How to Keep Your Linux System Secure From Hackers

As Linux gains widespread adoption across diverse platforms—ranging from servers and desktops to IoT devices—the need for securing these systems has become increasingly critical. While Linux is renowned for its solid security foundation, no operating system is entirely invulnerable to cyber threats. Attackers constantly evolve their tactics, making it vital for Linux users to stay ahead with the latest security measures. In this tutorial, we’ll explore popular security measures that every Linux user should implement. These best practices will help you mitigate risks and safeguard sensitive data. Let's get started!

Electronic circuit illustration — 📷 Credit: Freepik

The tips discussed below are generic and can be applied to Linux computers used in both homes and offices. It's not intended for production Linux servers running critical business software.

I'll recommend first trying some of the security tips in a virtual machine instance of your Linux distro. This way, you can test the waters before applying it to your system. Always take backups before proceeding.

1. Keep Your System Updated

One of the simplest yet most effective ways to secure your Linux system is by keeping it up to date. New vulnerabilities are discovered regularly, and vendors frequently release security patches to address them.

Here's how you do it on some of the most popular Linux distributions:

On a Debian/Ubuntu-based system, run:

sudo apt update && sudo apt upgrade

On a Fedora or RHEL-based system, run:

sudo dnf update

On an Arch Linux system, run:

sudo pacman -Syu

On a CentOS Linux system, run:

# For version 7.x or earlier
yum check-update
yum update

# For version 8.x and newer
dnf check-update
dnf update

If you are more concerned about the security of your Linux system, you may opt to automate the updates for critical security patches.

Caution: Be careful with fully automatic updates in production environments, as they can sometimes cause compatibility issues. Always test in a staging environment first.

On a Ubuntu system, you can enable unattended upgrades in the following way.

sudo apt install unattended-upgrades
sudo dpkg-reconfigure --priority=low unattended-upgrades

On a Fedora/RHEL-based system, use the following commands.

sudo dnf install dnf-automatic
systemctl enable --now dnf-automatic-install.timer # Works on Fedora 26 or newer

If you encounter compatibility issues and errors, roll back, disable automatic updates, and switch to the manual process.

2. Implement Strong User Permissions and Access Control

Linux's user permission system is highly robust, providing a strong first line of defense against unauthorized access. However, many users neglect to properly manage permissions, leaving their systems vulnerable. Effective permission and access control management is crucial to maintaining a secure environment.

Manage File Permissions

File permissions in Linux determine who can read, write, and execute files. The ls -l command provides detailed information about these permissions:

ls -l /path/to/your/file

This command will output a string similar to: -rwxr-xr--. The first character - represents the file type (a dash indicates a regular file), while the remaining nine characters are grouped into three sets that control permissions for the owner, group, and others.

'r' (read): Allows reading of the file contents.
'w' (write): Allows modification of the file contents.
'x' (execute): Allows execution of the file as a program/script.

For example, in -rwxr-xr--, the owner has full access (read, write, execute), the group can read and execute but not write, and others can only read the file.

To change file permissions, use the chmod command. If you want to ensure that only the file owner can execute a script, you can set permissions like this:

chmod 700 shell_script.sh

This command makes the file readable, writable, and executable only by the owner, while the group and others have no access.

Common `chmod` values:

'777': Full access for everyone (risky for sensitive files).
'755': The owner can read, write, execute; group and others can only read and execute.
'644': The owner can read and write; group and others can only read.
'600': Only the owner can read and write (used for sensitive files like SSH keys).

It’s essential to regularly review and tighten file permissions, especially for critical files like system scripts, configuration files, and sensitive user data.

Use the Principle of Least Privilege

The Principle of Least Privilege (PoLP) dictates that users should be granted the minimum access necessary to perform their tasks. This helps minimize the potential damage an attacker or a compromised account can do if access is gained.

Avoid using the root account directly: Instead of logging in as the root user, use sudo to perform administrative tasks. This limits root access and ensures that actions requiring higher privileges are tracked.

Restrict `sudo` access: Only users who need administrative privileges should have sudo access. You can manage which users have sudo rights by editing the /etc/sudoers file. It's highly recommended to use the visudo command for this task, as it performs syntax checking and reduces the chance of errors:

sudo visudo

Inside this file, you can specify which users have access and what commands they can execute with elevated privileges. For instance, if you want to allow a user (ken) to run only the fdisk command with sudo, you can add:

ken ALL=(ALL) NOPASSWD: /sbin/fdisk

Additionally, consider using groups like sudo or wheel (depending on your distribution) to manage privileged users. Adding or removing users from this group ensures centralized control over admin access.

