of your Linux system:

System is fully updated with the latest security patches
SSH root login is disabled and key-based authentication is enforced
Firewall is active with only necessary ports open
Fail2Ban or similar intrusion prevention is running
Unused services and daemons are disabled
User accounts follow the principle of least privilege
Automatic security updates are configured
Log monitoring is in place for critical services
Regular backups are scheduled and tested
Full disk encryption is enabled on sensitive systems

Remember: Security is a continuous process. Regularly review your configurations, update your software, and stay informed about new vulnerabilities affecting the packages you use.

Learn how to configure your network securely.

Networking Guide →