How to Harden Linux Servers With CIS Benchmarks and Lynis

Step by step

1. Audit the current state

   Lynis is a free auditing tool. It lists warnings and suggestions with a hardening index.

   sudo apt install -y lynis
   sudo lynis audit system
   

2. Patch automatically

   Install security updates automatically and reboot in a maintenance window.

   sudo apt install -y unattended-upgrades
   sudo dpkg-reconfigure -plow unattended-upgrades
   

3. Lock down SSH

   Key-only logins, no root login, limited users.

   PasswordAuthentication no
   PermitRootLogin no
   AllowGroups ssh-admins
   # then: sudo sshd -t && sudo systemctl reload ssh
   

4. Turn on the host firewall

   Allow only what the server needs.

   sudo ufw default deny incoming
   sudo ufw allow from 10.1.99.0/24 to any port 22 proto tcp
   sudo ufw allow 443/tcp
   sudo ufw enable
   

5. Remove what you do not use

   Every installed service is attack surface. List listening ports and remove unneeded packages.

   sudo ss -tulpn
   

6. Log and watch

   Send auth and system logs to your SIEM, and keep time synchronised with NTP.

7. Re-audit

   Run Lynis again and compare the hardening index. Schedule it monthly.

Commands are generic, industry-standard examples. Exact syntax and menu names vary by model and firmware; check your device's manual on the Documentation page.