10 Hardening Configuration Any Linux System Should Have
If you’re a Linux user, you likely appreciate its performance, efficiency, and built-in security. But no system is invulnerable, and adding extra layers of protection is always a smart move.
10 Essential Linux Hardening Configurations
If you’re a Linux user, you likely appreciate its performance, efficiency, and built-in security. But no system is invulnerable, and adding extra layers of protection is always a smart move. Below are ten practical, straightforward configurations you can implement to better secure your Linux system:
1️⃣ Randomize Your MAC Address
Use macchanger to randomize your network interface’s MAC address:
sudo macchanger -r <interface>
This helps protect your device identity on networks.
2️⃣ Change the Root Password
Strengthen your root account by updating its password:
sudo passwd root
3️⃣ Create a Non-Root User
Avoid daily use of the root account by creating a standard user:
sudo adduser john
4️⃣ Remove Unnecessary Services
Disable and uninstall services you don’t need, for example:
sudo apt purge avahi-daemon cups
Each running service is a potential attack surface.
5️⃣ Secure Shared Memory
Prevent execution of SUID files from shared memory by adding this line to /etc/fstab:
tmpfs /run/shm tmpfs ro,noexec,nosuid 0 0
6️⃣ Avoid Legacy and Insecure Services
Remove outdated and insecure services like FTP, Rlogin, RSH, and others:
sudo apt purge xinetd nis yp-tools tftpd atftpd tftpd-hpa telnetd rsh-server
7️⃣ Set a Maximum Number of Login Failures
Limit failed login attempts to mitigate brute-force attacks:
sudo faillog -M 10 -u username
8️⃣ Disable Core Dumps
Restrict system core dumps by adding:
echo ‘hard core 0’ >> /etc/security/limits.conf
9️⃣ Harden Kernel Dump Settings
Disable set-user-ID program dumps:
echo ‘fs.suid_dumpable = 0’ >> /etc/sysctl.conf
🔟 Restrict Firewall Rules and Kernel Parameters
Implement strict firewall rules, deny all traffic by default and allow only what’s necessary. Also, harden kernel parameters by disabling unused protocols like IPv6 and ICMP if not required.
Example for disabling IPv6:
echo ‘net.ipv6.conf.all.disable_ipv6 = 1’ >> /etc/sysctl.conf
🔒 Final Thought:
Security is a continuous process, not a one-time setup. Regularly review, audit, and harden your system as new vulnerabilities emerge.
Would you like a quick Twitter thread or LinkedIn post version of this too?
