#Linux Host Hardening

#Kernel Hardening (sysctl)

Config in /etc/sysctl.d/*.conf

#Network

net.ipv4.tcp_syncookies = 1              # SYN flood protection
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.all.rp_filter = 1          # reverse path filtering (anti-spoofing)
net.ipv4.conf.all.log_martians = 1
net.ipv4.conf.all.send_redirects = 0
net.ipv6.conf.all.accept_redirects = 0

#Kernel

kernel.randomize_va_space = 2            # full ASLR
kernel.dmesg_restrict = 1               # restrict dmesg
kernel.yama.ptrace_scope = 1            # restrict ptrace
kernel.kptr_restrict = 2                # hide kernel pointers

References:

• https://www.cyberciti.biz/faq/linux-kernel-etcsysctl-conf-security-hardening/
• https://madaidans-insecurities.github.io/guides/linux-hardening.html
• https://linux-audit.com/system-hardening/linux-hardening-with-sysctl/

#systemd Sandboxing

Audit exposure: systemd-analyze security <service>

Key directives:

ProtectSystem=strict       # everything read-only except /dev, /proc, /sys
PrivateTmp=yes             # isolated /tmp namespace
NoNewPrivileges=true       # no privilege escalation
CapabilityBoundingSet=     # restrict Linux capabilities
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectControlGroups=yes
PrivateDevices=yes
RestrictNamespaces=yes
RestrictSUIDSGID=true
IPAddressAllow=            # network access control

References:

• https://wiki.archlinux.org/title/Systemd/Sandboxing
• https://github.com/alegrey91/systemd-service-hardening
• https://www.ctrl.blog/entry/systemd-service-hardening.html

#auditd

Kernel-level syscall, file access, auth auditing. Rules in /etc/audit/audit.rules.

Best practice repos:

• Neo23x0/auditd (community standard): https://github.com/Neo23x0/auditd
• Rules file: https://github.com/Neo23x0/auditd/blob/master/audit.rules
• CIS/STIG + LOTL detection: https://github.com/steveandreassend/linux_auditd
• Elastic guide: https://www.elastic.co/security-labs/linux-detection-engineering-with-auditd

Expect 10-15% CPU overhead with security-centric config.

#SELinux vs AppArmor

Both must be in enforcing mode in production. Choose based on distro.

#File Integrity Monitoring

#AIDE / Tripwire

Create baseline snapshots of checksums/permissions/timestamps, detect changes.

• Monitor /etc and select config dirs, skip /usr (system updates cause legit changes)
• Combine real-time (auditd) with periodic baseline checks

References:

• https://dev.to/sebos/aide-file-integrity-monitoring-for-system-security-5hkd
• https://www.redhat.com/en/blog/security-monitoring-tripwire

#CIS Benchmarks & Lynis

CIS: Level 1 (most environments) and Level 2 (high-security). Fresh Ubuntu scores 50s-60s; after Level 1 hardening, 70s-80s.

Lynis: 2000+ config checks, prioritized recommendations.

• https://cisofy.com/lynis/
• https://linuxvox.com/blog/cis-benchmark-linux/

#SSH Hardening

Core: disable password auth, disable root login, Ed25519 keys, idle timeout, fail2ban.

2025 updates: sntrup761x25519-sha512 in KexAlgorithms, ED25519 host keys prioritized.

• Hardening guides: https://www.sshaudit.com/hardening_guides.html
• 2025 sshd_config: https://www.msbiro.net/posts/back-to-basics-sshd-hardening/
• Advanced features: https://docs.vultr.com/how-to-harden-server-ssh-access-using-advanced-openssh-features