32. Linux and Network Hardening
32.6 Network Hardening: Segmentation, VPN and IDS/IPS
Segmentation. Do not put everything on one flat network. Separate web, application, database and admin networks (in AWS: public and private subnets, Chapter 12). If the web server is hacked, the attacker should not reach the database or office PCs directly. Keep guest Wi-Fi separate from the office network.
VPN. Admin access (SSH, database tools) should come over a VPN, not the open internet. WireGuard is a simple modern option; OpenVPN and AWS Client VPN are also common. Then the security group allows port 22 only from the VPN range.
IDS and IPS. An IDS (Intrusion Detection System) watches traffic and alerts; an IPS (Intrusion Prevention System) sits inline and can block. The two best-known open-source engines are Snort and Suricata. Both use rules like this:
alert tcp any any -> $HOME_NET 22 (msg:"Possible SSH brute force"; flags:S; threshold:type both, track by_src, count 10, seconds 60; sid:1000001; rev:1;)
alert http any any -> $HOME_NET any (msg:"SQLi attempt - UNION SELECT"; content:"union"; nocase; content:"select"; nocase; sid:1000002; rev:1;)
Suricata quick lab (on a Linux sensor VM in the host-only network):
sudo yum install -y suricata # from EPEL on RHEL-family systems
sudo suricata-update # download the free Emerging Threats ruleset
sudo nano /etc/suricata/suricata.yaml # set HOME_NET to "[192.168.56.0/24]" and the right interface
sudo systemctl enable suricata
sudo service suricata start
sudo tail -f /var/log/suricata/fast.log # alerts appear here
Now scan from Kali with nmap -sS 192.168.56.20 and run a sqlmap test against DVWA (Chapter 21) – alerts appear in fast.log. Suricata's eve.json output can be sent to Wazuh or ELK (Chapter 31).
Ravindra Bagale's Tip
An IDS is installed but nobody looks at the alerts – this happens in many companies! Thousands of alerts come in and all of them get ignored. Tune the rules (reduce false positives) and send the important alerts to the SIEM. Without a process for reviewing alerts, an IDS is just for show.
Ravindra Bagale's Tip – मराठी
IDS लावला पण alerts कोणी बघत नाही – हे खूप companies मध्ये होते! हजारो alerts येतात आणि सगळे ignore होतात. Rules tune करा (false positives कमी करा), आणि महत्त्वाचे alerts SIEM मध्ये पाठवा. Alert बघण्याची process नसेल तर IDS फक्त शोभेसाठी आहे.
Ravindra Bagale's Tip – हिंदी
IDS लगाया पर alerts कोई नहीं देखता – यह बहुत companies में होता है! हज़ारों alerts आते हैं और सब ignore हो जाते हैं. Rules tune करो (false positives कम करो), और ज़रूरी alerts SIEM में भेजो. Alert देखने की process न हो तो IDS सिर्फ़ दिखावे के लिए है.
Lab
Install Suricata on a sensor VM, set HOME_NET to your lab range and load the Emerging Threats rules. Run an Nmap SYN scan and a sqlmap test from Kali and copy two alert lines from fast.log. Then add the custom SSH rule above to /etc/suricata/rules/local.rules, include it in suricata.yaml, restart and trigger it with Hydra.
Server hardening checklist
| Area | Must-do |
|---|---|
| SSH | Keys only, PermitRootLogin no, MaxAuthTries 3, fail2ban, or Session Manager |
| Firewall | Security group + firewalld/ufw, only needed ports |
| Patching | sudo yum update regularly, remove old packages |
| Users | No extra UID 0, no empty passwords, remove unused accounts, least sudo |
| Files | No 777, config files 640, review SUID files, SELinux enforcing |
| Web | Hide versions, no directory listing, security headers, HTTPS, PHP errors off |
| Network | Segmentation, VPN for admin, IDS/IPS alerts sent to the SIEM |