Linux Server Hardening

Patching and Support Lifecycles

Most real-world compromises use vulnerabilities that already had a fix. A release past end of life receives no more fixes, so every new flaw stays open forever. Keeping a supported release and installing security updates promptly removes the largest class of risk on most servers.

Accounts and Privileges

Any account with user id 0 is root, whatever its name. Accounts with empty passwords can log in with nothing. Sudo rules marked NOPASSWD turn any takeover of that user into instant root. Each of these violates least privilege.

Permissions, SUID and Cron

World-writable files under /etc or in cron directories let any local user change what root runs. SUID programs run with their owner's rights; one placed in /tmp or a web folder is a classic privilege escalation trick. The sticky bit on /tmp stops users deleting each other's files.

Kernel Hardening and Logging

Kernel parameters such as address space layout randomisation, restricted kernel pointers and disabled ICMP redirects make exploitation harder. Persistent logs, an audit daemon and synchronised time are what let you investigate afterwards. Module P16 covers them in depth.

In Summary

Keep the release supported and patched. Watch for extra root accounts, NOPASSWD sudo rules and loose permissions. Kernel settings make exploitation harder. Logs and time sync let you investigate later.

Apply It

These OpenVAPT checks put this module into practice. Open one to see its detection logic and source code.

Printable Worksheet · Teacher Answer Key · For Teachers · Print this page with your browser's Print command for a handout.

Also available as plain Markdown for notes, scripts and AI tools. Same facts, same source, no styling.

Lab

1. Run: openvapt demo --only HOST- --out p1
2. For each failed HOST check, find the line in internal/lab/lab.go that differs between the vulnerable and hardened server.
3. On a test machine you own: sudo openvapt scan --only HOST- and compare.

Check Yourself

Answers are checked in your browser and never stored or sent.

References

• NIST SP 800-123, Guide to General Server Security
• NIST SP 800-40 Rev. 4, Enterprise Patch Management

Adapted from the OpenVAPT Academy (openvapt.com), built by AI Cybersecurity Engineers, used under the OpenVAPT Source-Available Licence 1.3. Free teaching use under Teaching With OpenVAPT. Pre-release material may be wrong or unstable; use at your own risk.

OpenVAPT. (2026). P1: Linux Server Hardening (Version 0.1.0-alpha.6). OpenVAPT Academy. Retrieved October 16, 2026, from https://openvapt.com/academy/p1.html

@misc{openvapt_p1,
  author       = {{OpenVAPT}},
  title        = {{P1: Linux Server Hardening}},
  year         = {2026},
  howpublished = {\url{https://openvapt.com/academy/p1.html}},
  note         = {OpenVAPT Academy, version 0.1.0-alpha.6. Accessed 16 October 2026}
}