terminal LINUX SYSTEM ADMINISTRATION & SECURITY LEARNING

Linux System Security & Defensive Hardening

Hardening Linux hosts, firewall configuration (UFW), SSH key enforcement, and authentication log auditing.

Overview

Linux System Security & Defensive Hardening addresses the proactive configuration, auditing, and maintenance of Linux hosts to minimize attack surfaces. Hardening transforms an installation from a permissive default configuration into a resilient bastion host through access control enforcement, firewall policies, cryptographic SSH configuration, and audit logging.

Core Concepts

Defense in Depth: Implementing multiple defensive layers so that the failure of a single security control (e.g. an application vulnerability) is mitigated by host firewalls and permission boundaries.
Least Privilege Architecture: Ensuring processes, daemons, and administrative accounts possess only the minimum system capabilities required to perform their functions.
Host Firewall Filtering: Restricting network traffic at the Linux kernel packet filtering level (Netfilter/iptables/nftables) via simplified management frontends like UFW.
Cryptographic Remote Access: Hardening OpenSSH daemon configurations by disabling insecure password authentication, rejecting root login, and requiring modern elliptic-curve public keys (Ed25519).
Audit Trails & Log Integrity: Monitoring authentication journals and syslog records to detect unauthorized connection attempts and privilege changes.

Tools & Requirements

UFW (Uncomplicated Firewall), systemd/journalctl, OpenSSH server, and core GNU security auditing commands.

Commands & Practical Examples

1. Host Firewall Hardening with UFW

Configure default incoming drop rules, allow only encrypted administrative access, and activate the firewall:

BASH // FIREWALL CONFIGURATIONUFW

$ sudo ufw default deny incoming
$ sudo ufw default allow outgoing
$ sudo ufw allow 22/tcp comment 'SSH Management'
$ sudo ufw enable
$ sudo ufw status verbose

2. OpenSSH Daemon Hardening

Apply security directives in /etc/ssh/sshd_config to disable password authentication and root login:

CONFIG // SSHD SECURITY DIRECTIVES/ETC/SSH/SSHD_CONFIG

PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes
X11Forwarding no
MaxAuthTries 3

BASH // TEST & RELOAD SSHDSYSTEMCTL

$ sudo sshd -t && sudo systemctl reload ssh

3. Authentication & System Log Auditing

Inspect authentication failure logs and identify brute-force patterns:

BASH // LOG INVESTIGATIONJOURNALCTL & AUTH.LOG

$ sudo journalctl -u ssh -n 50 --no-pager
$ grep "Failed password" /var/log/auth.log | tail -n 20

4. Auditing World-Writable Files and System Permissions

Scan the filesystem for dangerously permissive files and directories:

BASH // PERMISSION AUDITFIND

$ find / -type f -perm -0002 2>/dev/null
$ find /etc -type f -perm -o+w 2>/dev/null

Practical Workflow

Network Minimization: Run ss -tulpn to identify all listening services and terminate unnecessary daemons.
Firewall Enforcement: Apply UFW default-deny policy and whitelist only necessary ports.
SSH Hardening: Restrict SSH to key-based authentication and non-root users.
Filesystem Audit: Check permissions across /etc, /var, and shared directories.
Log Verification: Review authentication logs regularly to ensure audit pipelines are functioning.

Common Mistakes & Troubleshooting

Locking Yourself Out: Enabling UFW before whitelisting the active SSH port terminates remote terminal access immediately. Always verify ufw allow <port> before enabling.
Syntax Errors in sshd_config: Always validate SSH configuration with sudo sshd -t before reloading the daemon to avoid bricking SSH.

Security Considerations & Scoping

Hardening configurations should be tested on staged or virtual systems before deployment to production environments to prevent service disruption.