Home

Welcome to The Practical Linux Hardening Guide wiki!

You can file an issue about it and ask that it be added.

---

The Practical Linux Hardening Guide provides a high-level overview of the hardening GNU/Linux systems. It is not an official standard or handbook but it touches and use industry standards.

Table of Contents

• External resources
  • Other official hardening guides
• Pre install tasks
  • Physical system security
    • Introduction
    • Secure rooms
    • Monitoring
    • Air conditioning
    • Fire protection
    • Locked racks
    • Console security
    • BIOS protection
    • Summary checklist
  • Hard disk encryption
    • Introduction
    • Encrypt root filesystem
    • Encrypt /boot partition
    • Swap partition
    • Summary checklist
• Post install tasks
  • Bootloader configuration (grub)
    • Introduction
    • Protect bootloader with password
    • Protect bootloader config files
    • Summary checklist
  • Disk partitions
    • Introduction
    • Separate disk partitions
    • Mount options: nodev, noexec and nosuid
    • Secure /boot directory
    • Secure /tmp and /var/tmp
    • Secure /dev/shm
    • Secure /proc filesystem
    • Swap partition
    • Disk quotas
    • Summary checklist
  • Keep system updated
    • Introduction
    • Make sure that the system is up to date
    • Automatic security updates
    • Useful resources
    • Summary checklist
  • Package management
    • Introduction
    • Check package signatures
    • Remove packages with known issues
    • Useful resources
    • Summary checklist
  • Netfilter ruleset
    • Shorewall
  • TCP wrapper
  • Users and groups
    • Limit su access
    • Disable root account
    • Logins to system console
    • Disable shell accounts
    • Strong password policy
    • Password aging
    • Previous passwords
    • Login failures
    • Protect single user mode
  • System path permissions
    • World writable files
  • PAM module
  • Limits
  • Shadow passwords
  • Linux kernel hardening
    • Kernel parameters
      • Network security
      • System security
  • Remove unused modules
  • Secure shared memory
  • IRQ balance
  • Disable compilers
  • Email notifications
    • Rebooting the system
    • Login the system
  • Backups
    • Backup policy
  • External devices
    • Disable USB usage
• Tools
  • Logging and Auditing
    • Syslog
    • Auditd
    • OSSEC
    • Tiger
    • Aide
    • Logwatch
  • SELinux
  • Other
    • Fail2ban
    • PSAD
    • Entropy daemon
    • Centralized authentication service
  • Testing tools
    • Lynis
    • Chrootkit
• Services
  • Disable all unnecessary services
    • Common unix print system
    • Summary checklist
  • System services
    • OpenSSH
    • NTP
    • Cron
    • Anacron
    • GnuPG 2
      • Unattended key generation
  • DNS services
    • Bind9
    • Unbound
    • Knot Resolver
  • Mail services
    • Postfix
  • Web services
    • Nginx
      • Files and directories permissions
      • Use HTTPS
      • Enable HTTP2
      • Separate domains
      • Redirect all unencrypted traffic to HTTPS
      • Enable HTTP Strict Transport Security
      • Diffie Hellman Ephemeral Parameter
      • Security related headers
    • Apache
  • Databases
    • PostgreSQL
    • MySQL
    • Redis
  • Queues
    • AMQP
• Containers
  • LXC/LXD
  • Docker
  • Hashicorp suite
• Deployment
• Testing configuration