How to Harden Linux Servers – A Security Guide by COLO BIRD

Disable Ctrl+Alt+Delete

Prevent physical reboot attempts by commenting out the following line in older systems (like CentOS 6):

ca::ctrlaltdel:/sbin/shutdown -t3 -r now

Disable Direct Root Login and Create a Dedicated SSH User

The root account has full privileges; avoid using it directly. Instead:

• Create a separate user with sudo privileges.
• Disable root login in /etc/ssh/sshd_config:

PermitRootLogin no

Change Default SSH Port and Disable ICMP Ping

Allows or blocks traffic based on state, port, and protocol. It uses rules set by the administrator and the context of the traffic.

• Modify /etc/ssh/sshd_config to use a non-standard port (e.g., 2222).
• Disable ping (ICMP requests) by editing /etc/sysctl.conf:

net.ipv4.icmp_echo_ignore_all = 1

Apply changes with sysctl -p.

Set Up CSF Firewall

ConfigServer Security & Firewall (CSF) is a powerful SPI firewall. It helps:

• Restrict access by IP
• Detect login attempts
• Prevent port scans

Install mod_evasive and mod_security

Protect Apache with:

• mod_evasive: Blocks DoS and brute-force attacks.
• mod_security: Web application firewall that filters and sanitizes HTTP requests.

Scan with Rootkit Hunter (rkhunter)

Detect rootkits and backdoors with:

rkhunter --check

It checks for:

• MD5 hash anomalies
• Hidden files
• Insecure permissions
• Suspicious strings in kernel modules

Run Malware Scans with Maldet and ClamAV

Use Linux Malware Detect (Maldet) and ClamAV to scan and eliminate malware, trojans, and suspicious scripts.

maldet -a /home

clamscan -r /home

Automate Weekly ClamAV Scans with Cron

Schedule weekly scans and automatic updates using a cron job:

0 3 * * 0 freshclam && clamscan -r / --log=/var/log/clamav/weekly.log

Hide Apache and PHP Version Information

Remove software version details to avoid giving clues to attackers:

• Apache: Set ServerTokens Prod and ServerSignature Off
• PHP: In php.ini, set:

expose_php = Off

Disable FTP — Use SFTP Instead

FTP is insecure and often exploited. Switch to SFTP, which is encrypted via SSH. Tools like WinSCP make SFTP easy to use on Windows.

Restrict Shell Access for Unknown Users

Lock down user shells:

usermod -s /sbin/nologin username

Review /etc/passwd to identify and disable unknown users.

Install Fail2Ban to Protect SSH

Fail2Ban monitors login attempts and bans IPs showing malicious behavior. This is essential for preventing brute-force SSH attacks.