Linux Server Security Hardening Commands

We have many hands on guides on specific softwares with all commands. Most of them needs time and not exactly covered all the issues. Here is a List of Linux Server Security Hardening Commands For the New SSH Users & New Sysadmins. Guide is For Cloud & Virtual Instances. The way to secure a dedicated server or colocation server will be different for various extra ways of access to physical hardware.

 

What to Read Before Running Linux Server Security Hardening Commands

 

Readers must look once at the three part IPTables guides :

1. IPtables Basics 1
2. IPtables Basics 2
3. IPtables Basics 3

 

It is actually difficult to easily get hacked by script kiddie, if you follow those guides. As a general purpose guideline, I have to say that :

1. Install security updates
2. Update Kernel
3. Disable root access as SSH user
4. Use secure passwords
5. Bind processes to localhost
6. Implement firewall
7. Secure various configurations
8. Limit access
9. Remotely monitor systems
10. Regularly backup
11. Perform system auditing
12. Separate IPv6 with reverse proxy

 

Linux Server Security Hardening Commands

 

Faillog

We can run faillog command to check records, set login failure limits etc. faillog command reads from the failure log files like /var/log/faillog. Here is manual page of faillog for Ubuntu :

If you run :

You’ll get :

Accounts

We need to make sure that no accounts have empty password and except root no account have UID 0. We can run these two commands :

Under normal condition, only second command will give this output :

Check Services and Packages

We can check the services on newer CentOS, Ubuntu with this command :

We can check the installed packages on Ubuntu, Debian with this command.

We can check the running network services :

Other things we actually covered though different previously published article like

1. List of Essential Security Tools For GNU/Linux Servers
2. Day to Day Commands for Sysadmins
3. server logs
4. tools and commands for brute forcing
5. checking Fail2Ban log etc.

What we listed in tis guide is usually not used and will work as my self reminder as well. It will be too big article too list all the possible commands. From those linked guides, here is a command to check the auth log for Failed passwords:

Same for gzip files :

Example output :

Now there are application specific matters like securing Apache2, Nginx, PHP, MySQL etc. We can protect files with chattr. We can use :

to make it “undeletable”.

Obviously that is possible on files :

If you want to “undo” that undeletable state, you need to use chattr -i command.