Regular Auditing of User Permissions

Regular audits of your system's users and their permissions can help identify security holes or unnecessary privileges.

1. Review User Accounts: Use the getent passwd command to list all user accounts on the system:

getent passwd

Look for any suspicious or outdated accounts, especially ones that may have been created for temporary access or services no longer in use.

2. Check `sudo` Access: Audit which users have sudo rights by reviewing the /etc/sudoers file. You can also list users who belong to the sudo group using:

getent group sudo

Ensure that only trusted users are in this group, as having sudo access provides significant control over the system.

3. Monitor File Permissions: Use the find command to locate files with risky permissions, such as world-writable files (files that anyone can modify):

find / -perm -o=w

Files with world-writable permissions can be modified by any user on the system, which can be a security risk.

In a nutshell, properly managing user permissions and access control is crucial in any Linux environment. By regularly auditing permissions, using the principle of least privilege, and implementing role-based access when necessary, you can significantly improve the security of your system.

3. Secure Your SSH Connections

SSH (Secure Shell) is a widely used protocol for securely accessing and managing Linux systems remotely. While it offers encrypted communication, default SSH configurations can pose significant security risks if not properly hardened.

Implementing robust SSH security measures is crucial to protect your system from unauthorized access and potential breaches. Here's how you can secure your SSH setup effectively:

1. Change the Default SSH Port

By default, SSH listens on port 22. Attackers often scan this port to look for vulnerable systems. Changing the default SSH port to a non-standard port can help reduce the likelihood of automated attacks. For example, you can change the SSH port to 2209 by editing the SSH configuration file:

sudo nano /etc/ssh/sshd_config

Locate the line #Port 22 and change it to:

Port 2209

After saving the changes, restart the SSH service:

sudo systemctl restart sshd

Remember, a change of default SSH port is a must if you want to avoid security problems related to remote SSH connections.

2. Disable Root Login

Allowing root login over SSH can be a significant security risk. If compromised, an attacker would have full control over your system. Instead, use a non-root user with sudo privileges for SSH access. To disable root login, modify the PermitRootLogin directive in the SSH configuration file:

# Open SSH configuration file
sudo nano /etc/ssh/sshd_config

# Change 'PermitRootLogin yes' directive to:
PermitRootLogin no

# Restart the SSH service
sudo systemctl restart sshd

Disallowing root login creates a baseline to avoid different types of unauthorized actions.

3. Use SSH Key Authentication

Password-based authentication is susceptible to brute-force attacks. Switching to SSH key-based authentication significantly enhances security. Generate an SSH key pair using the following command:

ssh-keygen -t rsa -b 4096

This will create a public and private key pair. Copy the public key to your remote server using:

ssh-copy-id user@remote-server-address

Now, disable password authentication by editing the SSH configuration file:

# Open SSH configuration file
sudo nano /etc/ssh/sshd_config

# Set the following directive
PasswordAuthentication no

# Restart the SSH service
sudo systemctl restart sshd

Eliminating password-based logins hardens your Linux system's security by many folds.

4. Limit SSH Access by IP Address

If you only need to access your server from specific IP addresses, you can configure the firewall to allow SSH connections only from those addresses. For example, using UFW (Uncomplicated Firewall), you can allow SSH access from a specific IP:

# Specify the IP to allow SSH connections from
sudo ufw allow from 192.168.1.56 to any port 2209

# Enable the firewall
sudo ufw enable

This restricts SSH access to only the specified IP, adding an extra layer of security.

5. Enable Two-Factor Authentication (2FA)

Adding a second layer of authentication to your SSH setup can further secure your server. Using tools like Google Authenticator or Authy, you can set up two-factor authentication. First, install the necessary PAM (Pluggable Authentication Module) library:

sudo apt install libpam-google-authenticator

Then, configure SSH to use it by adding the following line to the /etc/pam.d/sshd file:

auth required pam_google_authenticator.so

Finally, enable 2FA in the SSH configuration file:

# Open SSH configuration file
sudo nano /etc/ssh/sshd_config

# Uncomment or add the following directive
ChallengeResponseAuthentication yes

# Restart the SSH service
sudo systemctl restart sshd

This configuration requires both a key and a verification code to log in, significantly enhancing security.

