4 ms·

Hardening against vulnerabilities is a zero sum game ultimately. It is my experience that most guides you will find for Linux hardening are either outdated, to

Hardening against vulnerabilities is a zero sum game ultimately. It is my experience that most guides you will find for Linux hardening are either outdated, too opinionated or are written with shock value to induce paranoia [0]. I harden ssh (no root login, no passwords), setup fail2ban for it and leave it at that. Only thing I remember to do is not to mess with security configurations e.g disabling selinux to make something work. Keeping number of software installed to an absolute minimum. And last but not least I setup automatic updates via unattended-upgrades. [0] https://madaidans-insecurities.github.io/guides/linux-hardening.html https://madaidans-insecurities.github.io/guides/linux-harden...

marginalia_nu 4y ago
> It is my experience that most guides you will find for Linux hardening are either outdated, too opinionated or are written with shock value to induce paranoia [0]. A lot of it may be written for career benefits as well. If you're trying to sell security services, especially if you don't really have too many actual referrals to show, putting together a guide or two like this (by borrowing tips you find online) makes you not only appear more legit, but it appears like you know byzantine security secrets that nobody else does.
- dimensionc132 4y ago
  Most guides only deal with Systemd distros, not distros like Devuan etc
zepearl 4y ago
> I harden ssh (no root login, no passwords), setup fail2ban for it and leave it at that. Similar here (but I allow root login), with the addition of setting up an nftables firewall with whitelisted ports and logging all the rest, and having fail2ban analyze logs and adding/removing to it IPs that become blacklisted because of some global limit is exceeded (which happens e.g. if you try once to access weird stuff stuff in my webserver VM + try to guess a pwd in the mailserver VM + try to login unsuccessfully into SSHd)

marginalia_nu 4y ago

> It is my experience that most guides you will find for Linux hardening are either outdated, too opinionated or are written with shock value to induce paranoia [0]. A lot of it may be written for career benefits as well. If you're trying to sell security services, especially if you don't really have too many actual referrals to show, putting together a guide or two like this (by borrowing tips you find online) makes you not only appear more legit, but it appears like you know byzantine security secrets that nobody else does.

dimensionc132 4y ago
Most guides only deal with Systemd distros, not distros like Devuan etc

zepearl 4y ago

> I harden ssh (no root login, no passwords), setup fail2ban for it and leave it at that. Similar here (but I allow root login), with the addition of setting up an nftables firewall with whitelisted ports and logging all the rest, and having fail2ban analyze logs and adding/removing to it IPs that become blacklisted because of some global limit is exceeded (which happens e.g. if you try once to access weird stuff stuff in my webserver VM + try to guess a pwd in the mailserver VM + try to login unsuccessfully into SSHd)