Cheat SheetsLinuxSecurity

Security — Cheat Sheet

Linux · 1 topics. Download the PDF or the Instagram carousel and share it.

Cheat Sheet · AiCanCode.org
Security
Linux1 topicsQuick revision reference
1

Linux Security Hardening

Harden a Linux server by securing SSH, configuring the firewall (iptables/ufw), auditing with auditd, managing SELinux/AppArmor, and following the principle of least privilege throughout.

  • ✓Disable root SSH login and password authentication — key-only auth eliminates brute force.
  • ✓Default-deny firewall: allow only ports 22 (SSH), 80 (HTTP), 443 (HTTPS), plus app-specific ports.
  • ✓fail2ban bans IPs after repeated failed SSH attempts — essential for internet-facing servers.
  • ✓auditd logs security-relevant events (file modifications, privilege escalation, logins).
  • ✓sysctl hardening disables IP forwarding, ICMP redirects, and restricts kernel pointer exposure.
  • ✓Enable unattended security updates — most breaches exploit known, patched vulnerabilities.
/etc/ssh/sshd_config — hardening
# /etc/ssh/sshd_config — SSH server configuration

# Disable root login (use sudo from a regular account instead)
PermitRootLogin no

# Disable password authentication (require SSH keys)
PasswordAuthentication no
ChallengeResponseAuthentication no
PubkeyAuthentication yes

# Allow only specific users
AllowUsers akshay deploy-bot
# AllowGroups sshusers

# Restrict to specific key algorithms (disable weak ones)
HostKeyAlgorithms ssh-ed25519,rsa-sha2-512,rsa-sha2-256
KexAlgorithms curve25519-sha256,diffie-hellman-group14-sha256
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com

# Other hardening
MaxAuthTries 3
LoginGraceTime 30
ClientAliveInterval 300
ClientAliveCountMax 2
Banner /etc/ssh/banner.txt       # show legal warning before login

# After changes, validate then reload:
sshd -t                          # test configuration syntax
sudo systemctl reload sshd

# fail2ban — ban IPs after repeated failed logins
sudo apt install fail2ban
# /etc/fail2ban/jail.local:
# [sshd]
# enabled = true
# maxretry = 3
# bantime = 3600     # 1 hour ban
# findtime = 600     # within 10 minutes
Learn this free with Aria, your AI tutor → AiCanCode.org/learn/linux