Linux Server Security Hardening: Complete 2026 Checklist

Every Linux server is scanned by bots within minutes of going online. CISA identifies unpatched Linux servers as a top ransomware vector in 2026. AI-assisted recon compresses exploitation from weeks to hours. 70%+ of production breaches trace to: weak SSH, unpatched services, over-exposed ports.

Step 1: Patch First

Run apt update && apt upgrade -y (Debian/Ubuntu) or dnf update -y (RHEL/Rocky). Enable unattended-upgrades. Apply sysctl hardening: net.ipv4.tcp_syncookies=1, disable ICMP redirects, kernel.dmesg_restrict=1, kernel.randomize_va_space=2.

Step 2: SSH Hardening

Edit /etc/ssh/sshd_config: PermitRootLogin no, PasswordAuthentication no, MaxAuthTries 3, non-default port, AllowUsers whitelist, Ed25519/RSA-SHA2-512. Generate keys: ssh-keygen -t ed25519. Install Fail2Ban: bantime=3600, maxretry=3, enable sshd jail.

Step 3: Default-Deny Firewall

ufw default deny incoming && ufw default allow outgoing && ufw allow 2222/tcp && ufw allow 443/tcp && ufw enable. Audit monthly: ss -tlnp. Every unexplained open port is attack surface.

Step 4: Disable Unused Services

systemctl list-units –type=service –state=running. Disable: cups, avahi-daemon, bluetooth, postfix, rpcbind. Cannot justify it? Stop it.

Step 5: Mandatory Access Control

SELinux (RHEL): SELINUX=enforcing. AppArmor (Ubuntu): aa-enforce /etc/apparmor.d/*. Permissive mode logs only. Enforcing mode blocks.

Step 6: User Accounts

• Individual named admin accounts
• Minimal sudo: specific commands not ALL
• Audit UID 0: awk -F: $3==0{print} /etc/passwd
• Lock inactive: passwd -l username

Step 7: Audit Logging

Install auditd: apt install auditd -y. Watch /etc/passwd, /etc/sudoers, SSH config, all execve. Ship logs off-host to SIEM via rsyslog or Filebeat immediately.

Step 8: File Integrity

AIDE: aide –init, daily cron checks. Wazuh: real-time FIM, rootkit detection, CVE scanning.

Step 9: Lynis CIS Benchmark

lynis audit system. Target 80+. Run quarterly. CIS Benchmarks define the authoritative baseline.

Key Takeaways

• SSH key-only auth + Fail2Ban eliminates the most common brute-force path
• Default-deny firewall with only required ports reduces attack surface
• SELinux/AppArmor Enforcing mode contains compromised processes
• Ship audit logs off-host immediately to remote SIEM
• Measure hardening with Lynis vs CIS Benchmarks quarterly

Conclusion

Linux server hardening requires layered controls in priority order. Build into deployment templates, measure quarterly. Related: Network Security Best Practices.

Sources

• Linux Hardening Guide 2026 – linuxsecurity.com, mecanik.dev, linuxteck.com, zeonedge.com
• CIS Benchmarks – cisecurity.org
• CISA Advisories 2026 – cisa.gov

SSH and Kernel Hardening

Edit /etc/ssh/sshd_config: set PermitRootLogin no, PasswordAuthentication no, Protocol 2, ClientAliveInterval 300. For kernel: add net.ipv4.tcp_syncookies=1, kernel.randomize_va_space=2, fs.suid_dumpable=0 to /etc/sysctl.conf and apply with sysctl -p.

Auditd for Compliance Logging

Install auditd, log all sudo usage, privileged commands, and access to /etc/passwd. Forward logs to SIEM. Run aureport –summary weekly. Target Lynis score above 80.

Key Takeaways

• Disable SSH password auth – keys only
• SELinux or AppArmor in Enforcing mode always
• Automate CIS Level 1 baseline with Ansible
• Forward auditd logs to SIEM for compliance

Automated Compliance with Ansible

Use Ansible roles to automate CIS Benchmark application across your Linux fleet. Community roles like ansible-lockdown/RHEL8-CIS provide ready-made playbooks for major distributions. Run in check mode first to preview changes, then apply. Schedule quarterly re-runs to detect and remediate configuration drift. Store playbooks in Git and require peer review before applying to production servers.

Automated Compliance Scanning

Run OpenSCAP weekly to automatically assess your Linux server against CIS Benchmark Level 1 and Level 2 profiles. Install with yum install openscap-scanner scap-security-guide on RHEL/CentOS. Generate reports with oscap xccdf eval --profile cis --results scan-results.xml --report scan-report.html /usr/share/xml/scap/ssg/content/ssg-rhel9-ds.xml. Schedule in cron and email reports to your security team weekly. Target 80%+ compliance score within the first month.

Network Security Controls

Configure the local firewall using firewalld on RHEL or ufw on Ubuntu. Default policy: deny all inbound, allow all outbound. Explicitly allow only required services: SSH (restrict to management IP), HTTPS, and application-specific ports. Enable connection tracking: firewall-cmd --add-rich-rule="rule family=ipv4 source address=0.0.0.0/0 service name=ssh reject" --permanent for all non-management source IPs. Block ICMP redirects and source routing via sysctl.

Key Takeaways

• Run OpenSCAP weekly against CIS Benchmark profiles and target 80%+ compliance
• Default-deny firewall policy: only explicitly required ports should be open
• Patch critical CVEs within 72 hours using automated patch management
• Centralize logs to your SIEM immediately — local log tampering is a common attacker technique

Automated Hardening with Ansible

Manual hardening does not scale. Use Ansible CIS roles (ansible-lockdown project) to automate CIS Benchmark Level 1 and 2 across your Linux fleet. Run in check mode first, then apply. Schedule quarterly re-runs via Ansible AWX to remediate configuration drift automatically. Store playbooks in Git with mandatory peer review before production deployment.

OpenSCAP provides automated weekly compliance assessment against CIS profiles. Install scap-security-guide and run oscap xccdf eval weekly. Target 80 percent compliance within the first month. Feed results into your SIEM alongside vulnerability scanner data for unified compliance and vulnerability visibility that reduces analyst triage time significantly.

SIEM Integration and Auditd Configuration

Shipping logs off-host immediately is essential. An attacker who compromises a server will clear local logs. Remote syslog or Filebeat forwarding to a SIEM the attacker cannot reach prevents evidence destruction. Configure rsyslog forwarding and verify it works before considering hardening complete. Configure auditd to log all privileged command execution, sudo usage, changes to authentication files, and network configuration changes. Run aureport –summary weekly to detect anomalies. Spikes in failed authentication or privilege escalation events in auditd data frequently precede a successful compromise by hours or days.

Hardening Measurement and Continuous Improvement

Hardening without measurement produces unknown outcomes. Run Lynis quarterly and track the hardening index score over time. A declining score indicates configuration drift or new services being added without security review. Define a minimum acceptable Lynis score, alert the security team when any server falls below it, and require remediation within a defined SLA before the server is permitted to process sensitive data. Pair Lynis with OpenVAS or Nessus scans scheduled monthly to catch vulnerability exposure that hardening configuration alone does not address.