Skip to main content

Security in Linux

Security in Linux
Building Walls, Wards, and Shields for the Kingdom

Linux powers servers, cloud platforms, and embedded systems worldwide, making it a prime target for attackers. Security is not a one-time setup - it is a continuous process of hardening, monitoring, and adapting.

To protect the kingdom, administrators must build strong defenses: firewalls, secure authentication, intrusion prevention, and vigilant monitoring.

Principles of Security

The principles of security ensure that Linux systems remain resilient against all kinds of threats.

# Principle Technical Focus Example Tools
1 Encryption Protects data in transit from eavesdropping SSH, TLS
2 Authentication Ensures only authorized users connect SSH keys, MFA
3 Access Control Restrict who can log in and from where sshd_config, firewalls
4 Least Privilege Avoid root login, use sudo User accounts with limited rights
5 Monitoring & Logging Detect suspicious activity auditd, syslog
6 Regular Updates Patch vulnerabilities Package managers (apt, yum)
Security is not a single spell but a strategy of layers. Even if one wall is breached, others stand strong.

Security Principles Rocks

  • Linux is widely used in servers, cloud, and embedded systems, making it a prime target for attackers.
  • Following these principles ensures resilience against both external and internal threats.
  • Security is not a one-time setup - it’s a continuous process of hardening, monitoring, and adapting.

User Privileges and Sudo

  • Root User: Supreme wizard with unlimited powers
  • Sudo: A royal seal granting temporary authority
  • Avoid logging in as root directly; use sudo for specific tasks
sudo apt update
Root is the king - too powerful to be risked in daily tasks. sudo is the royal seal, granting temporary authority when needed.

Firewalls: Gaurding Walls

  • A firewall is a set of rules that determine which network traffic is allowed or blocked.
  • In Linux, the firewall is built into the kernel’s netfilter framework, and administrators configure it using tools like iptables, nftables, or firewalld.
  • It ensures that only trusted connections reach your system while blocking suspicious or harmful traffic.
# Tool Description
1 iptables Traditional command-line utility for configuring firewall rules
2 nftables Modern replacement for iptables, offering better performance and simpler syntax
3 firewalld Higher-level service that manages firewall rules dynamically, often used in Red Hat-based systems
4 UFW (Uncomplicated Firewall) User-friendly interface for managing firewall rules, common in Ubuntu
#Rule TypePurposeExample
1AllowPermit specific trafficAllow SSH on port 22
2Deny/DropBlock unwanted trafficBlock all incoming except HTTP/HTTPS
3ForwardingRedirect trafficForward port 80 to 8080
4LoggingRecord activityLog dropped packets for auditing
sudo ufw enable
sudo ufw allow 22/tcp
sudo ufw status

Enable SSH Port 22 on Linux with UFW

Firewalls are the castle walls and gates, deciding which visitors are allowed in. Linux firewalls are critical because servers often face constant probing from attackers. By enforcing strict rules, you reduce the attack surface and ensure that only legitimate traffic reaches your applications

Hackers Firewall Rocks

# Principle Description
1 Principle of Least Privilege Only open the ports you truly need
2 Regular Rule Review Audit firewall rules to remove outdated ones
3 Logging & Monitoring Track suspicious activity with tools like auditd or syslog
4 Defense in Depth Combine firewall rules with intrusion detection systems and encryption

Best Practices for Hardening

# Practice Description
1 Disable Root Login Use non-root accounts with sudo for elevated privileges
2 Use SSH Keys Replace passwords with key-based authentication for stronger security
3 Restrict Access with Firewalls Control connections using iptables, nftables, or ufw
4 Enable fail2ban Block repeated failed login attempts to prevent brute-force attacks
5 Keep Software Updated Patch vulnerabilities by regularly updating packages and the kernel
6 Monitor Logs Detect unauthorized access attempts using auditd or syslog 
# Monitor logs for suspicious activity

tail -f /var/log/auth.log

# Regularly update packages

sudo apt upgrade
Linux powers over half of web servers worldwide, making it a prime target for attackers. Secure remote access ensures administrators can manage systems efficiently without exposing them to unnecessary risks. It’s a balance between convenience and strong security controls.

Practical Exercises

  1. Generate SSH keys and connect securely.
  2. Disable root login in /etc/ssh/sshd_config.
  3. Monitor logs for failed login attempts.
  4. Install Fail2Ban and configure it to block repeated attackers.

Enable UFW and allow only SSH:

sudo ufw enable
sudo ufw allow 22/tcp

Hackers Quest - Mini Project

Fortify a Linux Fortress:

  • Set up SSH keys for secure login
  • Configure UFW to allow only SSH and HTTP
  • Disable root login
  • Install Fail2Ban to block repeated attackers
  • Document the fortress design in your spellbook

Hackers Notebook

A kingdom without walls is doomed. Security is not optional - it is the shield of your system. Build your fortress wisely, and you will sleep peacefully knowing your kingdom stands strong against invaders.

Tips, Tricks, Roadmaps, Resources, Networking, Motivation, Guidance, and Cool Stuff ♥
Updated on Dec 28, 2025