Linux Server Hardening Checklist

# Ubuntu/Debian
sudo apt update && sudo apt upgrade -y
sudo apt install -y unattended-upgrades
sudo dpkg-reconfigure --priority=low unattended-upgrades

# RHEL/CentOS
sudo dnf update -y
sudo dnf install -y dnf-automatic
sudo systemctl enable --now dnf-automatic.timer

# Create a non-root admin user
sudo useradd -m -s /bin/bash -G sudo adminuser
sudo passwd adminuser

# Copy SSH keys
sudo mkdir -p /home/adminuser/.ssh
sudo cp ~/.ssh/authorized_keys /home/adminuser/.ssh/
sudo chown -R adminuser:adminuser /home/adminuser/.ssh
sudo chmod 700 /home/adminuser/.ssh
sudo chmod 600 /home/adminuser/.ssh/authorized_keys

# /etc/ssh/sshd_config
Port 2222                     # Change default port
PermitRootLogin no            # Disable root login
PasswordAuthentication no     # Key-only auth
PubkeyAuthentication yes
AuthorizedKeysFile .ssh/authorized_keys
MaxAuthTries 3
LoginGraceTime 30
AllowUsers adminuser          # Whitelist users
ClientAliveInterval 300
ClientAliveCountMax 2
X11Forwarding no
AllowTcpForwarding no
Banner /etc/ssh/banner.txt

sudo systemctl restart sshd

sudo apt install -y fail2ban

cat > /etc/fail2ban/jail.local << 'EOF'
[DEFAULT]
bantime  = 3600
findtime = 600
maxretry = 3
backend  = systemd

[sshd]
enabled = true
port    = 2222
logpath = %(sshd_log)s
EOF

sudo systemctl enable --now fail2ban
sudo fail2ban-client status sshd

cat >> /etc/sysctl.d/99-hardening.conf << 'EOF'
# Disable IP forwarding (unless this is a router)
net.ipv4.ip_forward = 0

# Disable ICMP redirects
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0

# Enable SYN flood protection
net.ipv4.tcp_syncookies = 1

# Disable source routing
net.ipv4.conf.all.accept_source_route = 0

# Log suspicious packets
net.ipv4.conf.all.log_martians = 1

# Randomize memory layout
kernel.randomize_va_space = 2

# Restrict core dumps
fs.suid_dumpable = 0
EOF

sudo sysctl -p /etc/sysctl.d/99-hardening.conf

sudo apt install -y auditd audispd-plugins

# Monitor sensitive files
sudo auditctl -w /etc/passwd -p wa -k passwd_changes
sudo auditctl -w /etc/sudoers -p wa -k sudoers_changes
sudo auditctl -w /var/log/auth.log -p wa -k auth_log

# Enable and start
sudo systemctl enable --now auditd

# Check SSH config
sudo sshd -T | grep -E "permitrootlogin|passwordauth|port"

# Check open ports
sudo ss -tulpn

# Check firewall status
sudo ufw status verbose

# Check fail2ban
sudo fail2ban-client status

# Check for SUID/SGID files
find / -perm /4000 -type f 2>/dev/null

# Check listening services
sudo netstat -tulpn | grep LISTEN

# Run Lynis security audit
sudo apt install -y lynis
sudo lynis audit system