Stop 03 · Linux & Windows FundamentalsTopics · 8/10

System Hardening Basics

In short

Fresh installs come with extra services, default settings and open doors you don't need. Hardening closes them, and it stops a large share of attacks before any alert ever fires.

Reducing a system's attack surface — disabling unnecessary services, applying patches, enforcing strong configurations — following established baselines (like CIS Benchmarks) rather than guessing.

The blob bolts a window shut next to a packed suitcase, keys and a padlock.

Think of it like this

Locking up before a holiday

Before leaving home for a week, you bolt every window, lock rooms you don't need, switch off the geyser and keep the main key with you. Hardening a system is the same routine: close everything you're not using.

Watch it happen

A hardening pass on a new server

Patch

Disable

Lock access

Firewall

Audit

1/5Patch: install all updates and turn on automatic security updates.

The big ideas

What you need to know

Shrink the attack surface

Every service, port and account is a possible way in. Fewer of them means fewer chances.

Use a baseline

CIS Benchmarks are free, detailed checklists for Linux, Windows, cloud and more. Don't invent your own.

Defaults are dangerous

Default passwords and sample accounts are publicly known. Change or remove them on day one.

It's ongoing

Settings drift over time. Re-audit regularly, and automate with config tools where you can.

See it in code

Walk through the code

bash

1# Ubuntu lab VM: a few hardening steps2sudo apt update && sudo apt upgrade -y3sudo apt install -y unattended-upgrades lynis4 5# In /etc/ssh/sshd_config set:6#   PermitRootLogin no7#   PasswordAuthentication no8sudo systemctl restart ssh9 10sudo lynis audit system

1/3Update everything, install automatic security updates and the free Lynis auditing tool.

Set up SSH keys and test them before turning off password login, or you'll lock yourself out.

Save yourself the pain

Common mistakes

Oops

Hardening once at install and never again.

Do this instead

Schedule regular audits. New software and quick fixes slowly undo your work.

Oops

Applying every benchmark rule blindly on a live server.

Do this instead

Test changes on a copy first. Some settings can break apps, so roll them out carefully.

Your mission

Raise your Lynis score

~40 min

Quick check

Which step most directly shrinks a server's attack surface?

Go deeper

1Apply a basic hardening checklist to a practice VM (disable unused services, enforce strong passwords).
2Explore a CIS Benchmark document for a specific OS at a high level.
3Learn why hardening reduces risk even without eliminating every possible vulnerability.