Linux System Hardening

Linux systems provide a reliable and robust alternative to closed-source systems, such as MS Windows Server and UNIX. Moreover, choosing Linux can help cut down licensing costs dramatically. If you are not convinced, compare the cost of hosting a web server using Debian 11 with the cost of hosting a web server using MS Windows Server 2022. When we compare the combined costs of licensing and the minimum required hardware for each of these modern releases, we will have a strong case for Linux. Of course, we cannot claim that Linux is always the best choice; however, Linux is the best choice for many scenarios. Before using this option, we must focus on securing our Linux systems, also known as Linux hardening.

Learning Objectives

This room covers various topics related to Linux hardening. By the end of this room, you will learn more about improving the security of a Linux system by taking care of the following:

• Physical Security
• Filesystem Encryption
• Firewall Configuration
• Remote Access
• Software and Services
• Updates and Upgrades
• Logs

Prerequisites

We recommend that users have a good working knowledge of the Linux OS and a solid understanding of the basic security principles. We recommend the Linux Fundamentals module if you want to learn about Linux. If you haven’t done so, we suggest you complete the Security Principles room.

Linux VM

Some of the tasks in this room require using the attached Linux VM. We suggest that you click on the Start Machine button, along with the Start AttackBox button, so that they are ready when you need them. You may also use your VPN connection to connect with the Linux VM. You can access the attached machine using ssh by supplying the following credentials:

• Username: tryhackme (i.e., ssh tryhackme@MACHINE_IP)
• Password: insecurePass123

It is worth repeating that insecurePass123 is a weak password; however, a complicated password such as HkAcPQqdXKC2 would be very cumbersome to type while going through the exercises in this room. But please remember that a weak yet convenient password would put the security of your whole system and network at risk.

Username	tryhackme
Password	insecurePass123
IP	MACHINE_IP