ConsultationLinux hardening means reducing attack surface and improving detectability—not locking systems until operations break. Every exception needs an owner and review date.
Start with inventory: server role, required ports, human/service accounts, and dependencies. Without inventory, hardening is blind and risky.
Restrict SSH: keys over passwords when possible, disable root login, limit management networks, and fail repeated attempts.
Minimal packages/services, regular patching, audited sudo, and host firewall for east-west. CIS is a good baseline when exceptions are documented.
auditd and central log shipping; without telemetry, successful intrusion is seen late. Keep event time and identity consistent.
Apply high-risk changes in maintenance windows with rollback. Hardening is not a one-night project—baselines must live in images and automation.
Hoxy delivers linux-hardening with a repeatable baseline and compliance reporting. For large fleets, start with consultation to prioritize servers.