Linux Server Security Hardening: A Practical Checklist

SSH Hardening

# /etc/ssh/sshd_config
PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes
MaxAuthTries 3
LoginGraceTime 30
X11Forwarding no
AllowUsers deploy ubuntu

sshd -t && systemctl reload sshd   # test syntax before reloading

---

Firewall

ufw (Ubuntu/Debian):

ufw default deny incoming
ufw default allow outgoing
ufw allow 22/tcp
ufw allow 443/tcp
ufw allow from 10.0.0.0/8 to any port 5432
ufw enable

firewalld (RHEL/CentOS):

firewall-cmd --set-default-zone=drop
firewall-cmd --permanent --zone=public --add-service=ssh
firewall-cmd --permanent --zone=public --add-service=https
firewall-cmd --reload

---

User and Privilege Management

usermod -s /usr/sbin/nologin serviceusr    # disable login shell
passwd -l username                          # lock password

# Limit sudo to specific commands
echo "deploy ALL=(root) NOPASSWD: /bin/systemctl restart myapp"   >> /etc/sudoers.d/deploy

# Find UID 0 accounts (should only be root)
awk -F: '($3 == 0) {print $1}' /etc/passwd

# Find empty passwords
awk -F: '($2 == "") {print $1}' /etc/shadow

---

File Permission Auditing

# World-writable files
find / -xdev -type f -perm -o+w -not -path "/proc/*" 2>/dev/null

# SUID/SGID executables
find / -xdev ( -perm -4000 -o -perm -2000 ) -type f 2>/dev/null

# Files owned by nobody
find / -xdev -nouser -o -nogroup 2>/dev/null | head -20

---

Kernel Parameters

# /etc/sysctl.d/99-hardening.conf
net.ipv4.ip_forward = 0
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.tcp_syncookies = 1
kernel.dmesg_restrict = 1
kernel.kptr_restrict = 2
fs.suid_dumpable = 0

sysctl -p /etc/sysctl.d/99-hardening.conf

---

Audit Logging

systemctl enable --now auditd

# /etc/audit/rules.d/hardening.rules
-w /etc/passwd -p wa -k identity
-w /etc/sudoers -p wa -k privilege-escalation
-a always,exit -F arch=b64 -S execve -k exec-log

ausearch -k privilege-escalation --start recent
aureport --auth --start today

Practice in the ShellGenius Linux Labs — the apparmor-denial-hunting, auditd-privilege-tracking, and iptables-stateful-rules challenges cover real security scenarios.