30+ Linux Hardening Steps in Order

30 Linux Hardening Techniques: From Standard to Fabulous

Standard: Essential techniques every admin should implement

Advanced: Techniques for high-security environments

Rare: Cutting-edge and specialized hardening methods

Fabulous: Obscure but powerful security enhancements

---

Kernel & System Hardening

kernel.randomize_va_space = 2

kernel.kptr_restrict = 2

kernel.dmesg_restrict = 1

kernel.unprivileged_bpf_disabled = 1

kernel.yama.ptrace_scope = 3

kernel.core_uses_pid = 1

kernel.ctrl_alt_del = 0

fs.suid_dumpable = 0

Add to GRUB_CMDLINE_LINUX: "smep smap"

kernel.exec-shield = 1

kernel.randomize_va_space = 2

Add to kernel cmdline: "kg_protection=1 cfg_protection=1"

kernel.hardened_usercopy = 1

kernel.kexec_load_disabled = 1

---

Network Security Hardening

net.ipv4.tcp_syncookies = 1

net.ipv4.tcp_rfc1337 = 1

net.ipv4.tcp_timestamps = 0

net.ipv4.tcp_sack = 0

net.ipv4.tcp_dsack = 0

net.ipv4.tcp_fack = 0

net.ipv6.conf.all.use_tempaddr = 2

net.ipv6.conf.default.use_tempaddr = 2

net.ipv6.conf.all.temp_prefered_lft = 86400

net.ipv6.conf.all.temp_valid_lft = 172800

net.ipv6.conf.all.max_desync_factor = 600

ip netns add secure-ns

ip netns exec secure-ns systemctl start your-service

echo 1 > /proc/sys/net/ipv4/conf/all/arp_ignore

echo 2 > /proc/sys/net/ipv4/conf/all/arp_announce

table inet filter {

chain input {

type filter hook input priority 0; policy drop;

ct state invalid drop

ct state {established, related} accept

meta l4proto icmp limit rate 4/second accept

}

}

---

File System & Storage Hardening

chattr +i /etc/passwd /etc/shadow /etc/group

chattr +a /var/log/auth.log

chattr +u /home/*/important-files

lsattr /etc/passwd (verify attributes)

cryptsetup luksFormat --type luks2 --pbkdf argon2id --pbkdf-memory 1048576 /dev/sdX

cryptsetup luksAddKey --pbkdf argon2id --pbkdf-force-iterations 4 /dev/sdX

zfs create -o encryption=aes-256-gcm -o keyformat=passphrase rpool/encrypted

zfs set compression=lz4 rpool/encrypted

zfs set dedup=sha256 rpool/encrypted

auditctl -w /etc -p wa -k etc_changes

auditctl -w /bin -p x -k binary_execution

auditctl -w /sbin -p x -k sbin_execution

auditctl -w /usr/bin -p x -k usr_bin_execution

---

Process & Memory Hardening

Add to kernel cmdline: "lsm=landlock,lockdown,yama,apparmor"

Enable landlock for applications: LL_FS_REFER | LL_FS_MAKE_REG

Add to kernel cmdline: "arm64.mte=sync"

echo always > /sys/kernel/mm/transparent_hugepage/enabled

echo madvise > /sys/kernel/mm/transparent_hugepage/defrag

Add to kernel cmdline: "cet=on"

export GLIBC_TUNABLES=glibc.cpu.hwcaps=-CET

gcc -fcf-protection=full -o program program.c

setcap cap_net_bind_service=+ep /usr/bin/python3

getcap /usr/bin/python3

capsh --drop=cap_sys_admin --

---

AppArmor & MAC Hardening

aa-genprof /usr/bin/your-app

aa-logprof (after running the application)

aa-enforce /etc/apparmor.d/usr.bin.your-app

aa-status (verify active profiles)

network inet tcp,

network inet udp,

network unix stream,

deny network raw,

deny network packet,

deny mount,

deny umount,

mount options=(ro, noexec) /tmp/ -> /var/tmp/,

mount fstype=tmpfs -> /tmp/,

signal (send) set=(term, kill) peer=/usr/bin/target,

signal (receive) set=(term) peer=unconfined,

deny signal (send) set=(kill) peer=@{profile_name},

---

Boot & Secure Boot Hardening

openssl req -new -x509 -newkey rsa:2048 -keyout PK.key -out PK.crt

efi-updatevar -f PK.esl PK

sbsign --key db.key --cert db.crt --output vmlinuz.signed vmlinuz

Configure in BIOS: Enable Boot Guard

Verify: dmesg | grep -i "boot guard"

