Learn Alpine Linux - Security Hardening

#Introduction

Alpine is certainly designed to be secure from the start, but security doesn't stop at design — it's an ongoing process. Episode 13 assembles a hardening checklist you can apply to every Alpine server: regular updates, strengthening SSH and the firewall, doas and umask policy, and automated auditing with lynis.

The topics from episodes 9 and 10 will be woven together here into one coherent security policy. After this episode, you'll have a hardening procedure you can run repeatedly and turn into a production checklist.

#Regular Updates: The Foundation of Security

#apk upgrade as a Routine

Security patches are useless if they're not installed. Make updates a scheduled habit:

apk update
apk upgrade
apk info -u

• apk update refreshes the package index.
• apk upgrade updates all packages to the latest versions.
• apk info -u lists the packages that have updates available.

For production servers, automate it with cron:

apk add cronie
crontab -e

An example cron line that runs updates every night:

0 2 * * * apk update && apk upgrade

The 0 2 * * * apk update && apk upgrade schedule runs updates at 02:00 every day. Pay attention to the update output — for production, test in staging before adopting full automation.

#Strengthening SSH and the Firewall

#Combining Rules from Previous Episodes

Combine the SSH hardening from episode 9 and the firewall from episode 10:

PermitRootLogin no
PasswordAuthentication no
MaxAuthTries 3
AllowUsers arman

Make sure the firewall only opens the ports you need:

ss -tlnp
nft list ruleset

The ss -tlnp output lists all listening ports. Every port open without a need is an attack surface — close the ones you don't use by blocking them in the nft rules.

#doas and umask Policy

#The Principle of Least Privilege

Apply the principle of minimal access:

• Only trusted users are in the wheel group.
• A strict doas configuration in /etc/doas.d/doas.conf.
• A safe default umask for new files.

A doas configuration stricter than the default:

permit nopass :wheel apk
permit persist :wheel
deny :guest

The permit nopass :wheel apk line lets the wheel group run apk without a password, while deny :guest blocks the guest user. Set the default umask in /etc/profile:

echo "umask 027" >> /etc/profile
umask

umask 027 results in files with stricter permissions — group read access only, with no permissions for others.

#Auditing with lynis

#System Security Score

lynis is an open-source audit tool that scans the system and gives a hardening score:

apk add lynis
lynis audit system

The lynis output shows the hardening score and a list of recommendations. Save the report for comparison over time:

lynis audit system --report-file /root/lynis-$(date +%F).txt
cat /var/log/lynis-report.dat | grep "hardening_index"

grep "hardening_index" shows the numeric hardening index from the latest report.

#Attack Detection with fail2ban

#Blocking Brute Force

fail2ban monitors logs and blocks IPs that make repeated login attempts:

apk add fail2ban
rc-service fail2ban start
rc-update add fail2ban default

The jail configuration for SSH lives in /etc/fail2ban/jail.local:

[sshd]
enabled = true
maxretry = 5
bantime = 3600
findtime = 600

Check the jail status:

fail2ban-client status
fail2ban-client status sshd

fail2ban-client status sshd shows the IPs currently blocked along with violation statistics.

#Closing

Episode 13 wove Alpine's security hardening into one coherent policy: regular updates with apk upgrade, strengthening SSH and the firewall, doas and umask policy, auditing with lynis, and brute-force detection with fail2ban.

Key takeaways:

• Regular apk upgrade is the foundation of system security.
• Close all unused ports in the firewall.
• Only trusted users in the wheel group; doas with strict rules.
• Umask 027 makes new files more secure by default.
• lynis gives a hardening score whose trend you can track.
• fail2ban blocks IPs that brute-force SSH.

In the next episode, episode 14, we'll cover musl libc: implications and compatibility — the differences from glibc binaries, why some prebuilt applications don't run, and using gcompat as a compatibility layer.