Linux Server Hardening: Production Security Checklist

Linux Server Hardening: Production Checklist

A hardened Linux server significantly reduces attack surface. This is the checklist I apply to every production server.

1. SSH Hardening

BASH

# /etc/ssh/sshd_config
PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes
AllowUsers deployuser adminuser
MaxAuthTries 3
ClientAliveInterval 300
ClientAliveCountMax 2
Protocol 2

BASH

systemctl restart sshd

2. Firewall with UFW

BASH

ufw default deny incoming
ufw default allow outgoing
ufw allow from 10.0.0.0/8 to any port 22  # SSH from internal only
ufw allow 443/tcp
ufw allow 80/tcp
ufw enable

3. Fail2Ban

BASH

apt install fail2ban

# /etc/fail2ban/jail.local
[sshd]
enabled = true
maxretry = 3
bantime = 3600
findtime = 600

4. Automatic Security Updates

BASH

apt install unattended-upgrades
dpkg-reconfigure unattended-upgrades

5. Kernel Hardening (sysctl)

BASH

# /etc/sysctl.d/99-hardening.conf
net.ipv4.ip_forward = 0
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.all.log_martians = 1
kernel.randomize_va_space = 2
kernel.dmesg_restrict = 1
fs.suid_dumpable = 0

sysctl -p /etc/sysctl.d/99-hardening.conf

6. Audit Logging

BASH

apt install auditd audispd-plugins

# /etc/audit/rules.d/hardening.rules
-w /etc/passwd -p wa -k identity
-w /etc/shadow -p wa -k identity
-w /etc/sudoers -p wa -k sudo
-a always,exit -F arch=b64 -S execve -k exec

7. Remove Unnecessary Services

BASH

systemctl disable --now avahi-daemon cups bluetooth rpcbind
apt remove telnetd ftp rsh-server

8. CIS Benchmark Compliance

Use lynis to score your hardening:

BASH

apt install lynis
lynis audit system

Target score: 70+ (production servers should reach 80+).