The Ultimate Guide to Linux Hardening: Boost Your System Security [HINDI]

#linux #linuxadministrator #mprashant

Slide Link
https://www.canva.com/design/DAGSm6gsdxo/XEWlsRHH5fNHf_4oyhZPtw/edit?utm_content=DAGSm6gsdxo&utm_campaign=designshare&utm_medium=link2&utm_source=sharebutton
1. Principle of Least Privilege (PoLP)
• Grant only the minimum level of access necessary for users, processes, or programs to perform their tasks.
• Avoid running applications as root unless absolutely necessary.
• Utilize sudo to provide limited administrative privileges.
2. Minimize Attack Surface
• Disable Unnecessary Services: Stop or disable services that are not needed to reduce the number of potential entry points.
• Remove Unused Software: Remove applications, packages, and libraries that are not in use, especially since unnecessary software can introduce vulnerabilities.
3. Keep the System Updated
• Regular Patching: Keep the operating system, kernel, and installed software updated to protect against known vulnerabilities.
• Use tools like apt, yum, or other package managers to update and automate patches as much as possible.
4. Strong Authentication and Password Policies
• Enforce strong passwords by setting up password policies (/etc/security/pwquality.conf).
• Use multi-factor authentication (MFA) for critical accounts to improve security.
• Lock user accounts after repeated failed login attempts (/etc/pam.d can be configured for this).
5. Secure Remote Access
• Disable Root Login via SSH: Update /etc/ssh/sshd_config to set PermitRootLogin no.
• Use Key-Based Authentication: Instead of passwords, use SSH key pairs for remote access.
• Restrict SSH access to specific users and use a non-standard port to avoid common scanning attacks.
6. Logging and Monitoring
• Enable Logging: Use tools like rsyslog, syslog-ng, or journald to record system events.
• Log Analysis: Use intrusion detection tools like fail2ban or AIDE to monitor logs and detect suspicious activities.
• Regularly check system logs and automate alerts for unusual activities (e.g., /var/log/auth.log).
7. Firewall Configuration
• Use iptables/nftables/ufw: Configure firewall rules to restrict inbound and outbound traffic to trusted sources only.
• Limit open ports to services that are essential and block unused ports.
• Create logging rules for unusual traffic attempts.
8. File System Security
• Partitioning and Mount Options: Use separate partitions for different parts of the file system like /var, /tmp, and /home to limit damage if compromised.
• Use secure mount options, such as noexec, nosuid, and nodev, to prevent unauthorized execution of files, especially in /tmp.
• Encrypt Sensitive Data: Encrypt sensitive partitions or files using LUKS, eCryptfs, or similar tools to protect data at rest.
9. System Auditing
• Auditing with Tools: Use tools like auditd to monitor and log system activities, changes in key files, and user activities.
• Conduct periodic audits using tools like Lynis, OpenSCAP, or Tiger to ensure security compliance and identify weak points.
10. Disable Unused Network Services and Ports
• Run netstat, ss, or similar tools to view listening ports and disable services that aren't required.
• Close open ports using firewall settings to limit network exposure.
11. File and Directory Permissions
• Correct Ownership: Ensure files and directories have proper ownership and permissions (chown, chmod) to prevent unauthorized access.
• Set umask values appropriately to prevent creating files with insecure default permissions.
• Use tools like find to search for and rectify permissions for sensitive files (e.g., /etc/passwd, /etc/shadow).
12. Kernel Hardening
• Sysctl Settings: Harden the kernel by modifying /etc/sysctl.conf. Important configurations include:
○ Disable IP packet forwarding (net.ipv4.ip_forward = 0).
○ Prevent IP source routing (net.ipv4.conf.all.accept_source_route = 0).
○ Enable SYN flood protection and disable ICMP redirection.
• Use Security Modules: Use Linux security modules like SELinux or AppArmor for enforcing mandatory access control policies.
13. Use Security Tools and Enhanced Security Applications
• AppArmor/SELinux: Use these to enforce security policies that limit the actions that programs and services can perform.
• Antivirus/Anti-Malware: Use tools like ClamAV to scan for malware.
• Rootkit Detection: Use chkrootkit or rkhunter to detect rootkits on the system.
14. Data Backup and Recovery
• Regularly back up critical data using secure backup solutions.
• Ensure backups are encrypted and stored in a separate, secure location.
• Periodically test backup and recovery processes to ensure reliability.
15. Physical Security
• Restrict physical access to the server using physical security measures like locked cabinets and biometrics.
• Ensure the BIOS and bootloader are password-protected to prevent unauthorized access during boot.

Видео The Ultimate Guide to Linux Hardening: Boost Your System Security [HINDI] канала M Prashant