4.3. OS Hardening and Account Security
System hardening is the process of reducing the attack surface — removing everything that isn't needed and locking down everything that is. The principle is simple: every installed package, every running service, and every open port is a potential vulnerability. Hardening means minimizing that surface systematically.
💡 First Principle: Attack surface is the sum of all paths by which an attacker can enter or extract data from a system. Hardening reduces this by eliminating unnecessary entry points (services, packages, ports), strengthening necessary entry points (SSH key auth, MFA), and implementing detection (audit logs, file integrity monitoring).
⚠️ Common Misconception: Hardening is not a one-time task — it's ongoing. A freshly hardened system grows its attack surface with every package installed and every service enabled. Scheduled hardening audits (via OpenSCAP or CIS Benchmarks) catch configuration drift over time.
Default Linux installations are not hardened — they prioritise compatibility over minimal attack surface. An unhardened server connected to the internet will typically be compromised within hours via brute-force SSH, exploited services, or default credentials. Hardening is not optional for production systems.
Without hardening, default Linux installations expose unnecessary services, retain default credentials, and allow overly permissive file access. These defaults exist for compatibility, not security. On an internet-facing server, unpatched defaults are exploited within hours.
