Linux Security Hardening: 19 Best Practices with Linux Commands

What Is Linux Security Hardening?

Linux security hardening involves implementing a series of measures and best practices to reduce vulnerabilities and strengthen the security posture of a Linux server. This process aims to minimize potential attack vectors and ensure the server’s integrity, confidentiality, and availability. Hardening a Linux server typically includes configuring system settings, applying security patches, and disabling unnecessary services and applications.

The basic steps involved in hardening a Linux server include updating the system and all installed software to the latest versions to address known vulnerabilities; configuring access controls, such as setting strong passwords and managing user privileges; and improving network security by configuring firewalls (e.g., iptables or nftables), disabling unused network ports, and encrypting data communications.

Critical Benefits of Hardening a Linux Server 

Linux hardening provides many benefits, which are not limited to security. Here are a few reasons every Linux server should undergo hardening:

• Enhanced security: Hardening significantly reduces the risk of unauthorized access and data breaches.
• Reduced attack surface: Limits the number of entry points for attackers by disabling unnecessary services and applications.
• Incident response effectiveness: Facilitates quicker detection and response to security incidents through improved logging and monitoring.
• Improved system stability: Removing unnecessary services and software minimizes potential conflicts and resource usage.
• Data integrity and confidentiality: Ensures that sensitive data remains secure and unaltered through encryption and access controls.
• Operational continuity: Enhances the server’s ability to remain operational and functional during security incidents.

Tips and Best Practices for Linux Security Hardening (with Linux Commands) 

Here are some of the ways that organizations can harden their Linux servers.

1. Encrypt File Systems 

Encrypting file systems ensures that data stored on the disk is secure and inaccessible to unauthorized users, even if the physical media is compromised. A widely used method for encrypting disk partitions on Linux is LUKS (Linux Unified Key Setup), which offers strong encryption for block devices. LUKS operates at the partition level, providing full disk encryption.

Here’s how to set this up:

• Install LUKS: Use the following script:

sudo apt-get install cryptsetup  # Debian-based systems

sudo yum install cryptsetup      # Red Hat-based systems

• Set up a LUKS-encrypted partition: Before setting up encryption, identify the partition to encrypt using lsblk or fdisk. Use the following commands to initialize encryption on the chosen partition, open it, create a file system on it, and mount the encrypted partition:

sudo cryptsetup luksFormat /dev/sdX

sudo cryptsetup luksOpen /dev/sdX encrypted_partition

sudo mkfs.ext4 /dev/mapper/encrypted_partition
sudo mount /dev/mapper/encrypted_partition /mnt

• Access and manage encrypted data: To unmount and close the encrypted partition:

sudo umount /mnt

sudo cryptsetup luksClose encrypted_partition

• Automate mounting on boot: To automatically mount the encrypted partition on boot, you’ll need to store the LUKS passphrase securely (e.g., using a key file) and configure /etc/crypttab and /etc/fstab for auto-mounting. This allows the partition to be available without manual unlocking after each reboot, ensuring seamless access to the encrypted data.

2. Remove Unneeded Functionality 

Eliminating unnecessary components helps in minimizing the attack surface of Linux servers. This process involves identifying and disabling or uninstalling services, applications, and modules that are not required for the server’s operation. It reduces potential entry points for attackers, decreases system complexity, and improves the overall security posture:

• Audit installed packages: Use package management tools like apt, yum, or zypper to list all installed packages. Review the list and remove any packages that are not necessary for your server’s roles or functions. It is also important to install the security updates available for your operating system.
• Disable unused services: Check running services with commands like systemctl list-units –type=service or service –status-all. Disable services that are not needed for your server’s operation using appropriate commands (systemctl disable <service> or chkconfig <service> off).
• Unbind unnecessary network services: For network-bound services that cannot be disabled, configure them to listen only on localhost (127.0.0.1) if remote access is not required. This can often be done within the service’s configuration file.
• Limit module loading: Restrict the loading of kernel modules by blacklisting those that are unnecessary for your server’s functionality. This can be achieved by adding entries to files in /etc/modprobe.d/.
• Secure boot configuration: Ensure that boot loaders like GRUB2 are password-protected and configured securely to prevent unauthorized modifications during the boot process.

