# Linux Host Hardening

## Kernel Hardening (sysctl)

Config in /etc/sysctl.d/*.conf

### Network
```
net.ipv4.tcp_syncookies = 1              # SYN flood protection
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.all.rp_filter = 1          # reverse path filtering (anti-spoofing)
net.ipv4.conf.all.log_martians = 1
net.ipv4.conf.all.send_redirects = 0
net.ipv6.conf.all.accept_redirects = 0
```

### Kernel
```
kernel.randomize_va_space = 2            # full ASLR
kernel.dmesg_restrict = 1               # restrict dmesg
kernel.yama.ptrace_scope = 1            # restrict ptrace
kernel.kptr_restrict = 2                # hide kernel pointers
```

References:
- https://www.cyberciti.biz/faq/linux-kernel-etcsysctl-conf-security-hardening/
- https://madaidans-insecurities.github.io/guides/linux-hardening.html
- https://linux-audit.com/system-hardening/linux-hardening-with-sysctl/

## systemd Sandboxing

Audit exposure: `systemd-analyze security <service>`

Key directives:
```ini
ProtectSystem=strict       # everything read-only except /dev, /proc, /sys
PrivateTmp=yes             # isolated /tmp namespace
NoNewPrivileges=true       # no privilege escalation
CapabilityBoundingSet=     # restrict Linux capabilities
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectControlGroups=yes
PrivateDevices=yes
RestrictNamespaces=yes
RestrictSUIDSGID=true
IPAddressAllow=            # network access control
```

References:
- https://wiki.archlinux.org/title/Systemd/Sandboxing
- https://github.com/alegrey91/systemd-service-hardening
- https://www.ctrl.blog/entry/systemd-service-hardening.html

## auditd

Kernel-level syscall, file access, auth auditing. Rules in /etc/audit/audit.rules.

Best practice repos:
- Neo23x0/auditd (community standard): https://github.com/Neo23x0/auditd
- Rules file: https://github.com/Neo23x0/auditd/blob/master/audit.rules
- CIS/STIG + LOTL detection: https://github.com/steveandreassend/linux_auditd
- Elastic guide: https://www.elastic.co/security-labs/linux-detection-engineering-with-auditd

Expect 10-15% CPU overhead with security-centric config.

## SELinux vs AppArmor

| Feature | SELinux | AppArmor |
|---------|---------|----------|
| Model | Labels (inode-based) | Path-based |
| Distros | RHEL, CentOS, Fedora | Debian, Ubuntu |
| Depth | Deeper, system-wide | Simpler, application-focused |
| Weakness | Steep learning curve | Hard links bypass paths |

Both must be in enforcing mode in production. Choose based on distro.

## File Integrity Monitoring

### AIDE / Tripwire
Create baseline snapshots of checksums/permissions/timestamps, detect changes.
- Monitor /etc and select config dirs, skip /usr (system updates cause legit changes)
- Combine real-time (auditd) with periodic baseline checks

References:
- https://dev.to/sebos/aide-file-integrity-monitoring-for-system-security-5hkd
- https://www.redhat.com/en/blog/security-monitoring-tripwire

## CIS Benchmarks & Lynis

CIS: Level 1 (most environments) and Level 2 (high-security). Fresh Ubuntu scores 50s-60s; after Level 1 hardening, 70s-80s.

Lynis: 2000+ config checks, prioritized recommendations.
- https://cisofy.com/lynis/
- https://linuxvox.com/blog/cis-benchmark-linux/

## SSH Hardening

Core: disable password auth, disable root login, Ed25519 keys, idle timeout, fail2ban.

2025 updates: sntrup761x25519-sha512 in KexAlgorithms, ED25519 host keys prioritized.

- Hardening guides: https://www.sshaudit.com/hardening_guides.html
- 2025 sshd_config: https://www.msbiro.net/posts/back-to-basics-sshd-hardening/
- Advanced features: https://docs.vultr.com/how-to-harden-server-ssh-access-using-advanced-openssh-features