Two Linux servers hardened in four tiers, measured before and after

server-hardening — Two Linux servers hardened in four tiers, measured before and after

Key-only SSH, growing bans, audit logging, kernel lock-down and intrusion filtering on two servers, scored with Lynis before and after.

My own lab in the Fraser Valley: two Linux servers that face the internet and host my websites and tools.

• SSH accepts keys only, on non-standard ports, and only from Canadian addresses.
• Repeated failed sign-ins are banned for an hour at first, growing to seven days for repeat offenders.
• Audit logging watches user accounts, SSH settings, sudo rules, scheduled jobs and privilege changes; the rules are locked until the next restart.
• Kernel network settings locked down, with file-integrity and rootkit checks scheduled.
• Security updates install on their own, with a scheduled restart to finish them.
• Rate limits on the web server, CrowdSec intrusion filtering, and push alerts for bans and failures.

• Lynis audit run before and after on both servers.
• The two remaining warnings (a pending kernel restart and packages waiting to update) clear on their own at the scheduled restart.

• Ubuntu
• OpenSSH
• fail2ban
• auditd
• sysctl
• AIDE
• rkhunter
• CrowdSec
• ufw