A practical Linux security hardening baseline: CIS Benchmark controls, kernel hardening via sysctl, AppArmor mandatory access control, seccomp syscall filtering, auditd for syscall monitoring, SSH hardening, fail2ban, unattended-upgrades, and systemd unit sandboxing.
Hardening
-
Linux Security Hardening Baseline -
Azure Linux 4.0 and Azure Container Linux GA: Microsoft's Hardened OS for Cloud-Native and AI Workloads Microsoft announced Azure Linux 4.0 preview and Azure Container Linux GA at OSS Summit NA 2026 — a Fedora-based VM OS with atomic updates, AI-workload hardening, and a TCMalloc-Azure performance upgrade, alongside a sub-300MB container-only image purpose-built for AKS.
-
Linux Hardening Checklist A practical Linux hardening checklist covering CIS benchmark controls, auditd syscall monitoring, AppArmor and SELinux mandatory access control, kernel parameter tuning, and automated scoring with Lynis.
-
Container Image Hardening: Distroless, Multi-Stage Builds, and Vulnerability Scanning A practical, in-depth guide to reducing your container attack surface through distroless base images, multi-stage builds, Trivy vulnerability scanning, and CI/CD integration — covering everything from Dockerfile patterns to Kubernetes securityContext settings.
-
SSH Hardening: Locking Down the Door Every Server Has Open A complete SSH hardening guide — key-based authentication, sshd configuration, ProxyJump, agent forwarding, SSH certificates, port knocking, two-factor auth, and auditing who can get in and what they can do.