In the world of infrastructure as code and cloud-native development, the server is no longer just a machine; it is the foundation of your application’s integrity. However, a default Linux installation is rarely secure out of the box. It is designed for compatibility and ease of use, not for defending against a relentless barrage of automated bots and skilled attackers. This post explores the multi-layered approach to securing your Linux environment, moving beyond basic password protection to a robust, defense-in-depth strategy.
The First Line of Defense: SSH Hardening
Secure Shell (SSH) is often the first door an attacker tries to open. Default configurations are notoriously insecure, leaving port 22 open to brute-force attempts. To harden SSH, we must restrict access methods and limit exposure.
Start by disabling root login and password-based authentication. Instead, rely on SSH key pairs, which are exponentially harder to crack. Update your /etc/ssh/sshd_config file with the following directives:
PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes
AllowUsers deployer admin
After making these changes, restart the SSH service. Note that before closing your current session, ensure you can log in with your new key to avoid being locked out. Additionally, consider changing the default SSH port to a non-standard high number to reduce noise from automated scanners.
Context-Driven Access Control: SELinux and AppArmor
When a vulnerability in an application like Apache or Nginx is exploited, the attacker often gains the privileges of that service. Mandatory Access Control (MAC) systems like SELinux (Red Hat-based) and AppArmor (Debian-based) prevent this by confining programs to a limited set of resources.
SELinux operates in three modes: Enforcing, Permissive, and Disabled. Never run SELinux in disabled mode if you want genuine security. In Enforcing mode, it actively blocks unauthorized access. For developers concerned about debugging, tools like audit2allow can help generate policy modules for legitimate actions that were incorrectly flagged.
# Check current status
sestatus
# View denied access logs
sudo ausearch -m avc -ts recent
While AppArmor is generally easier to configure, SELinux offers finer-grained control. Choose the one that aligns with your distribution and team expertise, but ensure it is active.
Network Perimeter: Firewalls and Intrusion Prevention
Your firewall acts as the gatekeeper. Whether you are using iptables, nftables, or a higher-level tool like ufw (Uncomplicated Firewall), the principle remains the same: whitelist only what is necessary. Block all incoming traffic by default and allow only ports 22 (SSH), 80 (HTTP), and 443 (HTTPS).
However, even a well-configured firewall cannot stop a valid request from a malicious actor using a weak password. This is where Fail2ban comes in. Fail2ban monitors log files for repeated failed login attempts and temporarily bans the offending IP addresses. It is an essential tool for mitigating brute-force attacks.
sudo systemctl enable fail2ban
sudo systemctl start fail2ban
sudo fail2ban-client status sshd
Visibility and Compliance: Auditing
You cannot secure what you cannot see. The Linux Audit Framework provides a powerful way to monitor system calls, file accesses, and user commands. By configuring audit rules, you can detect anomalies such as a web server process trying to write to /etc/passwd.
Focus your auditing efforts on critical directories like /etc, /var/log, and /root. Ensure that audit logs are forwarded to a centralized logging server to prevent attackers from tampering with local logs if they gain access.
System Hardening: The Final Layer
Finally, implement general system hardening practices. This includes keeping your kernel and packages up to date, removing unnecessary services, and enforcing strong password policies via passwd and PAM configurations. Regularly review user accounts to ensure no dormant or excessive privileges exist.
Conclusion
Server security is not a one-time setup; it is a continuous process. By combining SSH hardening, MAC systems like SELinux, strict firewall rules, automated intrusion prevention with Fail2ban, and comprehensive auditing, you create a resilient environment that can withstand both common and sophisticated attacks. Treat your Linux server with the respect it deserves, and your applications will follow suit.