Linux¶
How to harden a Linux Mint 21 or Debian 12 image, the two Linux systems in the contest. The pages are grouped by the question a defender asks, in the same order as the Windows section, so the two sides of the site mirror each other. Each page covers one task: what to change, the command to do it, the command that reads the value back, and an example of what the problem looks like on an image.
Start with the README¶
Same rule as Windows. The README on the desktop lists the authorized users, which of them are administrators, and the services the machine must keep running. Read it first, write the lists down, and check it before removing anything. A service the README requires is one you harden, not one you stop.
The groups¶
| Group | The question it answers |
|---|---|
| Getting Around | Where are the settings, how do I read a value back to prove a change took, and what's different between Mint and Debian? |
| Accounts | Who can log in, and who is an administrator? |
| Password and Lockout Policy | What rules do passwords follow, and what happens after too many wrong guesses? |
| Sudo and Root | How hard is it to become root? |
| Network Doors | What's listening, and which of those doors should be closed or locked? |
| Kernel and System Protections | What does the kernel refuse to do for an attacker, and which of those protections has been switched off? |
| Updates | Is the system patched, and will it stay patched? |
| Unwanted Software and Files | What's on the disk that shouldn't be? |
| Browsers | What does Firefox let a bad website do? |
| Server Roles | What does the server application expose, and how do I lock it down? |
| Auditing | Can we see what happened? |
Work through them in order the first time. After that, use the sidebar to jump to whatever the image needs.
Together these groups cover every recommendation in the CIS Linux Mint 22 Benchmark v1.0.0 that applies to Mint 21, and the items the CIS Debian Linux 12 Benchmark v2.0.0 adds on top of it, placed by what each setting defends against rather than by benchmark section. Settings are Level 1 unless marked Level 2; Levels and the Two Distributions explains the difference and where Mint 21 and Debian 12 differ from the benchmark's Mint 22.
Before you start¶
Snapshot the VM. Open a terminal (Ctrl+Alt+T) and keep it open; almost everything on these pages is done there. Run sudo -v once so sudo has your password cached.