Linux Hardening

Scope

What this is: Securing Linux systems by reducing attack surface, enforcing least privilege, and implementing defence-in-depth controls.

Competition relevance: Infrastructure hardening. Core skill for all competition levels.

Why it matters: Linux hardening tasks are high-value, clearly defined, and have explicit marking criteria. Correct hardening without breaking services is essential.

WSOS 2026 alignment: This topic directly supports Section 4: Secure systems operation and maintenance (configuring and securing systems) and Section 5: Secure systems protection and defence (implementing security controls). You demonstrate competence by hardening Linux systems to industry standards under time pressure.

Competition area: This topic is core to the infrastructure hardening area, where you harden server environments to reduce attack surface and enforce security policies.

Offline competence: In competition environments with limited or no internet, use man pages (e.g., man iptables, man sshd_config, man chmod), check /usr/share/doc for package documentation, and prepare Zeal docsets or Kiwix offline resources for reference materials.

---

Competency Matrix

Level	Expectation
Regional	Disable obvious insecure services (telnet, FTP). Configure UFW firewall. Disable root SSH login. Set file permissions on sensitive files.
National	SELinux/AppArmor basic policies. iptables rule chains. SSH hardening with fail2ban. Audit daemon configuration. Automated hardening scripts.
Squad/Team Selection	SELinux troubleshooting and custom policies. Complex iptables with NAT/forwarding. Advanced SSH configurations (certificates, port knocking).
International	Zero-trust network segmentation. Kernel hardening (sysctl). Container security. Performance impact analysis of security controls.

---

Technical Content

Basic Hardening

Core principle: Minimize attack surface by disabling unnecessary services and enforcing secure defaults.

Essential tasks:

1. Disable insecure services:

# Check running services
systemctl list-units --type=service --state=running

# Disable telnet, FTP, rsh
systemctl stop telnet.socket
systemctl disable telnet.socket
systemctl stop vsftpd
systemctl disable vsftpd

2. Remove unnecessary packages:

# List installed packages
dpkg -l | grep -E "telnet|ftp|rsh"

# Remove insecure packages
apt remove telnet ftp rsh-client rsh-server

3. Secure file permissions:

# /etc/passwd should be 644, /etc/shadow should be 640
chmod 644 /etc/passwd
chmod 640 /etc/shadow

# Secure SSH config
chmod 600 /etc/ssh/sshd_config

# World-writable files are dangerous
find / -xdev -type f -perm -0002 -ls 2>/dev/null

4. Disable root login:

# Edit /etc/passwd or use usermod
usermod -s /sbin/nologin root

# For SSH specifically, edit /etc/ssh/sshd_config
# PermitRootLogin no

Competition context: These are quick wins (5-15 minutes each). Always screenshot before/after state. Document what you disabled and why.

---

Firewall Configuration

UFW (Uncomplicated Firewall):

# Enable UFW
ufw enable

# Default policies
ufw default deny incoming
ufw default allow outgoing

# Allow specific services
ufw allow 22/tcp    # SSH
ufw allow 80/tcp    # HTTP
ufw allow 443/tcp   # HTTPS

# Allow from specific IP
ufw allow from 192.168.1.100 to any port 22

# Check status
ufw status verbose

iptables (more control):

# View current rules
iptables -L -v -n

# Flush existing rules (careful!)
iptables -F

# Set default policies
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT

# Allow established connections
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# Allow loopback
iptables -A INPUT -i lo -j ACCEPT

# Allow SSH
iptables -A INPUT -p tcp --dport 22 -j ACCEPT

# Save rules
iptables-save > /etc/iptables/rules.v4

Competition context: Firewall rules are a large part of most hardening tasks. Test after each rule to ensure services still work.

---

SSH Hardening

Essential sshd_config changes:

# Edit /etc/ssh/sshd_config
PermitRootLogin no
PasswordAuthentication yes   # Set to 'no' for key-only at higher levels
PermitEmptyPasswords no
X11Forwarding no
MaxAuthTries 3
ClientAliveInterval 300
ClientAliveCountMax 2
AllowUsers specificuser      # Whitelist users
Port 2222                    # Non-standard port (national+)

# Restart SSH
systemctl restart sshd

Key-based authentication (national+):

# Generate key pair
ssh-keygen -t ed25519 -C "competition-key"

# Copy to server
ssh-copy-id user@server

# Disable password auth in sshd_config
PasswordAuthentication no

fail2ban integration (national+):

# Install fail2ban
apt install fail2ban

# Configure /etc/fail2ban/jail.local
[sshd]
enabled = true
port = 22
filter = sshd
logpath = /var/log/auth.log
maxretry = 3
bantime = 3600

