Why This Matters#

The operating system is the foundation of every workload. If the OS is compromised, everything running on it — applications, data, credentials — is compromised. OS hardening reduces the attack surface and limits what an attacker can do even after gaining initial access.

Hardening Principles#

Linux Security Architecture#

flowchart TD
    User["User Space"]
    User --> DAC["DAC<br/>(file permissions)"]
    User --> MAC["MAC<br/>(SELinux/AppArmor)"]
    User --> Caps["Capabilities<br/>(fine-grained root)"]
    
    Kernel["Kernel Space"]
    DAC --> Kernel
    MAC --> Kernel
    Caps --> Kernel
    
    Kernel --> Seccomp["seccomp<br/>(syscall filter)"]
    Kernel --> Namespaces["Namespaces<br/>(isolation)"]
    Kernel --> Cgroups["cgroups<br/>(resource limits)"]
    Kernel --> Audit["auditd<br/>(logging)"]

Discretionary Access Control (DAC)#

Traditional Unix permissions:

Special bits:

Mandatory Access Control (MAC)#

Enforces policies that even root cannot override:

SELinux example — a web server can only access its own files:

httpd_t (process) → can read → httpd_sys_content_t (files)
httpd_t (process) → cannot read → user_home_t (home dirs)

Linux Capabilities#

Break root’s power into granular capabilities:

Best practice: Drop all capabilities, add back only what’s needed.

System Hardening Checklist#

User and Authentication#

Network#

Filesystem#

Services#

Patch Management#

Lifecycle#

flowchart LR
    Discover["Discover<br/>(CVE published)"] --> Assess["Assess<br/>(CVSS + context)"]
    Assess --> Test["Test<br/>(staging)"]
    Test --> Deploy["Deploy<br/>(rolling)"]
    Deploy --> Verify["Verify<br/>(rescan)"]

Patching Strategies#

Immutable is best: Build new AMI/image with patches → deploy → destroy old instances. No configuration drift.

Endpoint Detection and Response (EDR)#

Beyond traditional antivirus — behavioral detection and response:

EDR Data Sources#

Container Security (OS Perspective)#

Containers share the host kernel — isolation is weaker than VMs:

Container Hardening#

Container Escape Vectors#

Logging and Auditing#

What to Log#

auditd Rules (Linux)#

# Monitor password file changes
-w /etc/passwd -p wa -k identity
-w /etc/shadow -p wa -k identity

# Monitor sudo usage
-w /etc/sudoers -p wa -k sudo_changes
-a always,exit -F arch=b64 -S execve -F euid=0 -k root_commands

# Monitor network connections
-a always,exit -F arch=b64 -S connect -k network_connect

Log Protection#

Key Takeaways#

1. Minimize attack surface — remove everything unnecessary (packages, services, users)
2. MAC (SELinux/AppArmor) limits damage — even if an app is compromised, it can’t escape its policy
3. Immutable infrastructure > patching — rebuild, don’t repair
4. EDR replaces antivirus — behavioral detection catches what signatures miss
5. Containers are not VMs — they share a kernel, so host security is critical
6. Log everything, ship immediately — if logs stay on the host, attackers delete them
7. Least privilege at every layer — users, processes, capabilities, network