Hardening Linux server

---

The below writeups were initially based on debian 9 hosts, and then later on ubuntu 18.04 LTS, and on CentOS 8. Everything in these writeups will probably also apply to newer versions. If something does not work, check the documentation for your distro and version for what you are trying to do.

---

Securing user accounts

• Introduction
• Configuring sudo
• Disabling root access
• Locking home directories
• Configuring password complexity
• Configuring other password requirements
• Dangers of the lxd group

Audit services

• Introduction
• Auditing system services with systemctl
• Auditing network services with netstat
• Auditing network services with nmap

Firewalls

• Introduction
• iptables
• UFW
• NFTables
• FirewallD
• FireHOL
• Packet filtering
• Fail2ban
• SSHguard
• Web Application Firewall WAF
• Port spoofing

Encryption technologies

• Introduction
• GNU Privacy Guard
• OpenVPN
• strongSwan
• Installing SSH
• Harden ssh server
• Key management
• Jumping hosts

Virtual network computing (VNC)

• Introduction
• TigerVNC
• TightVNC
• Securing sessions

Access control

• Introduction
• Discretionary access control (DAC)
• Access control lists (ACL) and shared directory management (SDM)
• Mandatory access control (MAC)

Public key infrastructure (PKI)

• Introduction
• Problems
• Internal PKI
• Pluggable Authentication Modules (PAM)
• Let’s Encrypt
• TLS/SSL

Logfiles

• Introduction
• Syslog
• log commands
• Path of a common intruder
• Logrotate
• Centralised logging

Guards! Guards!

• Introduction
• Samhain
• Maltrail

Incidents

• Introduction
• Preventing incidents
• Using git for configuration management
• Implementing a backup plan
• Using bootable recovery media

Troubleshooting

• Overview
• Authentication error
• Connection refused

---