Hardening Linux pour débutant : guide 2026

# Mise à jour complète immédiate
sudo apt update && sudo apt upgrade -y
sudo apt autoremove -y
 
# Activation unattended-upgrades (security uniquement)
sudo apt install -y unattended-upgrades apt-listchanges
sudo dpkg-reconfigure -plow unattended-upgrades
 
# Vérification config (doit inclure les lignes -security)
sudo cat /etc/apt/apt.conf.d/50unattended-upgrades | grep -E "security|Unattended"
 
# Logs
tail -f /var/log/unattended-upgrades/unattended-upgrades.log

sudo dnf update -y
sudo dnf install -y dnf-automatic
 
# Configuration security uniquement
sudo sed -i 's/^upgrade_type.*/upgrade_type = security/' /etc/dnf/automatic.conf
sudo sed -i 's/^apply_updates.*/apply_updates = yes/' /etc/dnf/automatic.conf
 
# Activation du timer
sudo systemctl enable --now dnf-automatic.timer

# Création user avec sudo
sudo adduser alice
sudo usermod -aG sudo alice  # Debian/Ubuntu
# sudo usermod -aG wheel alice  # RHEL/Rocky
 
# Vérifier l'accès
su - alice
sudo whoami  # doit renvoyer root
 
# Désactiver le login root (après avoir validé sudo pour alice)
sudo passwd -l root
 
# Auditer /etc/sudoers et /etc/sudoers.d/
sudo visudo -c
sudo cat /etc/sudoers.d/*

# Éditer la config SSH
sudo tee -a /etc/ssh/sshd_config.d/99-hardening.conf << 'EOF'
# Désactiver l'authentification par mot de passe
PasswordAuthentication no
KbdInteractiveAuthentication no
 
# Désactiver login root direct via SSH
PermitRootLogin no
 
# Limiter les users autorisés SSH
AllowUsers alice bob
 
# Limiter les tentatives par connexion
MaxAuthTries 3
 
# Timeout session SSH
ClientAliveInterval 300
ClientAliveCountMax 2
LoginGraceTime 30
 
# Protocoles et algorithmes modernes
Protocol 2
HostKeyAlgorithms ssh-ed25519,rsa-sha2-512,rsa-sha2-256
KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group16-sha512
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com
 
# Désactiver tunnels et X11 forwarding si non utilisés
X11Forwarding no
AllowTcpForwarding no
GatewayPorts no
PermitTunnel no
EOF
 
# Tester la config avant de reload
sudo sshd -t
 
# Reload sans couper les sessions existantes
sudo systemctl reload sshd

# Côté laptop admin
ssh-keygen -t ed25519 -a 100 -f ~/.ssh/id_ed25519_serveur
 
# Déployer la clé sur le serveur
ssh-copy-id -i ~/.ssh/id_ed25519_serveur.pub alice@serveur
 
# Tester la connexion
ssh -i ~/.ssh/id_ed25519_serveur alice@serveur

sudo apt install -y fail2ban
sudo tee /etc/fail2ban/jail.d/sshd.local << 'EOF'
[sshd]
enabled = true
port = 22
maxretry = 3
findtime = 10m
bantime = 24h
EOF
sudo systemctl enable --now fail2ban
sudo fail2ban-client status sshd

sudo apt install -y ufw
 
# Deny par défaut en entrée, allow en sortie
sudo ufw default deny incoming
sudo ufw default allow outgoing
 
# Autoriser SSH (port 22)
sudo ufw allow 22/tcp
 
# Autoriser les services nécessaires (exemple web)
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
 
# Activer
sudo ufw enable
sudo ufw status verbose

# Exemple de config nftables minimal
sudo tee /etc/nftables.conf << 'EOF'
#!/usr/sbin/nft -f
flush ruleset
 
table inet filter {
  chain input {
    type filter hook input priority 0; policy drop;
    iif lo accept
    ct state established,related accept
    ct state invalid drop
    ip protocol icmp accept
    tcp dport 22 accept
    tcp dport { 80, 443 } accept
  }
  chain forward {
    type filter hook forward priority 0; policy drop;
  }
  chain output {
    type filter hook output priority 0; policy accept;
  }
}
EOF
 
