Top 40 Linux Security Tips and Best Practices

Posted in /  

Top 40 Linux Security Tips and Best Practices

Ramya Shankar
Last updated on January 3, 2023

    It is highly crucial for individuals and teams to secure their servers. Linux is one of the most secure systems ever! However, there are still some cyber threats that hover around. Hence, you must keep yourself safe and stay two steps ahead of such attacks.

    Let’s discuss the 40 best Linux security tips in this article.

    40 Linux Security Tips | Linux hardening

    Here we have curated the best security tips to do Linux Hardening:

    1. Create and maintain backups

    Backups are essential to maintain the security of a system. With its help, it is possible to restore entire data if you face a cyber attack. There are various options available to create daily backups for your server, such as

    Make sure to test these backup tools regularly.

    2. Enable firewall

    Firewalls help create a shield over the system and protect it from any unauthorized access. As you know, DDoS attacks are getting more common; for that, the firewall is an excellent protective shield option.

    3. Keep the Linux kernel up-to-date

    This is an essential step to maintaining a Linux server in the best way possible. Moreover, you must closely monitor the security updates.

    Tip: Use the RPM package manager:

    • # yum update
    • # apt-get update && apt-get upgrade

    4. Use Linux security extensions

    A couple of security extensions can be used to protect the Linux server. Here is a list of the top ones:

    • AppArmor: protects the system from both external and internal threats.
    • SELinux: it provides a powerful access control mechanism to the server.
    • Grsecurity: provide security alerts comprising IP addresses of the potential threat to the system.

    5. Minimize redundant software

    It is one of the best options to cleanse out unwanted applications from the system. It’s a simple yet highly effective way to minimize some risky loopholes. For that, you can always use an RPM package manager to see which installed software is not needed anymore.

    You can use the following:

    • # dpkg --list
    • # dpkg --info packageName
    • # apt-get remove packageName

    6. GnuPG encryption for web security

    While transferring files on the network, always keep all your file's passwords encrypted. It further ensures additional security to your system. The chances of some potential attack on the network while data transfer is high. Additionally, you can use this excellent tool, GnuPG , for hosting web security.

    7. Use Kerberos

    Kerberos helps to enhance Linux server security immensely. It’s a third-party service based on symmetric key cryptography. With its help, you can remotely log in and perform secure intersystem file copying and other highly safe options.

    Moreover, this service also catches unauthorized users, which can be potential threats.

    8. Disable social media tracking

    As you know, we are heavily using social media platforms at present. Different channels gather your information as soon as you click on the share buttons on different websites. To disable these options, you can go to your social media account settings and do the needful.

    9. Use SELinux

    Security-Enhanced Linux or SELinux to provide strong access control to your server system. It prevents malicious attacks that try to gain administrative access to your system and saves your system from different malware.

    10. Privacy Badger Extension

    Privacy Badger is known to be an open-source browser extension that restricts third-party trackers from tracking your website. This extension addresses cookies and ads that try to track different web pages. Due to this feature, you can stay secure from any third-party malicious actions online.

    11. System accounting with auditd

    We use Auditd for various system audits. With its help, you can understand the following things in your system:

    • Track the time of an event.
    • Success or failure of an event.
    • Records any change or modification in the time and date of various events.
    • Traces the name of an individual who changed a file or changed network settings.

    12. Linux Kernel Runtime Guard

    Linux Kernel Runtime Guard (LKRG) is a kernel module. It checks the Linux kernel and detects any vulnerabilities against it.

    Hence, it is a great option to protect your system against any unauthorized access.

    13. Carefully set privacy settings and permissions

    Most browsers have a ‘do not track’ option in the settings. This option collects and tracks your data. Make sure you disable it. Further, you can also set your social media accounts on different platforms as private, as the data can be collected when available publicly.

    14. Use SSH (Secure Shell)

    SSH is a secure protocol that provides protection to system administrators. It is used by most data centers and large enterprises for additional security while working on different networks.

    Additionally, it protects your network against cryptographic attacks. Currently, this protocol is used by most web servers, especially UNIX or Linux , and in the cloud.

    15. Check network ports to clear the clutter

    You can use these two commands:

    • Check all open ports with the help of netstat networking command.
    • Use chkconfig command to discard any services, not in use or not needed by you anymore.

    16. Set strong password policies

    Never use easy passwords for the sake of easily remembering them. This can lead to easy data breaches and challenges or security. Instead, keep a password containing alphanumeric characters and digits for your applications and files.

    17. Separate desk partitions

    You must separate the operating system , software, and user files. Whenever a breach occurs, all your data will vanish if you use the same partition. Additionally, also make sure to install third-party apps on separate partitions.

    You can use the below-mentioned recommended partition scheme:

    • /
    • /boot
    • /usr
    • /var
    • /home
    • /tmp
    • /opt

    18. Prevent using FTP, Telnet, or RSH commands

    If someone on the network is using a packet sniffer; it becomes extremely easy to breach passwords or files. For that, use:

    To discard any insecure services, use:

    $ sudo apt-get --purge remove xinetd nis yp-tools tftpd atftpd tftpd-hpa telnetd rsh-server rsh-redone-server

    19. Set up Password Aging

    After a certain number of days, a password must be changed. The change command is helpful as it tracks the last password change date so that you can determine when you must take action and make changes. Use the below mentioned command:


    Minimum_days: minimum number of days between password changes.

    Maximum_days: maximum number of days for a password to exist.

    Warn: a warning as soon as the password's expiration date comes closer.

    Expire: the exact date after which the user is not allowed to use the same password.

