Linux Hardening & Security Guide v2.0: Modern OS, nftables, OpenSSH FIDO2, and systemd Sandboxing

Twenty years after authoring the first edition in 2006, I am proud to announce the official release of the Linux Hardening & Security Guide — Version 2.0 (2026 Enterprise Edition).

This comprehensive 68-page engineering reference manual (57 pages in the French edition) has been completely redesigned to meet the operational demands of mission-critical production environments hosting tier-one databases, Kubernetes nodes, and cloud-native container workloads.

Direct Download Links (Official PDF Formats)

In accordance with LightPath’s open-access publication commitment, this manual is released freely under the Creative Commons Attribution-ShareAlike 4.0 International (CC BY-SA 4.0) license, with no commercial gate or marketing paywall:

Why a Complete Overhaul in 2026?

By default, enterprise Linux distributions are engineered for broad compatibility and frictionless installation rather than hardened defense. In modern threat environments characterized by ransomware, automated vulnerability scans, and supply chain compromises, default configurations introduce critical technical debt.

Furthermore, many online administration guides still advocate legacy utilities from the 2000s that are completely obsolete on modern Linux 6.x kernels and systemd architectures.

Version 2.0 delivers a clean architectural break:

Deprecated Legacy Tooling	Modern 2026 Stack (Version 2.0)	Operational Advantage
`iptables` / `ip6tables`	Unified `nftables` + `firewalld`	Atomic IPv4/IPv6 packet filtering, bytecode kernel VM execution, zero rule churn
`portsentry`	`fail2ban` with `systemd-journald` backend	Direct memory journal ingestion, zero disk overhead, dynamic nftables set insertion
`afick` (MD5 collision-prone)	AIDE (Advanced Intrusion Detection Environment)	Cryptographic SHA-512 baseline signatures, deep inode attribute auditing
`chkrootkit` (legacy C scanner)	Lynis (CIS & ANSSI Automated Auditing)	Continuous Hardening Index telemetry, repeatable compliance benchmarking
Plaintext passwords / RSA 2048	OpenSSH Ed25519-sk (FIDO2) + PAM TOTP MFA	Hardware-sealed private keys (YubiKey), complete immunity to phishing and credential theft
Daemons running as raw root	systemd Sandboxing + Seccomp-BPF	Strict filesystem read-only locks (`ProtectSystem=strict`) and kernel system call filtering
Root-privileged Docker containers	Rootless Podman + cgroups v2 + Trivy	Isolated user namespaces (UID 0 mapped to non-root), immutable rootfs, automated CVE blocking

Core Engineering Pillars of Version 2.0

1. Modern Enterprise OS Targets

The manual has been tested and battle-proven across the two primary production distribution families:
– Enterprise Linux 9: Red Hat Enterprise Linux 9 (RHEL 9), CentOS Stream 9, Rocky Linux 9, and AlmaLinux 9.
– Debian / Ubuntu: Ubuntu 24.04 LTS (Noble Numbat) and Debian 12.

2. Host Packet Filtering & nftables Virtual Machine

Full deprecation of iptables. Version 2.0 leverages the unified inet address family to evaluate both IPv4 and IPv6 traffic in a single atomic pipeline. The firewall implements an uncompromising policy drop baseline, enforces rate-limiting meters to thwart TCP SYN floods, and integrates with fail2ban to dynamically update banned IP sets with automated TTL expiration without rule flushes.

3. Zero-Trust Identity, OpenSSH Hardening & Hardware FIDO2 MFA

Remote management represents the primary attack vector:
– Total ban on direct root remote login (PermitRootLogin no).
– Complete elimination of password authentication in favor of Ed25519 asymmetric keys with 100-round KDF derivation (-a 100).
– Mandatory FIDO2 / U2F hardware security keys (ed25519-sk) requiring physical touch verification (-O verify-required).
– Dual-factor authentication combining cryptographic keys with time-based one-time passwords (TOTP) via pam_google_authenticator.
– Comprehensive sudo hardening (noexec, zero cache timeout, tamper-evident audit logging in /var/log/sudo.log).

