Learning Artix Linux - Security & Hardening

#Introduction

A good firewall is just one layer. Episode 14 takes you through comprehensive hardening: access policy with sudo/doas, securing SSH with key-only auth, verifying the firewall, the habit of routine updates, and automated auditing with lynis and rkhunter.

Hardening isn't a one-time event, but an ongoing process. Every service added, every user created, and every package updated affects the system's security profile. Let's build the right habits from the start.

#Access Policy: sudo and doas

#Strict sudo Configuration

Sudo was set up in episode 7 for the wheel group. Hardening begins with restricting who can be an admin. Edit /etc/sudoers with visudo and adjust it so non-interactive root login is denied:

Additional rules in /etc/sudoers

root ALL=(ALL) ALL
%wheel ALL=(ALL) ALL

Extend the policy if your team needs restricted access. Always use visudo — it validates syntax before saving, preventing you from locking yourself out of admin rights.

#doas: The Minimal Alternative

doas from OpenBSD is much smaller and simpler. Install and configure it in /etc/doas.conf:

Install doas and create a policy

sudo pacman -S opendoas
sudo bash -c 'echo "permit persist :wheel" > /etc/doas.conf'

The line permit persist :wheel lets the wheel group use doas without a password for a set duration. Switch all your sudo habits to doas on systems where you want as few dependencies as possible.

#SSH Hardening

#Key-Only Authentication

The highest-impact step: turn off password login and enable key-only auth. First, install your public key on the server:

Copy an SSH key to the server

ssh-copy-id -i ~/.ssh/id_ed25519.pub devnull@203.0.113.50

ssh-copy-id adds the public key to ~/.ssh/authorized_keys. Once the key works, change the configuration in /etc/ssh/sshd_config:

Settings in /etc/ssh/sshd_config

PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes
MaxAuthTries 3

PasswordAuthentication no disables password-based login entirely. Before dropping the connection, test from a separate terminal with your key so you don't lock yourself out.

#Apply and Verify

Restart the SSH service, then verify from a client:

Restart SSH and verify

sudo rc-service sshd restart
ssh devnull@203.0.113.50

If the connection succeeds without asking for a password, key-only auth is in effect. Note that changes to sshd_config don't apply until the service is restarted.

#Firewall Verification and Routine Updates

#Check Active Rules

The firewall from episode 13 should be verified periodically. Check the nftables rules and UFW status if you use it:

Verify the active firewall

sudo nft list ruleset | head
sudo ufw status verbose

sudo nft list ruleset shows the rules currently in force. If both commands return nothing, the firewall service is probably down — fix it right away.

#Routine Updates as the First Line of Defense

Most attacks exploit vulnerabilities that have already been patched. Routine updates are one of the most effective security measures:

Routine system update

sudo pacman -Syu

Get in the habit of running pacman -Syu at least weekly. For servers, consider scheduling it via cron or a timer so it isn't forgotten — episode 16 covers safe update procedures in detail.

#Auditing with lynis

#Running an Audit

Lynis checks hundreds of security aspects of a system and gives a score. Install and run it:

Install and run lynis

sudo pacman -S lynis
sudo lynis audit system

sudo lynis audit system runs a comprehensive audit and shows the findings at the end. Pay attention to the Suggestions and Warnings sections — those are your prioritized fix list.

#Reading the Report

The full report is stored at /var/log/lynis-report.dat. View the hardening score and the fix list:

Check the hardening score

sudo lynis show hardening-index

The output of lynis show hardening-index shows your current security score. After applying the suggested fixes, audit again to see the score rise.

#rkhunter and Service Review

#rkhunter: Rootkit Detection

Rkhunter scans for signs of rootkits and changed files. For one-off use:

Install and scan with rkhunter

sudo pacman -S rkhunter
sudo rkhunter --update
sudo rkhunter --check --skip-keypress

The rkhunter --check command checks the system against a signature database. Read the output and investigate lines labeled Warning.

#Reviewing Running Services

A habit that's often overlooked: reviewing running services. The fewer services, the smaller the attack surface. List them and disable what you don't use:

List active services

rc-status
rc-update show

rc-update show shows all services across all runlevels. Question every service: is it needed? If not, remove it from the runlevel with rc-update del.

#Conclusion

Episode 14 cultivated hardening habits: strict sudo/doas policy, key-only SSH, firewall verification, routine updates, and periodic auditing with lynis and rkhunter.

Key takeaways:

Restrict admin access via /etc/sudoers or /etc/doas.conf.
Key-only SSH with PasswordAuthentication no and PermitRootLogin no.
Verify the active firewall periodically.
Routine pacman -Syu updates close known vulnerabilities.
Lynis gives a hardening score and a prioritized fix list.
Review active services; disable the ones you don't need.

In the next episode, episode 15, we'll cover AUR and AURIS — yay and paru, PKGBUILD structure, makepkg as a build sandbox, and the AURIS repository for init scripts of AUR applications on Artix.