Linux Security Fundamentals

Linux Security Fundamentals

Security is not a single tool or configuration — it is a set of principles applied consistently. Understanding why certain configurations are recommended (not just what they are) lets you make better security decisions when facing new situations. The three most important security principles for Linux system administration are: minimize attack surface, apply least privilege, and layer your defenses.

The CIA triad applied to Linux

Understanding attack surface

Attack surface is the total set of entry points an attacker could use. Every open port, every running service, every installed package, every user account, and every SUID binary is part of the attack surface. Reducing attack surface is the highest-value security activity because it eliminates entire classes of vulnerabilities.

# Assess your attack surface:

# What's listening on the network?
ss -tlnp    # Listening TCP ports with process names
ss -ulnp    # Listening UDP ports

# What services are running?
systemctl list-units --type=service --state=active

# What packages are installed?
dpkg -l | wc -l    # Total installed packages

# What users exist with login shells?
getent passwd | awk -F: '$7 !~ /nologin|false/ {print $1, $7}'

# What SUID binaries exist? (can be exploited for privilege escalation)
find / -perm /4000 -type f 2>/dev/null | grep -v proc

Principle of least privilege

Every process, user, and service should have only the minimum permissions required to perform its function. This limits blast radius when something is compromised.

# Run services as dedicated non-root users
# Check what user services run as:
ps aux | awk '{print $1, $11}' | grep -v root | sort | uniq

# Services should NOT run as root:
# Bad:  ExecStart=/usr/bin/myapp   with no User= (runs as root)
# Good: User=myapp in [Service] section

# Limit sudo access to specific commands:
# In /etc/sudoers.d/deploy:
deploy ALL=(root) NOPASSWD: /usr/bin/systemctl restart myapp, /usr/bin/systemctl status myapp

# Check who has full sudo:
getent group sudo

Defense in depth

Defense in depth layers for a Ubuntu server:

Physical/Network:
  Firewall (UFW/iptables) → only necessary ports open
  Network segmentation → services on private VLANs

System:
  Minimal installed packages
  Regular patching (unattended-upgrades)
  AppArmor profiles (limits what processes can access)

Authentication:
  SSH keys only (no password auth)
  fail2ban (brute-force protection)
  2FA for privileged access

Application:
  Run services as non-root users
  Separate database users per application
  Secrets in env files, not code

Detection:
  Centralized logging (journald/rsyslog → SIEM)
  File integrity monitoring (aide)
  Login auditing

Common Linux attack vectors

Conclusion

Security fundamentals: reduce attack surface (stop what doesn't need to run), apply least privilege (nothing should have more access than required), layer defenses (assume one layer will fail), and monitor (know when something is wrong). Every configuration hardening decision should trace back to one of these principles. When evaluating a new security recommendation, ask "what attack vector does this address?" — if the answer is unclear, the recommendation may not be worth its operational cost.