4. Granular systemd Service Sandboxing & Seccomp-BPF

Without the performance overhead of full virtualization, the guide demonstrates how to confine application daemons using native systemd directives:

[Service]
ProtectSystem=strict
ProtectHome=yes
PrivateTmp=yes
PrivateDevices=yes
NoNewPrivileges=yes
MemoryDenyWriteExecute=yes
CapabilityBoundingSet=CAP_NET_BIND_SERVICE
SystemCallFilter=@system-service ~@privileged @resources @reboot
SystemCallErrorNumber=EPERM

Any unexpected attempt to escalate privileges or tamper with system files is immediately halted at the system call boundary by the Linux kernel.

5. Mandatory Access Control (MAC): SELinux & AppArmor

The manual dedicates an entire operational chapter to maintaining MAC controls in enforcing mode:
– SELinux maintained in Enforcing mode on RHEL 9, with targeted policy troubleshooting via audit2allow to build tailored .pp modules rather than disabling security controls.
– AppArmor enforced (aa-enforce) on Ubuntu 24.04 for edge-facing services (Nginx, database daemons).

6. Unprivileged Rootless Containers & Supply Chain Security

Containers share the host kernel and are not security boundaries by default. Version 2.0 mandates:
– 100% Rootless execution using Podman (daemonless) or Rootless Docker via Linux user namespaces (/etc/subuid, /etc/subgid).
– Strict resource throttling via cgroups v2 (CPU quotas, memory caps, and --pids-limit against fork bombs).
– Immutable root filesystems mounted with --read-only and isolated ephemeral tmpfs mounts.
– Secure secrets injection without exposed command-line environment variables.
– Automated static CVE scanning via Trivy, blocking CI/CD delivery upon discovering high or critical vulnerabilities (--exit-code 1).

7. LUKS2 Storage Encryption (Argon2id) & Cryptographic Forensics

Full disk and partition encryption using LUKS2, 512-bit aes-xts-plain64 ciphers, and memory-hard Argon2id key derivation resistant to GPU/ASIC attacks. Automated secure unlock tied to TPM 2.0 chips (systemd-cryptenroll).
Hardened LVM mount options (nodev,nosuid,noexec) across /tmp, /var/tmp, /dev/shm, and /var/log.
Kernel-level auditd rules sealed with the -e 2 immutable flag, preventing rule tampering until the next system reboot.
Cryptographic log integrity protection via Forward Secure Sealing (FSS) in systemd-journald, rotating verification keys every 15 minutes.

Global Compliance Alignment

The configurations and procedures defined in this guide align directly with international and European cybersecurity baselines:
– ANSSI: Recommendations for GNU/Linux System Hardening (Minimal, Intermediate, and Enhanced levels).
– CIS Benchmarks: CIS Red Hat Enterprise Linux 9 Benchmark and CIS Ubuntu Linux 24.04 LTS Benchmark (Level 1 & Level 2 Server).
– NIST: Special Publication 800-123 (Guide to General Server Security).
– European Regulatory Directives (DORA & NIS2): Rigorous administrative access controls, operational resilience, and supply chain risk governance.

About the Author and LightPath

Jean-Marie Renouard is a recognized infrastructure specialist in mission-critical databases (MySQL, PostgreSQL, MariaDB), DevOps automation, and Platform Engineering. He is the author and maintainer of widely adopted open-source security tools, including MySQLTuner (8,400+ GitHub stars) and the CIS Benchmarks Tools suite.

Founded by Jean-Marie Renouard, LightPath provides specialized consulting services to CIOs, CISOs, and senior engineering teams for infrastructure audits, database optimization, platform engineering, and security compliance.

For feedback, inquiries, or enterprise hardening consulting, reach out via the LightPath Website or connect on LinkedIn.

Jean-Marie Renouard – Web and Data Technologist