sudo systemctl enable --now nftables
sudo nft list ruleset

# Lister les services actifs
sudo systemctl list-units --type=service --state=running
 
# Identifier les services non nécessaires (CUPS, Avahi, Bluetooth sur serveur, snapd si non utilisé)
sudo systemctl disable --now cups.service 2>/dev/null
sudo systemctl disable --now avahi-daemon.service 2>/dev/null
sudo systemctl disable --now bluetooth.service 2>/dev/null
 
# Lister les ports en écoute
sudo ss -tulpn
 
# Chaque port ouvert doit être justifié. En cas de doute : disable.

# Installation
sudo apt install -y lynis
# Ou depuis upstream pour version récente
cd /opt && sudo git clone https://github.com/CISOfy/lynis
cd lynis && sudo ./lynis audit system
 
# Le rapport donne un score (Hardening index) sur 100 et une liste de warnings et suggestions priorisées
# Score cible initial : 70+
# Score cible sous 1 mois : 80+
# Score cible production mature : 85+
 
# Log complet
less /var/log/lynis.log
less /var/log/lynis-report.dat

# Persistance des logs entre reboots
sudo mkdir -p /var/log/journal
sudo systemd-tmpfiles --create --prefix /var/log/journal
sudo systemctl restart systemd-journald
 
# Configuration rétention
sudo tee -a /etc/systemd/journald.conf << 'EOF'
SystemMaxUse=2G
SystemKeepFree=500M
MaxRetentionSec=30day
ForwardToSyslog=yes
Compress=yes
EOF

sudo apt install -y auditd audispd-plugins
sudo systemctl enable --now auditd
 
# Règles de base (loguer les commandes sudo, modifs /etc, tentatives d'escalade)
sudo tee /etc/audit/rules.d/hardening.rules << 'EOF'
# Fichiers d'authentification
-w /etc/passwd -p wa -k identity
-w /etc/shadow -p wa -k identity
-w /etc/group -p wa -k identity
-w /etc/gshadow -p wa -k identity
-w /etc/sudoers -p wa -k sudoers
-w /etc/sudoers.d/ -p wa -k sudoers
 
# SSH config
-w /etc/ssh/sshd_config -p wa -k sshd
 
# Commandes privilégiées
-a always,exit -F arch=b64 -S execve -F euid=0 -F auid>=1000 -F auid!=-1 -k root-cmd
EOF
 
sudo augenrules --load
sudo systemctl restart auditd
 
# Consulter les events
sudo ausearch -k identity -ts today

sudo tee /etc/sysctl.d/99-hardening.conf << 'EOF'
# Protection ICMP redirect
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv6.conf.all.accept_redirects = 0
net.ipv6.conf.default.accept_redirects = 0
net.ipv4.conf.all.secure_redirects = 0
net.ipv4.conf.default.secure_redirects = 0
 
# Protection source routing
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0
net.ipv6.conf.all.accept_source_route = 0
 
# SYN cookies contre SYN flood
net.ipv4.tcp_syncookies = 1
 
# Protection Martian packets (log)
net.ipv4.conf.all.log_martians = 1
net.ipv4.conf.default.log_martians = 1
 
# Ignorer ICMP echo broadcasts (smurf attack)
net.ipv4.icmp_echo_ignore_broadcasts = 1
 
# ASLR kernel
kernel.randomize_va_space = 2
 
# Protection hardlinks et symlinks contre race conditions
fs.protected_hardlinks = 1
fs.protected_symlinks = 1
fs.protected_fifos = 2
fs.protected_regular = 2
 
