Linux Server Security Best Practices

Server security cannot be treated as a one-time deployment task. As threat landscapes evolve with increasingly sophisticated automated attacks, supply chain vulnerabilities, and zero-day exploits, organizations must adopt a proactive, defense-in-depth security posture. This comprehensive guide provides actionable strategies and practical implementations for hardening Linux infrastructure across single-server deployments and large-scale cloud environments.

1. Implementing Zero Trust Architecture

Overview

The perimeter-based security model has become obsolete in modern distributed systems. Zero Trust Architecture (ZTA) operates on the principle of “never trust, always verify,” requiring continuous authentication and authorization for every access request, regardless of network location.

1.1 Network Micro-Segmentation

Concept: Isolate services and workloads into distinct security zones to limit lateral movement during a breach.

Implementation with NFTables:

# Flush existing rules
nft flush ruleset

# Create a new table
nft add table inet filter

# Define base chains
nft add chain inet filter input { type filter hook input priority 0 \; policy drop \; }
nft add chain inet filter forward { type filter hook forward priority 0 \; policy drop \; }
nft add chain inet filter output { type filter hook output priority 0 \; policy accept \; }

# Allow established connections
nft add rule inet filter input ct state established,related accept

# Allow loopback
nft add rule inet filter input iif lo accept

# Web server can only communicate with database on specific port
nft add rule inet filter input ip saddr 10.0.1.10 tcp dport 5432 accept

# SSH access only from management network
nft add rule inet filter input ip saddr 10.0.0.0/24 tcp dport 22 accept

# Save configuration
nft list ruleset > /etc/nftables.conf
systemctl enable nftables

Implementation with Cilium (Kubernetes environments):

apiVersion: "cilium.io/v2"
kind: CiliumNetworkPolicy
metadata:
  name: web-to-db-policy
spec:
  endpointSelector:
    matchLabels:
      app: web-frontend
  egress:
  - toEndpoints:
    - matchLabels:
        app: database
    toPorts:
    - ports:
      - port: "5432"
        protocol: TCP

1.2 Multi-Factor Authentication for SSH

Deploying Google Authenticator:

# Install PAM module
sudo apt install libpam-google-authenticator  # Debian/Ubuntu
sudo yum install google-authenticator          # RHEL/CentOS

# Configure PAM
sudo nano /etc/pam.d/sshd

# Add this line at the top:
auth required pam_google_authenticator.so

# Modify SSH configuration
sudo nano /etc/ssh/sshd_config

# Update these directives:
ChallengeResponseAuthentication yes
AuthenticationMethods publickey,keyboard-interactive

# Generate tokens for user
google-authenticator

# Answer configuration questions:
# - Time-based tokens: Yes
# - Update .google_authenticator: Yes
# - Disallow multiple uses: Yes
# - Rate limiting: Yes

# Restart SSH
sudo systemctl restart sshd

Implementing Hardware Token Authentication (YubiKey):

# Install required packages
sudo apt install libpam-u2f

# Register YubiKey
mkdir -p ~/.config/Yubico
pamu2fcfg > ~/.config/Yubico/u2f_keys

# Configure PAM
sudo nano /etc/pam.d/sshd
# Add:
auth required pam_u2f.so authfile=/home/%u/.config/Yubico/u2f_keys cue

# Configure SSH
sudo nano /etc/ssh/sshd_config
AuthenticationMethods publickey,keyboard-interactive:pam

sudo systemctl restart sshd

2. Advanced Kernel Hardening

The Linux kernel is the primary target for privilege escalation. Hardening it at the source is vital for neutralizing zero-day exploits.

• Kernel Lockdown Mode: Activating the lockdown feature in integrity or confidentiality mode prevents even the root user from modifying kernel code or accessing sensitive memory addresses.

# Check current lockdown status
cat /sys/kernel/security/lockdown

# Enable lockdown at boot (GRUB configuration)
sudo nano /etc/default/grub

# Add to GRUB_CMDLINE_LINUX:
lockdown=confidentiality

# For integrity mode (less restrictive):
lockdown=integrity

# Update GRUB
sudo update-grub  # Debian/Ubuntu
sudo grub2-mkconfig -o /boot/grub2/grub.cfg  # RHEL/CentOS

# Reboot
sudo reboot

Verification:

# Verify lockdown is active
dmesg | grep -i lockdown
cat /sys/kernel/security/lockdown

• Kernel Runtime Guarding: Deploying technologies like LKRG, or Linux Kernel Runtime Guard, helps monitor the kernel’s integrity in real-time. It acts as a proactive security layer that detects and kills exploit attempts as they happen.

