Security

Enterprise Security Hardening Guide

Master enterprise security hardening with system protection, access controls, network security, vulnerability management, compliance frameworks, and incident response for production environments.

What you'll learn

Apply CIS Benchmark hardening to Ubuntu 24.04
Configure UFW firewall and fail2ban
Implement SSH hardening and key-only authentication
Set up AppArmor mandatory access control
Configure audit logging with auditd
Implement vulnerability scanning with Trivy and Lynis
Build an incident response runbook

System Hardening

Bash

1# Keep system updated
2sudo apt update && sudo apt upgrade -y
3sudo apt install -y unattended-upgrades
4sudo dpkg-reconfigure unattended-upgrades
5
6# Disable unused filesystems
7cat >> /etc/modprobe.d/hardening.conf <<EOF
8install cramfs /bin/true
9install freevxfs /bin/true
10install jffs2 /bin/true
11install hfs /bin/true
12install hfsplus /bin/true
13install udf /bin/true
14EOF
15
16# Secure shared memory
17echo "tmpfs /run/shm tmpfs defaults,noexec,nosuid 0 0" >> /etc/fstab
18
19# Kernel hardening
20cat >> /etc/sysctl.d/99-hardening.conf <<EOF
21kernel.randomize_va_space = 2
22kernel.dmesg_restrict = 1
23net.ipv4.conf.all.rp_filter = 1
24net.ipv4.conf.default.rp_filter = 1
25net.ipv4.icmp_echo_ignore_broadcasts = 1
26net.ipv4.conf.all.accept_redirects = 0
27net.ipv4.tcp_syncookies = 1
28EOF
29sudo sysctl --system

SSH Hardening

Bash

1# /etc/ssh/sshd_config
2Port 2222                        # change default port
3PermitRootLogin no
4PasswordAuthentication no        # key-only
5PubkeyAuthentication yes
6AuthorizedKeysFile .ssh/authorized_keys
7MaxAuthTries 3
8LoginGraceTime 30
9X11Forwarding no
10AllowTcpForwarding no
11ClientAliveInterval 300
12ClientAliveCountMax 2
13Protocol 2
14KexAlgorithms [email protected]
15Ciphers [email protected],[email protected]
16MACs [email protected]
17
18sudo systemctl restart sshd
19
20# Install fail2ban
21sudo apt install -y fail2ban
22cat > /etc/fail2ban/jail.local <<EOF
23[sshd]
24enabled  = true
25port     = 2222
26maxretry = 3
27bantime  = 3600
28EOF
29sudo systemctl enable --now fail2ban

Firewall & Network

Bash

1# UFW firewall — default deny everything
2sudo ufw default deny incoming
3sudo ufw default allow outgoing
4sudo ufw allow 2222/tcp    # SSH (custom port)
5sudo ufw allow 80/tcp      # HTTP
6sudo ufw allow 443/tcp     # HTTPS
7sudo ufw enable
8
9# Rate limit SSH
10sudo ufw limit 2222/tcp
11
12# View rules
13sudo ufw status numbered

Access Control

Bash

1# AppArmor — enforce profiles
2sudo aa-status
3sudo apt install -y apparmor-profiles apparmor-utils
4sudo aa-enforce /etc/apparmor.d/*
5
6# Restrict sudo access
7visudo
8# Only specific users, specific commands:
9appuser ALL=(ALL) NOPASSWD: /usr/bin/systemctl restart myapp
10
11# Lock down file permissions
12chmod 700 /root
13chmod 644 /etc/passwd
14chmod 640 /etc/shadow
15chmod 644 /etc/group

Audit Logging

Bash

1sudo apt install -y auditd
2
3# /etc/audit/audit.rules
4-w /etc/passwd -p wa -k identity
5-w /etc/shadow -p wa -k identity
6-w /etc/sudoers -p wa -k sudo_changes
7-w /var/log/auth.log -p wa -k auth_log
8-a always,exit -F arch=b64 -S execve -k command_exec
9
10sudo systemctl enable --now auditd
11
12# Query audit log
13ausearch -k identity --start recent
14aureport --login

Vulnerability Management

Bash

1# Lynis — CIS benchmark audit
2sudo apt install -y lynis
3sudo lynis audit system --score
4
5# Trivy — scan containers and filesystem
6curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh |   sudo sh -s -- -b /usr/local/bin
7trivy image myapp:latest
8trivy fs /
9
10# npm/pip dependency audit
11npm audit --audit-level=high
12pip-audit

Incident Response

Contain: Isolate the affected system — revoke access tokens, rotate secrets, block IP at firewall.
Identify: Review audit logs, fail2ban bans, and application error logs to determine the attack vector.
Eradicate: Remove malicious code or access, patch the vulnerability, update credentials.
Recover: Restore from a known-good backup, re-deploy from a clean image, re-issue certificates.
Post-mortem: Document timeline, root cause, and remediation. Update runbooks and monitoring alerts.