6. Monitor and Limit Login Attempts

To prevent brute-force attacks, use tools like Fail2ban. Fail2ban monitors login attempts and blocks IP addresses that exceed a defined threshold of failed attempts. Install Fail2ban with:

sudo apt install fail2ban

Create a custom jail for SSH in /etc/fail2ban/jail.local:

[sshd]
enabled = true
port = 2209
filter = sshd
logpath = /var/log/auth.log
maxretry = 3

# Start and enable the Fail2ban service
sudo systemctl start fail2ban
sudo systemctl enable fail2ban

With these settings, if an IP address fails to authenticate three times, it will be banned for a specified duration.

By implementing these best practices, you can significantly reduce the risk of unauthorized access and safeguard your Linux systems against common SSH-related vulnerabilities.

4. Enable and Configure a Firewall

A firewall acts as a gatekeeper, deciding which network traffic can enter or leave your Linux system. UFW (Uncomplicated Firewall) is a user-friendly tool for firewall management on Ubuntu/Debian systems.

Setting Up UFW

Start by installing UFW if it’s not already installed:

sudo apt install ufw

Allow only the necessary services (e.g., SSH):

sudo ufw allow ssh

To deny all other incoming traffic:

sudo ufw default deny incoming
sudo ufw default allow outgoing

Then enable the firewall:

sudo ufw enable

To check the firewall status:

sudo ufw status

For more granular control, consider using iptables or nftables for complex rule sets.

5. Implement Disk Encryption

Disk encryption is a crucial security measure that protects your data in case your system falls into the wrong hands. By encrypting your disk, you ensure that even if an attacker gains physical access to your machine, they won’t be able to read your data without the decryption key.

Why Use Disk Encryption?

When your disk is encrypted, the data stored on it is converted into an unreadable format. Only someone with the correct decryption key can access it. This is particularly important for safeguarding sensitive information and preventing unauthorized access if your device is lost or stolen.

How to Set Up Disk Encryption

Most modern Linux distributions provide an option to encrypt the disk during installation, which is the easiest way to get started. However, if you're looking for an alternative, you can use LUKS (Linux Unified Key Setup), the standard for encrypting partitions on Linux.

Here’s how you can encrypt a new partition using LUKS:

1. Format the Partition with LUKS Encryption:

This command initializes the partition for LUKS, effectively wiping all data on it. Be sure to replace /dev/sdX with your actual partition identifier (e.g., /dev/sda1).

sudo cryptsetup luksFormat /dev/sdX

2. Open the Encrypted Partition:

This command will open the encrypted partition, allowing you to map it to a device name ('encrypted_partition in this case).

sudo cryptsetup luksOpen /dev/sdX encrypted_partition

3. Create a Filesystem on the Encrypted Partition:

Once the encrypted partition is mapped, you can create a filesystem on it. For example, to create an ext4 filesystem, run:

sudo mkfs.ext4 /dev/mapper/encrypted_partition

4. Mount the Encrypted Partition:

After creating the filesystem, you can mount the encrypted partition like any other disk:

sudo mount /dev/mapper/encrypted_partition /mnt

Now, your encrypted partition is accessible and can be used for secure data storage.

Encrypting Swap Partitions and Backups

To ensure comprehensive protection, it's crucial to encrypt not just your primary storage partitions but also swap partitions and any backup media. Swap partitions can contain sensitive information, as they temporarily store data from RAM, including passwords and encryption keys.

Similarly, unencrypted backups defeat the purpose of disk encryption, as they can be easily accessed if compromised.

Encrypting Swap: You can configure encrypted swap space by editing your system's /etc/crypttab and /etc/fstab files, or by using a tool like cryptsetup during system setup.

Encrypting Backups: For backups, consider using tools like Duplicity or BorgBackup, which offer built-in support for encryption.

By following the steps mentioned above, you can enhance the security of your Linux system by many folds and protect your data from unauthorized access.

6. Securing the Linux Kernel with Mandatory Access Controls (MAC)

Mandatory Access Control (MAC) frameworks, such as SELinux (Security-Enhanced Linux) and AppArmor, enhance Linux system security. They enforce strict policies that govern which resource processes can access, providing an extra layer of security against potential threats.

These mechanisms are particularly effective when an attacker compromises a process, as they limit the damage that can be done by restricting access to sensitive parts of the system.

Implementing SELinux on CentOS/Fedora

SELinux is a robust MAC implementation that is widely used in CentOS and Fedora. By default, it operates in one of three modes:

Enforcing: SELinux policies are enforced, and unauthorized actions are blocked.
Permissive: SELinux policies are not enforced, but violations are logged for auditing purposes.
Disabled: SELinux is completely turned off.

