Linux Hardening: A Baseline
Hardening a Linux system means shrinking its attack surface and replacing convenient defaults with secure ones. Linux is powerful and configurable, which cuts both ways: out of the box it may run more than it needs and trust more than it should. A hardening baseline turns a general-purpose install into a defensible one.
The highest-impact steps#
Roughly in order of return on effort:
| Step | Why |
|---|---|
| Patch regularly | Closes known vulnerabilities |
| Remove unneeded packages/services | Less to attack and maintain |
| Key-based SSH, no root login | Ends brute-forcing, forces escalation (SSH hardening) |
| Careful sudo / least privilege | Limits blast radius |
| Host firewall (nftables/ufw) | Controls network exposure |
| Auditing (auditd) | Records security events |
| SELinux / AppArmor | Confines processes even if compromised |
The theme throughout is least privilege and fail-safe defaults: run less, trust less, and confine what you do run.
Use a benchmark, not intuition#
Rather than hardening from memory, apply a security baseline like the CIS Benchmark for your distribution. It gives you an expert-reviewed, prioritized set of settings, and automated tools can both apply it and scan for drift — turning “hardened” from an opinion into a checkable state.
Linux hardening is a security baseline in practice. See also Windows hardening and the Defense & Hardening hub.
Frequently asked questions#
What are the most important Linux hardening steps?
Keep the system patched, remove unnecessary packages and services, enforce key-based SSH with no root login, apply least privilege via careful sudo configuration, enable a host firewall, and turn on auditing. Using a mandatory access control system like SELinux or AppArmor and following a CIS Benchmark rounds out a strong baseline.
Should you use a hardening benchmark or do it manually?
Use a benchmark. The CIS Benchmarks for Linux distributions provide expert-reviewed, prioritized settings, and automated tooling can apply and audit them. Hand-hardening is error-prone and hard to reproduce; a benchmark gives you a consistent, measurable baseline you can scan for drift.