# Désactiver coredumps setuid (evite fuite d'infos)
fs.suid_dumpable = 0
 
# Restreindre dmesg aux privileged
kernel.dmesg_restrict = 1
 
# Restreindre ptrace (empêche ptrace across UID arbitraire)
kernel.yama.ptrace_scope = 1
 
# Kexec désactivé (un attaquant root pourrait loader un autre kernel)
kernel.kexec_load_disabled = 1
 
# Désactiver unprivileged user namespaces si non utilisés (containers rootless)
# kernel.unprivileged_userns_clone = 0
EOF
 
sudo sysctl --system

sudo aa-status
# Résultat attendu : profiles are in enforce mode
 
# Si en mode complain, passer en enforce
sudo aa-enforce /etc/apparmor.d/*

sudo getenforce  # doit renvoyer Enforcing
sudo setenforce 1  # si permissive, passer enforcing
sudo sed -i 's/^SELINUX=.*/SELINUX=enforcing/' /etc/selinux/config

# /etc/systemd/system/myapi.service
[Unit]
Description=My Secure API
After=network.target
 
[Service]
Type=simple
User=myapi
Group=myapi
WorkingDirectory=/opt/myapi
ExecStart=/opt/myapi/venv/bin/python app.py
Restart=on-failure
RestartSec=5s
 
# Hardening systemd
NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=strict
ReadWritePaths=/opt/myapi/data /var/log/myapi
ProtectHome=true
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectKernelLogs=true
ProtectControlGroups=true
ProtectClock=true
ProtectHostname=true
ProtectProc=invisible
ProcSubset=pid
RestrictNamespaces=true
RestrictRealtime=true
RestrictSUIDSGID=true
LockPersonality=true
MemoryDenyWriteExecute=true
SystemCallFilter=@system-service
SystemCallFilter=~@privileged @resources
CapabilityBoundingSet=
AmbientCapabilities=
PrivateDevices=true
PrivateNetwork=false
 
[Install]
WantedBy=multi-user.target

systemd-analyze security myapi.service
# Donne un score (lower = better) et liste les propriétés manquantes

# Installation
sudo apt install -y libopenscap8 openscap-scanner ssg-base
# Sur RHEL : sudo dnf install -y openscap-scanner scap-security-guide
 
# Lister les profils disponibles
oscap info /usr/share/xml/scap/ssg/content/ssg-ubuntu2204-ds.xml
 
# Scan avec profil CIS Level 1 Server
sudo oscap xccdf eval \
  --profile xccdf_org.ssgproject.content_profile_cis_level1_server \
  --results /tmp/ssg-results.xml \
  --report /tmp/ssg-report.html \
  /usr/share/xml/scap/ssg/content/ssg-ubuntu2204-ds.xml
 
# Ouvrir le rapport HTML
xdg-open /tmp/ssg-report.html

# example.rb - test InSpec basique
control 'ssh-01' do
  impact 1.0
  title 'SSH root login must be disabled'
  describe sshd_config do
    its('PermitRootLogin') { should eq 'no' }
  end
end
 
control 'ssh-02' do
  impact 1.0
  title 'SSH PasswordAuthentication must be disabled'
  describe sshd_config do
    its('PasswordAuthentication') { should eq 'no' }
  end
end

# hardening.yml - playbook Ansible minimal
- hosts: linux_servers
  become: true
 
  tasks:
    - name: Apt update and upgrade
      apt:
        update_cache: yes
        upgrade: dist
        autoremove: yes
 
    - name: Install security packages
      apt:
        name:
          - unattended-upgrades
          - fail2ban
          - ufw
          - auditd
          - apparmor
          - apparmor-utils
        state: present
 
    - name: Enable unattended-upgrades
      systemd:
        name: unattended-upgrades
        enabled: yes
        state: started
 