Check TPM PCR values: tpm2_pcrread

Add to kernel cmdline: "mem_encrypt=on"

Verify: dmesg | grep -i "memory encryption"

Check: cat /sys/kernel/mm/amd_sme/sme_enabled

---

Logging & Monitoring Hardening

auditctl -a always,exit -F arch=b64 -S execve -k exec_commands

auditctl -a always,exit -F arch=b64 -S openat -F success=0 -k file_access_failures

auditctl -w /etc/sudoers -p wa -k sudoers_changes

auditctl -w /var/log/wtmp -p wa -k login_logout

bpftrace -e 'tracepoint:syscalls:sys_enter_execve { printf("PID %d executed %s\n", pid, str(args->filename)); }'

bpftrace -e 'kprobe:tcp_connect { printf("TCP connection from PID %d\n", pid); }'

Add to kernel cmdline: "lsm=krsi,apparmor"

Load KRSI programs: bpf_prog_load(BPF_PROG_TYPE_LSM, ...)

---

Service & Application Hardening

[Service]

PrivateNetwork=yes

PrivateTmp=yes

PrivateDevices=yes

ProtectSystem=strict

ProtectHome=yes

NoNewPrivileges=yes

ProtectKernelTunables=yes

ProtectKernelModules=yes

ProtectControlGroups=yes

RestrictRealtime=yes

RestrictSUIDSGID=yes

LockPersonality=yes

MemoryDenyWriteExecute=yes

RestrictNamespaces=yes

unshare -U -r /bin/bash

echo 'deny' > /proc/sys/kernel/unprivileged_userns_clone

sysctl kernel.unprivileged_userns_clone=0

gcc -fcheck-pointer-bounds -mmpx -o program program.c

Add to kernel cmdline: "nompx" (to disable if causing issues)

tpm2_createprimary -C o -g sha256 -G rsa -c primary.ctx

tpm2_create -C primary.ctx -g sha256 -G aes -r key.priv -u key.pub

tpm2_load -C primary.ctx -r key.priv -u key.pub -c key.ctx

tpm2_encryptdecrypt -c key.ctx -o encrypted.dat plaintext.dat

---

Implementation Priority Matrix

Priority	Techniques	Complexity	Impact
P0 - Critical	1, 5, 9, 17, 24	Low-Medium	High
P1 - High	2, 6, 10, 16, 18, 21, 27	Medium	High
P2 - Medium	3, 7, 11, 12, 19, 22, 25, 28	Medium-High	Medium-High
P3 - Advanced	4, 8, 13, 20, 23, 26, 29, 30	High	Medium
Research - Cutting Edge	14, 15	Very High	Future-Proof

---

Verification & Testing

sysctl -a | grep -E "(randomize|kptr|dmesg)" (verify kernel hardening)

aa-status (check AppArmor profiles)

systemctl status auditd (verify audit daemon)

lsattr /etc/passwd (check file attributes)

netstat -tuln (verify listening services)

ss -tuln (modern netstat alternative)

iptables -L -n (check firewall rules)

mount | grep -E "(noexec|nodev|nosuid)" (verify mount options)

journalctl -u your-service --no-pager (check service logs)

tpm2_getcap properties-fixed (verify TPM status)

lynis audit system (comprehensive security audit)

chkrootkit (rootkit detection)

rkhunter --check (rootkit hunter)

tiger (security auditing tool)

aide --check (file integrity checking)

---

Final Recommendations

Phase 1: Implement Standard techniques (1-2 weeks)

Phase 2: Deploy Advanced techniques (3-4 weeks)

Phase 3: Rare techniques for high-security environments (1-2 months)

Phase 4: Fabulous techniques for cutting-edge security (ongoing)