Enterprise Linux Server Hardening & Kernel Security Guide

Preventing privilege escalation and lateral movement following an initial perimeter compromise requires systematic infrastructure hardening.

# 1. Kernel Sysctl Hardening (/etc/sysctl.d/99-security.conf)

# Prevent IP Spoofing
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1

# Ignore ICMP Redirects
net.ipv4.conf.all.accept_redirects = 0
net.ipv6.conf.all.accept_redirects = 0

# Mitigate SYN Flooding
net.ipv4.tcp_syncookies = 1

# Restrict Kernel Pointer Inspection
kernel.kptr_restrict = 2
kernel.dmesg_restrict = 1

# Disable Core Dumps for SUID binaries
fs.suid_dumpable = 0

# 2. Zero-Trust SSH Configurations

• ▹Disable legacy passwords: PasswordAuthentication no
• ▹Mandate Ed25519 or Curve25519 keys
• ▹Forbid root SSH access: PermitRootLogin no
• ▹Require hardware 2FA keys (FIDO2) or PAM-based TOTP.