Skip to content
Search

Linux:Security

lastmod 2026-02-09created 2026-02-092 edits

Notes on Linux security.

Ubuntu 22.04 system hardening

System updates and automatic security patches 

# 시스템 전체 업데이트 / Full system update
sudo apt update && sudo apt upgrade -y && sudo apt dist-upgrade -y

# 자동 보안 업데이트 설정 / Enable automatic security updates
sudo apt install -y unattended-upgrades apt-listchanges
sudo dpkg-reconfigure -plow unattended-upgrades

Check in /etc/apt/apt.conf.d/50unattended-upgrades that only security updates are enabled: 

Unattended-Upgrade::Allowed-Origins {
    "${distro_id}:${distro_codename}-security";
};
Unattended-Upgrade::Remove-Unused-Dependencies "true";
Unattended-Upgrade::Automatic-Reboot "true";
Unattended-Upgrade::Automatic-Reboot-Time "03:00";

Removing unnecessary services 

# 현재 listen 중인 서비스 확인 / Check listening services
sudo ss -tulnp

# 불필요한 서비스 비활성화 / Disable unnecessary services
sudo systemctl disable --now avahi-daemon
sudo systemctl disable --now cups
sudo systemctl disable --now bluetooth
sudo systemctl disable --now ModemManager

# snap 불필요 시 제거 / Disable snap if not needed
sudo systemctl disable --now snapd

SSH hardening

Create /etc/ssh/sshd_config.d/hardening.conf: 

sudo tee /etc/ssh/sshd_config.d/hardening.conf << 'EOF'
# 루트 로그인 차단 / Disable root login
PermitRootLogin no

# 패스워드 인증 비활성화 (키 인증만 허용) / Key-only authentication
PasswordAuthentication no
PubkeyAuthentication yes
AuthenticationMethods publickey

# 프로토콜 및 알고리즘 제한 / Restrict algorithms
KexAlgorithms curve25519-sha256,[email protected]
Ciphers [email protected],[email protected]
MACs [email protected],[email protected]

# 세션 제한 / Session limits
MaxAuthTries 3
MaxSessions 3
LoginGraceTime 30
ClientAliveInterval 300
ClientAliveCountMax 2

# 기타 강화 / Additional hardening
X11Forwarding no
AllowAgentForwarding no
AllowTcpForwarding no
PermitEmptyPasswords no
UseDNS no

# 특정 사용자만 SSH 허용 / Allow specific users only
AllowUsers zer0
EOF

sudo systemctl restart sshd

Item

Description

PermitRootLogin no

Blocks direct login to the root account

PasswordAuthentication no

Disables password authentication, allowing SSH keys only

MaxAuthTries 3

Disconnects after more than 3 authentication attempts

AllowUsers

Only the specified users can access via SSH

Basic UFW firewall setup 

sudo apt install -y ufw

# 기본 정책: 인바운드 차단, 아웃바운드 허용 / Default policy
sudo ufw default deny incoming
sudo ufw default allow outgoing

# SSH만 LAN에서 허용 / Allow SSH from LAN only
sudo ufw allow from 192.168.1.0/24 to any port 22 proto tcp comment 'SSH-LAN'

# 로깅 활성화 / Enable logging
sudo ufw logging high

sudo ufw enable

Installing Fail2Ban 

sudo apt install -y fail2ban

sudo tee /etc/fail2ban/jail.local << 'EOF'
[DEFAULT]
bantime = 3600
findtime = 600
maxretry = 3
banaction = ufw

[sshd]
enabled = true
port = ssh
filter = sshd
logpath = /var/log/auth.log
maxretry = 3
bantime = 86400
EOF

sudo systemctl enable --now fail2ban

Item

Value

Description

bantime

86400

SSH ban time of 24 hours

findtime

600

Counts failures within 10 minutes

maxretry

3

Bans after 3 failures

banaction

ufw

Bans through integration with UFW

Kernel security parameters (sysctl) 

sudo tee /etc/sysctl.d/99-security.conf << 'EOF'
# IP 스푸핑 방지 / Anti IP spoofing
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1

# ICMP redirect 차단 / Block ICMP redirects
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv4.conf.all.send_redirects = 0
net.ipv6.conf.all.accept_redirects = 0

# SYN flood 방지 / SYN flood protection
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_max_syn_backlog = 2048
net.ipv4.tcp_synack_retries = 2

# Source routing 차단 / Block source routing
net.ipv4.conf.all.accept_source_route = 0
net.ipv6.conf.all.accept_source_route = 0

# IP forwarding 비활성화 / Disable IP forwarding
net.ipv4.ip_forward = 0
net.ipv6.conf.all.forwarding = 0

# ASLR 최대화 / Maximize ASLR
kernel.randomize_va_space = 2

# 코어 덤프 제한 / Restrict core dumps
fs.suid_dumpable = 0

# dmesg 접근 제한 / Restrict dmesg access
kernel.dmesg_restrict = 1

# 커널 포인터 숨김 / Hide kernel pointers
kernel.kptr_restrict = 2

# BPF JIT 강화 / BPF JIT hardening
net.core.bpf_jit_harden = 2
EOF

sudo sysctl --system

Checking and hardening AppArmor 

# AppArmor 상태 확인 / Check AppArmor status
sudo aa-status

# 추가 프로파일 설치 / Install additional profiles
sudo apt install -y apparmor-utils apparmor-profiles apparmor-profiles-extra

Audit logging (auditd) 

sudo apt install -y auditd audispd-plugins

sudo tee /etc/audit/rules.d/hardening.rules << 'EOF'
# 파일 삭제 감시 / Monitor file deletion
-a always,exit -F arch=b64 -S unlink -S unlinkat -S rename -S renameat -F auid>=1000 -F auid!=4294967295 -k delete

# 사용자/그룹 변경 감시 / Monitor user/group changes
-w /etc/passwd -p wa -k identity
-w /etc/group -p wa -k identity
-w /etc/shadow -p wa -k identity
-w /etc/gshadow -p wa -k identity

# sudoers 변경 감시 / Monitor sudoers changes
-w /etc/sudoers -p wa -k sudoers
-w /etc/sudoers.d/ -p wa -k sudoers

# NFS 설정 파일 감시 / Monitor NFS exports
-w /etc/exports -p wa -k nfs_exports
EOF

sudo systemctl enable --now auditd
sudo augenrules --load

Other security measures 

# 공유 메모리 제한 / Restrict shared memory
echo "tmpfs /run/shm tmpfs defaults,noexec,nosuid 0 0" | sudo tee -a /etc/fstab

# USB 스토리지 차단 / Block USB storage
echo "blacklist usb-storage" | sudo tee /etc/modprobe.d/disable-usb-storage.conf

# 로그인 배너 / Login banner
sudo tee /etc/issue.net << 'EOF'
***WARNING*** Unauthorized access is prohibited. All activity is monitored.
EOF

# cron 접근 제한 / Restrict cron access
sudo touch /etc/cron.allow
echo "zer0" | sudo tee /etc/cron.allow
sudo chmod 600 /etc/cron.allow

See also

author Zer0 sitemap