To verify if SELinux is enabled on your system, you can use the following command:

sestatus

This will output the current status, showing whether SELinux is enabled and which mode it is operating in. If SELinux is not enabled, you can enable it by editing its configuration file. Follow these steps:

1. Open the configuration file in a text editor:

sudo nano /etc/selinux/config

2. Locate the line that starts with SELINUX=. It will typically be set to disabled or permissive:

SELINUX=disabled

3. Change this line to the following to enable enforcing mode:

SELINUX=enforcing

4. Save the file and exit the editor. For the changes to take effect, you need to reboot the system:

sudo reboot

After the reboot, you can confirm that SELinux is now enforcing policies by running the sestatus command again.

Configuring AppArmor on Ubuntu

AppArmor is the default MAC implementation on Ubuntu and offers similar protections to SELinux but with a different approach to defining and enforcing security policies. It's lightweight and integrates seamlessly with the Ubuntu ecosystem.

To check the status of AppArmor and see which profiles are loaded and enforced, use the following command:

sudo aa-status

This will display a list of loaded AppArmor profiles along with their current enforcement status. If you need to enable or disable specific profiles, you can do so using the aa-enforce or aa-disable commands, respectively. For example, to enforce a Google Chrome process's profile:

sudo aa-enforce /etc/apparmor.d/opt.google.chrome.chrome

Both SELinux and AppArmor provide powerful tools for enhancing the security posture of Linux systems. Regardless of your choice, enabling and configuring these MAC frameworks can significantly reduce the risk of exploitation by constraining what a compromised process can do on your system.

7. Implement Log Monitoring and Auditing

Logs serve as the digital breadcrumbs of your system, recording everything from user activities to system events. They are best suited for troubleshooting issues, monitoring system performance, and, most importantly, identifying security threats.

Effective log management and monitoring are crucial for early detection of potential security incidents, helping you respond promptly and minimize damage.

Why Log Monitoring is Essential

When an unexpected issue arises or a security breach occurs, logs provide a detailed account of what happened. They can reveal unauthorized access attempts, system anomalies, or malicious activities, enabling you to take corrective action before a minor issue becomes a critical problem.

Monitor Logs with Logwatch

Logwatch is a log analysis tool that simplifies the process of reviewing log files by generating human-readable reports. It provides a comprehensive summary of logs from various services, including SSH, web servers, and mail servers, making it easier to detect unusual activities.

Installing Logwatch:

To install Logwatch on a Debian-based system, run the following command:

sudo apt install logwatch

Configuring Logwatch:

Once installed, you can configure Logwatch to send daily log summaries to your email, ensuring you are promptly notified of any suspicious activity. Use the following command to set it up:

logwatch --output mail --mailto you@emailaddress.com --detail high

Pro Tip: Adjust the --detail parameter to set the verbosity of the reports. Options range from low (basic information) to high (detailed information), depending on your monitoring needs.

Enhancing Log Monitoring with Advanced Tools

While Logwatch is excellent for daily summaries, integrating additional tools can provide deeper insights and real-time monitoring capabilities.

Keep Track of Critical System Events with auditd

The auditd (Audit Daemon) is a robust tool for tracking system events, including file access, changes to system configurations, and user activities. It's especially useful for compliance purposes and forensics in case of a security incident.

Installing auditd:

To install auditd on your system, use the following command:

sudo apt install auditd

Basic Configuration:

After installation, you can start tracking significant events by defining rules that specify which actions to monitor. For example, to monitor changes to a sensitive and important file like /etc/passwd, you can add a rule like this:

sudo auditctl -w /etc/passwd -p wa -k passwd_modified

In this example:

-w /etc/passwd sets the file to watch.
-p wa specifies the permissions to watch: `w` for write and `a` for attribute changes.
-k passwd_modified assigns a key to the rule, making it easier to search for related events.

Best Practices for Log Monitoring and Auditing

Retention Policies: Define how long you will retain logs. Ensure old logs are archived securely.
Access Controls: Restrict access to log files and monitoring tools to prevent tampering.
Regular Audits: Periodically review your log monitoring setup and update it to cover new services or changes in your environment.

Log monitoring and auditing are important components of Linux security strategy. By combining tools like Logwatch and auditd, you can gain visibility into your systems and detect threats early.

Conclusion

Implementing these crucial Linux security practices will help you greatly lower the chances of security incidents and vulnerabilities on your system. While no setup is entirely impervious to threats, a combination of regular updates, strict access controls, firewalls, intrusion detection, and encryption provides robust protection against both external attacks and internal risks.