Phase 01
Environment Initialization & Updates
Establish a baseline of clean, fully updated packages. This resolves critical software bugs and dependency exploits prior to executing manual security configurations.
# Synchronize repos and upgrade system files safely
sudo apt update && sudo apt full-upgrade -y
# Restart server to load any updated kernel configurations
sudo reboot
Phase 02
Administrative Privilege Segregation
Operating as root is a high risk. Create a dedicated administrative user account (`secadmin`) and grant access using standard privilege escalation.
# Create non-root system administrative account
sudo adduser secadmin
# Add user to privilege escalation database (sudo)
sudo usermod -aG sudo secadmin
# Validate new account escalations
su - secadmin
sudo -v
# Lock standard root user database credentials
sudo passwd -l root
⚠️ CRITICAL SECURITY PRINCIPLE: Always verify the `secadmin` user is fully capable of elevated execution before terminating active connections. Locking root while your admin configuration contains typos will result in a permanent system lockout.
Phase 03
Cryptographic OpenSSH Hardening
Secure your remote access gateway. Transition away from plain authentication models toward custom-scoped asymmetric certificates.
# Generate highly resilient cryptographic keys on the Client workstation (e.g. Kali Machine):
ssh-keygen -t ed25519 -a 100 -C "secadmin@hardenedserver"
ssh-copy-id -i ~/.ssh/id_ed25519.pub secadmin@SERVER_IP
# Enforce rigorous rules in the configuration file (`/etc/ssh/sshd_config`):
# Backup current parameters
sudo cp /etc/ssh/sshd_config /etc/ssh/sshd_config.bak.$(date +%F)
# Edit settings
sudo nano /etc/ssh/sshd_config
Authentication Core:
`Port 22` (Or your custom port)
`Protocol 2` (Enforces modern SSHv2)
`PermitRootLogin no` (Disable network root Access)
`PasswordAuthentication no` (Force Public Keys)
`AllowUsers secadmin` (Strict account whitelist)
Channel Constraints:
`X11Forwarding no` (Disables GUI tunnels)
`MaxAuthTries 3` (Accelerates brute-force banning)
`ClientAliveInterval 300` (Ping client every 5 mins)
`ClientAliveCountMax 2` (Closes inactive sessions)
`LoginGraceTime 30` (Closes incomplete handshakes)
# Check configurations and restart safely:
# Check configurations for typos (Extremely Critical!)
sudo sshd -t
# Apply settings instantly without tearing down current terminals
sudo systemctl reload ssh
Phase 04
Network Perimeter Control (UFW)
Instantiate a stateful system firewall checking ingress frames while granting outgoing access to standard system updating directories.
# Enforce global drop policy on unsolicited packets
sudo ufw default deny incoming
sudo ufw default allow outgoing
# Authorize your administrative connection channel
sudo ufw allow 22/tcp
# OPTIONAL: Lock access so ONLY your administrative workstation IP is accepted
# sudo ufw allow from MANAGEMENT_STATION_IP to any port 22 proto tcp
# Turn on active rules
sudo ufw enable
# Verify active table policy
sudo ufw status verbose
Phase 05
Automated Anti-Brute Force (Fail2Ban)
Create an automated bouncer. Monitor logs for access anomalies and interactively append temporary drop parameters to your firewall table.
# Install package definitions
sudo apt install fail2ban -y
# Copy and edit local system jail parameters
sudo nano /etc/fail2ban/jail.local
# Example production-grade override block inside `/etc/fail2ban/jail.local`:
[DEFAULT]
bantime = 1h
findtime = 10m
maxretry = 5
backend = systemd
[sshd]
enabled = true
port = ssh
logpath = %(sshd_log)s
# Activate service and check statuses
sudo systemctl enable --now fail2ban
sudo fail2ban-client status sshd
Phase 06
Automated Security Patching
Automating the application of security patches protects against newly discovered exploits (CVEs).
# Install automated patching software
sudo apt install unattended-upgrades apt-listchanges -y
sudo dpkg-reconfigure --priority=low unattended-upgrades
# Configure daily execution (`/etc/apt/apt.conf.d/20auto-upgrades`):
APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Unattended-Upgrade "1";
# Enable system reboots for kernel modifications at $02:00\text{ AM}$ (`/etc/apt/apt.conf.d/50unattended-upgrades`):
Unattended-Upgrade::Automatic-Reboot "true";
Unattended-Upgrade::Automatic-Reboot-Time "02:00";
Phase 07
Network Surface Reduction
Purge legacy services transmitting credentials in clear text. Run active port checks to identify listening sockets.
