Hardening

Hardening is the practice of making a system more resistant to attack by shrinking what can be abused. It involves disabling unused services and accounts, changing default credentials, applying updates, restricting permissions and configuring security options.

Why it matters

Default installations favour convenience, not security. They often enable extra services, sample content and broad permissions. Each of those is extra attack surface. Hardening applies a secure baseline consistently, and published benchmarks, such as those from the Center for Internet Security, provide checklists for common platforms.

Example

For a new Linux web server, an administrator might do the following:

1. Remove packages and services the site does not use.
2. Disable password login over SSH and require keys.
3. Open only ports 80, 443 and the management port, restricted to known addresses.
4. Enable automatic security updates and central logging.

Writing these steps as automation keeps every server identical.

Common mistakes

• Hardening once by hand and letting configuration drift.
• Applying a benchmark blindly without testing, which can break applications.
• Forgetting defaults on appliances, databases and cloud storage.
• Treating hardening as a substitute for patching.

Related

• Attack surface
• Least privilege
• SSH
• Patch management

This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.