3. Minimize Open Ports and Other Network Vulnerabilities 

By reducing the number of open ports and securing those that need to remain open, administrators can significantly decrease the server’s exposure to potential attacks. Here are strategies to achieve this goal:

• Conduct a port audit: Use tools like nmap or ss to identify all open ports on the server. Review the list of open ports and determine which services are associated with each port.
• Close unnecessary ports: For any service that is not required, disable the service or configure it to stop listening on the network. This can usually be done within the service’s configuration file or by stopping and disabling the service using systemd commands (systemctl stop <service> and systemctl disable <service>).
• Implement firewall rules: Utilize a firewall solution like iptables, nftables, or ufw to create rules that explicitly allow traffic only on necessary ports and deny all other traffic by default. Be sure to allow essential services such as SSH (on a non-default port), HTTP/HTTPS for web servers, and any application-specific ports that must be accessible. Use restrictive settings, which ensure all ports are inaccessible except those explicitly open by the security admin
• Use TCP wrappers for additional control: For services that support it, use TCP wrappers (/etc/hosts.allow and /etc/hosts.deny) to restrict access to specific services based on IP addresses or hostnames, adding an extra layer of control over who can connect to your server.
• Regularly review network configuration: Periodically re-audit your server’s open ports and firewall rules to ensure that only required ports remain open and that firewall rules are still relevant based on changes in your server’s roles or applications.
• Isolate sensitive services: For critical services, consider running them in isolated environments such as containers or virtual machines with dedicated network interfaces. This limits access to these services and reduces risk in case of compromise.
• Enable connection rate limiting: Configure the firewall or use tools like fail2ban to limit connection attempts to sensitive services like SSH. This helps mitigate brute-force attacks by temporarily banning IPs that make too many failed connection attempts within a short period. In addition, it is recommended to use third-party DDoS protection such as Cloudflare to mitigate risks associated with such attacks.

4. Manage Password Policies 

Password management is essential for ensuring that all user accounts on the system adhere to strong password standards. This helps prevent unauthorized access due to weak or compromised passwords. Here are strategies for managing password policies on Linux systems:

• Enforce password complexity: Configure Pluggable Authentication Modules (PAM) to enforce password complexity requirements. This can include rules for minimum length, and the inclusion of uppercase letters, lowercase letters, numbers, and special characters. An example PAM configuration in /etc/pam.d/common-password is :

password requisite pam_pwquality.so retry=3 minlen=12 dcredit=-1 ucredit=-1 lcredit=-1 ocredit=-1

This configuration enforces a minimum length of 12 characters and requires at least one digit (dcredit), one uppercase letter (ucredit), one lowercase letter (lcredit), and one special character (ocredit).

• Implement password aging: Use the chage command to set password expiration policies for user accounts. This forces users to regularly update their passwords, reducing the risk of long-term use of compromised passwords. Here’s an example command to set a maximum password age of 90 days:

sudo chage -M 90 username

• Limit password reuse: To prevent users from reusing old passwords, configure PAM with the pam_unix.so module’s remember option in /etc/pam.d/common-password. Here’s an example PAM configuration to remember the last five used passwords: password sufficient pam_unix.so remember=5
• Educate users about secure password practices: Regularly inform and educate users about the importance of strong passwords and secure authentication practices. Encourage the use of passphrase generators or managers where appropriate.
• Monitor failed login attempts: Configure the system to monitor and alert administrators about excessive failed login attempts, which could indicate brute-force attacks. 

5. Lock User Accounts After Login Failures 

Locking user accounts after a certain number of unsuccessful login attempts helps prevent brute-force attacks. By implementing account lockout policies, systems can automatically disable access for accounts that exhibit suspicious login behavior, reducing the risk of unauthorized access. To implement this:

• Configure PAM for account lockout: Use the PAM framework to set up account lockout policies. Edit the /etc/pam.d/common-auth file and add entries to define lockout conditions.

• Example configuration to lock an account after 5 failed login attempts for 10 minutes:
  • auth required pam_tally2.so onerr=fail deny=5 unlock_time=600

• Use the faillog command: The faillog command can display and modify the login failure log, set limits on allowed failed login attempts, and reset counters. Use this command to manage account lockouts and review failed login attempts.
• Implement manual unlock procedures: Establish procedures for manually unlocking accounts after verification of the user’s identity. This ensures that legitimate users can regain access while maintaining security controls. 

