As a associate system administrator I worked on Redhat Linux servers, including user management, permissions, services, and performance monitoring Automated routine administrative tasks using Bash scripting and cron jobs, reducing manual effort by ~30% I am aws certified sysops administrator and Google Certified Cloud Engineer. Determined to transition my career into cloud architect /Cloud Support role
Linux servers are widely trusted for their stability and performance, but a default installation is not secure by default. Server hardening is the process of minimizing security risks by tightening configurations, removing unnecessary components, and enforcing strong access controls. This approach significantly reduces the attack surface and improves resilience against real-world threats.
1. Secure User Authentication
Enforce Strong Password Policies
Weak passwords are one of the most common attack vectors. You should enforce password complexity and expiration rules.
# Install password quality module
sudo dnf install -y libpwquality
# Edit password policy
sudo vi /etc/security/pwquality.conf
Example settings:
minlen = 12
dcredit = -1
ucredit = -1
lcredit = -1
ocredit = -1
Apply password aging rules:
chage --maxdays 90 --mindays 7 --warndays 14 username
2. Harden SSH Access
Disable direct root login and password authentication over SSH.
sudo vi /etc/ssh/sshd_config
Set:
PermitRootLogin no
PasswordAuthentication no
MaxAuthTries 3
Protocol 2
Restart SSH safely:
sudo systemctl restart sshd
Use SSH key-based authentication:
ssh-keygen -t ed25519
ssh-copy-id user@server_ip
3. Reduce the Attack Surface
Remove unused packages and disable unnecessary services.
# List installed packages
dnf list installed
# Remove unwanted software
sudo dnf remove telnet ftp
# List active services
systemctl list-unit-files --type=service
# Disable unused services
sudo systemctl disable avahi-daemon
4. Configure a Firewall
Use firewalld to restrict inbound traffic.
sudo systemctl enable --now firewalld
# Allow SSH and web traffic
sudo firewall-cmd --permanent --add-service=ssh
sudo firewall-cmd --permanent --add-service=http
sudo firewall-cmd --permanent --add-service=https
sudo firewall-cmd --reload
5. Apply Automatic Security Updates
Keeping the system patched closes known vulnerabilities.
sudo dnf install -y dnf-automatic
sudo systemctl enable --now dnf-automatic.timer
6. File System and Permission Hardening
Identify world-writable files:
sudo find / -xdev -type f -perm -0002
Secure mount options in /etc/fstab:
/dev/sdb1 /tmp ext4 defaults,noexec,nosuid,nodev 0 0
7. Enable Intrusion Prevention
Install Fail2Ban to block brute-force attacks.
sudo dnf install -y fail2ban
sudo systemctl enable --now fail2ban
Basic SSH jail:
[sshd]
enabled = true
maxretry = 3
bantime = 3600
8. Logging, Auditing, and Monitoring
Enable auditing to track security-relevant events.
sudo dnf install -y audit
sudo systemctl enable --now auditd
Generate daily log summaries:
sudo dnf install -y logwatch
sudo logwatch --detail high
9. Regular Backups and Recovery
Automate backups using a simple Bash script:
#!/bin/bash
tar -czf /backup/etc-$(date +%F).tar.gz /etc
Schedule with cron:
crontab -e
0 2 * * * /root/backup.sh
Linux System Hardening:
Introduction
Linux powers the majority of modern servers—from cloud infrastructure and containers to enterprise applications. However, a default Linux installation is not secure enough for production use. Linux system hardening is the process of strengthening your server by reducing vulnerabilities, tightening configurations, and enforcing strict access controls.
In this guide, you’ll learn essential Linux server hardening techniques with real-world Bash commands. Whether you’re a system administrator, DevOps engineer, or cloud professional, these practices will help you secure Linux servers against common attacks.
Why Linux Server Hardening Is Important
Linux server hardening minimizes the attack surface by:
Restricting unauthorized access
Reducing exploitable services
Protecting sensitive data
Improving audit and compliance readiness
Preventing brute-force and privilege escalation attacks
Security is not a one-time activity—it’s a continuous process.
1. Secure User Authentication
Enforce Strong Password Policies
Weak passwords are a primary cause of server breaches. Enforce complexity and expiration policies using libpwquality.
sudo dnf install -y libpwquality
sudo vi /etc/security/pwquality.conf
Recommended settings:
minlen = 12
ucredit = -1
lcredit = -1
dcredit = -1
ocredit = -1
Apply password aging:
chage --maxdays 90 --mindays 7 --warndays 14 username
2. Harden SSH Access
SSH is a frequent attack target. Disable root login and password authentication.
sudo vi /etc/ssh/sshd_config
Secure configuration:
PermitRootLogin no
PasswordAuthentication no
MaxAuthTries 3
Protocol 2
Restart SSH:
sudo systemctl restart sshd
Use SSH keys:
ssh-keygen -t ed25519
ssh-copy-id user@server_ip
3. Reduce the Attack Surface
Remove unused packages and disable unnecessary services.
sudo dnf remove telnet ftp
systemctl list-unit-files --type=service
sudo systemctl disable avahi-daemon
Fewer services mean fewer vulnerabilities.
4. Configure a Firewall
Enable and configure firewalld to allow only required traffic.
sudo systemctl enable --now firewalld
sudo firewall-cmd --permanent --add-service=ssh
sudo firewall-cmd --permanent --add-service=https
sudo firewall-cmd --reload
5. Enable Automatic Security Updates
Apply security patches automatically to reduce exposure to known CVEs.
sudo dnf install -y dnf-automatic
sudo systemctl enable --now dnf-automatic.timer
6. File System and Permission Hardening
Identify insecure permissions:
sudo find / -xdev -type f -perm -0002
Secure mount options:
/dev/sdb1 /tmp ext4 defaults,noexec,nosuid,nodev 0 0
7. Prevent Brute-Force Attacks with Fail2Ban
Fail2Ban blocks malicious IPs automatically.
sudo dnf install -y fail2ban
sudo systemctl enable --now fail2ban
Basic SSH jail:
[sshd]
enabled = true
maxretry = 3
bantime = 3600
8. Logging, Auditing, and Monitoring
Enable auditing for security events.
sudo dnf install -y audit
sudo systemctl enable --now auditd
Generate reports:
sudo dnf install -y logwatch
sudo logwatch --detail high
9. Backup and Recovery Strategy
Security also means recoverability.
#!/bin/bash
tar -czf /backup/etc-$(date +%F).tar.gz /etc
Schedule with cron:
0 2 * * * /root/backup.sh
Conclusion
Linux system hardening is a foundational skill for DevOps and cloud engineers. By securing authentication, hardening SSH, minimizing services, enabling firewalls, automating updates, enforcing permissions, and monitoring activity, you significantly reduce security risks.
Start small, automate wherever possible, and treat security as a continuous improvement process.