    - name: Configure sshd hardening
      blockinfile:
        path: /etc/ssh/sshd_config.d/99-hardening.conf
        create: yes
        mode: "0644"
        block: |
          PasswordAuthentication no
          PermitRootLogin no
          MaxAuthTries 3
          ClientAliveInterval 300
          X11Forwarding no
      notify: reload sshd
 
    - name: Deploy hardened sysctl
      copy:
        dest: /etc/sysctl.d/99-hardening.conf
        content: |
          net.ipv4.conf.all.accept_redirects = 0
          net.ipv4.tcp_syncookies = 1
          kernel.randomize_va_space = 2
          kernel.yama.ptrace_scope = 1
          fs.protected_symlinks = 1
          fs.protected_hardlinks = 1
      notify: reload sysctl
 
    - name: Configure UFW
      ufw:
        state: enabled
        policy: deny
        logging: "on"
 
    - name: Allow SSH
      ufw:
        rule: allow
        port: "22"
        proto: tcp
 
    - name: Enable fail2ban
      systemd:
        name: fail2ban
        enabled: yes
        state: started
 
    - name: Enable auditd
      systemd:
        name: auditd
        enabled: yes
        state: started
 
  handlers:
    - name: reload sshd
      systemd:
        name: sshd
        state: reloaded
 
    - name: reload sysctl
      command: sysctl --system

checklist_hardening_linux_debutant = {
    # Patch management
    "mises_a_jour_immediates": "apt upgrade ou dnf update exécuté",
    "unattended_upgrades_actif": "Mises à jour sécurité automatiques activées",
    "reboot_apres_kernel": "Reboot planifié si mise à jour kernel",
 
    # Utilisateurs et sudo
    "user_non_root": "User non-root créé avec sudo",
    "root_login_disabled": "passwd -l root appliqué",
    "sudoers_audite": "sudoers propre, pas de NOPASSWD abusif",
 
    # SSH
    "ssh_password_auth_off": "PasswordAuthentication no",
    "ssh_root_login_off": "PermitRootLogin no",
    "ssh_key_ed25519": "Clé SSH ed25519 déployée",
    "fail2ban_actif": "fail2ban activé sur sshd",
    "ssh_max_auth_tries": "MaxAuthTries 3",
 
    # Firewall
    "firewall_deny_default": "Firewall policy deny par défaut",
    "firewall_ports_justifies": "Chaque port ouvert justifié",
 
    # Kernel sysctl
    "sysctl_hardening_deploy": "99-hardening.conf déployé",
    "aslr_active": "kernel.randomize_va_space = 2",
    "ptrace_scope": "kernel.yama.ptrace_scope = 1",
 
    # MAC
    "apparmor_selinux_enforce": "AppArmor ou SELinux en enforce/enforcing",
 
    # Services
    "services_inutiles_off": "CUPS, Avahi, Bluetooth désactivés si non utilisés",
    "ports_ecoute_audits": "ss -tulpn review, chaque port justifié",
 
    # Logging
    "auditd_actif": "auditd installé et running",
    "journald_persistent": "journald logs persistants configurés",
    "retention_logs_30j": "Retention logs 30 jours minimum",
 
    # Systemd hardening services custom
    "services_no_new_privs": "NoNewPrivileges=true sur services applicatifs",
    "services_private_tmp": "PrivateTmp=true sur services applicatifs",
 
    # File system
    "permissions_sensitive_files": "chmod 600 /etc/shadow, /etc/gshadow",
    "tmp_noexec_option": "Montage /tmp avec noexec,nosuid,nodev si possible",
 
    # Audit outils
    "lynis_score_70": "Score Lynis supérieur à 70",
    "openscap_cis_l1_scan": "Scan OpenSCAP CIS Level 1 exécuté",
 
    # Documentation
    "runbook_baseline": "Runbook baseline documenté en markdown",
    "changes_tracked_git": "Config /etc trackée en Git (etckeeper ou Ansible)",
}
 
# Viser 25 plus sur 30 en débutant