SSH hardening (/etc/ssh/sshd_config): disable root login (PermitRootLogin no), use key-based authentication only (PasswordAuthentication no, PubkeyAuthentication yes), change default port (Port 2222), limit users (AllowUsers user1 user2), use Protocol 2 only, set LoginGraceTime 30, MaxAuthTries 3, disable empty passwords (PermitEmptyPasswords no), disable X11 forwarding if not needed (X11Forwarding no).
Firewall configuration: enable firewall (ufw, firewalld, iptables), default deny policy, whitelist necessary ports only. UFW: ufw default deny incoming, ufw allow 22/tcp, ufw allow 80/tcp, ufw enable. Iptables: iptables -P INPUT DROP, iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT, iptables -A INPUT -p tcp --dport 22 -j ACCEPT, persist with iptables-save.
Minimize attack surface: disable unused services (systemctl disable service), remove unnecessary packages (apt remove or yum remove), close unnecessary ports, run services as non-root users, use chroot jails or containers for service isolation.
SELinux/AppArmor: mandatory access control systems. SELinux (RHEL/CentOS): enforce policies restricting process actions, set to enforcing mode: setenforce 1, check status: getenforce, fix context: restorecon -Rv /path, audit logs in /var/log/audit/audit.log. AppArmor (Ubuntu): profile-based confinement, enable profile: aa-enforce /etc/apparmor.d/usr.bin.program, check status: aa-status.
Security updates: enable automatic security updates (unattended-upgrades on Debian/Ubuntu, yum-cron on RHEL/CentOS), configure notification, test in staging before production, subscribe to security mailing lists (ubuntu-security-announce, centos-announce), monitor CVEs for installed software.
Password policies: enforce strong passwords with PAM (pam_pwquality), set password expiration (chage -M 90 user), lock accounts after failed attempts (pam_faillock), audit passwords with john the ripper (authorized testing).
File permissions: review world-writable files: find / -xdev -type f -perm -002, review setuid files: find / -xdev -type f -perm -4000 (potential security risks), protect sensitive files (600 for SSH keys, 640 for config files), audit with aide or tripwire detecting unauthorized changes.
Audit logging: enable auditd for system call auditing, log important events (file access, authentication, privilege escalation), central log collection, regular log review, configure retention policy.
Network security: disable IPv6 if not used, disable unnecessary network services, use TCP wrappers (/etc/hosts.allow, /etc/hosts.deny), configure reverse DNS, enable fail2ban for intrusion prevention (bans IPs with multiple failed logins).
Monitoring: install intrusion detection (OSSEC, Snort), monitor logs for suspicious activity, set up alerts for critical events, regular security scans (nmap for open ports, nikto for web vulnerabilities - authorized testing only), vulnerability scanning (OpenVAS, Nessus).
Understanding security hardening protects systems from attacks and ensures compliance with security standards.