Linux Zero to Hero Playlist 2024 - The Ultimate Guide to Linux Hardening: Boost Your System Security [HINDI]

#linux #linuxadministrator #mprashant Slide Link https://www.canva.com/design/DAGSm6gsdxo/XEWlsRHH5fNHf_4oyhZPtw/edit?utm_content=DAGSm6gsdxo&utm_campaign=designshare&utm_medium=link2&utm_source=sharebutton 1. Principle of Least Privilege (PoLP) • Grant only the minimum level of access necessary for users, processes, or programs to perform their tasks. • Avoid running applications as root unless absolutely necessary. • Utilize sudo to provide limited administrative privileges. 2. Minimize Attack Surface • Disable Unnecessary Services: Stop or disable services that are not needed to reduce the number of potential entry points. • Remove Unused Software: Remove applications, packages, and libraries that are not in use, especially since unnecessary software can introduce vulnerabilities. 3. Keep the System Updated • Regular Patching: Keep the operating system, kernel, and installed software updated to protect against known vulnerabilities. • Use tools like apt, yum, or other package managers to update and automate patches as much as possible. 4. Strong Authentication and Password Policies • Enforce strong passwords by setting up password policies (/etc/security/pwquality.conf). • Use multi-factor authentication (MFA) for critical accounts to improve security. • Lock user accounts after repeated failed login attempts (/etc/pam.d can be configured for this). 5. Secure Remote Access • Disable Root Login via SSH: Update /etc/ssh/sshd_config to set PermitRootLogin no. • Use Key-Based Authentication: Instead of passwords, use SSH key pairs for remote access. • Restrict SSH access to specific users and use a non-standard port to avoid common scanning attacks. 6. Logging and Monitoring • Enable Logging: Use tools like rsyslog, syslog-ng, or journald to record system events. • Log Analysis: Use intrusion detection tools like fail2ban or AIDE to monitor logs and detect suspicious activities. • Regularly check system logs and automate alerts for unusual activities (e.g., /var/log/auth.log). 7. Firewall Configuration • Use iptables/nftables/ufw: Configure firewall rules to restrict inbound and outbound traffic to trusted sources only. • Limit open ports to services that are essential and block unused ports. • Create logging rules for unusual traffic attempts. 8. File System Security • Partitioning and Mount Options: Use separate partitions for different parts of the file system like /var, /tmp, and /home to limit damage if compromised. • Use secure mount options, such as noexec, nosuid, and nodev, to prevent unauthorized execution of files, especially in /tmp. • Encrypt Sensitive Data: Encrypt sensitive partitions or files using LUKS, eCryptfs, or similar tools to protect data at rest. 9. System Auditing • Auditing with Tools: Use tools like auditd to monitor and log system activities, changes in key files, and user activities. • Conduct periodic audits using tools like Lynis, OpenSCAP, or Tiger to ensure security compliance and identify weak points. 10. Disable Unused Network Services and Ports • Run netstat, ss, or similar tools to view listening ports and disable services that aren't required. • Close open ports using firewall settings to limit network exposure. 11. File and Directory Permissions • Correct Ownership: Ensure files and directories have proper ownership and permissions (chown, chmod) to prevent unauthorized access. • Set umask values appropriately to prevent creating files with insecure default permissions. • Use tools like find to search for and rectify permissions for sensitive files (e.g., /etc/passwd, /etc/shadow). 12. Kernel Hardening • Sysctl Settings: Harden the kernel by modifying /etc/sysctl.conf. Important configurations include: ○ Disable IP packet forwarding (net.ipv4.ip_forward = 0). ○ Prevent IP source routing (net.ipv4.conf.all.accept_source_route = 0). ○ Enable SYN flood protection and disable ICMP redirection. • Use Security Modules: Use Linux security modules like SELinux or AppArmor for enforcing mandatory access control policies. 13. Use Security Tools and Enhanced Security Applications • AppArmor/SELinux: Use these to enforce security policies that limit the actions that programs and services can perform. • Antivirus/Anti-Malware: Use tools like ClamAV to scan for malware. • Rootkit Detection: Use chkrootkit or rkhunter to detect rootkits on the system. 14. Data Backup and Recovery • Regularly back up critical data using secure backup solutions. • Ensure backups are encrypted and stored in a separate, secure location. • Periodically test backup and recovery processes to ensure reliability. 15. Physical Security • Restrict physical access to the server using physical security measures like locked cabinets and biometrics. • Ensure the BIOS and bootloader are password-protected to prevent unauthorized access during boot.