Boost Your Linux Security: Practical Commands Every Admin Should Know

In this article we discuss how to harden a Linux system using a series of practical security commands.

First, we ask whether Linux is already secure enough. The answer is no; attackers constantly discover new vulnerabilities that can be exploited within hours, so security must be an ongoing concern.

The main topics covered are:

Console security

Password lifecycle

Sudo notifications

SSH tuning

Using Tripwire for intrusion detection

Firewalld

Falling back to iptables

Restricting compilers

Immutable files

Managing SELinux with aureport

Using sealert

1. Console Security

Limit which terminals root can log in from by editing the security file under /etc/ that lists allowed devices. It is recommended to allow root access only on a single console and require all other users to log in as non‑root, using su when root privileges are needed.

2. Password Lifecycle

Set an expiration period for passwords so they must be changed regularly, reducing the risk of stolen or cracked credentials.

Method 1 – command line: chage -M 20 likegeeks Method 2 – edit /etc/login.defs:

PASS_MAX_DAYS 20 PASS_MIN_DAYS 0 PASS_WARN_AGE 5

3. Sudo Notifications

Configure /etc/sudoers to restrict which commands can be run with sudo and to send email alerts when sudo is used.

mailto [email protected]

mail_always on

4. SSH Tuning

SSH is a critical service; harden it by changing the default port, disabling root login, disabling password authentication, and enabling additional security options.

Port 5555

PermitRootLogin no

PasswordAuthentication no PermitEmptyPasswords no

UseDNS yes

GSSAPIAuthentication no

ServerAliveInterval 15 ServerAliveCountMax 3 TCPKeepAlive yes

ClientAliveInterval 30 ClientAliveCountMax 5

AllowUsers user1 user2

AllowGroup group1 group2

yum install google-authenticator

google-authenticator

auth required pam_google_authenticator.so

ChallengeResponseAuthentication yes

systemctl restart sshd

After these changes SSH will prompt for a verification code, protecting against brute‑force attacks.

5. Using Tripwire for Intrusion Detection

Tripwire is a host‑based intrusion detection system that monitors file attributes and alerts on changes.

wget http://dl.fedoraproject.org/pub/epel/7/x86_64/e/epel-release-7-9.noarch.rpm

rpm -ivh epel-release-7-9.noarch.rpm

sudo yum install tripwire

tripwire-setup-keyfiles

/etc/tripwire/twpol.txt

tripwire --update-policy --secure-mode low /etc/tripwire/twpol.txt

tripwire --init

tripwire --check

Secure the policy files twpol.txt and twcfg.txt after setup.

6. Using Firewalld

Firewalld replaces iptables and allows rule changes without stopping connections.

firewall-cmd --state

firewall-cmd --get-zones

firewall-cmd --set-default-zone=

firewall-cmd --zone=ZONE --list-all

firewall-cmd --get-services

firewall-cmd --zone=ZONE --add-service=SERVICE

firewall-cmd --zone=ZONE --remove-service=SERVICE

firewall-cmd --zone=ZONE --list-ports

firewall-cmd --zone=ZONE --add-port=PORT/PROTOCOL

firewall-cmd --zone=ZONE --remove-port=PORT/PROTOCOL

firewall-cmd --zone=ZONE --add-forward-port=port=PORT:proto=PROTOCOL:toport=DEST_PORT:toaddr=DEST_IP

firewall-cmd --zone=ZONE --remove-forward-port=...

7. Falling Back to iptables

If you prefer iptables, first disable firewalld:

systemctl disable firewalld

systemctl stop firewalld

Install and start iptables services:

yum install iptables-services

touch /etc/sysconfig/iptables

touch /etc/sysconfig/ip6tables

systemctl start iptables

systemctl start ip6tables

systemctl enable iptables

systemctl enable ip6tables

Reboot the system for the kernel to apply the new configuration.

8. Restricting Compilers

Prevent attackers from compiling malicious code by limiting access to compiler binaries.

rpm -q --filesbypkg gcc | grep 'bin'

groupadd compilerGroup

chown root:compilerGroup /usr/bin/gcc

chmod 0750 /usr/bin/gcc

9. Immutable Files

Make critical files immutable so even root cannot modify, delete, rename, or create hard links.

chattr +i /myscript

chattr -i /myscript

Directories such as /sbin and /usr/lib can also be made immutable to protect binaries and libraries.

10. Managing SELinux with aureport

Use aureport to generate audit reports for SELinux events.

aureport --avc

aureport -x

aureport -au -i

aureport -au --summary -i --failed

aureport -au --summary -i --success

11. Using Sealert

Install and run sealert to get human‑readable explanations of SELinux alerts.

yum install setools

sealert -a /var/log/audit/audit.log

The article concludes that many more Linux security techniques exist, and readers are encouraged to explore further.