Introduction

In an era where cyber threats evolve daily and data breaches make headlines with alarming frequency, securing your Linux system isn't just good practice—it's essential. While Linux is inherently more secure than many operating systems, this advantage isn't a guarantee of safety.

Whether you're managing a personal workstation, a web server, or enterprise infrastructure, understanding and implementing proper security measures can mean the difference between a secure system and a compromised one. This comprehensive guide will take you through the fundamental principles and practical implementations of Linux security, from basic user permissions to advanced encryption protocols.

We'll explore not just the "what" but the "why" behind each security measure, helping you build a robust defense strategy that stands up to modern threats.

1. System Access Security

User Privileges and Authentication

Linux's security model starts with its robust user privilege system. Unlike other operating systems that might grant broad permissions by default, Linux follows the principle of least privilege.

Root Access Methods

# <a id="method-1-temporary-elevation-using-sudo"></a>Method 1: Temporary elevation using sudo
sudo apt update

# <a id="method-2-switch-to-root-user-use-with-caution"></a>Method 2: Switch to root user (use with caution)
su -

# <a id="method-3-execute-specific-command-as-root"></a>Method 3: Execute specific command as root
sudo -u root command

SSH Security

# <a id="generate-secure-ssh-key"></a>Generate secure SSH key
ssh-keygen -t ed25519 -C "your_email@example.com"

# <a id="secure-ssh-configuration"></a>Secure SSH configuration
sudo nano /etc/ssh/sshd_config

Add these lines to your SSH config:

PermitRootLogin no
PasswordAuthentication no
MaxAuthTries 3

Login Policies

# <a id="set-password-policies"></a>Set password policies
sudo nano /etc/login.defs

Configure these settings:

PASS_MAX_DAYS   90
PASS_MIN_DAYS   1
PASS_WARN_AGE   7

Set up login attempt limits:

# <a id="configure-login-attempts"></a>Configure login attempts
sudo nano /etc/pam.d/common-auth

Add this configuration:

auth required pam_tally2.so deny=5 unlock_time=900

2. File System Security

Basic Permissions

Linux uses a three-level permission system (user, group, others) with three types of access (read, write, execute).

Common Permission Patterns

# <a id="executable-script"></a>Executable script
chmod 755 script.sh     # <a id="rwxr-xr-x"></a>rwxr-xr-x

# <a id="private-key"></a>Private key
chmod 600 id_rsa        # <a id="rw"></a>rw-------

# <a id="configuration-file"></a>Configuration file
chmod 644 config.txt    # <a id="rw-r-r"></a>rw-r--r--

# <a id="shared-directory"></a>Shared directory
chmod 775 shared_dir/   # <a id="rwxrwxr-x"></a>rwxrwxr-x

Access Control Lists (ACLs)

# <a id="install-acl-tools"></a>Install ACL tools
sudo apt-get install acl

# <a id="set-specific-user-permissions"></a>Set specific user permissions
setfacl -m u:username:rx file.txt

# <a id="set-default-acls-for-new-files"></a>Set default ACLs for new files
setfacl -d -m g:project_team:rw /shared/project/

# <a id="view-acls"></a>View ACLs
getfacl file.txt

Extended Attributes

# <a id="make-file-immutable"></a>Make file immutable
sudo chattr +i important_config.conf

# <a id="add-append-only-attribute"></a>Add append-only attribute
sudo chattr +a log_file.txt

# <a id="view-attributes"></a>View attributes
lsattr file.txt

3. Encryption

Full Disk Encryption

During installation:

1. Choose "Encrypt the new Ubuntu installation"
2. Set a strong security key
3. Optionally, enable encryption of your home directory

Post-installation encryption:

# <a id="install-luks-tools"></a>Install LUKS tools
sudo apt-get install cryptsetup

# <a id="create-encrypted-partition"></a>Create encrypted partition
sudo cryptsetup luksFormat /dev/sdX1

# <a id="open-encrypted-partition"></a>Open encrypted partition
sudo cryptsetup luksOpen /dev/sdX1 secure_storage

File-Level Encryption

Using GPG

# <a id="encrypt-file-with-password"></a>Encrypt file with password
gpg -c sensitive_file.txt

# <a id="encrypt-for-specific-recipient"></a>Encrypt for specific recipient
gpg --encrypt --recipient "user@email.com" sensitive_file.txt

# <a id="create-encrypted-archive"></a>Create encrypted archive
tar czf - directory/ | gpg --symmetric --cipher-algo AES256 > backup.tar.gz.gpg

Using VeraCrypt

# <a id="create-encrypted-container"></a>Create encrypted container
veracrypt --create secure_container --size 100M --encryption AES --hash SHA-512

# <a id="mount-encrypted-container"></a>Mount encrypted container
veracrypt secure_container /mnt/encrypted

4. System Hardening

Firewall Configuration

# <a id="enable-ufw-firewall"></a>Enable UFW firewall
sudo ufw enable

# <a id="set-default-policies"></a>Set default policies
sudo ufw default deny incoming
sudo ufw default allow outgoing

# <a id="allow-specific-services"></a>Allow specific services
sudo ufw allow ssh
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp

# <a id="check-status"></a>Check status
sudo ufw status verbose

Audit System

# <a id="install-audit-system"></a>Install audit system
sudo apt-get install auditd

# <a id="monitor-file-access"></a>Monitor file access
sudo auditctl -w /etc/passwd -p wa -k user_changes
sudo auditctl -w /etc/shadow -p wa -k shadow_changes

# <a id="view-audit-logs"></a>View audit logs
sudo ausearch -k user_changes

5. Security Best Practices

Regular Maintenance Checklist

• Update system packages weekly
• Review auth logs for suspicious activity
• Check active user accounts
• Verify important file permissions
• Test backup restoration
• Update firewall rules as needed

Security Guidelines

1. Minimize Attack Surface

   • Remove unnecessary services
   • Close unused ports
   • Uninstall unneeded packages

2. Access Control

   • Implement strong password policies
   • Use SSH keys instead of passwords
   • Enable two-factor authentication where possible

3. Monitoring

   • Set up log monitoring
   • Configure intrusion detection
   • Enable process accounting

💡 Pro Tip: Always test security changes in a development environment before applying them to production systems.

⚠️ Warning: Never use chmod 777 unless you absolutely know what you're doing and why.

Quick Reference

Permission Calculator

Permission  Binary    Octal
---         000       0
--x         001       1
-w-         010       2
-wx         011       3
r--         100       4
r-x         101       5
rw-         110       6
rwx         111       7

Common Directory Permissions

/home/user     750   User home directory
/etc           755   System configuration
/var/log       750   System logs
/usr/bin       755   User commands
/usr/sbin      755   System commands

Resources

• 📚 Linux Security Checklist
• 🔒 National Security Agency Linux Guidelines
• 📖 Your distribution's security documentation

Distribution-Specific Notes:

• For CentOS/RHEL, replace apt-get with yum or dnf
• UFW commands on RHEL systems should use firewall-cmd instead
• Package names might vary between distributions

Remember to always back up your system before making significant security changes.