Linux Server Hardening Checklist for Production DevOps Engineers
A comprehensive Linux server hardening checklist secures cloud virtual machines against unauthorized intrusion: (1) disable root login and password authentication in /etc/ssh/sshd_config using Ed25519 SSH keys only, (2) enforce strict packet filtering using UFW / iptables with default deny inbound, (3) prevent automated brute-force attacks via Fail2Ban, (4) configure unattended-upgrades for automated zero-day security patching, and (5) isolate shared memory (/dev/shm) and kernel parameters via sysctl.conf.
Every newly provisioned Linux virtual machine connected to a public IPv4 address receives automated port scans and SSH brute-force attempts from botnets within 60 seconds of launching. Whether you are running a free EC2 instance on the AWS Free Tier (AWS Free Tier Zero-Cost Guide) or deploying container hosts with Terraform (Terraform IaC Guide), baseline OS hardening is mandatory.
Building on the principles of Zero-Trust architecture (Zero-Trust Cloud Security Architecture Guide), this checklist outlines the battle-tested steps every DevOps engineer must execute before deploying production workloads.
▼
[ SSH Port ] ➔➔ [ Fail2Ban Inspection (Auto-Ban after 3 failed attempts) ]
▼
[ OpenSSH Daemon: PermitRootLogin NO | PasswordAuthentication NO | Ed25519 Only ]
▼
[ Isolated App User Space | Kernel Hardening (sysctl) | Unattended Security Patches ]
01. Locking Down OpenSSH (/etc/ssh/sshd_config)
SSH is the front door of your server. Never allow password authentication or root logins. Edit /etc/ssh/sshd_config.d/99-hardening.conf:
# SSH Hardening Configuration
Port 22
PermitRootLogin no
PasswordAuthentication no
ChallengeResponseAuthentication no
UsePAM yes
PubkeyAuthentication yes
AuthenticationMethods publickey
# Modern Secure Ciphers & Key Exchange Algorithms
KexAlgorithms curve25519-sha256@libssh.org,diffie-hellman-group16-sha512
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com
MACs hmac-sha2-512-etm@openssh.com
# Session Idle Timeout
ClientAliveInterval 300
ClientAliveCountMax 2
MaxAuthTries 3Test the configuration with sshd -t and reload with sudo systemctl restart sshd. When connecting automated runners, authenticate with generated deployment keys stored in GitHub Secrets as shown in our GitHub Actions CI/CD Pipeline Guide.
02. Enforcing Strict Firewall Rules with UFW
Never rely solely on cloud provider security groups. Defense-in-depth requires local host-level firewall enforcement using UFW (Uncomplicated Firewall):
# Default Deny Inbound, Allow Outbound
sudo ufw default deny incoming
sudo ufw default allow outgoing
# Allow Essential Services
sudo ufw allow 22/tcp comment 'SSH'
sudo ufw allow 80/tcp comment 'HTTP'
sudo ufw allow 443/tcp comment 'HTTPS'
# Enable Firewall
sudo ufw enable
sudo ufw status verbose03. Automated Brute-Force Banning with Fail2Ban
Install and configure Fail2Ban to monitor authentication logs and automatically ban abusive IP addresses using iptables rules:
# /etc/fail2ban/jail.local
[DEFAULT]
bantime = 1h
findtime = 10m
maxretry = 3
[sshd]
enabled = true
port = 22
mode = aggressiveRestart the service with sudo systemctl restart fail2ban. Check currently banned IPs using: sudo fail2ban-client status sshd.
04. Automated Zero-Day Patching with Unattended-Upgrades
Servers often fall victim to known vulnerabilities because human administrators forget to patch packages. Enable Ubuntu/Debian automatic security updates:
sudo apt install -y unattended-upgrades
sudo dpkg-reconfigure --priority=low unattended-upgradesThis guarantees that Linux kernel CVEs and OpenSSL patches are applied automatically within hours of publication.
05. Kernel Parameter Hardening via /etc/sysctl.conf
Harden network stack parameters against SYN flood attacks, IP spoofing, and man-in-the-middle packet redirection:
# /etc/sysctl.d/99-security.conf
# Disable IP Source Routing & ICMP Redirects
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.all.accept_redirects = 0
net.ipv6.conf.all.accept_redirects = 0
# Enable SYN Flood Protection
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_max_syn_backlog = 2048
# Prevent IP Spoofing
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1
# Ignore Broadcast Ping Requests
net.ipv4.icmp_echo_ignore_broadcasts = 1Apply settings immediately without rebooting: sudo sysctl --system.
Linux Server Hardening Priority Checklist
| Security Domain | Hardening Action | Vulnerability Neutralized | Implementation Effort |
|---|---|---|---|
| SSH Access Control | Disable root login & enforce ED25519 keys | Brute-force credential guessing & password stuffing | Low (< 5 minutes) |
| Host Firewall (UFW) | Default DENY incoming; allow strictly 80, 443 & SSH | Unauthenticated probing of open database/debug ports | Low (< 5 minutes) |
| Intrusion Prevention | Configure Fail2ban with aggressive bans | Automated botnet dictionary scans | Medium (15 minutes) |
| Filesystem Hardening | Mount /dev/shm with noexec,nosuid |
Execution of malicious dropped binary payloads | Low (10 minutes) |
| Kernel Parameter Tuning | Disable ICMP redirects & enable SYN cookies | SYN flood denial of service & man-in-the-middle spoofing | Medium (sysctl.conf tuning) |
- ↗ CIS Benchmarks for Ubuntu Linux — Center for Internet Security prescriptive guidelines for hardening Linux server environments.
- ↗ Linux Foundation Security Guidelines — Open-source industry recommendations for kernel security and supply chain defense.
06. Frequently Asked Questions (FAQ)
/dev/shm). Mounting it with noexec,nosuid,nodev prevents uploaded binary scripts from executing.sudo apt install lynis && sudo lynis audit system. It generates a comprehensive hardening index and actionable remediation checklist.06. Conclusion & Next Steps
Securing Linux hosts is an indispensable responsibility in production DevOps engineering. By methodically implementing these baseline controls—disabling root logins, mounting shared memory as non-executable, enforcing strict firewall rules, and deploying automated brute-force mitigations—you transform vulnerable default cloud instances into hardened, enterprise-grade hosts.
To maintain your security baseline over time, codify these configurations into automated Ansible playbooks or Terraform cloud-init scripts, and schedule automated unattended security updates to patch upstream CVEs the moment they are released.
Hardening enterprise Linux environments, SSH access, and firewall perimeters against unauthorized intrusion? Explore production server configuration baselines in the Waseem Kaluwal Portfolio, or contact me via DevOps Consultation for dedicated infrastructure hardening.
Related Cloud & DevOps Engineering Guides
Supercharge your infrastructure and deployment workflow with these companion production tutorials:
Written by Waseem Kaluwal
Software Engineer, Full-Stack Website Developer, Social Media Influencer, Python & AI Expert, Technical SEO Strategist, and AWS DevOps Specialist. Tech YouTuber, Photographer, and Global Freelancer dedicated to engineering high-performance digital platforms and intelligent automation systems.
No comments:
Post a Comment