Linux Hardening: It Doesn't Have To Be Hard

The talk starts from the observation that mainstream Linux distributions are tuned for convenience rather than security, and that a hardened base matters even when the applications on top are well protected. The speaker, an embedded systems engineer, frames hardening as a documented process and stresses backups and a non-production test environment before changing anything.

The middle of the talk moves through the system layer by layer. Remote interfaces come first: find open ports from outside and inside the machine, disable what is not needed, and tighten SSH with strong keys and restricted users. Firewalling follows, with tools such as nftables, UFW and firewalld. For accounts, the speaker covers limiting root logins, scoping sudo rights to least privilege and avoiding shell escapes. PAM is presented as a way to enforce password policy, centralise accounts and add second factors such as one-time codes or hardware keys. Filesystem topics include ownership, avoiding world-writable files, set-UID binaries and mount options such as nosuid, noexec and read-only. Mandatory access control, systemd service sandboxing, container confinement, cgroup resource limits and package sourcing are also covered.

The closing section looks at supply chain risk from manually downloaded binaries, language package managers and unofficial repositories, and recommends automatic updates, signed packages and internal mirrors. Real examples include a sudo privilege escalation, a shell escape through apt and a socket left writable by everyone. The suggested starting point is a risk assessment, followed by auditing with tools such as Lynis and OpenSCAP and checking that services still work after each change.