Linux server hardening checks

Every check Umbermark runs on a Linux server, what it inspects, why it matters, and how to fix it.

Algorithm knowledge as of 2026-11-14: reviewed quarterly against OpenSSH, Mozilla TLS guidelines and the OWASP Secure Headers Project.

On-server checks

SSH root login critical Checks whether SSH allows direct root logins. Fails when the effective PermitRootLogin value is yes.
SSH password login critical Checks whether SSH accepts passwords. Fails when PasswordAuthentication is yes; warns if a Match block re-enables it.
SSH cipher strength high Checks whether sshd offers legacy ciphers, MACs or key-exchange algorithms such as CBC ciphers, HMAC-SHA1 or group14-sha1.
SSH port low Informational: reports whether sshd listens on the default port 22. A port change reduces scan noise but is not real security.
Passwordless sudo rules high Checks sudoers for NOPASSWD rules that grant all commands or a whole group. Narrow command-specific rules only warn.
sudo authentication high Checks that sudo's PAM stack asks for a credential, i.e. there is no sufficient pam_permit.so that lets everyone through.
Password aging policy low Informational: lists login-capable accounts with a usable password and no maximum password age. NIST advises against forced rotation.
Failed SSH logins (7 days) medium Counts failed SSH logins in the last 7 days. 1-49 passes, 50-499 warns, 500+ fails; 0 is skipped.
fail2ban brute-force protection high Checks that fail2ban is running with at least one active jail. Fails when it is not active on a publicly reachable host.

Kernel age high Checks how old the running kernel is from its build date. Over 180 days warns, over a year fails. Installing a new kernel and rebooting fixes it.
Security updates high Counts installed packages with security updates waiting. None passes, 1 to 5 warns, 6 or more fails.
Pending reboot high Checks whether the system is waiting for a reboot after a kernel or core-library update. Fails while a reboot is pending.
Automatic security updates medium Checks that automatic security updates are set up: unattended-upgrades on Debian/Ubuntu or dnf-automatic with apply_updates = yes on the RHEL family.
Package signing keys medium Checks that package signing keys exist: apt trusted.gpg.d or Signed-By keyring files on Debian/Ubuntu, gpg-pubkey packages on the RHEL family.

Host firewall critical Checks for a host firewall that drops unsolicited inbound traffic: active ufw, or a drop/reject input policy with rules in nftables or iptables.
Clock synchronisation medium Checks that the clock is synchronised and a network time service is running, as reported by timedatectl.
DNS resolver medium Checks that /etc/resolv.conf lists a nameserver and that a test lookup of deb.debian.org works.
Firewall cover for listening ports high Finds public listening ports that are reachable only because the firewall defaults to accept. A default-deny firewall passes.

Root disk space high Checks how full the root filesystem is. Under 80% passes, 80 to 94% warns, 95% or more fails.
/tmp mount options medium Checks that /tmp is its own mount with noexec and nosuid, so programs cannot be run from it. Otherwise it warns.
World-writable files and SUID binaries high Audits world-writable files outside /tmp and SUID binaries that are not on the standard list. 1 to 5 findings warn, more fail.

Failed systemd units medium Checks for systemd units in the failed state. None passes, 1 or 2 warns, 3 or more fails.
Swap pressure low Checks for sustained swapping, using vmstat. Zero swap-in/swap-out passes, under 100 KB/s warns, 100 KB/s or more fails.
Public listening ports high Lists services listening on all addresses on ports other than 22, 80 and 443. One warns, two or more fail; firewalled ports are informational only.

Persistent system logs medium Checks that the systemd journal is kept on disk (persistent) so logs survive a reboot. Without it the check warns.

AppArmor / SELinux high Checks that AppArmor (Debian/Ubuntu) or SELinux (RHEL family) is on and enforcing, not just logging or switched off.

Exposed data stores critical A database or cache reachable from the internet is one of the fastest routes to data theft or ransom. Bind it to loopback and block its port.
Legacy plaintext services high Telnet, FTP, TFTP and the r-services send passwords and data unencrypted. Switch them off or restrict them to the few addresses that need them.
Remote-management ports medium Remote desktop, container and cluster control ports should sit behind a VPN or an address allow-list, not answer the whole internet.
SSH algorithms (outside view) high Your SSH server offers deprecated algorithms (SHA-1 key exchange, CBC ciphers, MD5/SHA-1 MACs, ssh-rsa or DSA host keys). Remove them.
SSH algorithms on alternate ports (outside view) high SSH answering on an alternate port offers deprecated algorithms (SHA-1 key exchange, CBC ciphers, MD5/SHA-1 MACs, ssh-rsa or DSA host keys).
TLS and certificate high HTTPS should offer only TLS 1.2 and 1.3 and present a valid, trusted, non-expiring certificate. Disable old protocols and automate renewal.
HTTP security headers medium HTTPS responses should carry HSTS, a Content-Security-Policy, X-Frame-Options and X-Content-Type-Options. Add them in the web server.