32. Linux and Network Hardening
32.1 Hardening Principles
| Principle | Meaning | Example |
|---|---|---|
| Least privilege | Every user, process and service gets only the access it needs | App user cannot use sudo; DB user has rights only on its own database |
| Reduce attack surface | Fewer running services and open ports means fewer ways in | Remove FTP/Telnet, close unused ports |
| Defence in depth | Several layers, so one failure is not fatal | Security group + host firewall + fail2ban + strong keys |
| Secure defaults | Change default passwords, disable sample pages and debug | No admin/admin, display_errors=Off |
| Patch and monitor | Known bugs fixed quickly, activity logged | sudo yum update, Wazuh (Chapter 31) |
Industry checklists such as the CIS Benchmarks list hundreds of hardening settings per OS; tools like Lynis check a server against them.
sudo yum install -y lynis # on Amazon Linux it may need the EPEL repo, or install from the CISOfy site
sudo lynis audit system # prints warnings, suggestions and a hardening index
Ravindra Bagale's Tip
Hardening is not something you do once and forget. A new package, a new user, a new port – check again after every change. Run Lynis's "hardening index" once a month and see whether it goes up.
Ravindra Bagale's Tip – मराठी
Hardening म्हणजे एकदा केले आणि विसरले असे नाही. नवीन package, नवीन user, नवीन port – प्रत्येक बदलानंतर पुन्हा तपासा. Lynis चा "hardening index" महिन्यातून एकदा चालवा आणि तो वाढतो का ते बघा.
Ravindra Bagale's Tip – हिंदी
Hardening एक बार करके भूल जाने वाली चीज़ नहीं है. नया package, नया user, नया port – हर बदलाव के बाद फिर से जाँचो. Lynis का "hardening index" महीने में एक बार चलाओ और देखो कि वह बढ़ रहा है या नहीं.
Practice task
Run sudo ss -tulnp on your lab server and list every listening port and the service behind it. Mark each one "needed" or "remove", then run Lynis and note its hardening index before you start this chapter.