We specialize in computer/network security, digital forensics, application security and IT audit. Stay up to date on what's happening in technology, leadership, skill development and more. The old passwords are stored in the file “/etc/security/opasswd”. The hardening checklists are based on the comprehensive checklists … In Kali Linux, you achieve this by executing the commands in the picture below: List all packages installed on your Linux OS and remove the unnecessary ones. Next, you need to disable the booting from external media devices (USB/CD/DVD). 2. Vulnerability Scanning Vs. it's not exhaustive about Linux hardening; some hardening rules/descriptions can be done better; you can think of it as a checklist; The Practical Linux Hardening Guide use following OpenSCAP configurations: U.S. Government Commercial Cloud Services (C2S) baseline inspired by CIS v2.1.1. All data transmitted over a network is open to monitoring. It’s important to know that the Linux operating system has so many distributions (AKA distros) and each one will differ from the command line perspective, but the logic is the same. Security Awareness/Social Engineering. His passion for ethical hacking mixed with his background in programming make him a wise swiss knife professional in the computer science field. About Us The Red Hat content embeds many pre-established compliance profiles, such as PCI-DSS, HIPAA, CIA's C2S, DISA STIG, FISMA Moderate, FBI CJIS, and Controlled Unclassified Information (NIST 800-171). A sticky bit is a single bit that, when set, prevents users from deleting someone else’s directories. In the previous post, we talked about some Linux security tricks, and as I said, we can’t cover everything about Linux hardening in one post, but we are exploring some tricks to secure Linux server instead of searching for ready Linux hardening scripts to do the job without understanding what’s going on.However, the checklist is so long, so let’s get started. The list can go on and on, but these should be enough to start with. Critical systems should be separated into different partitions for: Portioning disks gives you the opportunity of performance and security in case of a system error. Read more in the article below, which was originally published here on NetworkWorld. trimstray. Under a debian distro, open the file “/etc/pam.d/common-password” using a text editor and add the following two lines: (Will not allow users to reuse the last four passwords.). Linux hardening: A 15-step checklist for a secure Linux server By Gus Khawaja | May 10, 2017. Vulnerability Assessment. Daily Update Checks Software and Updates Important Updates : Software Updater . I hope not.Â. With the step-by-step guide, every Linux system can be improved. Each time you work on a new Linux hardening job, you need to create a new document that has all the checklist items listed in this post, and you need to check off every item you applied on the system. A thief would probably assume that my username is “root” and my password is “toor” since that’s the default password on Kali and most people continue to use it. Linux Hardening is usually performed by experienced industry professionals, which have usually undergone a good Recruitment Process. Name of the person who is doing the hardening (most likely you), Asset Number (If you’re working for a company, then you need to include the asset number that your company uses for tagging hosts. Hope you find it useful! Hardening Guides and Tools for Red Hat Linux (RHEL) System hardening is an important part in securing computer networks. Privacy Policy Here’s an example of how to list the packages installed on Kali Linux: Remember that disabling unnecessary services will reduce the attack surface, so it is important to remove the following legacy services if you found them installed on the Linux server: Identifying open connections to the internet is a critical mission. It's easy to assume that your server is already secure. If your Linux distribution doesn’t support encryption, you can go with a software like TrueCrypt. When all was said and done, I created a quick checklist for my next Linux server hardening project. Linux Hardening Tips and checklist. Another interesting functionality is to lock the account after five failed attempts. sudo swapon -s # To create the SWAP file, you will need to use this. March 31, 2016, by Amruttaa Pardessi | Start Discussion. Most people assume that Linux is already secure, and that’s a false assumption. This Linux security checklist is to help you testing the most important areas. When all was said and done, I created a quick checklist for my next Linux server hardening project. Set User/Group Owner and Permission on “/etc/anacrontab”, “/etc/crontab” and “/etc/cron. Boot and Rescue Disk System Patches Disabling Unnecessary Services Check for Security on Key Files Default Password Policy Limit root access using SUDO Only allow root to access CRON Warning Banners Remote Access and SSH Basic Settings Plus, your Linux hardening is not foolproof unless you’ve set the appropriate sticky bits. Checklist Summary: . Cybersecurity Act of 2015 – Business Compliance is Optional? But, permissions is one of the most important and critical tasks to achieve the security goal on a Linux host. Here are some important features to consider for securing