6.Use Secure Shell with Key-Based Authentication 

Implementing Secure Shell (SSH) with key-based authentication enhances security by replacing traditional password-based logins with cryptographic keys. This method reduces the risk of brute-force attacks and unauthorized access since attackers must possess the correct private key to gain entry. Here’s how to set up key-based authentication for SSH:

• Generate a key pair: On the client machine, use the ssh-keygen command to create a public and private key pair. The command and its default parameters will save the keys in the ~/.ssh directory:

ssh-keygen -t rsa -b 4096 -C “your_email@example.com”

This generates a public key (id_rsa.pub) and a private key (id_rsa).

• Copy the public key to the server: Transfer the public key to the server’s authorized keys file. Use the ssh-copy-id command to achieve this:

ssh-copy-id user@server_ip_address

Alternatively, manually append the public key to the ~/.ssh/authorized_keys file on the server:

cat ~/.ssh/id_rsa.pub | ssh user@server_ip_address ‘cat >> ~/.ssh/authorized_keys’

• Configure the SSH daemon: Edit the SSH configuration file (/etc/ssh/sshd_config) on the server to enhance security settings. Disable password-based authentication by setting:

PasswordAuthentication no

PubkeyAuthentication yes

After making changes, restart the SSH service:

sudo systemctl restart sshd

• Set proper permissions: Ensure that the .ssh directory and the authorized_keys file have the correct permissions to prevent unauthorized access:

chmod 700 ~/.ssh

chmod 600 ~/.ssh/authorized_keys

• Disable root login: To further secure the server, disable root login over SSH by adding or modifying the following line in the sshd_config file:

PermitRootLogin no

7. Enable SELinux or AppArmor 

Enabling mandatory access control (MAC) systems such as SELinux or AppArmor adds an additional layer of security by enforcing policies that restrict how programs can access resources. 

Here’s how to set up and manage SELinux:

• Installation: On many Linux distributions, SELinux is already installed (note that it is not installed by default on Ubuntu). Verify its status using:

sestatus

• Configuration: Modify the SELinux configuration file (/etc/selinux/config) to enable it in enforcing mode:

SELINUX=enforcing

Apply changes by rebooting the system:

sudo reboot

• Policies: Use predefined policies to restrict applications. For example, to apply a policy for an Apache server, use:

sudo semanage fcontext -a -t httpd_sys_content_t “/var/www/html(/.*)?”

sudo restorecon -Rv /var/www/html

To enable AppArmor:

• Installation: Install AppArmor if it is not already present. On Debian-based systems, use:

sudo apt-get install apparmor apparmor-utils

• Configuration: Ensure AppArmor is enabled at boot by editing the GRUB configuration (/etc/default/grub) and adding apparmor=1 security=apparmor to the GRUB_CMDLINE_LINUX line:

GRUB_CMDLINE_LINUX=”… apparmor=1 security=apparmor”

Update GRUB and reboot:

sudo update-grub

sudo reboot

• Profiles: Load and enforce AppArmor profiles for applications. For example, to enforce a profile for the MySQL service, use:

sudo aa-enforce /etc/apparmor.d/usr.sbin.mysqld

8. Review User Accounts and Authentication 

Ensuring that only authorized users have access, and that they are authenticated securely, is fundamental to protecting the system from unauthorized access and potential breaches. To ensure a thorough review process:

• Audit user accounts: Regularly audit all user accounts on the system using commands like cat /etc/passwd or getent passwd. Look for any accounts that are no longer in use, or were created for testing purposes and forgotten. These should be disabled or removed to prevent unauthorized access.
• Enforce strong password policies: Implement strong password policies using Pluggable Authentication Modules (PAM) configuration. This can include password complexity requirements, minimum password length, and password expiration policies. Tools like pam_cracklib can be used to enforce these policies.
• Use two-factor authentication (2FA): For critical systems, consider implementing two-factor authentication for an added layer of security. This requires users to provide two forms of identification: something they know (like a password) and something they have (like a token or mobile phone app generating one-time codes).
• Limit the use of the root account: Avoid using the root account for day-to-day administration by creating individual user accounts with sudo privileges for administrators. This reduces the risk associated with having multiple people share the root account and provides an audit trail of administrative actions.
• Regularly review the sudoers file: Carefully manage the /etc/sudoers file to control which users have sudo access and what commands they can execute as root. Use the visudo command to edit this file safely.
• Manage SSH keys: If using SSH key-based authentication, regularly review and remove any outdated or unused public keys from ~/.ssh/authorized_keys files on user accounts.
• Disable empty password accounts: Ensure no accounts exist with empty passwords by setting them to a locked state or assigning strong passwords where necessary.
• Implement an account lockout policy: Configure account lockout policies to temporarily disable accounts after a certain number of failed login attempts, reducing the risk of brute-force attacks.