2.2 Linux Kernel Runtime Guard (LKRG)

Installation and Configuration:

# Install dependencies
sudo apt install build-essential linux-headers-$(uname -r)

# Download LKRG
wget https://github.com/lkrg-org/lkrg/archive/refs/tags/v0.9.7.tar.gz
tar xzf v0.9.7.tar.gz
cd lkrg-0.9.7

# Build and install
make
sudo make install

# Load module
sudo insmod /lib/modules/$(uname -r)/extra/lkrg.ko

# Configure auto-load on boot
echo "lkrg" | sudo tee -a /etc/modules-load.d/lkrg.conf

# Configure LKRG parameters
sudo nano /etc/modprobe.d/lkrg.conf

# Add configuration:
options lkrg kint_enforce=1 kint_validate=1 pint_enforce=1

# Verify LKRG is running
sudo dmesg | grep LKRG
lsmod | grep lkrg

2.3 Kernel Parameter Hardening

Comprehensive sysctl Configuration:

sudo nano /etc/sysctl.d/99-security-hardening.conf

# Network security
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv4.conf.all.secure_redirects = 0
net.ipv4.conf.default.secure_redirects = 0
net.ipv6.conf.all.accept_redirects = 0
net.ipv6.conf.default.accept_redirects = 0
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0
net.ipv6.conf.all.accept_source_route = 0
net.ipv6.conf.default.accept_source_route = 0

# Enable SYN cookies
net.ipv4.tcp_syncookies = 1

# Disable ICMP redirect acceptance
net.ipv4.conf.all.accept_redirects = 0

# Enable IP spoofing protection
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1

# Log suspicious packets
net.ipv4.conf.all.log_martians = 1

# Kernel hardening
kernel.dmesg_restrict = 1
kernel.kptr_restrict = 2
kernel.unprivileged_bpf_disabled = 1
kernel.unprivileged_userns_clone = 0
kernel.yama.ptrace_scope = 2

# Disable kexec
kernel.kexec_load_disabled = 1

# Address Space Layout Randomization
kernel.randomize_va_space = 2

# Apply settings
sudo sysctl -p /etc/sysctl.d/99-security-hardening.conf

• Control-Flow Enforcement: Ensure your hardware and OS support features like Shadow Stack to protect against Return-Oriented Programming attacks, commonly known as ROP.

# Control-Flow Enforcement (CET)
# Ensure your hardware and OS support features like Shadow Stack 
# to protect against Return-Oriented Programming attacks (ROP).

# Check if CET is supported by CPU:
cpuid | grep -i cet

# Check if Shadow Stack is enabled in kernel:
grep CONFIG_X86_USER_SHADOW_STACK /boot/config-$(uname -r)

3. Mandatory Access Control (MAC)

Standard Linux permissions such as Owner, Group, and Others are often too blunt for modern security needs. To truly isolate processes, you must leverage Mandatory Access Control.

• SELinux and AppArmor: Do not disable these features. SELinux, which is standard on RHEL and Fedora, and AppArmor, found on Ubuntu and Debian, provide granular control. They ensure that even if a service like Nginx is hacked, the attacker remains trapped within a restricted sandbox.
• Rootless Containers: If you run Docker or Podman, always aim for rootless mode. This ensures that a container breakout does not result in full administrative access to the host machine.

4. Intelligent Threat Detection and Live Patching

Manual log checking is too slow for modern security. You need automation to detect and respond to threats instantly. While Fail2Ban is a classic tool, CrowdSec is a powerful modern alternative. It uses behavior-based detection and a community database of malicious IPs to block attackers before they even reach your login prompt.

Furthermore, high-traffic servers cannot afford downtime for updates. Tools like Canonical Livepatch, kpatch, or KernelCare allow you to apply critical security fixes to the kernel without restarting the server, keeping you protected and online at the same time.

5. The Essential Hardening Checklist

For immediate results, ensure your configuration meets these baseline requirements:

Security Measure /	Implementation /	Why it matters /
Disable Root SSH |	PermitRootLogin no |	Blocks direct attacks on the admin account |
Change SSH Port |	Use a port above 1024 |	Stops 90% of automated bot scans |
Strict Firewall |	default deny incoming |	Only opens the doors you actually use |
Auditd Monitoring |	systemctl enable auditd |	Records every major change for later review |
Disk Encryption |	LUKS / dm-crypt |	Protects data if the physical drive is accessed |

Security is a process, not a product. Securing a Linux server is an ongoing journey that requires a balance of automated tools and vigilant administration. By shrinking your attack surface and assuming a breach is always possible, you create an environment that is too costly and difficult for intruders to penetrate.