    20. Lock accounts after repeated wrong credentials

    There are certain commands that notify you whenever any malicious login attempts take place. To check the number of failed login attempts, just use the following command:


    In case you see any suspicious activity, simply lock your account using:

    # lock Linux account 
    passwd -l userName

    21. Disable root login

    It is highly recommended to use sudo to enhance the overall security of the system, and it is an excellent step in Linux server hardening.

    Further, it also comes up with tracking and auditing features.

    22. Disable USB sticks

    Restrict users from accessing USB sticks to protect your system from any sort of data breach. Use this command:

    install usb-storage /bin/true

    23. Restrict using previous passwords

    Protect your system by restricting users from keeping any old passwords. Here is a mechanism you can use to keep a record of all the previous passwords:

    pam_unix module parameter remember

    PAM helps to authenticate users and doesn’t allow users to use the same password again. This guarantees that security is not compromised.

    24. Don’t set UID as 0 for non-root accounts

    This step is crucial as UID 0 is only for the root account with all the permissions. These permissions help access the overall system as and when needed. To check which accounts are set to 0, use the below-mentioned command:

    # awk -F: '($3 == "0") {print}' /etc/passwd

    25. Disable SUID and SGID (unwanted) binaries

    If any SUID or SGID file faces insecure activity, all SUID/SGID bits are put at risk. Find such files using the following command and disable them:

    For SUID Files:

    find / -perm +4000

    For SGID Files:

    find / -perm +2000

    Single command for both SUID and SGID:

    find / \( -perm -4000 -o -perm -2000 \) -print
    find / -path -prune -o -type f -perm +6000 -ls

    26. Discard all noowner files

    In case you find any files not owned by any user, it is crucial to discard them as they can be easily used for some malicious purpose. Use this command to find such files:

    find /dir -xdev \( - nouser -o -nogroup \) - print

    27. Use OpenSSH server

    It is highly recommended to use the OpenSSH server for any sort of remote login and file transfer.

    28. Protect files, email, and directories

    There are various ways through which you can protect files in Linux. Some of them are mentioned below:

    • Only send root Mail to an account under your notice.
    • Use OpenSSL to protect your files.
    • Use the gpg command to encrypt your files with a password.

    29. Secure PHP/ Apache/ Nginx server

    Use the following commands for that:

    ServerTokens Prod
    ServerSignature Off
    TraceEnable Off
    Options all -Indexes
    Header always unset X-Powered-By

    30. Use NIDS

    Network Intrusion Detection System or NIDS is a wonderful option that notifies you in case of any outside attack by monitoring the traffic on your network.

    Hence, it’s important to install an IDS for this extra safety. In addition, it’s also beneficial to add the below-mentioned software too:

    31. Use SSH keys more than using passwords

    SSH key pairs are Highly secured as compared to passwords; however, they are less user-friendly. Additionally, an SSH key pair is the same as a 12-character password.

    When you use these key pairs in your system, it becomes quite impossible for a hacker to perform brute-force hacking on your system.

    32. Switch off external device booting

    USB drives are often used by outside users to access important information from your system. To safeguard yourself from this action, disable all sorts of external device booting.

    33. Disable IPv6

    If IPv6 is not in use, it’s the best option to disable it. Doing this can decrease the probability of any malicious attack on the system.



    34. Ensure disabling these systems

    Here is a list of filesystems that shouldn’t be placed in your system:

    • FAT
    • udf
    • squashfs
    • hfs
    • hfsplus
    • jffs2
    • cramfs
    • freevxfs

    35. Configure 2-factor authentication

    Added layer of security doesn’t hurt, right? Well, you must take all the needed steps to keep your defense mechanism stronger. It is highly recommended that you incorporate two-factor authentication into your system.

    Encrypted channels guarantee maximum protection against breaches.

    36. Set up fail2ban

    There are various bots with the intention to attack your servers. Now, these bots try gaining access if your server has an unpatched vulnerability.

    If you don’t wish this to happen, it’s the best option to install the Fail2Ban tool . This tool is known to block any suspicious or malicious IP addresses or bots and safeguard your server at its finest.

    Use this command to install this tool:

    sudo apt-get install fail2ban

    37. Change the FTP port

    This step again adds extra security to your Linux system. Follow these steps:

    • Find port 21 line.
    • Change this port to any random port number ranging from 0 to 65353.

    38. Use Spamassassin to remove email spam

    Many outside attackers have found email as one of the easiest ways to attack you. A spam folder is a simple way to reach you and extract confidential information. One excellent tool to help you is SpamAssassin .

    It scans each of your mail and identifies any suspicious incoming messages. Use this command to install this tool:

    sudo apt install spamassassin

    39. Delete old backups

    It is crucial to shift your old backup files to the server locally. In addition, you can store backup files on third-party storage services as well.

    40. Set up auto-updates

    Linux servers receive security updates quite frequently. It is a great step to install automated updates.

    Set auto-updates using this command:

    sudo apt install unattended-upgrades apt-listchanges bsd-mailx update-notifier-common

    Use this command to enable these automatic updates:

    sudo dpkg-reconfigure --priority=low unattended-upgrades

    Final Remarks

    Linux distributions are considered to be one of the safest systems available. However, there are certain security safeguards that you must incorporate into your system for extra safety. This post provided you with the best Linux security tips for a smooth and safe workflow.

    Linux server security is of utmost importance for any user; hence, I would hope these tips help you in the best possible way to keep your system secure. Feel free to comment below with some extra tips if I missed any.


    People are also reading:

    linux security

    Leave a Comment on this Post