# Inspect all active sockets and services running on boot
ss -tulpen
sudo systemctl list-unit-files --type=service | grep enabled
# Purge cleartext services
sudo apt purge -y telnet rsh-client rsh-redone-client talk ftp
sudo apt autoremove --purge -y
# Stop and disable unnecessary background processes (e.g. mDNS broadcast engines)
sudo systemctl disable --now avahi-daemon
Phase 08
Kernel Parameters Hardening (sysctl)
Secure the transport layer. Adjust core kernel parameters to mitigate IP spoofing, drop local redirection frames, and ignore broadcast sweeps.
# Initialize custom security configurations
sudo nano /etc/sysctl.d/99-hardening.conf
# Paste standard parameters:
# Prevent IP Spoofing via reverse path validation checks
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1
# Disable ICMP redirect acceptance (Stops Man-in-the-Middle route changes)
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv6.conf.all.accept_redirects = 0
net.ipv6.conf.default.accept_redirects = 0
# Prevent local machine from acting as router
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0
# Ignore ICMP Echo requests to broadcast addresses (Mitigates Smurf Attacks)
net.ipv4.icmp_echo_ignore_broadcasts = 1
# Enable logging of Martian packets
net.ipv4.conf.all.log_martians = 1
# Apply parameters instantly without rebooting
sudo sysctl --system
Phase 09
Memory Execution Mitigations
Disable program core dumping (which can leak configuration variables) and secure shared memory locations to prevent unauthorized binary executions.
# Disable core dumps globally
echo '* hard core 0' | sudo tee /etc/security/limits.d/99-disable-coredump.conf
sudo sysctl -w fs.suid_dumpable=0
echo 'fs.suid_dumpable = 0' | sudo tee /etc/sysctl.d/99-coredump.conf
sudo sysctl --system
# Secure the Shared Memory Partition (modern `/dev/shm` target)
echo 'tmpfs /dev/shm tmpfs defaults,noexec,nosuid,nodev 0 0' | sudo tee -a /etc/fstab
sudo mount -o remount /dev/shm
mount | grep shm
Phase 10
Access Auditing & PAM Complexity Enforcement
Enforce minimum length and complexity policies for local account modifications via PAM (Pluggable Authentication Modules).
# Install password validation module
sudo apt install libpam-pwquality -y
sudo nano /etc/security/pwquality.conf
# Configure policies inside `/etc/security/pwquality.conf`:
minlen = 14
minclass = 3
maxrepeat = 3
dictcheck = 1
# Set account password aging policies (`/etc/login.defs`):
PASS_MAX_DAYS 90
PASS_MIN_DAYS 1
PASS_WARN_AGE 7
# Force limits on existing administrative accounts
sudo chage -M 90 -m 1 -W 7 secadmin
sudo chage -l secadmin
Phase 11
Host Auditing & Log Engine Configuration
Deploy audit utilities to log system calls, tracking account changes, file accesses, and permission changes.
# Install and start auditing daemon
sudo apt install auditd audispd-plugins -y
sudo systemctl enable --now auditd
# Query system logs for specific parameters
# High severity events since boot
sudo journalctl -p 3 -xb
# View real-time user ssh connection logs (on modern journal systems)
sudo journalctl -f -u ssh
# Search the audit service explicitly for authentication results
sudo ausearch -m USER_AUTH
Phase 12
Malware & Rootkit Baselines
Establish file integrity checks. Regularly compare critical system files against standard baseline definitions.
# Install scanners
sudo apt install rkhunter chkrootkit -y
# Update and record local baseline properties
sudo rkhunter --propupd
# Run checks manually
sudo rkhunter-check --sk
sudo chkrootkit
Phase 13
Time Synchronization
Synchronous time tracking is critical for log correlation during post-incident forensic investigations.
# Enable NTP sync
sudo timedatectl set-ntp true
# Set accurate local timezone
sudo timedatectl set-timezone America/New_York
# Confirm sync parameters
timedatectl status
Phase 14
Post-Deployment Verification (Lynis)
Audit the completed baseline using open-source compliance scanning suites.
# Run Lynis audit
sudo apt install lynis -y
sudo lynis audit system
# Inspect suggestions and warnings
sudo grep -E "warning|suggestion" /var/log/lynis-report.dat
# Resolve standard recommendations (BANN-7126 & AUTH-9328):
# Deploy pre-login legal warnings
echo "Authorized access only. All activities are monitored and logged." | sudo tee /etc/issue
echo "Authorized access only. All activities are monitored and logged." | sudo tee /etc/issue.net
# Set strict global file creation mask (umask) in `/etc/login.defs`
UMASK 027
Phase 15
Disaster Recovery & Archiving
Safely archive custom security parameters and configurations to off-host backup systems.
# Create compressed archive of security configuration files
sudo tar czf /root/hardening-backup-$(date +%F).tar.gz \
/etc/ssh/ \
/etc/ufw/ \
/etc/fail2ban/ \
/etc/sysctl.d/ \
/etc/apt/apt.conf.d/