Linux Security Baseline for Production Servers
Executive Summary A security baseline is the foundation: OS-hardened, patched, with restricted access and audit trails. This guide covers minimal-install servers with hardened SSH, firewall (default-deny), LSM enforcement, least-privilege sudo, audit logging, and systemd hardening.
Goal: Reduce attack surface, detect breaches, and enforce privilege boundaries.
1. Minimal Install & Patching Minimal Install What it is:
Install only required packages (base + SSH + monitoring agent) No GUI, X11, unnecessary daemons Reduces vulnerabilities (fewer packages = fewer CVEs) Install steps (Ubuntu/Debian):
…