Learn Void Linux - Security & Hardening

#Introduction

Security isn't a one-time product, but a habit that's continuously maintained. Episode 14 applies this principle to a Void system: hardening SSH, limiting access with sudo and doas policies, maintaining the firewall, running audits, and building the habit of regular upgrades. This is the most practical episode for systems that will be exposed to the internet.

Void has a small advantage: a slim rolling release system means a smaller attack surface, and all services are plainly visible in /var/service/. We'll use this transparency to do measurable hardening.

Let's start with the most common entry point: SSH.

#Hardening SSH

#Key-Based Authentication

The first and most important step is replacing password authentication with SSH keys. Generate a key on your machine, then send it to the server:

ssh-keygen -t ed25519
ssh-copy-id user@server

Once the key is installed, disable password login and root login in /etc/ssh/sshd_config:

PermitRootLogin no
PasswordAuthentication no

Verify the configuration before reloading:

sudo sshd -t
sudo sv reload sshd

The sshd -t command validates the configuration syntax. Only after it succeeds, reload the sshd service with sv reload sshd.

#Limiting SSH Users

Restrict which users can log in via SSH so that if one account is compromised, not all accounts are affected:

AllowUsers devnull

Add the AllowUsers devnull line to /etc/ssh/sshd_config, test with sshd -t, then reload.

#sudo and doas Policy

#The Principle of Least Privilege

The most important principle in access management is least privilege: grant the smallest amount of rights needed to do the job. On Void, this means daily users are in the wheel group, while administrative tasks are done per-command through sudo or doas.

Review the policy we set up in episode 7:

sudo cat /etc/sudoers | grep -v '^#'
cat /etc/doas.conf

Notice whether any line grants overly broad rights. If not needed, remove it.

#Firewall and Audits

#Ensuring the Firewall Is Persistent

The firewall from episode 13 must always be active. Verify periodically:

sv status nftables
sudo nft list ruleset | head

If the nftables service isn't in /var/service/, re-enable it with a symlink as in episode 13.

#Auditing with lynis

lynis is a security audit tool that examines the system thoroughly:

sudo xbps-install -S lynis
sudo lynis audit system

The output of lynis audit system produces a hardening score and a list of suggestions. Follow the relevant recommendations gradually, not all at once.

#Brute-Force Protection with fail2ban

fail2ban scans logs and blocks suspicious IP addresses:

sudo xbps-install -S fail2ban
sudo ln -s /etc/sv/fail2ban /var/service/
sudo sv start fail2ban

Check the active jails with the client command:

sudo fail2ban-client status sshd

The output of fail2ban-client status sshd shows the number of blocked IPs — a direct indicator that the protection is working.

#The Discipline of Regular Upgrades

#The xbps-install -Su Ritual

A rolling release means security updates come continuously. Make regular upgrades a habit:

sudo xbps-install -Su

The xbps-install -Su command syncs the repositories and upgrades all packages. For changes that demand a service restart, note which services need to be restarted after an upgrade.

#Auditing Running Services

Finally, take stock of your services periodically:

ls /var/service/
sv status /var/service/*

The ls /var/service/ listing shows which services are running. The fewer services, the smaller the attack surface — remove symlinks for unused services.

#Conclusion

Episode 14 applied hardening to a Void system: key-based SSH authentication with password login disabled, least-privilege access policy through sudo and doas, a persistent firewall, audits with lynis, brute-force protection with fail2ban, and the discipline of regular upgrades.

Key takeaways:

• Disable password authentication and root login in SSH.
• Apply least privilege with the wheel group and doas.
• Make sure the nftables firewall is always active and persistent.
• Run lynis audit system for periodic audits.
• fail2ban blocks IPs attempting brute-force attacks.
• Regular upgrades with xbps-install -Su are the key to security.

In the next episode, episode 15, we will cover xbps-src and void-packages — building packages from source with xbps-src binary-bootstrap, understanding the package template structure, installing local packages, and contributing to the Void repository.