Skip to content
Yasmin FreitasCybersecurity Analyst, home page
PT, Ler em português
Back to projects
LabHardening

Linux server hardening

Hardening a Debian server against the CIS Benchmark, with before-and-after audits using Lynis.

Study lab in an isolated, authorized environment using my own or intentionally vulnerable systems. No third-party systems were tested.

Problem

Default installs leave services, permissions and settings more open than necessary, widening the attack surface.

Technical goal

Shrink the attack surface of a Linux server and produce a reusable checklist.

How it was done

  1. Generate a Lynis baseline and record the findings.

  2. Harden SSH: keys only, no root login, modern algorithms.

  3. Apply an nftables firewall with a default-deny policy.

  4. Enable auditd and keep logs of authentication and sensitive changes.

  5. Remove unneeded services and enable automatic security updates.

  6. Run a new audit and compare with the baseline.

Evidence

Layers covered in the lab, from the outside in.
/etc/ssh/sshd_config.d/10-hardening.confbash
PermitRootLogin noPasswordAuthentication noKbdInteractiveAuthentication noPubkeyAuthentication yesMaxAuthTries 3LoginGraceTime 30X11Forwarding noAllowTcpForwarding noKexAlgorithms sntrup761x25519-sha512@openssh.com,curve25519-sha256Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com
Excerpt of the SSH configuration applied in the lab.

/etc/nftables.confbash
table inet filter {  chain input {    type filter hook input priority 0; policy drop;    ct state established,related accept    iif lo accept    tcp dport 22 ct state new limit rate 10/minute accept    icmp type echo-request limit rate 5/second accept  }}
Inbound policy with default deny and rate-limited SSH.

Key takeaways

  • Measure before changing: without a baseline there's no way to show improvement.
  • Hardening is a balance; every control has to fit how the server is actually run.
  • A versioned checklist is worth more than a perfect server nobody can reproduce.