Blog Details

A Linux server that is set up quickly and never hardened is an easy target. The good news is that the basics are well known, free, and mostly a one-time job. Here is a practical checklist for Red Hat Enterprise Linux (RHEL) and Ubuntu Server.

RHEL: keep SELinux on

“Just disable SELinux, the app will work.” It’s one of the most common, and most risky, shortcuts on Red Hat servers. SELinux limits what each service can touch, so a compromised web app can’t wander through the rest of the server.

• Keep SELinux in enforcing mode. When an application is blocked, fix the policy or the file labels instead of switching SELinux off.
• Use firewalld to allow only the services the server actually needs.
• Start from a minimal install, and remove packages and services you don’t use.
• Use SSH keys, block direct root login, and have admins use sudo.
• Turn on Red Hat Insights. It’s included with RHEL subscriptions and flags known risks and misconfigurations.

Ubuntu Server: five hardening basics

• SSH keys instead of passwords for remote logins.
• ufw, Ubuntu’s simple firewall, allowing only the ports the server needs.
• unattended-upgrades, so security updates install automatically.
• Livepatch, which applies many kernel security fixes without a reboot.
• No direct root login; admins use their own accounts and sudo.

Habits that apply to every Linux server

• Patch on a routine. dnf on RHEL and apt on Ubuntu, with a regular maintenance window.
• Know your versions. Ubuntu 22.04’s standard support ends in May 2027; servers still on CentOS 7 have been without updates since June 2024.
• Keep a simple record of each server: what it does, who owns it, its version and its support end date.
• Back up, and test restores, so you know you can rebuild if something goes wrong.