9. Enable Iptables (Firewall)

Enabling and correctly configuring iptables, the default Linux firewall, is a critical step towards securing a Linux server. This firewall allows you to define rules for how incoming and outgoing network traffic should be handled. By setting up iptables, you can protect the server from unauthorized access and various network attacks. Here are some tips for configuring it:

• Default policies: Set default policies to DROP for INPUT, FORWARD, and OUTPUT chains. This ensures that any traffic not explicitly allowed will be denied.

iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT DROP

• Allow essential traffic: Define rules to allow essential inbound and outbound traffic for your server’s operation. Commonly allowed inbound traffic includes SSH (port 22), HTTP (port 80), and HTTPS (port 443). Remember to adjust port numbers if you’re using non-standard ports.

iptables -A INPUT -p tcp –dport 22 -j ACCEPT
iptables -A INPUT -p tcp –dport 80 -j ACCEPT
iptables -A INPUT -p tcp –dport 443 -j ACCEPT

• Allow the loopback interface: The loopback interface (lo) is essential for internal system communication. Ensure that traffic on this interface is allowed.

iptables -A INPUT -i lo -j ACCEPT

• Establish stateful inspection: Use connection tracking to allow established connections to continue while still filtering new incoming connections based on your defined rules.

iptables -A INPUT -m conntrack –ctstate ESTABLISHED,RELATED -j ACCEPT

• Log dropped packets: Configure logging for dropped packets to help identify potentially malicious activity or adjust the firewall rules as needed. 

iptiles –A INPUT –m limit –limit 5/min –j LOG –log-prefix “iptables denied: ” –log-level 7

• Save the rules: After configuring these rules, ensure that they persist across reboots by saving them with the appropriate command for your distribution (iptables-save on Debian/Ubuntu or service iptables save on CentOS/RHEL).
• Regularly review the firewall rules: Periodically review and update the rules to adapt to changes in the server’s configuration or respond to emerging security threats.

10. Encrypt Data Communication for Linux Server 

Encryption involves transforming readable data into an encoded format that can only be deciphered by someone who possesses the correct decryption key. By encrypting data in transit, organizations can protect sensitive information from being intercepted and accessed by unauthorized individuals. To ensure full encryption (in addition to enabling SSH as described above):

• Implement TLS/SSL for web services: Use Transport Layer Security (TLS) or its predecessor, Secure Sockets Layer (SSL), to secure HTTP traffic. Obtain a certificate from a trusted Certificate Authority (CA) and configure your web server to use HTTPS.
• Enable IPsec for network communication: This protocol suite authenticates and encrypts each IP packet in a communication session. Use IPsec to secure data communication between Linux servers, especially when transmitting over untrusted networks.
• Use VPNs for remote connections: Virtual Private Networks (VPNs) create a secure tunnel between remote users or sites over the Internet. By routing traffic through this encrypted tunnel, VPNs ensure that data remains confidential and protected from eavesdropping.
• Use email encryption: Implement protocols such as S/MIME (Secure/Multipurpose Internet Mail Extensions) or PGP/GPG (Pretty Good Privacy/GNU Privacy Guard). 