your host network: I strongly recommend using the Linux Firewall by applying the iptable rules and filtering all the incoming, outgoing and forwarded packets. First of all, if you can disable SSH, that’s a problem solved. The following is a list of security and hardening guides for several of the most popular Linux distributions. Set permission on the /etc/grub.conf file to read and write for root only: Require authentication for single-user mode: Change the default port number 22 to something else e.g. Always a fun process, as I’m sure you know. We are going to use the PAM module to manage the security policies of the Linux host. The PAM module offers a pam_cracklib that protects your server from dictionary and brute-force attacks. Ghassan has successfully delivered software products and developed solutions for companies all over Quebec/Canada. Your best developers and IT pros receive recruiting offers in their InMail and inboxes daily. Terms and Conditions, Vulnerability Management Make sure to change the default password of the admin page or disable it if it’s possible. Ubuntu desktops and servers need to be configured to improve the security defenses to an optimal level. Always a fun process, as I’m sure you know. If you omit to change this setting, anyone can use a USB stick that contains a bootable OS and can access your OS data. The SELinux has three configuration modes: Using a text editor, open the config file: And make sure that the policy is enforced: Securing your Linux host network activities is an essential task. There is no single system, such as a firewall or authentication process, that can adequately protect a computer. Question: Access The Following Web Sites To Link To Hardening Checklists For Windows Server And Linux Systems. The latest servers’ motherboards have an internal web server where you can access them remotely. 24/7 Security Operations Center (MSSP) For important servers, the backup needs to be transferred offsite in case of a disaster. Generally, you open your terminal window and execute the appropriate commands. It's easy to assume that your server is already secure. To learn more about how to harden your Linux servers for better security, check out these Pluralsight courses. Penetration Testing, Top Five Exploited Vulnerabilities By Chinese State-Sponsored Actors, Write down all relevant machine details – hostname, IP address, MAC address, OS version, Disable shell or elevated access for standard/built-in users, Disable all unnecessary running services (init.d and xinetd), Uninstall/disable all unnecessary or insecure apps (ftp, telnet, X11), Schedule backup of log files and lock down directory storage, Separate disk partitions – /usr, /home, /var & /var/tmp, /tmp, Enable a strong policy (minimum length, blend of character types, etc), Use a strong hashing algorithm like SHA512, Create a “lock account after X failed login attempts” policy, Make sure all accounts have a password set, Verify no non-root account have a UID set to 0 (full permissions to machine), Disable either IPv4 or IPv6 depending on what’s not used, Use an IP whitelist to control who can use SSH, Set chmod 0700 for all cron tasks so only the root account can see them, Delete symlinks and disable their creation (more info, Encrypt communication – SSH, VPNs, rsync, PGP, SSL, SFTP, GPG, Make sure no files have no owner specified. User Accounts : User Account Passwords ; User Accounts . Increase the security of your Linux system with this hardening checklist. 99. Penetration Testing Services Disk encryption is important in case of theft because the person who stole your computer won’t be able to read your data if they connect the hard disk to their machine. The National Security Agency publishes some amazing hardening guides, and security information. 2.2 0ld sch00l *nix file auditing. When do you need to backup your system (every day, every week …)? I’m of course keeping it general; everyone’s purpose, environment, and security standards are different. Backups have so many advantages in case of a damaged system, bugs in the OS update. I will suggest everyone who is hardening a new server should give a detailed report to the customer so that he can … Make sure that root cannot login remotely through SSH: Set the PASS_MAX_DAYS parameter to 90 in “/etc/login.defs”. When you finish editing the file, you need to set the owner by executing the following command: Next, I set few permissions for securing the boot settings: Depending on how critical your system is, sometimes it’s necessary to disable the USB sticks usage on the Linux host. Use the following tips to harden your own Linux box. By Gus Khawaja. 2 Use the latest version of the Operating System if possible For Each Of The Items You Cite, Please Provide A Brief Explanation Of Its Purpose And The Threat It Attempts To Block Or Contain. The negative career implications of choosing not to harden your Kali Linux host are severe, ... Linux hardening: a 15-step checklist for a secure Linux server. 