# Start fail2ban
systemctl enable fail2ban
systemctl start fail2ban

# Check status
fail2ban-client status sshd

---

Mandatory Access Control

SELinux basics (RHEL/CentOS):

# Check SELinux status
sestatus
getenforce

# Set enforcing mode
setenforce 1

# Make permanent in /etc/selinux/config
SELINUX=enforcing

# View contexts
ls -Z /var/www/html

# Restore default contexts
restorecon -Rv /var/www/html

# Check for denials
ausearch -m avc -ts recent

AppArmor basics (Ubuntu/Debian):

# Check status
aa-status

# Enforce a profile
aa-enforce /etc/apparmor.d/usr.sbin.apache2

# Complain mode (log only)
aa-complain /etc/apparmor.d/usr.sbin.apache2

# Reload profiles
systemctl reload apparmor

Competition context: SELinux/AppArmor appears at national+ level. Expect to enforce existing profiles, not write custom policies (unless international).

---

User and Privilege Management

sudo configuration:

# Edit /etc/sudoers with visudo
# Allow user to run specific commands
user ALL=(ALL) /usr/bin/systemctl restart apache2

# Disable password for sudo (dangerous - only if task requires)
user ALL=(ALL) NOPASSWD: ALL

# Audit sudo usage
grep sudo /var/log/auth.log

Password policies:

# Install password quality checker
apt install libpam-pwquality

# Edit /etc/security/pwquality.conf
minlen = 12
dcredit = -1
ucredit = -1
ocredit = -1
lcredit = -1

# Force password change
chage -d 0 username

---

Competition Strategy & Marking

What gets marked:

• Services disabled correctly (systemctl status screenshots)
• Firewall rules implemented (ufw status or iptables -L output)
• SSH configuration changes (before/after sshd_config snippets)
• Users/permissions corrected (ls -l screenshots)

Evidence and reporting requirements:

• Before/after screenshots for every change (systemctl status, ufw status, ls -l output)
• Configuration file snippets showing exact changes (diff format preferred)
• Service status output proving changes persisted after reboot (systemctl status after reboot)
• Written justification for each hardening action (why this change improves security)
• Documented testing (proof that services still function correctly)
• Timestamp all evidence to demonstrate work sequence
• Use clear file naming: hostname_task_before.png, hostname_task_after.png

Time allocation:

• Basic hardening (services, permissions): 20-30 minutes
• Firewall configuration: 15-20 minutes
• SSH hardening: 10-15 minutes
• Advanced (SELinux, audit): 15-25 minutes (national+)

Common marking criteria:

• Service still functional after hardening: 50%
• Configuration persists after reboot: 30%
• Documentation quality: 20%

Time-boxed drill suggestion: 90-minute Linux hardening grind: Given a vulnerable VM, disable insecure services, configure UFW or iptables, harden SSH, set correct permissions on /etc/shadow and /etc/passwd, configure sudo, and document all changes. Reboot and verify hardening persists. This drill builds muscle memory for competition-day execution.

---

False Flags / Wrong Paths

Common Traps

Breaking services while hardening Disabling the wrong service or setting permissions too strict can break required functionality. Always test after each change.

Firewall rules that block yourself out If you deny SSH before allowing it, you’ll lose access. Always allow required services BEFORE setting default deny.

SELinux “just disable it” trap Setting SELinux to permissive/disabled might seem like it fixes problems, but you’ll lose marks. Troubleshoot denials instead.

Over-hardening If the task says “secure the web server,” don’t disable HTTP. Harden configuration, don’t break functionality.

Red herrings from past competitions:

• Services that look insecure but are required for scoring (e.g., a specific port must remain open)
• Firewall rules that seem redundant but are part of the marking scheme
• Users that look suspicious but are legitimate service accounts

---

Practice Checklist

• Can identify and disable insecure services in under 10 minutes
• Can configure UFW to allow specific ports and deny all others
• Can write iptables rules manually (no UFW wrapper)
• Can harden SSH configuration (disable root, key-based auth, non-standard port)
• Can set correct file permissions on /etc/shadow, /etc/passwd, SSH keys
• Understand SELinux/AppArmor basics (status, enforce, troubleshoot denials)
• Can configure sudo to allow specific commands only
• Can implement fail2ban for SSH brute-force protection
• Can produce competition-compliant screenshots for all changes
• Can verify hardening persists after reboot

---

References

• Regional Roadmap: Infrastructure hardening
• National Roadmap: Infrastructure hardening
• Cheat Sheet: Linux Hardening Checklist (planned)