11. Disable USB Usage 

Disabling USB ports helps in preventing unauthorized access and data exfiltration from Linux systems. USB devices can be used to introduce malware or copy sensitive information without permission. Here’s how to disable USB usage:

• Block the USB storage module: Prevent the kernel from loading the usb-storage module, which is responsible for recognizing USB storage devices. Edit or create a file in /etc/modprobe.d/ named disable-usb-storage.conf and add the line 
• blacklist usb-storage. This will stop the system from loading the USB storage driver, effectively disabling the use of USB storage devices.
• Use Udev rules: Udev, the device manager for the Linux kernel, allows you to write rules that can enable or disable access to certain devices. Create a udev rule in /etc/udev/rules.d/ to disable all USB storage:

ACTION==”add”, KERNEL==”sd[a-z][0-9]*”, SUBSYSTEMS==”usb”, ATTRS{removable}==”1″, RUN+=”/bin/sh -c ‘echo 0 > /sys$DEVPATH/../bConfigurationValue'”

This rule matches removable devices added (ACTION==”add”) that are recognized as SCSI disk devices (KERNEL==”sd[a-z][0-9]*”) on the USB subsystem (SUBSYSTEMS==”usb”), then disables them.

• Remove or disable unnecessary drivers: If the system does not require any USB functionality, consider removing or disabling unnecessary drivers from the kernel configuration if you are compiling your own kernel.
• Physically disable or block ports: For systems that should never use USB ports (e.g., servers in a data center), physically disabling or blocking access to USB ports is an effective measure. This can be done by disconnecting internal headers on motherboards or using physical locks available for USB ports.
• Restrict access with permissions: As an additional layer of protection, you can set strict permissions on device nodes for USB storage devices: chmod 000 /dev/sda* This command removes all permissions for accessing first SCSI disk device nodes, preventing users from accessing attached USB storage. 

12. Physically Secure the Server 

Physical server security involves implementing measures to prevent unauthorized physical access, theft, vandalism, and environmental hazards that could compromise server integrity and data confidentiality. Here are some key considerations for enhancing physical server security:

• Access control: Implement strict access control measures to restrict entry to server rooms and data centers. Use electronic access systems with key cards or biometric authentication to track and control who enters the server environment.
• Surveillance: Deploy surveillance cameras around critical areas, including entrances/exits and server racks. Continuous monitoring can deter potential intruders and provide evidence in case of security incidents.
• Environmental controls: Ensure that servers are housed in a controlled environment with optimal temperature and humidity levels maintained through climate control systems. Protect against environmental risks such as fire, flooding, and power surges with appropriate detection systems (smoke detectors) and uninterruptible power supplies (UPS).
• Rack security: Secure servers within locked racks or cages to prevent unauthorized removal or tampering with the hardware. Consider using tamper-evident seals on server cases for additional security.
• Visitor management: Establish a visitor management protocol that includes signing in/out procedures, escorted access for visitors, and temporary badges that clearly identify non-staff members.
• Secure disposal of equipment: When decommissioning servers or storage devices, ensure secure disposal methods are used to prevent data recovery from hard drives or other storage media. This may include physical destruction or professional data wiping services.

13. Enable BIOS Protection 

The BIOS (Basic Input/Output System) or UEFI (Unified Extensible Firmware Interface) firmware initializes and tests hardware during the boot process and provides runtime services for operating systems. Unauthorized modifications to BIOS settings can compromise the entire system, allowing attackers to bypass security mechanisms or introduce malware. Here’s how to implement BIOS protection:

• Enable a BIOS password: Set a strong password for accessing the BIOS setup utility. This prevents unauthorized users from changing critical settings such as boot order, enabling/disabling hardware components, or other security-related configurations.
• Disable boot from external devices: Configure the BIOS to prioritize booting from the internal hard drive and disable boot options for external devices such as USB drives, CDs/DVDs, and network PXE boot. This reduces the risk of unauthorized bootable media being used to bypass OS security.
• Enable secure boot: This feature ensures only digitally signed software can be executed during the boot process. Enabling secure boot helps protect against rootkits and other low-level malware by verifying the integrity of the bootloader and operating system kernel.
• Use TPM for additional security: If the system includes a Trusted Platform Module (TPM), enable it in the BIOS settings. The TPM is a hardware-based security device that can securely store cryptographic keys, passwords, and digital certificates. It enhances data encryption, disk encryption, and platform authentication.
• Document and audit BIOS configurations: Maintain documentation of approved BIOS configurations for your systems and perform regular audits to ensure compliance with organizational security policies. Any unauthorized changes should be investigated promptly.