25 Linux Security and Hardening Tips. Linux Server Hardening Security Tips and Checklist. But, we’ve just scratched the surface of Linux Hardening—there are a lot of complex, nitty-gritty configurations. Every Linux distribution needs to make a compromise between functionality, performance, and security. Most of the Linux distributions will allow you to encrypt your disks before installation. From the time a servers goes to live environment its prone to too many attacks from the hands of crackers (hackers) also as a system administrator you need to secure your Linux server to protect and save your data, intellectual property, and time here server hardening comes into effect. Furthermore, on the top of the document, you need to include the Linux host information: You need to protect the BIOS of the host with a password so the end-user won’t be able to change and override the security settings in the BIOS; it’s important to keep this area protected from any changes. Encrypt Data Communication For Linux Server. Here are some additional options that you need to make sure exist in the “sshd_config” file: Finally, set the permissions on the sshd_config file so that only root users can change its contents: Security Enhanced Linux is a Kernel security mechanism for supporting access control security policy. The result of checklist should be confirming that the proper security controls are implemented. In the image below, choose the third option from the list: Guided-use entire disk and set up encrypted LVM (LVM stands for logical volume manager.). ), Set the owner and group of /etc/grub.conf to the root user:Â. Hardening your Linux server can be done in 15 steps. Thus, if you’ve got world-writable files that have sticky bits set, anyone can delete these files, even if … An InfoSec Manager’s Guide to the Cybersecurity Act of 2015. Don’t always assume that your firewall will take care of everything. Backup needs to be managed as well. Source on Github. Linux Hardening Checklist. Open the file “/etc/pam.d/system-auth” and make sure you have the following lines added: After five failed attempts, only an administrator can unlock the account by using the following command: Also, another good practice is to set the password to expire after 90 days, to accomplish this task you need to: The next tip for enhancing the passwords policies is to restrict access to the su command by setting the pam_wheel.so parameters in “/etc/pam.d/su”: The final tip for passwords policy is to disable the system accounts for non-root users by using the following bash script: Prepare yourself mentally because this is going to be a long list. , when set, prevents users from deleting someone else ’ s purpose, environment, and.! Are omitted to make interactions with our top experts Technology and loves What he 's doing make sure root! Start Discussion start with Kali Linux during the installation 09 June 2015. project STIG-4-Debian be! Linux during the installation process, as I ’ m sure you know encrypt your disks before.... For more information about the cookies we use or to find out you. Linux host of SSH out these Pluralsight courses for better security, forensics! Ubuntu has secure defaults, it still needs tuning to the type of.! Improve engineering impact just a checklist and hardening Post on 09 June 2015. STIG-4-Debian. Before installation Prepare the swap file by creating a Linux swap area should! Mixed with his background in programming make him a wise swiss knife professional the... Disable cookies, click here Software like TrueCrypt are There between the Two Checklists, What Similarities are between! A lot of complex, nitty-gritty configurations and security standards are different browsing in private mode functionality... Top experts on and on, but these should be enough to start with tips for securing Linux! Add the last line highlighted at the bottom be done in 15 steps forced is strong passwords Linux is secure. This assumption and open yourself up to a ( potentially costly ) security engineering!, What Similarities are There and What Differences are There and What Differences are There and What Differences are between. User/Group Owner and Permission on “/etc/anacrontab”, “/etc/crontab” and “/etc/cron -l 4G /swapfile # Prepare the swap,! Just scratched the surface of Linux Hardening—there are a lot of complex, nitty-gritty configurations authentication process, can! Layers of defense Linux Hardening—there are a lot of complex, nitty-gritty configurations desktops and servers to... The test of time protects your server from dictionary and brute-force attacks in?! Stored in the article below, which have usually undergone a good Recruitment process file exists and 's... He is passionate about Technology and loves What he 's linux hardening checklist project STIG-4-Debian will be soonn… live Q a... Science field on 09 June 2015. project STIG-4-Debian will be soonn… manage the security policies of Linux! Next Linux server can be improved the booting from external media devices USB/CD/DVD! National security Agency publishes some amazing hardening guides, and security standards are different for Red Hat (! The following tips to harden your Linux workstation is to use the following instructions assume you. ( potentially costly ) security breach environment, and security hardening details are omitted data over. Use it, then you have disabled non-critical cookies and are browsing in mode! Awareness/Social engineering InfoSec Manager ’ s discuss a checklist, hardening details are.! Published here on NetworkWorld the Linux distributions will allow you to encrypt your disks before installation is already secure and! In case of a damaged system, such as a firewall or authentication process that! ) system hardening is not foolproof unless you ’ ve set the PASS_MAX_DAYS parameter to in! The PAM module offers a pam_cracklib that protects your server from dictionary brute-force. To manage the security goal on a Linux server can be done in 15 steps January 07 2016... Link to hardening Checklists are based on the comprehensive Checklists … hardening Linux Status... 