Linux Server Hardening

Linux Server Hardening

Distro support

Two-family skill. SSH and kernel/sysctl hardening are largely identical; the big difference is mandatory access control — Debian/Ubuntu use AppArmor, the RHEL family (Fedora, RHEL, CentOS Stream, Rocky, Alma, Oracle) enforces SELinux by default. Full SELinux detail is in references/selinux-reference.md.

Golden rule on RHEL: never setenforce 0 to "fix" a problem — diagnose the denial and set the right context/boolean/port. See references/selinux-reference.md and docs/multi-distro/plan.md. In sk-* scripts use the common.sh primitives (pkg_install, firewall_allow, svc_name).

Use when

• Applying security fixes after an audit or known hardening gap.
• Locking down SSH, UFW, fail2ban, sysctl, web stack, database, or file-permission posture.
• Converting audit findings into confirmed, staged changes on a live server.

Do not use when

• You only need a read-only findings report; use linux-security-analysis.
• The task is a narrow, non-security operational change better handled by a specialist skill.

Required Inputs

Capability Contract

Read/search confirmation precedes every change. Root-level edits, installs, service reloads, firewall changes, and enforcement changes require explicit authority. Preserve an independent recovery path and never broaden scope from one approved finding to an entire baseline.

Degraded Mode

Without audit evidence, root, recovery access, a maintenance window, or validation tooling, produce the narrowest qualified plan and exact commands for an operator. Leave the finding open; do not claim hardening is complete.

Decision Rules

Workflow

1. Reproduce the finding, identify distro/role dependencies, and confirm scope.
2. Define success, rollback, recovery access, and a syntax/config test; stop if any is missing.
3. Back up the affected config and preview the smallest change.
4. Apply one authorised control and validate access, syntax, service health, and application behaviour.
5. Roll back immediately on failed validation; preserve output and stop related changes.
6. Re-run the original audit check and record closure or residual risk.

Evidence Produced

Quality standards

• Every hardening step must be deliberate, reversible, and verified.
• Preserve operator access while tightening controls.
• Close findings with evidence, not intention.

Anti-patterns

• Hardening blind. Fix: reproduce a verified finding or define a precise target.
• Bundling high-risk changes. Fix: validate and checkpoint each control.
• Calling a control fixed before re-checking. Fix: repeat the original audit test.
• Disabling SELinux or AppArmor to clear a denial. Fix: fix labels, context, or narrow policy.
• Editing SSH without recovery access. Fix: preserve a second session or console and run sshd -t.
• Assuming rollback exists. Fix: create and test the config backup and restore command.

Outputs

Worked Example

For password SSH still enabled on Ubuntu, first verify key login in a second session, back up sshd_config, change only PasswordAuthentication, run sshd -t, reload SSH, and prove a new key session works before closing the old one. Restore the backup if validation fails.

Book-derived additions

For an NGO or civil-society programme that must join host controls to mission, identity, staff, incident, and recovery risk, load ../linux-ngo-cyber-resilience/SKILL.md.

References

• references/hardening-checklist.md
• references/sysctl-reference.md
• references/selinux-reference.md
• ../../01-provisioning-and-bootstrap/linux-package-management/SKILL.md — package hygiene, Flatpak/snap, and workstation AppImage runtime support.

This skill is self-contained. Every hardening step below uses standard tools on both Debian/Ubuntu and the RHEL family (Fedora, RHEL, CentOS Stream, Rocky, Alma, Oracle); see the Distro support table above for the family-specific equivalents. The sk-* scripts in the Optional fast path section are convenience wrappers — never required.

Applies security fixes interactively. Runs the audit first — never applies a change without your confirmation.

For a full picture first: run linux-security-analysis before hardening.

Desktop/workstation exception: AppImage runtime packages such as fuse3, desktop-file-utils, and app-specific media libraries (mpv-libs on Fedora) belong to workstation package setup, not production server hardening. Keep them off headless servers unless a real desktop app requirement exists; use linux-package-management when such a requirement is present.

Step 1: Run The Audit

sudo bash ~/.claude/skills/scripts/server-audit.sh

Fix FAIL items first, then WARN. Use references/hardening-checklist.md for the complete commands for each area.

Hardening Areas (In Priority Order)

1. SSH

• Disable password auth, disable root login, set MaxAuthTries 3
• WARNING: Keep existing SSH session open. Test login in a second terminal before closing the first session.
• Config: /etc/ssh/sshd_config.d/99-hardening.conf
• Script: sudo sk-harden-ssh (tests before reload, backs up existing config)

2. Firewall (UFW)

• Default deny incoming, allow 22/80/443 only
• sudo ufw status verbose to check current state
• Script: sudo sk-ufw-reset (interactive profile picker)

3. Kernel (sysctl)

• Network stack hardening + ASLR + kernel pointer restriction
• Config: /etc/sysctl.d/99-linux-skills.conf
• Script: sudo sk-harden-sysctl

4. Nginx

• server_tokens off in nginx.conf
• Security headers on all vhosts (or global security.conf)
• Dotfile blocking snippet included in all vhosts

5. PHP-FPM

• expose_php = Off, display_errors = Off, allow_url_include = Off
• Session cookie security settings
• disable_functions for dangerous functions
• Config: /etc/php/8.3/fpm/php.ini
• Script: sudo sk-harden-php

6. MySQL

• bind-address = 127.0.0.1 (never expose to network)
• Run mysql_secure_installation
• Application users: least-privilege only

7. Redis

• Bound to 127.0.0.1, password set, dangerous commands renamed

8. File Permissions

• /etc/shadow → 640, credential files → 600
• No world-writable files in /var/www
• SSH keys → 600

9. Automatic Updates

• unattended-upgrades installed and enabled

Verify After Hardening

sudo bash ~/.claude/skills/scripts/server-audit.sh
# All previous FAIL items should now be PASS

Full configs and commands for each area: references/hardening-checklist.md Reference guide: ~/.claude/skills/notes/server-security.md

Optional fast path (when sk-* scripts are installed)

Running sudo install-skills-bin linux-server-hardening installs:

These wrap the manual steps in references/hardening-checklist.md.

Scripts

This skill installs the following scripts to /usr/local/bin/. To install:

sudo install-skills-bin linux-server-hardening