14. Lock the Boot Directory 

Locking the boot directory helps protect critical boot files from unauthorized modification. The boot directory contains essential components like the kernel image and bootloader configuration, which, if tampered with, could compromise the entire system’s integrity. Here are steps to secure the boot directory:

• Set ownership and permissions: Change the ownership of the /boot directory to root and set strict file permissions to prevent non-root users from making modifications.

sudo chown -R root:root /boot
sudo chmod -R 700 /boot

• Secure the GRUB configuration: The GRUB bootloader’s configuration file (/boot/grub/grub.cfg) is critical for system startup. Protect it by setting root ownership and read-only permissions.

sudo chown root:root /boot/grub/grub.cfg
sudo chmod 400 /boot/grub/grub.cfg

• Regularly monitor for unauthorized changes: Use file integrity monitoring tools such as AIDE (Advanced Intrusion Detection Environment) or Tripwire to detect any unauthorized changes to files within the /boot directory.
• Limit access to BIOS/UEFI settings: Ensure that BIOS or UEFI settings are password-protected and configured to prevent booting from external devices. This prevents attackers from bypassing the locked /boot directory by using a bootable USB drive or CD/DVD.

15. Keep Linux Kernel and Software Up to Date 

Keeping the Linux kernel and software up to date helps address vulnerabilities that could be exploited by attackers, ensuring that the system is protected against known security threats. Here are some steps to ensure your Linux kernel and software are kept current:

• Enable automatic updates: Most Linux distributions offer automatic update features, which can be enabled to ensure that all software packages, including the kernel, receive timely updates. For Debian-based systems, use unattended-upgrades; for Red Hat-based systems, consider using yum-cron or dnf-automatic.
• Regularly check for updates: In addition to automatic updates, manually check for available updates regularly using your package manager (apt-get update && apt-get upgrade for Debian/Ubuntu or yum update for CentOS/RHEL). This ensures that you are aware of any pending updates.
• Update the kernel: The Linux kernel receives regular updates to fix security vulnerabilities and improve performance. Ensure these updates are applied and reboot the system to activate the new kernel version. 

16. Review Logs Regularly 

Regularly reviewing system and application logs is a vital practice for maintaining security and operational integrity on Linux servers. Logs provide insights into system behavior, unauthorized access attempts, and potential issues. Here are strategies for effective log management:

1. Centralize log management: Use centralized log management solutions to aggregate logs from multiple sources. Tools like syslog-ng or rsyslog can forward logs to a central server, simplifying analysis and monitoring.
2. Monitor critical logs: Prioritize monitoring of critical logs, such as authentication logs (/var/log/auth.log), system messages (/var/log/messages), and web server access and error logs (/var/log/apache2/access.log, /var/log/nginx/error.log). Set up alerts for unusual patterns or specific events.
3. Implement log rotation: To prevent log files from consuming excessive disk space, implement log rotation using logrotate. Configure rotation policies based on file size or time, and compress older logs to save space.
4. Secure log files: Ensure that log files are accessible only to authorized users by setting appropriate permissions. Consider encrypting sensitive logs to protect data in transit and at rest.
5. Use log analysis tools: Leverage tools like GoAccess for web server logs, Fail2Ban for detecting brute-force attempts, or ELK Stack (Elasticsearch, Logstash, Kibana) for comprehensive log analysis and visualization.
6. Regularly audit logs: Schedule regular audits of your logs to identify security incidents, operational issues, or areas for improvement in your logging strategy.

By systematically reviewing logs and employing effective log management practices, administrators can enhance their ability to detect security threats early, troubleshoot issues promptly, and maintain a secure Linux environment.

17. Perform System Auditing 

Performing system auditing is an essential practice for identifying security vulnerabilities, ensuring compliance with security policies, and detecting unauthorized changes or activities within Linux systems. System auditing involves collecting, analyzing, and reporting on various system events and configurations. Here’s how to effectively perform system auditing:

• Use auditing tools: Use Linux auditing tools such as auditd, the Linux Audit Daemon, which provides detailed logging of security events. Configure auditd rules to monitor access to sensitive files, use of privileged commands, and changes to critical system files.
• Regular vulnerability scanning: Implement regular vulnerability scanning using tools like OpenVAS or Nessus. These tools can identify known vulnerabilities in software packages, configurations, and services running on your system.
• Check for integrity: Use file integrity monitoring tools such as AIDE (Advanced Intrusion Detection Environment) or Tripwire. These tools help detect unauthorized changes to critical system files, directories, and configurations by comparing current file states against a known good baseline.
• Document auditing processes: Keep detailed documentation of your auditing processes, including the scope of audits, tools used, schedules, and procedures for responding to findings.
• Act on audit findings: Promptly address any issues discovered during audits by applying necessary patches, tightening security configurations, removing unnecessary services or software packages, and updating policies as needed. 

