Linux Security Hardening

Linux security hardening is a disciplined way to reduce the ways a system can be attacked and to make security-relevant behavior visible. It is not a list of settings to paste into every host. A database server, build runner, laptop, and Kubernetes node have different jobs, trust boundaries, and failure costs.

Start with the system's intended function. Identify who administers it, which network paths it needs, which services it runs, what data it stores, and how it is recovered. Then remove or restrict what does not serve that function. NIST describes server security as selecting, implementing, and maintaining controls. That maintenance part matters: a hardened image drifts as packages, services, accounts, and operational needs change.

The mental model

Think in layers. Each layer limits a different part of the problem.

1. Lifecycle — use a supported distribution, apply updates, and retire systems that no longer receive security fixes.
2. Exposure — install and enable only required services. Restrict listening ports and administrative paths.
3. Identity — give people and automation distinct accounts, strong authentication, and the smallest useful administrative authority.
4. Execution — constrain what services and users can execute. Keep mandatory access control active where the distribution provides it.
5. Data — control file ownership, permissions, secrets, encryption, and backup access.
6. Detection and recovery — collect useful logs, monitor changes, test restores, and preserve an incident path.