Don't Panic: Linux Security Hardening

Linux security hardening is the discipline of making a machine do only the work it was built to do, then retaining enough evidence to notice when it wanders off. This is less glamorous than a heroic wall of firewall rules, but considerably more useful. A database server, build runner, laptop, and Kubernetes node need different services, identities, data paths, and recovery arrangements. One universal settings file would therefore be a fine way to break all of them at once.

Start with the host's purpose. Its attack surface is every service, socket, package source, privileged helper, and administrative path that can be reached or misused. Inventory those things before changing them. Then choose a baseline, which is the documented target configuration used to compare later changes. The baseline is not a certificate of virtue. It is the answer to the otherwise awkward question: was this new service meant to be here?

Linux has several overlapping controls. Ownership and permissions decide ordinary file access. Capabilities split parts of traditional root authority. Mandatory access control can add another kernel-enforced decision. A request must survive every applicable layer. That is the surprising bit: making one setting more permissive does not necessarily make the action possible, and making one setting stricter can strand a service that depended on it. The machine is not being difficult. It is being very literal.

Assessment tools such as OpenSCAP help compare the running host with selected security content and profiles. They produce findings, which are evidence for review, not permission slips for mass remediation. Read the profile, rule rationale, exceptions, and service impact. Test changes in small groups, retain a separate management or recovery path, and verify the effective state after each change. A configuration file can look impressively secure while the running service has other opinions.

Hardening also refuses to stay finished. Packages change, accounts accumulate, and configuration drift, the gap between intended and actual state, quietly returns. The Intro explains the control layers and change process. The Slides show the relationships between them. The Cheatsheet is the compact reference for inventory, access controls, sysctl, and assessment. The Quiz tests the judgement calls. Start there, then take the reference path into your distribution's current hardening guide.