> For the complete documentation index, see [llms.txt](https://security.andreasbreum.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://security.andreasbreum.com/blue-team/linux-system-hardening.md).

# Linux System Hardening

A general overview of techniques to harden Linux systems. The techniques here are aimed at Ubuntu systems.

## General best practices

* Regularly update your system: Keep your Linux distribution and all installed software up to date by applying security patches and updates. This helps protect against known vulnerabilities.
* Use strong passwords: Enforce strong password policies, including password complexity requirements and regular password changes. Consider using a password manager to generate and securely store complex passwords.
* Disable unnecessary services: Disable or uninstall any unnecessary services and daemons to minimize the attack surface of your system. Only enable the services required for your system's functionality.

## GRUB password

Many BIOS and UEFI firmware allows you to add a boot password. This password will prevent unauthorized users from booting the system. 

One tool to do so is `grub2-mkpasswd-pbkdf2`, which prompts you to input your password twice and generates a hash for you. The resulting hash should be added to the appropriate [configuration file](https://help.ubuntu.com/community/Grub2/Passwords)

## Filesystem Partitioning and Encryption

### [VeraCrypt ](https://veracrypt.fr/en/Home.html)nice and easy tool to use.

### However we can also use LUKS (Linux Unified Key Setup).

Most distributions let you encrypt a drive using a graphical interface. However, if you would like to set up LUKS from the command line, the steps are along these lines:

* Install `cryptsetup-luks`. (`apt install cryptsetup`)
* Confirm the partition name using `fdisk -l`, `lsblk` or `blkid`. (Create a partition using `fdisk` if necessary.)
* Set up the partition for LUKS encryption: `cryptsetup -y -v luksFormat /dev/sdb1`. (Replace `/dev/sdb1` with the partition name you want to encrypt.)
* Create a mapping to access the partition: `cryptsetup luksOpen /dev/sdb1 EDCdrive`.
* Confirm mapping details: `ls -l /dev/mapper/EDCdrive` and `cryptsetup -v status EDCdrive`.
* Overwrite existing data with zero: `dd if=/dev/zero of=/dev/mapper/EDCdrive`.
* Format the partition: `mkfs.ext4 /dev/mapper/EDCdrive -L "Strategos USB"`.
* Mount it and start using it like a usual partition: `mount /dev/mapper/EDCdrive /media/secure-USB`.

## Firewall (iptables)

We can configure firewall rules in Linux systems with iptables. Other firewalls include `nftables`. It is often easier to use a GUI than a CLI, as managing firewall rules is quite cumbersome.

Example: Enable SSH traffic.

`iptables -A INPUT -p tcp --dport 22 -j ACCEPT`

* `-A INPUT` appends to the INPUT chain, i.e., packets destined for the system.
* `-p tcp --dport 22` applies to TCP protocol with destination port 22.
* `-j ACCEPT` specifies (jump to) target rule ACCEPT.

`iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT`

* `-A OUTPUT` append to the OUTPUT chain, i.e., packets leaving the system.
* `-p tcp --sport 22` applies to TCP protocol with source port 22.

## Remote Access

Always use SSH and 

1. Disable remote login as `root`; force login as non-root users.
2. Disable password authentication; force public key authentication (with password) instead.
3. Preferable enforce whitelisting approach of public keys 

The configuration of the OpenSSH server can be controlled via the `sshd_config` file, usually located at `/etc/ssh/sshd_config`. You can disable the root login by adding the following line:

`PermitRootLogin no`

We can disable passwords authentication and enabling public key authentication as such:

* `PubkeyAuthentication yes` to enable public key authentication
* `PasswordAuthentication no` to disable password authentication