18. Use Antivirus and Linux Monitoring Tools 

Even though Linux is less susceptible to malware than other operating systems, using antivirus software and monitoring tools is crucial for maintaining a secure environment. Here are some strategies for implementing these tools:

• Install antivirus software: Choose a reputable antivirus solution compatible with Linux. Some popular options include ClamAV, Sophos, and ESET. To install ClamAV:

sudo apt-get install clamav

sudo freshclam

• Running scans: Schedule regular scans to check for malware:

sudo clamscan -r /home

• Enable real-time monitoring: Real-time monitoring tools help detect and respond to threats quickly.
• Integrate with ClamAV: Use tools like ClamAV’s clamd for real-time protection.

sudo systemctl enable clamd

sudo systemctl start clamd

• Use an intrusion detection system (IDS): IDS tools such as AIDE (Advanced Intrusion Detection Environment) and Tripwire monitor file changes and alert administrators of suspicious activities. For example, start by installing AIDE:

sudo apt-get install aide

sudo aideinit

sudo cp /var/lib/aide/aide.db.new /var/lib/aide/aide.db

Then run AIDE checks:

sudo aide –check

• Monitor system logs: Regularly review system logs for unusual activities using tools like rsyslog or syslog-ng. Implement centralized logging with tools such as Graylog or ELK stack (Elasticsearch, Logstash, and Kibana) for enhanced analysis. To set up rsyslog:

sudo systemctl enable rsyslog

sudo systemctl start rsyslog

• Network monitoring: Tools like Wireshark, Nagios, and Zabbix provide comprehensive network monitoring (using respective modules or scripts for capturing network metrics), helping detect abnormal traffic patterns indicative of an attack. To install Nagios:

sudo apt-get install nagios3

• System resource monitoring: Use tools like top, htop, and glances to monitor CPU, memory, and disk usage, identifying potential performance issues and security incidents. Alerting tools should be used to notify relevant teams in case of abnormal metrics.

19. Deploy Runtime Application Self Protection 

Runtime Application Self-Protection (RASP) embeds protection mechanisms within an application to detect and mitigate threats in real time. Here’s how to deploy RASP:

• Integrate RASP with applications: Follow the provider’s guidelines to integrate RASP with your application. This typically involves adding a library or agent to the application’s runtime environment. Next, initialize the RASP agent during the application startup. This ensures that the protection mechanisms are active from the moment the application begins running.
• Customize security policies: Configure the RASP solution to define acceptable behavior and responses to detected threats. Customize these policies to match the specific needs of your application. For example, set a policy to block SQL injection attacks by inspecting database queries at runtime.
• Monitor and respond to alerts: Continuously monitor the alerts and logs generated by the RASP solution. Establish a protocol for responding to different types of threats. One option is to configure automated responses to certain threats, such as blocking IP addresses or terminating malicious sessions.

• Regular updates: Keep the RASP solution updated with the latest security patches and threat intelligence to ensure it can defend against new vulnerabilities and attack vectors.
• Testing and validation: Regularly test the effectiveness of the RASP solution by simulating attacks and validating that the protective measures work as intended.

Runtime Protection for Linux Operating Systems with Sternum

Sternum is an IoT security and observability platform. Sternum provides deterministic security with runtime protection against known and unknown threats; complete observability that provides data about individual devices and the entire device fleet; and anomaly detection powered by AI to provide real-time operational intelligence.

Sternum operates at the bytecode level, making it universally compatible with any IoT device or operating system including RTOS, Linux, OpenWrt, Zephyr, Micrium, and FreeRTOS. It has low overhead of only 1-3%, even on legacy devices. 

Visit our dedicated Linux solutions page to learn more about Sternum’s agentless embedded Linux security

Related content: Read our guide to Linux security vulnerabilities