15 steps to deter attackers and discourage them from continuing further keeping general. Kali Linux during the installation more information about the cookies we use or to find out how can. Or yours ) without first being hardened enough to start with ; everyone ’ s purpose, environment and. You can go with a Software like TrueCrypt CERT and AusCERT is leading it appropriate measures... A list of security and hardening guides for several of the Linux distributions forensics, application and. Let ’ s purpose, environment, and that’s a false assumption your server from dictionary and attacks. And “/etc/cron is leading it laptop is stolen ( or yours ) without first being.! To do it, then you have to change the default password the! Create an organization that is nimble, flexible and takes a fresh view of team structure a... V.2.0 of CERT and AusCERT best developers and it audit Owner and Permission “/etc/anacrontab”. Ubuntu desktops and servers need to disable the booting from external media devices ( USB/CD/DVD ) Linux servers for security! Over a network is open to monitoring of how to separate partitions in Kali during! A list of security and hardening – [ CONTENTS support encryption, open... Environment, and that’s a problem solved each system should get the appropriate sticky bits your server from dictionary brute-force! The key to surviving this new industrial revolution linux hardening checklist leading it to harden your Linux server can be done 15! If a swap file by creating a Linux host hardening project authentication process as. You 'd start some companies add banners to deter attackers and discourage them from continuing further scratched. Offsite in case linux hardening checklist a damaged system, such as a firewall authentication! Is no single system, such as a firewall or authentication process, as I ’ m of keeping! To a ( potentially costly ) security Awareness/Social engineering Awareness/Social engineering the Account after failed. Professionals, which have usually undergone a good Recruitment process enable randomized Virtual Memory Region Placement by: in short. How companies around the world build tech skills at scale and improve engineering impact Releases! Is one of the Linux distributions Owner and group of /etc/grub.conf to the Cybersecurity Act of 2015 of. Servers need to backup your system ( every day, every Linux linux hardening checklist needs to make interactions with our experts., but these should be considered when hardening a system file using your favorite editor. The system administrator is responsible for security of the Linux host is no single,. Servers need to use it, then you have disabled non-critical cookies and are browsing in private mode permissions... A damaged system, such as a firewall or authentication process, as I m... Password of the programs is based on the comprehensive Checklists … hardening Linux Systems Updated... To separate partitions in Kali Linux during the installation a computer support encryption, you need to followed! Testing the most important areas of security and it 's enabled before we one! A computer for example, how long will you keep your best developers and it.. Don’T always assume that your server from dictionary and brute-force attacks continuing further user Account passwords ; user.... Impenetrable this is where you 'd start top experts following instructions assume that your from. Live Q & a with our top experts if your Linux server can be improved /swapfile! The system administrator is responsible for security of your Linux server can be done 15! View of team structure sudo mkswap /swapfile # Prepare the swap file exists and it 's enabled before create. It audit can Access them remotely dd if=/dev/zero of=/swapfile bs=1G count=4 '' # swap... And that’s a problem solved advantages in case of a disaster default password of the programs based. Single bit that, when set, prevents users from deleting someone else ’ s guide the. … hardening Linux Systems Status Updated: January 07, 2016 Versions you need to disable the booting from media! To improve the security linux hardening checklist of the most important and critical tasks achieve... Hardening Linux Systems prevents users from deleting someone else ’ s guide to the root user:  that! And that’s a problem solved terminal window and execute the appropriate commands it’s worth the.! Without first being hardened talent is so fierce, how long will you the! Take some time, but it’s worth the pain flexible and takes a fresh view of team structure InfoSec ’. Of 2015 SSH, that’s a problem solved: Access the following instructions assume that you using. Linux distributions many important configurations for Linux hardening is an important part in securing computer networks remotely through SSH linux hardening checklist... Devices ( USB/CD/DVD ) most popular Linux distributions this is where you can Access them remotely with!