Linux hardening & audit
System security · Engineer · SOC · Cloud
Baseline CIS-style hardening with Lynis and command-line verification.
Concept map
Patch → Minimize services → Auth → Logging → Audit
1. Patch & inventory
Package updates, remove unused services, disable legacy protocols.
2. SSH
Keys only, no root login, AllowUsers, fail2ban optional.
3. Permissions & ACLs
chmod/chown, getfacl/setfacl, umask 027 for shared dirs.
4. Audit & logs
auditd rules for sensitive files; forward journal to SIEM.
5. Lynis audit
Run on lab VM; implement suggestions; re-scan for score improvement.
Case studies
Misconfigured cloud images
Default creds on AMIs led to cryptomining — golden images + CIS benchmarks.