Linux Security Concerns, Patching and Hardening

What it is

Linux runs most servers, cloud workloads and many network appliances. It is secure by design in many respects, but a default install still has risks: weak passwords, exposed services, unpatched packages and loose permissions. The defender's job is to install it minimally, patch it on a schedule and harden it to a standard.

How it works

Linux OS and its security concerns

Because everything in Linux is a file with an owner, group and permission set, permission mistakes are among the most common flaws.

Linux installation and patching

Secure installation

• Install only the packages the role needs (a minimal install).
• Use separate partitions for /boot, /home, /tmp and /var, with options such as noexec and nosuid on /tmp where suitable.
• Encrypt disks with LUKS.
• Set a strong root and bootloader password, and create a normal administrative user.
• Install from verified media, checking checksums or signatures.

Patching

Package managers verify GPG signatures on packages and use trusted repositories. Patch cycle: refresh the package list, review available security updates, test on a staging system, apply, and reboot when the kernel or core libraries changed. Unattended upgrades can apply security updates automatically on low risk systems. Live kernel patching reduces reboots on critical servers.

Linux OS hardening techniques

• Remove or disable unneeded services and close unneeded ports.
• Host firewall: iptables or nftables, or the front ends ufw and firewalld, with default deny inbound.
• File permissions: follow least privilege. Permissions are read (4), write (2) and execute (1) for owner, group and others, so 640 means owner read and write, group read, others nothing. Review SUID and SGID files and world writable files regularly.
• Mandatory access control: SELinux (Red Hat family) and AppArmor (Debian, Ubuntu, SUSE) confine programs even if they are compromised. SELinux modes are enforcing, permissive (logs only) and disabled.
• Kernel parameters (sysctl) to ignore source routed packets, ICMP redirects and enable SYN cookies.
• Auditing: the Linux Audit framework (auditd) and syslog or journald forwarded to a central server.
• File integrity monitoring with tools such as AIDE.
• Remove compilers and tools that are not needed on production servers.
• Secure boot loader with a GRUB password and restricted console access.
• Apply a baseline: CIS Benchmarks, DISA STIGs, or scan with OpenSCAP.

A worked example

A new web server is built from a minimal image on an encrypted disk. Only ports 22 and 443 are allowed by the firewall, SELinux is in enforcing mode, the web content directory is owned by a non privileged account and auditd logs changes under the configuration directory. A scheduled job applies security updates, and a weekly OpenSCAP scan compares the server to the CIS Benchmark.

How the exam asks about this

• "Which Linux mandatory access control system is used on Red Hat based distributions?" → SELinux.
• "What does a package manager use to confirm a package is authentic?" → GPG signatures from a trusted repository.
• "What does permission 644 mean?" → Owner read and write, group and others read only.